@caupulican/pi-adaptative 0.80.99 → 0.80.102

package/dist/core/agent-session.js

@@ -58,7 +58,7 @@ import { GatewayRegistry } from "./gateways/channel-provider.js";
 import { buildGoalContinuationPrompt, } from "./goals/goal-continuation-prompt.js";
 import { buildGoalRuntimeSnapshot, } from "./goals/goal-runtime-snapshot.js";
 import { appendGoalStateSnapshot, getLatestGoalStateSnapshot } from "./goals/session-goal-state.js";
-import { appendLearningAuditSnapshot, getLearningAuditSnapshots, proposalFromReflectionWrite, rollbackPlanForReflectionWrite, } from "./learning/learning-audit.js";
+import { APPLY_WRITE_REFUSED_REASON_CODE, appendLearningAuditSnapshot, contradictionsForReflectionWrite, getLearningAuditSnapshots, proposalFromReflectionWrite, rollbackPlanForReflectionWrite, } from "./learning/learning-audit.js";
 import { evaluateLearningDecision } from "./learning/learning-gate.js";
 import { ObservationStore, observationKey } from "./learning/observation-store.js";
 import { decideDemand, ReflectionEngine, } from "./learning/reflection-engine.js";
@@ -80,6 +80,8 @@ import { bufferModelRouterSessionCustomMessage, bufferModelRouterSessionMessage,
 import { formatModelRouterStatus, getRecentModelRouterDecisions, MODEL_ROUTER_DECISION_CUSTOM_TYPE, } from "./model-router/status.js";
 import { shouldEscalateModelRouterTool } from "./model-router/tool-escalation.js";
 import { FitnessStore } from "./models/fitness-store.js";
+import { OLLAMA_PROVIDER } from "./models/local-registration.js";
+import { OllamaRuntime } from "./models/local-runtime.js";
 import { expandPromptTemplate } from "./prompt-templates.js";
 import { runModelFitnessProbe } from "./research/model-fitness.js";
 import { runResearch } from "./research/research-runner.js";
@@ -153,6 +155,12 @@ function persistModelRouterDecision(sessionManager, decision) {
 const AUTONOMY_TELEMETRY_CUSTOM_TYPE = "autonomy-telemetry";
 /** G8: bound on the in-memory gate-outcome history. Oldest entries evict once the cap is reached. */
 const GATE_OUTCOME_HISTORY_LIMIT = 50;
+/** User-facing router tiers in ascending order — "learning" is never selected for a user turn, so
+ * it has no place in the escalation ladder (#27's _ensureRouteModelReady walks this forward only). */
+const MODEL_ROUTER_TIER_ORDER = ["cheap", "medium", "expensive"];
+/** How long the #31 "install ollama now?" confirm waits before auto-dismissing (same as a "No") —
+ * long enough to read and decide, short enough that an unattended session doesn't hang a turn on it. */
+const OLLAMA_INSTALL_CONFIRM_TIMEOUT_MS = 30_000;
 /** Read a packed grep/find tool result's `details.artifactId`, if present, without `any`. */
 function extractArtifactId(message) {
     if (!message || message.role !== "toolResult")
@@ -239,6 +247,8 @@ export class AgentSession {
     _brainCurator = new BrainCurator();
     _lastCurationSkipReason = undefined;
     _inertExtensionWarnings = [];
+    /** Extensions the active resource profile removed from the runtime set (surfaced in /context). */
+    _profileDeniedExtensionCount = 0;
     _lastPreDigestSkipReason = undefined;
     _unboundToolGrantWarnings = [];
     _toolArtifactStore = undefined;
@@ -268,6 +278,12 @@ export class AgentSession {
     _cwd;
     _agentDir;
     _collectWorkspaceSources;
+    _localRuntimeDeps;
+    /** Lazy, cached by baseUrl so the router path and any other caller share one instance per server. */
+    _localRuntimes = new Map();
+    /** Server URLs confirmed reachable THIS session — skips the health-check round trip on every
+     * local-routed turn once warm. Keyed the same way as _localRuntimes. */
+    _localRuntimeConfirmedUp = new Set();
     _extensionRunnerRef;
     _initialActiveToolNames;
     _allowedToolNames;
@@ -338,6 +354,7 @@ export class AgentSession {
         this._cwd = config.cwd;
         this._agentDir = config.agentDir ?? getAgentDir();
         this._collectWorkspaceSources = config.collectWorkspaceSources ?? collectWorkspaceSources;
+        this._localRuntimeDeps = config.localRuntimeDeps;
         this._modelRegistry = config.modelRegistry;
         this._extensionRunnerRef = config.extensionRunnerRef;
         this._initialActiveToolNames = config.initialActiveToolNames;
@@ -1018,6 +1035,7 @@ export class AgentSession {
             adjustments: { memoryEvidenceTokens, enforcementSavedTokens },
             extraObservations: [
                 ...this._resourceLoader.getAgentsDiagnostics().map((diagnostic) => diagnostic.message),
+                ...this._profileDeniedResourceObservations(),
                 ...this._inertExtensionWarnings,
                 ...this._unboundToolGrantWarnings,
                 // G7: auto-built per-turn foreground envelope (observe-only; not enforced). Falls back to a
@@ -1441,6 +1459,16 @@ export class AgentSession {
     }
     // Track last assistant message for auto-compaction check
     _lastAssistantMessage = undefined;
+    /**
+     * User messages already painted to the UI by an early, synthetic `message_start` fired from
+     * `_promptUnserialized` — before the model-router judge's bounded LLM call — so the prompt
+     * appears immediately instead of hanging until routing finishes. The real agent-loop run emits
+     * its own authoritative `message_start` for the SAME message object once the turn actually
+     * starts; `_handleAgentEvent` consumes (deletes) it from this set to suppress that one duplicate
+     * listener notification. Persistence is untouched: it stays keyed off `message_end`, which is
+     * never added here and never suppressed.
