@deepstrike/sdk 0.2.34 → 0.2.36

package/README.md

@@ -1,3 +1,9 @@
+<p align="center">
+  <a href="https://github.com/kongusen/deepstrike">
+    <img src="https://raw.githubusercontent.com/kongusen/deepstrike/main/docs/public/banner.png" alt="DeepStrike" width="420" />
+  </a>
+</p>
+
 # DeepStrike Node.js SDK
 
 Runtime framework built on a Rust kernel. The kernel owns loop control, context compression, governance, signal routing, and memory paging — the SDK owns all I/O (LLM calls, tool execution, disk, long-term memory).
@@ -181,7 +187,7 @@ The mechanisms above are not internal refactors — they change what you can bui
 Tool calls, spawns, compression, and signals pass through one kernel gate with an explicit lifecycle (Ready / Running / Blocked / Suspended). You implement I/O; the kernel decides *when* and *whether*. Node, Python, and Rust share the same decision path, so `wake(sessionId)` and cross-language tooling see consistent behavior.
 
 **Longer, sturdier sessions (Layer-1 spool + semantic page-out)**  
-Oversized tool results (> 50 KB) stay in context as a preview plus a `.spool/` reference — the model reads the full payload on demand via ordinary file tools. When pressure triggers semantic eviction, the SDK summarizes archived content into `DreamStore` and satisfies `page_in_requested` on the way back in. Long tasks survive token pressure instead of failing mid-run.
+Oversized tool results (> 50 KB) stay in context as a preview plus a `.spool/` reference — the model reads the full payload on demand via ordinary file tools. When pressure triggers semantic eviction, the SDK summarizes archived content into `DreamStore`. Long tasks survive token pressure instead of failing mid-run.
 
 **Safety and governance by default (OS native profile)**  
 Every run loads declarative `governancePolicy` (deny / ask_user / rate-limit / param rules) and in-kernel signal routing (`attentionPolicy`, default queue 64). Dangerous tools, external interrupts, and approval flows are policy — not ad-hoc `if` checks in your handlers.
@@ -305,7 +311,7 @@ The kernel renders context as four LLM API slots — only **history** is compres
 | Slot | Source | Role |
 |------|--------|------|
 | `systemStable` | system partition | Identity, rules — never changes within a run |
-| `systemKnowledge` | knowledge partition | Preloaded memory, skill defs — low frequency |
+| `systemKnowledge` | knowledge partition | Skill bodies, `initialMemory`, host-pinned durable refs — keyed, boundary-evicted, budgeted |
 | `turns[0]` | `task_state` + signals | Goal, plan, progress, compression log, runtime signals |
 | `turns[1..N]` | history | Conversation transcript |
 
@@ -489,15 +495,15 @@ effort: 1
 2. Express each as a concise bullet
 ```
 
+A loaded skill's body is pinned into the durable `knowledge` slot (keyed `skill:<name>`) and its `allowed_tools` narrow the exposed toolset. Activation is **not** permanent: `runner.deactivateSkill(name)` re-widens the toolset at the next provider call and unpins the body at the next boundary, and `skillLeaseTurns` auto-deactivates every skill N turns after it loads — so a long multi-phase run doesn't monotonically accumulate early-phase skills. There is deliberately no model-facing unload (deactivation is host-driven only).
+
 ---
 
 ## Knowledge
 
-Implement `KnowledgeSource` to connect any RAG system. The kernel injects a `knowledge` meta-tool that the LLM calls on demand. Runtime retrieval results land in **history** as tool results.
-
-To inject durable knowledge at startup (Slot 2, cacheable on Anthropic), use `initialMemory` or `runner.pushKnowledge()`.
+Implement `KnowledgeSource` to connect any RAG system. The kernel injects a `knowledge` meta-tool that the LLM calls on demand. Runtime retrieval results land in **history** as tool results (single-use fact content that decays with the compression pyramid) — not in the durable `knowledge` partition.
 
-Before tool execution the kernel may emit `page_in_requested`; the SDK satisfies it from `DreamStore`, `KnowledgeSource`, and a local semantic page-out cache, then feeds `page_in` back to the kernel.
+To inject durable knowledge at startup (Slot 2, cacheable on Anthropic), use `initialMemory` or `runner.pushKnowledge(content, tokens?, { key, pinned })`. A **keyed** entry upserts on a repeated key and can be removed with `runner.removeKnowledge(key)`; both take effect at the next compaction/renewal boundary (where the `system[1]` cache prefix is rewritten anyway). Set `knowledgeBudgetRatio` (default 0.25 of `maxTokens`, 0 disables) to cap the partition — over budget, the oldest unpinned, non-skill entries are evicted at boundaries while `pinned: true` entries survive.
 
 ```typescript
 const runner = new RuntimeRunner({

package/dist/providers/anthropic.js

@@ -182,6 +182,9 @@ export class AnthropicProvider {
                     // cache-heavy turn look tiny and suppress compaction until a 413.
                     const inputTokens = uncachedInput + cacheReadTokens + cacheCreationTokens;
                     const bySlot = estimateCacheReadBySlot(cacheReadTokens, slotBp);
+                    // stop_reason is only present on message_delta (the closing frame). `max_tokens` drives
+                    // the kernel's output-cap recovery; other reasons (end_turn/tool_use) are informational.
+                    const stopReason = evt.delta?.stop_reason;
                     yield {
                         type: "usage",
                         totalTokens: inputTokens + outputTokens,
@@ -190,6 +193,7 @@ export class AnthropicProvider {
                         cacheReadInputTokens: cacheReadTokens,
                         cacheCreationInputTokens: cacheCreationTokens,
                         ...(bySlot ? { cacheReadInputTokensBySlot: bySlot } : {}),
+                        ...(stopReason ? { stopReason } : {}),
                     };
                 }
             }