+     */
+    _earlyDisplayedUserMessages = new Set();
     /** Internal handler for agent events - shared by subscribe and reconnect */
     _handleAgentEvent = async (event) => {
         // When a user message starts, check if it's from either queue and remove it BEFORE emitting
@@ -1470,8 +1498,14 @@ export class AgentSession {
         const suppressRetryPromptEvent = this._isModelRouterRetry &&
             (event.type === "message_start" || event.type === "message_end") &&
             (event.message.role === "user" || event.message.role === "custom");
+        // This is the authoritative message_start for a user message already painted early (see
+        // _promptUnserialized). Set#delete both tests and consumes membership in one step, so only
+        // this one duplicate is suppressed and a later, unrelated user message is never affected.
+        const suppressAlreadyDisplayedUserMessage = event.type === "message_start" &&
+            event.message.role === "user" &&
+            this._earlyDisplayedUserMessages.delete(event.message);
         // Notify all listeners
-        if (!suppressRetryPromptEvent) {
+        if (!suppressRetryPromptEvent && !suppressAlreadyDisplayedUserMessage) {
             this._emit(event.type === "agent_end" ? { ...event, willRetry: this._willRetryAfterAgentEnd(event) } : event);
         }
         // Handle session/context retention. Tool result details are UI/log metadata,
@@ -2021,7 +2055,7 @@ export class AgentSession {
 - Treat current-turn evidence as a cue, not proof; prefer longitudinal corroboration before changing durable behavior.
 - Active-task work remains primary: learning runs must not interrupt user-visible execution or claim task completion.`;
     }
-    _rebuildSystemPrompt(toolNames) {
+    _buildSystemPromptOptionsForToolNames(toolNames) {
         const validToolNames = toolNames.filter((name) => this._toolRegistry.has(name));
         const toolSnippets = {};
         const promptGuidelines = [];
@@ -2054,7 +2088,7 @@ export class AgentSession {
         // to invoke) a skill its profile blocks.
         const loadedSkills = this._resourceLoader.getActiveSkills();
         const loadedContextFiles = this._resourceLoader.getAgentsFiles().agentsFiles;
-        this._baseSystemPromptOptions = {
+        return {
             cwd: this._cwd,
             skills: loadedSkills,
             contextFiles: loadedContextFiles,
@@ -2065,8 +2099,21 @@ export class AgentSession {
             promptGuidelines,
             extensions: [...this._extensionRunner.activeExtensions],
         };
+    }
+    _rebuildSystemPrompt(toolNames) {
+        this._baseSystemPromptOptions = this._buildSystemPromptOptionsForToolNames(toolNames);
         return buildSystemPrompt(this._baseSystemPromptOptions);
     }
+    /**
+     * Build a system prompt for a specific tool surface WITHOUT touching the session's base prompt
+     * state. Used for a router-swapped turn (G4): the routed model runs against a filtered tool set,
+     * so it must also receive a system prompt whose tool guidelines/snippets match that filtered
+     * surface — but the change is per-turn, so it must not mutate `_baseSystemPromptOptions` (which
+     * later turns and extension events read).
+     */
+    _buildSystemPromptForToolNames(toolNames) {
+        return buildSystemPrompt(this._buildSystemPromptOptionsForToolNames(toolNames));
+    }
     // =========================================================================
     // Prompting
     // =========================================================================
@@ -2180,6 +2227,190 @@ export class AgentSession {
             return undefined;
         }
     }
+    /**
+     * Shared {@link OllamaRuntime} for a given server, lazily created and cached by baseUrl so every
+     * caller — the router's readiness gate below and any host UI's own model-lifecycle commands
+     * (e.g. `/models`) — sees and can stop the SAME pi-managed process instead of each tracking its
+     * own untracked child.
+     */
+    getLocalRuntime(baseUrl) {
+        const key = baseUrl ?? "default";
+        let runtime = this._localRuntimes.get(key);
+        if (!runtime) {
+            runtime = new OllamaRuntime({ agentDir: this._agentDir, baseUrl, deps: this._localRuntimeDeps });
+            this._localRuntimes.set(key, runtime);
+        }
+        return runtime;
+    }
+    /** models.json registers a local model's baseUrl as `<server>/v1` (OpenAI-compat); the runtime's
+     * own health/boot endpoints are on the Ollama-native server root. */
+    _deriveOllamaServerUrl(modelBaseUrl) {
+        return modelBaseUrl.replace(/\/v1\/?$/, "");
+    }
+    /**
+     * If the last assistant message in this session was an error from THIS exact local server, a
+     * cached "confirmed up" flag would be stale (the server may have died mid-session) — drop it so
+     * the next ensure-check is a real one instead of trusting stale state.