package/dist/providers/openai.js

@@ -250,6 +250,11 @@ export class OpenAIChatProvider {
         let inputTokens = 0;
         let outputTokens = 0;
         let cacheReadTokens = 0;
+        // Phase 4: OpenAI signals an output-cap truncation via finish_reason="length", which arrives on
+        // a `choices` frame separate from the trailing `usage` frame — so capture it and attach it to the
+        // usage event the runner reads. The kernel treats "length" as a truncation (== Anthropic
+        // "max_tokens"); other reasons ("stop"/"tool_calls") pass through harmlessly.
+        let finishReason;
         for await (const chunk of stream) {
             if (chunk.usage) {
                 totalTokens = chunk.usage.total_tokens;
@@ -261,6 +266,8 @@ export class OpenAIChatProvider {
             const choice = chunk.choices[0];
             if (!choice)
                 continue;
+            if (choice.finish_reason)
+                finishReason = choice.finish_reason;
             const delta = choice.delta;
             if (!delta)
                 continue;
@@ -317,7 +324,7 @@ export class OpenAIChatProvider {
         rememberStream();
         yield* emitPendingToolCalls();
         if (totalTokens > 0)
-            yield { type: "usage", totalTokens, inputTokens, outputTokens, ...(cacheReadTokens > 0 ? { cacheReadInputTokens: cacheReadTokens } : {}) };
+            yield { type: "usage", totalTokens, inputTokens, outputTokens, ...(cacheReadTokens > 0 ? { cacheReadInputTokens: cacheReadTokens } : {}), ...(finishReason ? { stopReason: finishReason } : {}) };
     }
     /**
      * Default `prompt_cache_key` derived from the cacheable prefix (system prompt +

package/dist/runtime/kernel-step.d.ts

@@ -65,6 +65,8 @@ export interface KernelObservation {
     phase_id?: string;
     capabilities_unlocked?: string[];
     evidence?: string[];
+    removed_keys?: string[];
+    tokens_freed?: number;
     reason?: RollbackReason | string;
     agent_id?: string;
     parent_session_id?: string;

package/dist/runtime/large-result-spool.d.ts

@@ -77,6 +77,13 @@ export declare class LargeResultSpool {
      * Read a spooled result back from disk.
      */
     readSpooledResult(spoolRef: string): Promise<string>;
+    /**
+     * O7: locate a spooled output by the tool call's id (the `read_result` meta-tool only knows
+     * `call_id`, not the content-hashed file name `persistOutput` chose). Scans the spool directory
+     * for the `${callId}-*.txt` naming convention; returns `undefined` if nothing was ever spooled
+     * for that call (e.g. it never actually exceeded the threshold, or the spool dir was cleaned up).
+     */
+    findByCallId(callId: string): Promise<string | undefined>;
     /**
      * Clean up old spool files (optional maintenance).
      */

package/dist/runtime/large-result-spool.js

@@ -140,6 +140,31 @@ omitted: ${omitted} chars
             throw new Error(`Failed to read spooled result: ${error}`);
         }
     }
+    /**
+     * O7: locate a spooled output by the tool call's id (the `read_result` meta-tool only knows
+     * `call_id`, not the content-hashed file name `persistOutput` chose). Scans the spool directory
+     * for the `${callId}-*.txt` naming convention; returns `undefined` if nothing was ever spooled
+     * for that call (e.g. it never actually exceeded the threshold, or the spool dir was cleaned up).
+     */
+    async findByCallId(callId) {
+        let files;
+        try {
+            files = await fs.readdir(this.spoolDir);
+        }
+        catch {
+            return undefined;
+        }
+        const prefix = `${callId}-`;
+        const match = files.find(f => f.startsWith(prefix) && f.endsWith('.txt'));
+        if (!match)
+            return undefined;
+        try {
+            return await fs.readFile(path.join(this.spoolDir, match), 'utf-8');
+        }
+        catch {
+            return undefined;
+        }
+    }
     /**
      * Clean up old spool files (optional maintenance).
      */

package/dist/runtime/runner.d.ts

@@ -1,7 +1,7 @@
 import type { LLMProvider, Message, ContentPart, ToolSchema, StreamEvent, ToolSuspendEvent, PermissionRequestEvent, PermissionResponse, AsyncSummarizer, DreamSummarizer } from "../types.js";
 import type { DreamStore, MemoryEntry, MemoryQuery, MemoryWriteRequest } from "../memory/protocols.js";
 import type { KnowledgeSource } from "../knowledge/source.js";
-import type { SignalSource } from "../signals/types.js";
+import type { SignalSource, RuntimeSignalUrgency } from "../signals/types.js";
 import type { SessionLog, SessionEvent } from "./session-log.js";
 import type { ArchiveStore } from "./archive.js";
 import type { ExecutionPlane } from "./execution-plane.js";
@@ -50,6 +50,18 @@ export interface TurnMetrics {
     /** Tokens written to the prompt cache this turn (Anthropic `cache_creation_input_tokens`). */
     cacheCreationTokens: number;
 }
+/** O5: decision returned by `onToolCall` — `block: true` denies this call before it executes; the
+ *  `reason` is fed back to the model as a governance-denied tool result (so it can redirect). */
+export interface ToolCallHookDecision {
+    block?: boolean;
+    reason?: string;
+}
+/** O5: decision returned by `onToolResult` — `replaceOutput` swaps the result the model (and the
+ *  session log) sees; `note` is injected into the signal stream (see `injectNote`). */
+export interface ToolResultHookDecision {
+    replaceOutput?: string;
+    note?: string;
+}
 export interface RuntimeOptions {
     provider: LLMProvider;
     /** M4/G5: cumulative token cap for this run (the kernel's `max_total_tokens`). A workflow node's
@@ -81,6 +93,10 @@ export interface RuntimeOptions {
     preQueryMemory?: (ctx: {
         goal: string;
         runSpec?: AgentRunSpec;
+        /** K4: `"initial"` = the once-per-run pre-turn-1 fetch; `"renewal"` = re-fired after a sprint
+         *  renewal (renewal drops the old history INCLUDING earlier memory hits, so the new sprint
+         *  gets a fresh recall pass). Hooks that ignore it keep the pre-K4 behavior. */
+        phase?: "initial" | "renewal";
     }) => Promise<string[] | undefined> | string[] | undefined;
     systemPrompt?: string;
     initialMemory?: string[];
@@ -118,6 +134,63 @@ export interface RuntimeOptions {
      * and memory-write syscalls are admitted unconditionally (pre-M2 behavior).
      */
     resourceQuota?: ResourceQuota;
+    /**
+     * O6: the in-kernel repeat fuse — the hard rungs above the soft no-progress STOP. When the model
+     * re-issues the IDENTICAL tool call (same name AND args) `denyAfter` turns in a row, the kernel
+     * denies it and feeds a directive note back; at `terminateAfter` the run ends `no_progress`.
+     * Same-tool/different-args loops never trip it. Defaults: enabled, denyAfter 5, terminateAfter 8.
+     * Pass `false` to disable (e.g. legit fixed-argument polling loops).
+     */
+    repeatFuse?: {
+        denyAfter?: number;
+        terminateAfter?: number;
+    } | false;
+    /**
+     * O4: the turn-end criteria gate (the Stop-hook analog). When the model tries to finish while the
+     * run's `criteria` stand, the kernel injects ONE self-check turn ("verify each criterion; continue
+     * if any is unmet") before accepting completion. Fires at most once per run; runs without criteria
+     * are untouched. Default enabled — set `false` to accept the first finish unconditionally.
+     */
+    criteriaGate?: boolean;
+    /**
+     * K2: max share of `maxTokens` the durable knowledge partition may occupy. Exceeding it emits a
+     * `knowledge_budget_exceeded` observation (once per cache generation) and evicts the OLDEST
+     * unpinned, non-skill entries at the next compaction/renewal boundary until usage fits. Pinned
+     * entries and skill pins are never budget-evicted. `0` disables. Default: kernel's 0.25.
+     */
+    knowledgeBudgetRatio?: number;
+    /**
+     * K3: default lease (in turns) for every skill activation. After that many turns the kernel
+     * auto-deactivates the skill — toolset re-widens, knowledge pin boundary-swept — exactly like
+     * an explicit `deactivateSkill()`. Absent ⇒ activations are permanent (default). A repeat
+     * `skill(name)` call refreshes the lease.
+     */
+    skillLeaseTurns?: number;
+    /**
+     * O5 (the PreToolUse-hook analog): called for each kernel-APPROVED tool call just before it
+     * executes. Return `{ block: true, reason }` to veto — the call never runs and the reason is fed
+     * back to the model as a denied tool result. This is the seam for STATEFUL host policy (count
+     * repeats, budget writes per resource, project-specific rules); keep static allow/deny in
+     * `governancePolicy`. Errs-open: a throwing hook never blocks the run.
+     */
+    onToolCall?: (call: {
+        callId: string;
+        name: string;
+        arguments: string;
+    }) => Promise<ToolCallHookDecision | undefined | void> | ToolCallHookDecision | undefined | void;
+    /**
+     * O5 (the PostToolUse-hook analog): called for each executed tool result before it reaches the
+     * kernel. Return `{ replaceOutput }` to swap the result the model sees (redact / annotate), and/or
+     * `{ note }` to push a contextual note into the signal stream (same channel as `injectNote` —
+     * e.g. "that write was a no-op, stop repeating it"). Errs-open: a throwing hook changes nothing.
+     */
+    onToolResult?: (result: {
+        callId: string;
+        name: string;
+        arguments: string;
+        output: string;
+        isError: boolean;
+    }) => Promise<ToolResultHookDecision | undefined | void> | ToolResultHookDecision | undefined | void;
     /**
      * L1 (RunGroup): bind this runner to a governance domain shared by N peer sessions of one logical
      * run. Members pass the same `id` + `budgetStore`; the kernel's run-level token cap is then enforced