+     */
+    _invalidateLocalRuntimeIfLastCallFailed(model, serverUrl) {
+        const lastAssistant = this._findLastAssistantMessage();
+        if (lastAssistant?.stopReason === "error" &&
+            lastAssistant.provider === OLLAMA_PROVIDER &&
+            lastAssistant.model === model.id) {
+            this._localRuntimeConfirmedUp.delete(serverUrl);
+        }
+    }
+    /**
+     * Ensure a routed model is actually reachable before the turn calls it. No-op (and free) for any
+     * non-local model — this only ever does network/process work for the `ollama` provider. Caches a
+     * "confirmed up this session" flag per server so a steady-state session pays the health-check
+     * round trip once, not on every turn; invalidated above when a prior local call actually failed,
+     * so a server that died mid-session gets re-detected rather than trusted forever. Boots via
+     * `startReuseExisting()` — never owned storage — so the turn sees the user's OWN pulled models,
+     * the same server `/models` commands and the user's own `ollama` CLI already talk to. Never
+     * installs anything itself (installGuide is GUIDE MODE: printed, never executed).
+     */
+    async _ensureLocalModelReady(model) {
+        if (model.provider !== OLLAMA_PROVIDER) {
+            return { ready: true, reason: "not_local" };
+        }
+        const serverUrl = this._deriveOllamaServerUrl(model.baseUrl);
+        this._invalidateLocalRuntimeIfLastCallFailed(model, serverUrl);
+        if (this._localRuntimeConfirmedUp.has(serverUrl)) {
+            return { ready: true, reason: "confirmed_up_cached" };
+        }
+        const runtime = this.getLocalRuntime(serverUrl);
+        const status = await runtime.detect();
+        if (status.serverUp) {
+            this._localRuntimeConfirmedUp.add(serverUrl);
+            return { ready: true, reason: "already_running" };
+        }
+        if (!status.binaryPath) {
+            return { ready: false, reason: "binary_missing", installGuide: runtime.installGuide() };
+        }
+        const started = await runtime.startReuseExisting();
+        if (started.started) {
+            this._localRuntimeConfirmedUp.add(serverUrl);
+        }
+        return { ready: started.started, reason: started.reason };
+    }
+    /**
+     * #31: the ONE case a routed local model's unreadiness can be fixed automatically is a missing
+     * ollama binary — an unreachable server can't be helped by installing, so that reason is left to
+     * the graceful-fallback warning below unchanged. Only offered when there's an interactive UI to
+     * ask through: headless/RPC/print sessions have no _extensionUIContext and fall straight through,
+     * same as declining or timing out (both resolve confirm() to false). Reverses "pi never runs
+     * installers itself" specifically for this one path — the user is asked first, the download is
+     * pi's own (never curl|sh), and it lands in pi's own runtimes dir (see OllamaRuntime.installManaged).
+     *
+     * Pauses/resumes the routing working-indicator around the confirm dialog itself (re-emitting
+     * routing_end/routing_start — both already idempotent, see interactive-mode.ts's handlers) so an
+     * animated spinner doesn't fight a dialog the user is trying to read and answer; the indicator
+     * comes back for the download/extract that follows a "yes", which is genuine processing feedback.
+     */
+    async _maybeInstallOllamaOnConsent(model, readiness) {
+        const ui = this._extensionUIContext;
+        if (!ui || readiness.ready || readiness.reason !== "binary_missing")
+            return readiness;
+        const modelLabel = formatModelRouterModel(model);
+        this._emit({ type: "routing_end" });
+        let confirmed;
+        try {
+            confirmed = await ui.confirm("Install Ollama?", `Ollama isn't installed, so the local model "${modelLabel}" can't run. Pi can download and ` +
+                "install it now (a large one-time download, possibly over 1 GB depending on your platform) " +
+                "into its own runtimes folder — never curl|sh, never touching anything outside pi's own " +
+                "directory. Install it now?", { timeout: OLLAMA_INSTALL_CONFIRM_TIMEOUT_MS });
+        }
+        finally {
+            this._emit({ type: "routing_start" });
+        }
+        if (!confirmed)
+            return readiness;
+        const serverUrl = this._deriveOllamaServerUrl(model.baseUrl);
+        const runtime = this.getLocalRuntime(serverUrl);
+        let installResult;
+        try {
+            installResult = await runtime.installManaged((status) => ui.setStatus("ollama-install", status));
+        }
+        finally {
+            ui.setStatus("ollama-install", undefined);
+        }
+        if (!installResult.ok) {
+            return { ready: false, reason: "install_failed", installAttemptError: installResult.error };
+        }
+        return this._ensureLocalModelReady(model);
+    }
+    /**
+     * Router-swap gate (#27): a turn routed to a local model (any tier, including an executor-direct
+     * route — both carry tier "cheap") must not dead-end the turn just because ollama isn't up.
+     * Never a SILENT swap: every fallback is announced in a warning that states (i) the local model
+     * was unavailable and WHY — binary missing surfaces the install guide inline; any other reason
+     * gets a "check that ollama is running" hint — and (ii) which tier is now handling the turn, so
+     * the cost shift is never a surprise. Escalates cheap -> medium -> expensive, skipping any
+     * unconfigured intermediate tier, reusing the router's own existing "model unavailable"
+     * resolution (_resolveConfiguredTierModel) rather than inventing a new fallback mechanism.
+     * Escalation is bounded: tier strictly increases each hop, so it terminates within two hops.
+     *
+     * Before the warning/escalation below: #31's consent gate gets one shot at fixing a missing
+     * binary interactively (see _maybeInstallOllamaOnConsent) — declining, timing out, running
+     * headless, or the install attempt itself failing all fall through here unchanged, just with an
+     * honest reason (an install that failed is worded as a failed install, not re-labeled as if
+     * nothing was ever tried).
+     */
+    async _ensureRouteModelReady(resolved) {
+        let current = resolved;
+        while (current && current.model.provider === OLLAMA_PROVIDER) {
+            let readiness = await this._ensureLocalModelReady(current.model);
+            if (!readiness.ready) {
+                readiness = await this._maybeInstallOllamaOnConsent(current.model, readiness);
+            }
+            if (readiness.ready)
+                return current;
+            // Walk the remaining tiers in order (never back down to cheap) and take the first one that
+            // actually resolves — an unconfigured intermediate tier (e.g. no mediumModel set) must be
+            // skipped, not treated as "no fallback available".
+            const startIndex = MODEL_ROUTER_TIER_ORDER.indexOf(current.decision.tier);
+            let escalated;
+            for (let i = startIndex + 1; startIndex !== -1 && i < MODEL_ROUTER_TIER_ORDER.length; i++) {
+                const tier = MODEL_ROUTER_TIER_ORDER[i];
+                const model = this._resolveConfiguredTierModel(tier);
+                if (model) {
+                    escalated = { tier, model };
+                    break;
+                }
+            }
+            const modelLabel = formatModelRouterModel(current.model);
+            const whyText = readiness.installAttemptError
+                ? `pi tried to install it just now, but the install attempt failed: ${readiness.installAttemptError}`
+                : readiness.installGuide
+                    ? ["the ollama binary is not installed.", ...readiness.installGuide].join("\n")
+                    : `its server is not reachable (${readiness.reason}) — check that ollama is running.`;
+            const fallbackText = escalated
+                ? `Falling back to the ${escalated.tier} tier for this turn.`
+                : "No other tier is configured — falling back to the session's default model.";
+            this._emit({
+                type: "warning",
+                message: `Local model "${modelLabel}" is unavailable: ${whyText}\n${fallbackText}`,
+            });
+            if (!escalated)
+                return undefined; // no higher tier resolves — caller falls back to the session default
+            current = {
+                model: escalated.model,
+                decision: {
+                    ...current.decision,
+                    tier: escalated.tier,
+                    fallbackFrom: current.decision.tier,
+                    reasonCode: "local_model_not_ready_fallback",
+                    reasons: [
+                        ...current.decision.reasons,
+                        `Local model not ready (${readiness.reason}); escalated to ${escalated.tier}`,
+                    ],
+                    model: formatModelRouterModel(escalated.model),
+                },
+            };
+        }
+        return current;
+    }
     _resolveModelRouterTurnRoute(prompt) {
         const settings = this.settingsManager.getModelRouterSettings();
         if (!settings.enabled) {
@@ -2300,7 +2531,9 @@ export class AgentSession {
                     systemPrompt,
                     messages: [{ role: "user", content: [{ type: "text", text: userPrompt }], timestamp: Date.now() }],
                     model: judgeModel,
-                    thinkingLevel: "off",
+                    // Per-tier thinking (R1): judgeThinking overrides the judge's own completion; unset
+                    // keeps today's "off" (the judge is a cheap classification call by default).
+                    thinkingLevel: settings.judgeThinking ?? "off",
                     maxTokens: ROUTE_JUDGE_MAX_OUTPUT_TOKENS,
                     signal,
                     // The judge system prompt is static — the provider can cache the prefix.
@@ -2370,6 +2603,12 @@ export class AgentSession {
         const previousModel = this.agent.state.model;
         const previousThinkingLevel = this.agent.state.thinkingLevel;
         const previousTurnTools = this.agent.state.tools;
+        const previousSystemPrompt = this.agent.state.systemPrompt;
+        // G4 swap bookkeeping (Bug G): the exact references the swap below assigns, so the finally can
+        // restore ONLY what IT put there — never assigned when no swap happens (e.g. a full-class
+        // routed profile).
+        let swappedTools;
+        let swappedSystemPrompt;
         const previousActiveModelRouterIntent = this._activeModelRouterIntent;
         const previousActiveModelRouterRoute = this._activeModelRouterRoute;
         const previousModelRouterSessionBuffer = this._modelRouterSessionBuffer;
@@ -2401,7 +2640,24 @@ export class AgentSession {
         }
         if (!modelsAreEqual(this.model, routedModel)) {
             this.agent.state.model = routedModel;
-            this.agent.state.thinkingLevel = clampThinkingLevel(routedModel, previousThinkingLevel);
+            // Per-tier thinking (R1): a configured tier/executor thinking level overrides the inherited
+            // session thinking for THIS routed turn only; unset falls back to exactly today's
+            // inherit-and-clamp behavior. Executor routes carry tier "cheap" too, so reasonCode is
+            // checked first — otherwise an executor turn would silently pick up cheapThinking instead.
+            // The judge's own completion has a separate knob (judgeThinking) applied at its call site.