@@ -217,11 +290,17 @@ export declare class RuntimeRunner {
     private activeKernel;
     private pendingObservations;
     private currentSessionId;
+    /** O2 (system-reminder channel): host-pushed notes awaiting the next turn-boundary drain. */
+    private injectedSignals;
+    /** Skill names whose content has already been pushed into the durable `knowledge` slot this
+     *  run — guards against re-pushing a duplicate entry if the model calls `skill(name)` again for
+     *  an already-active skill (loading is idempotent; the knowledge push should be too). */
+    private knowledgePushedSkills;
     private nextArchiveStart;
+    /** K4: the active run's goal, kept for the renewal-boundary memory re-query. */
+    private currentGoal;
     /** Full tool outputs keyed by call_id until Layer-1 spool observations are logged. */
     private pendingSpoolOutputs;
-    /** Local cache of paged-out/archived messages for priority memory retrieval. */
-    private localPageOutCache;
     /** M5 v2.1: sub-workflow specs a top-level agent authored via `start_workflow`, awaiting auto-drive
      *  at the next safe point (after the tool turn resolves, kernel back in Reason — not suspended). */
     private pendingAuthoredWorkflows;
@@ -256,10 +335,22 @@ export declare class RuntimeRunner {
     mountMarker(kind: string, id: string, description: string): void;
     /** Unmount a capability by kind + id from the active run. No-op if not running. */
     unmountCapability(kind: string, id: string): void;
-    /** Phase 4: satisfy kernel page-in requests before meta-tool execution. */
-    private applyKernelPageIn;
-    /** Push content into the Knowledge slot (memory retrievals, skill definitions, artifacts). */
-    pushKnowledge(message: Message, tokens?: number): void;
+    /** Push content into the Knowledge slot (memory retrievals, skill definitions, artifacts).
+     *  K1: `opts.key` gives the entry identity — a same-key push upserts (applied at the next
+     *  compaction/renewal boundary, where the cached system[1] block is rewritten anyway) instead
+     *  of appending a duplicate. `opts.pinned` exempts the entry from the knowledge-budget sweep. */
+    pushKnowledge(message: Message, tokens?: number, opts?: {
+        key?: string;
+        pinned?: boolean;
+    }): void;
+    /** K1: mark a keyed knowledge entry for removal at the next compaction/renewal boundary.
+     *  Errs-open: an unknown key is a kernel-side no-op. */
+    removeKnowledge(key: string): void;
+    /** K3: host-driven skill deactivation (there is deliberately no model-facing unload — it
+     *  invites thrash). The toolset re-widens at the next provider call; the skill's knowledge pin
+     *  drops at the next compaction/renewal boundary. A later `skill(name)` call re-activates and
+     *  re-pins fresh content. Errs-open: not-active is a kernel-side no-op. */
+    deactivateSkill(name: string): void;
     /**
      * Spawn an isolated sub-agent via the kernel, run it on the host, and feed the result back.
      * Requires an active parent run (`run()` / `wake()` in progress or paused at milestone).
@@ -359,6 +450,16 @@ export declare class RuntimeRunner {
         failed: string[];
     }>;
     interrupt(): void;
+    /** Push a contextual note into the run's signal stream (the system-reminder channel): it drains at
+     *  the next turn boundary, routes through the kernel attention policy, and — once acted on — renders
+     *  as a `[SIGNAL] <text>` line in the volatile state turn plus a durable directive. Use it to feed
+     *  host-detected events back to the model mid-run (e.g. "that write was a no-op — stop repeating it")
+     *  without wiring a full `SignalSource`. `urgency` maps to the kernel disposition ladder: `"normal"`
+     *  queues for the next boundary (default), `"high"` soft-interrupts, `"critical"` preempts. */
+    injectNote(text: string, urgency?: RuntimeSignalUrgency): void;
+    /** Injected-note drain shared by the main loop's per-turn poll: injected notes first (FIFO), then
+     *  the configured `signalSource`. Keeps the two inbound channels on one code path so they never drift. */
+    private nextInboundSignal;
     run(req: {
         sessionId: string;
         goal: string;
@@ -376,7 +477,22 @@ export declare class RuntimeRunner {
     dream(agentId: string, nowMs?: number): AsyncIterable<StreamEvent>;
     /** Resolve in-kernel AskUser suspend; returns resume lists and stream events to yield. */
     private resolveKernelSuspend;
+    /**
+     * O7: resolve a `read_result` meta-tool call to the full text of a previously-evicted tool
+     * output. Resolution order: (a) this turn's in-memory `pendingSpoolOutputs` map (a call spooled
+     * earlier in the SAME tool-turn, before the session-log write lands), (b) the on-disk result
+     * spool (persisted once the kernel observation `large_result_spooled` was processed), (c) a
+     * session-log scan for the original `tool_completed` event carrying that `call_id`. Slices the
+     * resolved text by `[offset, offset + maxBytes)` (plain string slice — "bytes-ish").
+     */
+    private resolveReadResult;
     private execute;
+    /** I4 + K4: fetch long-term memory hits for the current goal and land them in `history` as an
+     *  ordinary user turn — single-use retrieval content that decays with the compression pyramid,
+     *  never pinned into `knowledge`. Called once before turn 1 (`phase: "initial"`) and re-fired
+     *  after each sprint renewal (`phase: "renewal"`): renewal drops the old history INCLUDING the
+     *  earlier memory hits, so the new sprint gets a fresh recall pass. Errs-open throughout. */
+    private prefetchMemoryIntoHistory;
     private appendObservations;
     private archiveSemanticPageOut;
     private upgradeCompressedSummary;