+            const routerThinkingSettings = this.settingsManager.getModelRouterSettings();
+            const configuredThinking = !routeDecision
+                ? undefined
+                : routeDecision.reasonCode === "executor_direct"
+                    ? routerThinkingSettings.executorThinking
+                    : routeDecision.tier === "cheap"
+                        ? routerThinkingSettings.cheapThinking
+                        : routeDecision.tier === "medium"
+                            ? routerThinkingSettings.mediumThinking
+                            : routeDecision.tier === "expensive"
+                                ? routerThinkingSettings.expensiveThinking
+                                : undefined;
+            this.agent.state.thinkingLevel = clampThinkingLevel(routedModel, configuredThinking ?? previousThinkingLevel);
             // G4: capability tool-filtering follows the ROUTED model for the turn. Without this a
             // cheap/local routed model inherits the session model's full tool surface — schemas it
             // pays for on every request and may not be able to drive at all.
@@ -2411,7 +2667,16 @@ export class AgentSession {
             });
             if (routedProfile.class !== "full") {
                 const allowed = new Set(filterToolNamesForCapability(previousTurnTools.map((tool) => tool.name), routedProfile));
-                this.agent.state.tools = previousTurnTools.filter((tool) => allowed.has(tool.name));
+                swappedTools = previousTurnTools.filter((tool) => allowed.has(tool.name));
+                this.agent.state.tools = swappedTools;
+                // G4: the system prompt follows the ROUTED model's filtered surface too — otherwise the
+                // cheap/local model is billed for (and told about) tool guidelines/snippets it can't call.
+                // Per-turn only; restored in the finally. A live extension override of the prompt is left
+                // alone (only shed when we're on the base prompt).
+                if (this.agent.state.systemPrompt === this._baseSystemPrompt) {
+                    swappedSystemPrompt = this._buildSystemPromptForToolNames(this.agent.state.tools.map((tool) => tool.name));
+                    this.agent.state.systemPrompt = swappedSystemPrompt;
+                }
             }
         }
         try {
@@ -2445,6 +2710,16 @@ export class AgentSession {
                     };
                     this._lastModelRouterDecision = completedDecision;
                 }
+                else {
+                    // The muscle missed AND the reflex brain could not refine the request into a toolkit
+                    // instruction (no fit brain model, or no confident plan). There is deliberately NO
+                    // frontier fallback here, so surface the miss instead of letting it stand silently —
+                    // otherwise the routed turn just ends with an unrun command and no explanation.
+                    this._emit({
+                        type: "warning",
+                        message: "Executor lane: the toolkit command did not run and the reflex brain could not refine it into an explicit instruction; leaving the turn as-is (no automatic escalation).",
+                    });
+                }
             }
             if (bufferRoutedTurn && this._modelRouterEscalationRequested) {
                 this.agent.state.messages.splice(originalHistoryLength);
@@ -2480,7 +2755,18 @@ export class AgentSession {
             if (modelsAreEqual(this.agent.state.model, routedModel)) {
                 this.agent.state.model = previousModel;
                 this.agent.state.thinkingLevel = previousThinkingLevel;
-                this.agent.state.tools = previousTurnTools;
+                // Symmetric restore (Bug G): undo tools/systemPrompt only if each is STILL the exact
+                // reference/string the G4 swap above assigned (never assigned at all when the routed
+                // profile was full-class — then there is nothing to restore either). An extension calling
+                // setActiveToolsByName mid-turn reassigns both to its own values without touching the
+                // model — the model guard above still passes, but that live change is legitimate and must
+                // survive rather than being silently reverted to the stale pre-turn snapshot.
+                if (swappedTools !== undefined && this.agent.state.tools === swappedTools) {
+                    this.agent.state.tools = previousTurnTools;
+                }
+                if (swappedSystemPrompt !== undefined && this.agent.state.systemPrompt === swappedSystemPrompt) {
+                    this.agent.state.systemPrompt = previousSystemPrompt;
+                }
                 // The registry may have changed mid-turn (command-time registerProvider): re-resolve
                 // the restored model so a provider override is not dropped with the routed model.
                 this._refreshCurrentModelFromRegistry();
@@ -2605,6 +2891,10 @@ export class AgentSession {
         let messages;
         let routedTurnModel;
         let routedTurnRouteDecision;
+        // Built and painted early (see below) so a later throw in this try block — e.g. no model
+        // selected/authenticated — can un-register it from _earlyDisplayedUserMessages instead of
+        // leaking the reference forever.
+        let userMessage;
         // R4 effectiveness feedback: remember the recall page + the query so we can score, after the
         // response, whether the agent actually used the recalled context.
         let injectedRecall = "";
@@ -2667,13 +2957,38 @@ export class AgentSession {
             }
             // Flush any pending bash messages before the new prompt
             this._flushPendingBashMessages();
+            // Build the user message now — before the router judge — and paint it to the UI
+            // immediately via a synthetic message_start. The judge is a real bounded LLM completion
+            // (seconds), not a regex; awaiting it first made the prompt appear to hang. The
+            // authoritative message_start emitted later for this SAME object is suppressed in
+            // _handleAgentEvent (see _earlyDisplayedUserMessages) so it is still shown exactly once.
+            const userContent = [{ type: "text", text: expandedText }];
+            if (currentImages) {
+                userContent.push(...currentImages);
+            }
+            userMessage = {
+                role: "user",
+                content: userContent,
+                timestamp: Date.now(),
+            };
+            this._earlyDisplayedUserMessages.add(userMessage);
+            this._emit({ type: "message_start", message: userMessage });
+            // Bracket the routing/prep phase (judge, model/auth checks, compaction, ...) so the UI can
+            // show general "working" feedback for it — otherwise the user stares at their own echoed
+            // prompt with nothing happening for however long the judge takes. routing_end is emitted
+            // exactly once below: either in the catch block (this phase failed) or right after the try
+            // block (this phase succeeded, whether or not it produced a turn to run).
+            this._emit({ type: "routing_start" });
             const resolvedRouteInfo = await this._resolveModelRouterTurnRouteJudged(expandedText, {
                 // Internally generated turns (goal continuation, lane follow-ups) never consult the judge:
                 // the regex floor already classified them, and a 20-turn loop must not buy 20 judge calls.
                 skipJudge: options?.autoContinueGoal === false,
             });
-            routedTurnModel = resolvedRouteInfo?.model;
-            routedTurnRouteDecision = resolvedRouteInfo?.decision;
+            // #27: a route landing on a local (ollama) model must not hard-fail the turn just because
+            // the server isn't up yet — boot/reuse it here, or escalate to a non-local tier.
+            const readyRouteInfo = await this._ensureRouteModelReady(resolvedRouteInfo);
+            routedTurnModel = readyRouteInfo?.model;
+            routedTurnRouteDecision = readyRouteInfo?.decision;
             const requestModel = routedTurnModel ?? this.model;
             // Validate model
             if (!requestModel) {
@@ -2719,16 +3034,9 @@ export class AgentSession {
                     // recall must never break a turn
                 }
             }
-            // Add user message
-            const userContent = [{ type: "text", text: expandedText }];
-            if (currentImages) {
-                userContent.push(...currentImages);
-            }
-            messages.push({
-                role: "user",
-                content: userContent,
-                timestamp: Date.now(),
-            });
+            // Add user message (built earlier, before the router judge, so it could be painted
+            // immediately — see the early message_start emit above).
+            messages.push(userMessage);
             // Inject any pending "nextTurn" messages as context alongside the user message
             for (const msg of this._pendingNextTurnMessages) {
                 messages.push(msg);
@@ -2759,9 +3067,22 @@ export class AgentSession {
             }
         }
         catch (error) {
+            // The turn never reached _runAgentPrompt, so the authoritative message_start that would
+            // normally consume this entry (see _handleAgentEvent) never fires — un-register it here
+            // instead of leaking the reference.
+            if (userMessage) {
+                this._earlyDisplayedUserMessages.delete(userMessage);
+            }
+            // The routing/prep phase (routing_start above) failed before ever reaching the turn — end
+            // it here, or the UI's "working" indicator for it spins forever with nothing behind it.
+            this._emit({ type: "routing_end" });
             preflightResult?.(false);
             throw error;
         }
+        // The routing/prep phase is over — either we're about to hand off into the turn (which emits
+        // its own agent_start/streaming events right after), or messages is unexpectedly unset and we
+        // bail below. Either way nothing is left "routing" past this point.
+        this._emit({ type: "routing_end" });
         if (!messages) {
             return;
         }
@@ -3939,15 +4260,22 @@ export class AgentSession {
     }
     _filterExtensionsForRuntime(extensions) {
         this._inertExtensionWarnings = [];
+        this._profileDeniedExtensionCount = 0;
         if (this.settingsManager.getActiveResourceProfileNames().length === 0) {
-            return this.settingsManager.hasExplicitActiveResourceProfileSelection()
-                ? []
-                : extensions.filter((extension) => extension.sourceInfo.source === "inline");
+            if (this.settingsManager.hasExplicitActiveResourceProfileSelection()) {
+                // An explicit profile selection that resolves to no active profile is a deliberate
+                // deny-all — every extension is withheld by that choice.
+                this._profileDeniedExtensionCount = extensions.length;
+                return [];
+            }
+            // No profile in play: only inline/SDK extensions load by default. That is the baseline, not
+            // a profile denial, so it is not counted as withheld.
+            return extensions.filter((extension) => extension.sourceInfo.source === "inline");
         }
         const hasToolOrCommandGate = this._hasToolOrCommandProfileGate();
-        return extensions
-            .filter((extension) => this.settingsManager.isResourceAllowedByProfile("extensions", extension.path, extension.sourceInfo.baseDir))
-            .map((extension) => {
+        const allowedExtensions = extensions.filter((extension) => this.settingsManager.isResourceAllowedByProfile("extensions", extension.path, extension.sourceInfo.baseDir));
+        this._profileDeniedExtensionCount = extensions.length - allowedExtensions.length;
+        return allowedExtensions.map((extension) => {
             if (!hasToolOrCommandGate)
                 return extension;
             const tools = new Map(Array.from(extension.tools.entries()).filter(([name]) => this._isToolOrCommandAllowedByProfile(name)));
@@ -3962,6 +4290,36 @@ export class AgentSession {
             return { ...extension, tools, commands };
         });
     }
+    /**
+     * /context observations for skills/prompts/extensions the active resource profile removed from
+     * listings — the analog of the withheld-AGENTS.md warning. Strict UAC makes these silently absent,
+     * so a lean profile's effect on the resource surface stays visible. Counts are profile-scoped
+     * (skills/prompts via the profile-independent discovery universe filtered by the live profile
+     * filter; extensions via the runtime filter's denied tally). Empty when nothing is withheld.