package/dist/runtime/runner.js

@@ -5,14 +5,14 @@ import { peekProviderReplay, seedProviderReplayFromEvents } from "./provider-rep
 import { sanitizeReplayText } from "./replay-sanitize.js";
 import { buildLlmCompletedEvent, buildRunTerminalEvent, buildWorkflowNodeCompletedEvent, buildWorkflowNodesSubmittedEvent, recoverCompletedWorkflowNodes, recoverSubmittedWorkflowNodes, repairEventsForRecovery, } from "./session-repair.js";
 import { KernelPrimitivesDashboard } from "./kernel-primitives-dashboard.js";
-import { capabilityMarker, capabilitySkill, capabilityTool, capabilityCommandMount, capabilityCommandUnmount, kernelAction, kernelApply, kernelMaybeAction, forceCompact, messageToKernelMessage, skillMetadataToKernel, taskUpdateToKernel, toolResultToKernel, toolSchemaToKernel, } from "./kernel-step.js";
+import { capabilityMarker, capabilitySkill, capabilityTool, capabilityCommandMount, capabilityCommandUnmount, kernelAction, kernelApply, kernelMaybeAction, messageToKernelMessage, skillMetadataToKernel, taskUpdateToKernel, toolResultToKernel, toolSchemaToKernel, } from "./kernel-step.js";
 import { agentRunSpecToKernel, findSpawnProcessObservation, milestoneCheckPass, milestoneCheckResultToKernel, spawnObservationToManifest, subAgentResultToKernel, submitWorkflowNodesToKernel, submitWorkflowToKernel, workflowBudgetNote, workflowNodeToManifest, workflowNodeToSpec, workflowSpecToKernel, } from "../types/agent.js";
 import { defaultSubAgentOrchestrator } from "./sub-agent-orchestrator.js";
 import { extractJsonValue, schemaInstruction, schemaRetryInstruction, validateAgainstSchema, } from "./output-schema.js";
 import { resolveReducer } from "./reducers.js";
 import { loopInstruction, classifyInstruction, judgeGoal, extractLoopContinue, extractClassifyBranch, extractJudgeWinner, } from "./workflow-control-flow.js";
 import { governancePolicyToKernelEvent, governanceFilterSchema } from "../governance.js";
-import { kernelObservationToSessionEvent, withCategory } from "./kernel-event-log.js";
+import { kernelObservationToSessionEvent } from "./kernel-event-log.js";
 import { assertNativeProfile } from "./os-profile.js";
 import { LargeResultSpool } from "./large-result-spool.js";
 import { formatToolError } from "../tools/errors.js";
@@ -25,11 +25,17 @@ export class RuntimeRunner {
     activeKernel = null;
     pendingObservations = [];
     currentSessionId = null;
+    /** O2 (system-reminder channel): host-pushed notes awaiting the next turn-boundary drain. */
+    injectedSignals = [];
+    /** Skill names whose content has already been pushed into the durable `knowledge` slot this
+     *  run — guards against re-pushing a duplicate entry if the model calls `skill(name)` again for
+     *  an already-active skill (loading is idempotent; the knowledge push should be too). */
+    knowledgePushedSkills = new Set();
     nextArchiveStart = 0;
+    /** K4: the active run's goal, kept for the renewal-boundary memory re-query. */
+    currentGoal = "";
     /** Full tool outputs keyed by call_id until Layer-1 spool observations are logged. */
     pendingSpoolOutputs = new Map();
-    /** Local cache of paged-out/archived messages for priority memory retrieval. */
-    localPageOutCache = [];
     /** M5 v2.1: sub-workflow specs a top-level agent authored via `start_workflow`, awaiting auto-drive
      *  at the next safe point (after the tool turn resolves, kernel back in Reason — not suspended). */
     pendingAuthoredWorkflows = [];
@@ -181,6 +187,22 @@ export class RuntimeRunner {
         if (groupSpawnsBase !== undefined && groupSpawnsBase > 0) {
             config.group_spawns_base = groupSpawnsBase;
         }
+        // O6: tune/disable the in-kernel repeat fuse. `false` disables; an object overrides thresholds.
+        // Absent ⇒ kernel defaults (enabled, deny_after=5, terminate_after=8).
+        if (this.opts.repeatFuse !== undefined) {
+            const rf = this.opts.repeatFuse;
+            config.repeat_fuse = rf === false
+                ? { enabled: false, deny_after: 0, terminate_after: 0 }
+                : { enabled: true, deny_after: rf.denyAfter ?? 5, terminate_after: rf.terminateAfter ?? 8 };
+        }
+        // O4: turn-end criteria gate toggle (absent ⇒ kernel default: enabled).
+        if (this.opts.criteriaGate !== undefined) {
+            config.criteria_gate = this.opts.criteriaGate;
+        }
+        // K2: knowledge budget ratio (absent ⇒ kernel default 0.25; 0 disables).
+        if (this.opts.knowledgeBudgetRatio !== undefined) {
+            config.knowledge_budget_ratio = this.opts.knowledgeBudgetRatio;
+        }
         kernelApply(runtime, this.pendingObservations, { kind: "configure_run", config });
     }
     async appendMemorySyscallObservations(sessionId, observations) {
@@ -221,62 +243,39 @@ export class RuntimeRunner {
             return;
         kernelApply(this.activeKernel, this.pendingObservations, capabilityCommandUnmount(kind, id));
     }
-    /** Phase 4: satisfy kernel page-in requests before meta-tool execution. */
-    async applyKernelPageIn(runtime, sessionId) {
-        const requests = this.pendingObservations.filter((o) => o.kind === "page_in_requested" && typeof o.tool === "string");
-        if (requests.length === 0)
-            return;
-        const entries = [];
-        for (const req of requests) {
-            const query = typeof req.query === "string" ? req.query : "";
-            const topK = typeof req.top_k === "number" ? req.top_k : 5;
-            if (req.tool === "memory") {
-                // Priority search: Local Page-Out Cache (lexical/keyword filter)
-                const localHits = this.localPageOutCache.filter(m => typeof m.content === "string" && m.content.toLowerCase().includes(query.toLowerCase())).slice(0, topK);
-                for (const hit of localHits) {
-                    entries.push({
-                        content: `[local semantic cache] ${hit.role}: ${hit.content}`,
-                        source: "semantic_cache",
-                    });
-                }
-                // Fall back to dreamStore for the remainder if needed
-                const remainingK = topK - entries.length;
-                if (remainingK > 0 && this.opts.dreamStore && this.opts.agentId) {
-                    const hits = await this.opts.dreamStore.search(this.opts.agentId, query, remainingK);
-                    for (const hit of hits) {
-                        entries.push({
-                            content: `[memory score=${hit.score.toFixed(3)}] ${hit.text}`,
-                            source: "memory",
-                        });
-                    }
-                }
-            }
-            else if (req.tool === "knowledge" && this.opts.knowledgeSource) {
-                const snippets = await this.opts.knowledgeSource.retrieve(query, topK);
-                for (const snippet of snippets) {
-                    entries.push({ content: snippet, source: "knowledge" });
-                }
-            }
-        }
-        if (entries.length === 0)
-            return;
-        kernelApply(runtime, this.pendingObservations, { kind: "page_in", entries });
-        await this.opts.sessionLog.append(sessionId, withCategory({
-            kind: "page_in",
-            turn: runtime.turn(),
-            entry_count: entries.length,
-        }));
-    }
-    /** Push content into the Knowledge slot (memory retrievals, skill definitions, artifacts). */
-    pushKnowledge(message, tokens) {
+    /** Push content into the Knowledge slot (memory retrievals, skill definitions, artifacts).
+     *  K1: `opts.key` gives the entry identity — a same-key push upserts (applied at the next
+     *  compaction/renewal boundary, where the cached system[1] block is rewritten anyway) instead
+     *  of appending a duplicate. `opts.pinned` exempts the entry from the knowledge-budget sweep. */
+    pushKnowledge(message, tokens, opts) {
         if (!this.activeKernel)
             return;
         kernelApply(this.activeKernel, this.pendingObservations, {
             kind: "add_knowledge_message",
             content: message.content ?? "",
             tokens: tokens ?? Math.max(1, Math.ceil((message.content?.length ?? 0) / 4)),
+            ...(opts?.key !== undefined ? { key: opts.key } : {}),
+            ...(opts?.pinned ? { pinned: true } : {}),
         });
     }
+    /** K1: mark a keyed knowledge entry for removal at the next compaction/renewal boundary.
+     *  Errs-open: an unknown key is a kernel-side no-op. */
+    removeKnowledge(key) {
+        if (!this.activeKernel)
+            return;
+        kernelApply(this.activeKernel, this.pendingObservations, { kind: "remove_knowledge", key });
+    }
+    /** K3: host-driven skill deactivation (there is deliberately no model-facing unload — it
+     *  invites thrash). The toolset re-widens at the next provider call; the skill's knowledge pin
+     *  drops at the next compaction/renewal boundary. A later `skill(name)` call re-activates and
+     *  re-pins fresh content. Errs-open: not-active is a kernel-side no-op. */
+    deactivateSkill(name) {
+        if (!this.activeKernel)
+            return;
+        kernelApply(this.activeKernel, this.pendingObservations, { kind: "skill_deactivated", name });
+        // Re-arm the SDK-side push guard so a re-activation re-pins the content.
+        this.knowledgePushedSkills.delete(name);
+    }
     /**
      * Spawn an isolated sub-agent via the kernel, run it on the host, and feed the result back.
      * Requires an active parent run (`run()` / `wake()` in progress or paused at milestone).
@@ -571,7 +570,10 @@ export class RuntimeRunner {
         if (!source)
             return null;
         while (!batchState.settled) {
-            const sig = await source.nextSignal(this.currentSessionId ?? undefined);
+            // O2: injected notes participate in the monitor too, so a host `injectNote` mid-batch is not
+            // stranded until the batch settles (the drain order matches `nextInboundSignal`).
+            const sig = this.injectedSignals.shift()
+                ?? await source.nextSignal(this.currentSessionId ?? undefined);
             if (batchState.settled)
                 break;
             if (!sig) {
@@ -699,6 +701,30 @@ export class RuntimeRunner {
         return this.runWorkflow(spec, { resumedCompleted, resumedSubmissions, sessionId });
     }
     interrupt() { this.interrupted = true; this.abortController?.abort(); }
+    /** Push a contextual note into the run's signal stream (the system-reminder channel): it drains at
+     *  the next turn boundary, routes through the kernel attention policy, and — once acted on — renders
+     *  as a `[SIGNAL] <text>` line in the volatile state turn plus a durable directive. Use it to feed
+     *  host-detected events back to the model mid-run (e.g. "that write was a no-op — stop repeating it")
+     *  without wiring a full `SignalSource`. `urgency` maps to the kernel disposition ladder: `"normal"`
+     *  queues for the next boundary (default), `"high"` soft-interrupts, `"critical"` preempts. */
+    injectNote(text, urgency = "normal") {
+        this.injectedSignals.push({
+            source: "custom",
+            signalType: "event",
+            urgency,
+            payload: { goal: text },
+        });
+    }
+    /** Injected-note drain shared by the main loop's per-turn poll: injected notes first (FIFO), then
+     *  the configured `signalSource`. Keeps the two inbound channels on one code path so they never drift. */
+    async nextInboundSignal() {
+        const injected = this.injectedSignals.shift();
+        if (injected)
+            return injected;
+        if (!this.opts.signalSource)
+            return null;
+        return this.opts.signalSource.nextSignal(this.currentSessionId ?? undefined);
+    }
     async *run(req) {
         const prior = req.inheritEvents ?? await this.opts.sessionLog.read(req.sessionId);
         const midRun = isMidRun(prior);
@@ -876,6 +902,65 @@ export class RuntimeRunner {
         }
         return { approved, denied, events };
     }
+    /**
+     * O7: resolve a `read_result` meta-tool call to the full text of a previously-evicted tool
+     * output. Resolution order: (a) this turn's in-memory `pendingSpoolOutputs` map (a call spooled
+     * earlier in the SAME tool-turn, before the session-log write lands), (b) the on-disk result
+     * spool (persisted once the kernel observation `large_result_spooled` was processed), (c) a
+     * session-log scan for the original `tool_completed` event carrying that `call_id`. Slices the
+     * resolved text by `[offset, offset + maxBytes)` (plain string slice — "bytes-ish").
+     */
+    async resolveReadResult(sessionId, argsJson) {
+        let callId = "";
+        let offset = 0;
+        let maxBytes = 4000;
+        try {
+            const args = JSON.parse(argsJson || "{}");
+            callId = typeof args.call_id === "string" ? args.call_id : "";
+            if (typeof args.offset === "number" && Number.isFinite(args.offset))
+                offset = args.offset;
+            if (typeof args.max_bytes === "number" && Number.isFinite(args.max_bytes))
+                maxBytes = args.max_bytes;
+        }
+        catch {
+            // malformed arguments — callId stays empty, falls through to "not found" below
+        }
+        let full = this.pendingSpoolOutputs.get(callId)?.output;
+        if (full === undefined) {
+            const spool = this.opts.resultSpool ?? new LargeResultSpool();
+            try {
+                full = await spool.findByCallId(callId);
+            }
+            catch {
+                full = undefined;
+            }
+        }
+        if (full === undefined) {
+            try {
+                const events = await this.opts.sessionLog.read(sessionId);
+                for (const { event } of events) {
+                    if (event.kind !== "tool_completed")
+                        continue;
+                    const match = event.results.find(r => r.call_id === callId);
+                    if (match)
+                        full = match.output;
+                }
+            }
+            catch {
+                full = undefined;
+            }
+        }
+        if (full === undefined) {
+            return { text: `no stored output for call_id "${callId}"`, isError: true };
+        }
+        const start = Math.max(0, offset);
+        const end = Math.min(full.length, start + Math.max(0, maxBytes));
+        const slice = full.slice(start, end);
+        return {
+            text: `[read_result ${callId}: chars ${start}–${end} of ${full.length}]\n${slice}`,
+            isError: false,
+        };
+    }
     async *execute(sessionId, goal, criteria, extensions, priorEvents, resumeMidRun = false, attachments) {
         this.interrupted = false;
         this.abortController = new AbortController();
@@ -999,14 +1084,36 @@ export class RuntimeRunner {
             // P1-B B3: rebuild active-skill gating after a wake by re-emitting SkillActivated for each
             // `skill` tool call in the replayed history (active_skills is not snapshotted — graceful).
             // The catalog (set_available_skills) was already fed above, so allowed_tools resolves.
+            // `knowledge` isn't snapshotted either (same graceful-reset philosophy) — best-effort re-push
+            // the skill's content from its replayed tool_result so the durable copy survives a wake too.
+            const toolResultByCallId = new Map();
+            for (const m of replayed) {
+                for (const part of m.contentParts ?? []) {
+                    if (part.type === "tool_result")
+                        toolResultByCallId.set(part.callId, part.output);
+                }
+            }
             for (const m of replayed) {
                 for (const tc of m.toolCalls ?? []) {
                     if (tc.name !== "skill")
                         continue;
                     try {
                         const name = JSON.parse(tc.arguments || "{}").name;
-                        if (name)
-                            kernelApply(runtime, this.pendingObservations, { kind: "skill_activated", name });
+                        if (!name)
+                            continue;
+                        kernelApply(runtime, this.pendingObservations, {
+                            kind: "skill_activated",
+                            name,
+                            ...(this.opts.skillLeaseTurns !== undefined ? { lease_turns: this.opts.skillLeaseTurns } : {}),
+                        });
+                        const output = toolResultByCallId.get(tc.id);
+                        if (output && !this.knowledgePushedSkills.has(name)) {
+                            this.knowledgePushedSkills.add(name);
+                            // K1: keyed — the kernel-side upsert is the authoritative dedup, so a wake re-push