+     *
+     * Uses `isResourceDeniedByActiveProfile` (profile-only), not `isResourceAllowedByProfile` (which
+     * also folds in the user's own legacy `disabledResources` list): a plain user-disabled resource
+     * must never be misattributed to "the active resource profile" — that case is already surfaced by
+     * the G14 disable-wins warning. With no active profile at all, the helper always reports nothing
+     * denied, so this naturally stays silent (extensions keep their own runtime-filter-derived count,
+     * which is already correctly zero absent a profile).
+     */
+    _profileDeniedResourceObservations() {
+        const observations = [];
+        const withheld = (kind, paths) => paths.filter((path) => this.settingsManager.isResourceDeniedByActiveProfile(kind, path, this._cwd)).length;
+        const skillsWithheld = withheld("skills", this._resourceLoader.getDiscoverableSkillPaths());
+        if (skillsWithheld > 0) {
+            observations.push(`${skillsWithheld} skill(s) withheld by the active resource profile — grant the "skills" kind to restore them`);
+        }
+        const promptsWithheld = withheld("prompts", this._resourceLoader.getDiscoverablePromptPaths());
+        if (promptsWithheld > 0) {
+            observations.push(`${promptsWithheld} prompt(s) withheld by the active resource profile — grant the "prompts" kind to restore them`);
+        }
+        if (this._profileDeniedExtensionCount > 0) {
+            observations.push(`${this._profileDeniedExtensionCount} extension(s) withheld by the active resource profile — grant the "extensions" kind to restore them`);
+        }
+        return observations;
+    }
     /**
      * Re-resolve the active resource profile's model/thinking from current settings and apply it.
      * Only acts when the profile actually binds model/thinking AND that field was not set by an
@@ -5726,6 +6084,8 @@ export class AgentSession {
                 maxWallClockMs: settings.maxWallClockMs,
                 usageReportId,
                 signal: this._workerDelegationAbort.signal,
+                // Parent validation must use the same relative-path baseline the runner reports in.
+                cwd: this._cwd,
                 // Write lane (G2): runner-side action application through the envelope path scope.
                 applyActions: workerRequest.envelope.capabilities.includes("write_files")
                     ? (actions) => applyWorkerActions({ actions, envelope: workerRequest.envelope, cwd: this._cwd })
@@ -6104,7 +6464,10 @@ export class AgentSession {
                     proposal,
                     confidence: policy.reflectionSourceConfidence,
                     observations,
-                    contradictions: 0,
+                    // A replace/remove supersedes an existing durable fact — the reflection engine's
+                    // confront-before-write conflict signal — so it routes through approval instead of
+                    // silently overwriting prior memory. Additive writes contradict nothing.
+                    contradictions: contradictionsForReflectionWrite(write),
                     settings: {
                         enabled: true,
                         autoApplyEnabled: policy.autoApplyEnabled,
@@ -6112,6 +6475,7 @@ export class AgentSession {
                         minObservations: policy.minObservations,
                         allowedAutoApplyLayers: policy.allowedAutoApplyLayers,
                         requireRollbackPlan: policy.requireRollbackPlan,
+                        autoApplySupersessions: policy.autoApplySupersessions,
                     },
                 })
                 : {
@@ -6147,20 +6511,25 @@ export class AgentSession {
                     },
                 });
             }
-            if (decision.kind === "apply") {
-                await this._applyReflectionWrite(write, signal);
-            }
+            // The gate's decision and the write's actual outcome are two different questions: the memory
+            // tool can refuse a write (budget exceeded, drift, threat) via details.success:false without
+            // throwing. Capture that outcome instead of assuming "decision.kind === apply" means it landed
+            // — otherwise a refused write leaves a phantom "apply" audit whose rollback later fails
+            // not-found (or, worse, misfires against whatever now occupies that text).
+            const applied = decision.kind === "apply" ? await this._applyReflectionWrite(write, signal) : false;
+            const writeFailed = decision.kind === "apply" && !applied;
             if (decision.kind !== "no-op") {
                 auditSequence += 1;
                 appendLearningAuditSnapshot(this.sessionManager, {
                     id: `audit-${auditSequence}`,
                     proposalId,
                     layer: proposal.layer,
-                    action: decision.kind === "apply" ? "apply" : "propose",
+                    action: writeFailed ? "apply_failed" : decision.kind === "apply" ? "apply" : "propose",
                     summary: proposal.summary,
-                    reasonCode: decision.reasonCode,
+                    reasonCode: writeFailed ? APPLY_WRITE_REFUSED_REASON_CODE : decision.reasonCode,
                     decision,
-                    rollback,
+                    // No rollback plan on a failed apply — nothing durable landed, so there is nothing to undo.