+                            // of a skill already pinned live can never double-pin (the in-run Set resets with
+                            // each runner instance; the key does not).
+                            this.pushKnowledge({ role: "system", content: output, toolCalls: [] }, undefined, { key: `skill:${name}` });
+                        }
                     }
                     catch { /* malformed skill args — skip */ }
                 }
@@ -1054,30 +1161,21 @@ export class RuntimeRunner {
                 message: attachmentsToKernelMessage(attachments),
             });
         }
-        // I4: pre-fetch memory into the knowledge partition before the first LLM turn. Skipped on
-        // resumes (memory was already on the prior context) and when dreamStore/agentId is absent.
-        if (!resumeMidRun && this.opts.preQueryMemory && this.opts.dreamStore && this.opts.agentId) {
-            try {
-                const queries = await this.opts.preQueryMemory({ goal, runSpec: this.opts.runSpec });
-                const entries = [];
-                for (const q of queries ?? []) {
-                    if (typeof q !== "string" || !q.trim())
-                        continue;
-                    const hits = await this.opts.dreamStore.search(this.opts.agentId, q, 5);
-                    for (const hit of hits) {
-                        entries.push({ content: `[memory score=${hit.score.toFixed(3)}] ${hit.text}`, source: "memory" });
-                    }
-                }
-                if (entries.length > 0) {
-                    kernelApply(runtime, this.pendingObservations, { kind: "page_in", entries });
-                }
-            }
-            catch { /* errs-open — a faulty pre-fetch never breaks the run */ }
+        // I4: pre-fetch memory before the first LLM turn so the model sees it on turn 1 instead of
+        // discovering it via the `memory` tool on turn 3+. Skipped on resumes (already in prior
+        // context) and when dreamStore/agentId is absent.
+        //
+        // Strict dynamic context control: this is single-use retrieval content (facts relevant to
+        // THIS run's goal right now), not a stable method/skill — so it lands in `history` as an
+        // ordinary turn, exactly like a real `memory` tool result would, and decays with the
+        // compression pyramid over subsequent turns instead of pinning itself in `knowledge` forever.
+        this.currentGoal = goal;
+        if (!resumeMidRun) {
+            await this.prefetchMemoryIntoHistory(runtime, "initial");
         }
         let action = resumeMidRun
             ? kernelAction(runtime, this.pendingObservations, { kind: "resume" })
             : kernelAction(runtime, this.pendingObservations, startPayload);
-        let hasAttemptedReactiveCompact = false;
         // P0-C: the skill loaded and in effect going into the current turn (updated when the model's
         // `skill` tool call resolves). Drives the per-turn `activeSkill` metric → dwell measurement.
         let activeSkill;
@@ -1089,18 +1187,14 @@ export class RuntimeRunner {
         // an input" from "the run is still in progress."
         try {
             while (!runtime.isTerminal()) {
-                // Page-in must run before appendObservations drains pending kernel observations.
-                if (action.kind === "execute_tool") {
-                    await this.applyKernelPageIn(runtime, sessionId);
-                }
                 nextCompressedArchiveStart = await this.appendObservations(sessionId, runtime, nextCompressedArchiveStart);
                 this.nextArchiveStart = nextCompressedArchiveStart;
                 if (this.interrupted) {
                     action = kernelAction(runtime, this.pendingObservations, { kind: "timeout" });
                     break;
                 }
-                if (this.opts.signalSource) {
-                    const sig = await this.opts.signalSource.nextSignal(this.currentSessionId ?? undefined);
+                if (this.opts.signalSource || this.injectedSignals.length > 0) {
+                    const sig = await this.nextInboundSignal();
                     if (sig) {
                         // Kernel-routed: the kernel decides disposition (dedup/queue/interrupt) and emits
                         // `signal_disposed`. An actionable disposition yields a new action to adopt; queued/observed/
@@ -1158,7 +1252,7 @@ export class RuntimeRunner {
                     let turnCacheReadTokens = 0;
                     let turnCacheCreationTokens = 0;
                     let turnCacheReadBySlot;
-                    let shouldRetry = false;
+                    let turnStopReason;
                     const abortSignal = this.abortController?.signal;
                     try {
                         for await (const evt of this.opts.provider.stream(context, tools, Object.keys(ext).length ? ext : undefined, providerState, abortSignal)) {
@@ -1178,6 +1272,10 @@ export class RuntimeRunner {
                                 // I1: per-slot attribution forwarded into TurnMetrics. Undefined when the provider
                                 // doesn't honor cache_control (OpenAI-family auto-cache).
                                 turnCacheReadBySlot = usageEvt.cacheReadInputTokensBySlot;
+                                // Phase 4: stop_reason drives the kernel's max-output-tokens recovery. The closing
+                                // usage frame carries it; keep the last non-empty value seen this turn.
+                                if (usageEvt.stopReason)
+                                    turnStopReason = usageEvt.stopReason;
                                 continue;
                             }
                             yield evt;
@@ -1190,24 +1288,32 @@ export class RuntimeRunner {
                         }
                     }
                     catch (err) {
-                        // #2-B-ii: an aborted in-flight request surfaces as an AbortError — treat it as an interrupt
-                        // (the loop-top `interrupted` check converts it to a clean `timeout`/UserAbort), not a crash.
                         if (abortSignal?.aborted) {
+                            // #2-B-ii: an aborted in-flight request surfaces as an AbortError — treat it as an
+                            // interrupt (the post-stream `aborted` check below converts it to a clean
+                            // timeout/UserAbort), not a crash or a provider error.
                             this.interrupted = true;
                         }
-                        const errMsg = formatToolError(err).toLowerCase();
-                        if ((errMsg.includes("413") || errMsg.includes("too long") || errMsg.includes("context length exceeded") || errMsg.includes("context_length_exceeded")) &&
-                            !hasAttemptedReactiveCompact) {
-                            hasAttemptedReactiveCompact = true;
-                            if (forceCompact(runtime, this.pendingObservations)) {
-                                nextCompressedArchiveStart = await this.appendObservations(sessionId, runtime, nextCompressedArchiveStart);
-                                shouldRetry = true;
+                        else {
+                            // Reactive recovery is now a kernel decision. Forward the raw provider error and
+                            // dispatch whatever the kernel returns: `call_provider` to retry with a freshly
+                            // compacted context, or `done` to terminate with an honest `ContextOverflow`. The
+                            // classify + compact + retry + give-up policy lives in the kernel (one place), not
+                            // duplicated across the four SDK runners. `continue` re-enters the loop: a recovered
+                            // turn persists its compaction archive via the loop-top appendObservations, and a
+                            // terminal `done` exits through `isTerminal()` into the run_terminal emit below.
+                            action = kernelAction(runtime, this.pendingObservations, {
+                                kind: "provider_error",
+                                message: formatToolError(err),
+                            });
+                            // Withholding (query.ts parity): surface the raw provider error only when the kernel
+                            // could NOT recover (it returned a terminal). On a recovered retry (`call_provider`)