+                    rollback: writeFailed ? undefined : rollback,
                     createdAt: new Date().toISOString(),
                 });
             }
@@ -6196,28 +6565,41 @@ export class AgentSession {
         const rollback = audit.rollback;
         if (!rollback)
             return { ok: false, reason: "no_rollback_plan" };
+        // Every inverse must be VERIFIED-applied before the rollback audit is appended: a silently
+        // failed inverse that still recorded "rollback" would permanently self-lock the change
+        // behind already_rolled_back while the durable write is in fact still live.
         switch (rollback.kind) {
             case "memory_remove": {
                 if (!rollback.target)
                     return { ok: false, reason: "missing_rollback_target" };
-                await this._applyReflectionWrite({ kind: "memory_remove", target: rollback.target });
+                if (!(await this._applyReflectionWrite({ kind: "memory_remove", target: rollback.target }))) {
+                    return { ok: false, reason: "rollback_apply_failed" };
+                }
                 break;
             }
             case "memory_restore": {
                 if (!rollback.target || rollback.previous === undefined) {
                     return { ok: false, reason: "missing_rollback_target" };
                 }
-                await this._applyReflectionWrite({
+                const applied = await this._applyReflectionWrite({
                     kind: "memory_replace",
                     target: rollback.target,
                     text: rollback.previous,
                 });
+                if (!applied)
+                    return { ok: false, reason: "rollback_apply_failed" };
                 break;
             }
             case "memory_add": {
                 if (rollback.previous === undefined)
                     return { ok: false, reason: "missing_rollback_target" };
-                await this._applyReflectionWrite({ kind: "memory_add", section: "MEMORY", text: rollback.previous });
+                const applied = await this._applyReflectionWrite({
+                    kind: "memory_add",
+                    section: "MEMORY",
+                    text: rollback.previous,
+                });
+                if (!applied)
+                    return { ok: false, reason: "rollback_apply_failed" };
                 break;
             }
             case "archive_skill": {
@@ -6245,28 +6627,34 @@ export class AgentSession {
     /**
      * Apply one reflection write through the bundled `memory` tool. `memory_replace`/`memory_remove`
      * don't carry a target file, so we try MEMORY.md first and fall back to USER.md when the substring
-     * isn't found there. Best-effort: failures are swallowed (reflection must never break a turn).
+     * isn't found there. Never throws (reflection must never break a turn); returns whether the write
+     * actually applied so callers that MUST know — rollback's once-only accounting — can react instead
+     * of recording a success that never happened.
      */
     async _applyReflectionWrite(write, signal) {
         // R7 memory-to-behavior: a recurring procedure is compiled into an executable skill file rather
         // than stored as a flat fact. Written under the agent skills dir so it loads like any user skill.
         if (write.kind === "promote_skill") {
-            this._promoteReflectionSkill(write.name, write.description, write.body);
-            return;
+            return this._promoteReflectionSkill(write.name, write.description, write.body);
         }
         const memTool = this._memoryManager.getToolDefinitions().find((t) => t.name === "memory");
         const exec = memTool?.execute;
         if (!exec)
-            return;
+            return false;
         const run = (params) => exec("reflection", params, signal, undefined, undefined);
         if (write.kind === "memory_add") {
             try {
-                await run({ action: "add", target: write.section === "USER" ? "user" : "memory", content: write.text });
+                const res = await run({
+                    action: "add",
+                    target: write.section === "USER" ? "user" : "memory",
+                    content: write.text,
+                });
+                return res?.details?.success === true;
             }
             catch {
                 // best-effort; reflection writes must never throw into the turn loop
+                return false;
             }
-            return;
         }
         // replace / remove carry no target file — try MEMORY.md, then USER.md. The memory tool reports
         // outcomes via `details.success` (it catches its own errors rather than throwing). Only a
@@ -6279,15 +6667,16 @@ export class AgentSession {
                     : { action: "remove", target, oldContent: write.target };
                 const res = await run(params);
                 if (res?.details?.success === true)
-                    return; // applied
+                    return true; // applied
                 if (!/not found/i.test(String(res?.details?.error ?? "")))
-                    return; // real failure — don't misapply
+                    return false; // real failure — don't misapply
                 // substring simply absent from this file — try the next target
             }
             catch {
                 // defensive: if the tool ever does throw, try the next target
             }
         }
+        return false;
     }
     /**
      * R7: write a reflection-promoted skill as `<agentDir>/skills/<name>/SKILL.md` so it loads like any
@@ -6301,21 +6690,23 @@ export class AgentSession {
             .replace(/^-+|-+$/g, "")
             .slice(0, 64);
         if (!name || !body.trim())
-            return;
+            return false;
         try {
             const dir = join(this._agentDir, "skills", name);
             const file = join(dir, "SKILL.md");
             if (existsSync(file))
-                return; // do not overwrite an existing skill
+                return false; // do not overwrite an existing skill
             mkdirSync(dir, { recursive: true });
             const safeDescription = description.replace(/[\r\n]+/g, " ").trim();
             // `promoted: true` marks this as reflection-generated so the curator (#32) can lifecycle-manage
             // it (archive/consolidate) WITHOUT ever touching hand-authored user skills.
             const content = `---\nname: ${name}\ndescription: ${safeDescription}\npromoted: true\n---\n\n<!-- Auto-generated by the reflection engine (R7 memory-to-behavior). Review and refine. -->\n\n${body.trim()}\n`;
             writeFileSync(file, content, "utf-8");
+            return true;
         }
         catch {
             // promotion must never break a turn
+            return false;
         }
     }
     getContextUsage() {