+                            // the error stays hidden, so embedders that terminate on `error` events don't see a
+                            // phantom failure mid-recovery.
+                            if (action.kind === "done") {
+                                yield { type: "error", message: formatToolError(err) };
                             }
-                        }
-                        if (!shouldRetry) {
-                            yield { type: "error", message: formatToolError(err) };
-                            action = kernelAction(runtime, this.pendingObservations, { kind: "timeout" });
-                            break;
+                            continue;
                         }
                     }
                     // #2-B-ii: stream aborted (preempt/interrupt) via the break path (provider yielded no error) —
@@ -1217,14 +1323,6 @@ export class RuntimeRunner {
                         action = kernelAction(runtime, this.pendingObservations, { kind: "timeout" });
                         break;
                     }
-                    if (shouldRetry) {
-                        action = {
-                            kind: "call_provider",
-                            context: runtime.render(),
-                            tools,
-                        };
-                        continue;
-                    }
                     const assistantMessage = {
                         role: "assistant",
                         content: finalText,
@@ -1237,6 +1335,7 @@ export class RuntimeRunner {
                         ...(turnInputTokens > 0 ? { observed_input_tokens: turnInputTokens } : {}),
                         ...(turnOutputTokens > 0 ? { observed_output_tokens: turnOutputTokens } : {}),
                         now_ms: Date.now(),
+                        ...(turnStopReason ? { stop_reason: turnStopReason } : {}),
                     };
                     let nextAction = kernelMaybeAction(runtime, this.pendingObservations, providerEvent);
                     if (!nextAction && this.pendingObservations.some(o => o.kind === "suspended")) {
@@ -1299,11 +1398,17 @@ export class RuntimeRunner {
                         resultSpool: this.opts.resultSpool ?? new LargeResultSpool(),
                     };
                     const toolResults = [];
-                    const normalCalls = allCalls.filter(c => c.name !== "update_plan" && c.name !== "submit_workflow_nodes" && c.name !== "start_workflow");
+                    const normalCalls = allCalls.filter(c => c.name !== "update_plan" && c.name !== "submit_workflow_nodes" && c.name !== "start_workflow"
+                        && c.name !== "read_result");
                     const planCalls = allCalls.filter(c => c.name === "update_plan");
                     // M5 v1: `start_workflow` (author a sub-workflow) flattens to the same append path as
                     // `submit_workflow_nodes` — a `WorkflowSpec` is a node batch. (v2 adds top-level bootstrap.)
                     const submitCalls = allCalls.filter(c => c.name === "submit_workflow_nodes" || c.name === "start_workflow");
+                    // O7: `read_result` re-fetches a tool output the kernel evicted from context. Content is
+                    // host-resolved: (a) this turn's in-memory pending spool map, (b) the on-disk result spool
+                    // (persisted once the kernel observes `large_result_spooled`), (c) a session-log scan for
+                    // the original `tool_completed` event. The kernel only advertises the capability.
+                    const readResultCalls = allCalls.filter(c => c.name === "read_result");
                     for (const call of planCalls) {
                         const update = parseUpdatePlanArgs(call.arguments);
                         kernelApply(runtime, this.pendingObservations, {
@@ -1314,6 +1419,11 @@ export class RuntimeRunner {
                         toolResults.push(result);
                         yield { type: "tool_result", callId: call.id, content: "success", isError: false };
                     }
+                    for (const call of readResultCalls) {
+                        const out = await this.resolveReadResult(sessionId, call.arguments);
+                        toolResults.push({ callId: call.id, output: out.text, isError: out.isError });
+                        yield { type: "tool_result", callId: call.id, content: out.text, isError: out.isError };
+                    }
                     // R3-1: `submit_workflow_nodes` cannot be applied to this runner's kernel — when this runner
                     // is a workflow node, the workflow lives in the *parent* kernel. Surface the requested nodes
                     // as a stream event; the orchestrator collects them onto the node's result and `runWorkflow`
@@ -1343,8 +1453,37 @@ export class RuntimeRunner {
                         toolResults.push(result);
                         yield { type: "tool_result", callId: call.id, content: "submitted", isError: false };
                     }
-                    if (normalCalls.length > 0) {
-                        for await (const evt of this.opts.executionPlane.executeAll(normalCalls, runCtx)) {
+                    // O5 (PreToolUse-hook analog): give the host a STATEFUL veto over each kernel-approved
+                    // call. A blocked call never executes; its reason reaches the model as a governance-denied
+                    // tool result (the kernel rolls the turn back with the note). Errs-open on hook throw.
+                    let executableCalls = normalCalls;
+                    if (this.opts.onToolCall) {
+                        const allowed = [];
+                        for (const call of normalCalls) {
+                            let decision;
+                            try {
+                                decision = await this.opts.onToolCall({ callId: call.id, name: call.name, arguments: call.arguments });
+                            }
+                            catch {
+                                decision = undefined;
+                            }
+                            if (decision?.block) {
+                                const reason = decision.reason ?? "blocked by host onToolCall hook";
+                                yield { type: "tool_denied", callId: call.id, toolName: call.name, reason };
+                                await this.opts.sessionLog.append(sessionId, {
+                                    kind: "tool_denied", turn: runtime.turn(), call_id: call.id, tool_name: call.name, reason,
+                                });
+                                const out = `blocked by host hook: ${reason}`;
+                                toolResults.push({ callId: call.id, output: out, isError: true, errorKind: "governance_denied" });
+                                yield { type: "tool_result", callId: call.id, name: call.name, content: out, isError: true };
+                                continue;
+                            }
+                            allowed.push(call);
+                        }
+                        executableCalls = allowed;
+                    }
+                    if (executableCalls.length > 0) {
+                        for await (const evt of this.opts.executionPlane.executeAll(executableCalls, runCtx)) {
                             yield evt;
                             if (evt.type === "tool_result") {
                                 const tre = evt;
@@ -1398,12 +1537,38 @@ export class RuntimeRunner {
                                 });
                             }
                         }
-                        const names = normalCalls.map(c => c.name).join(", ");
+                        const names = executableCalls.map(c => c.name).join(", ");
                         kernelApply(runtime, this.pendingObservations, {
                             kind: "update_task",
                             update: taskUpdateToKernel({ progress: `Executed tools: ${names}` }),
                         });
                     }
+                    // O5 (PostToolUse-hook analog): let the host inspect each executed result BEFORE it
+                    // reaches the kernel/session-log — replace the output (redact/annotate) and/or push a
+                    // contextual note into the signal stream. Errs-open on hook throw.
+                    if (this.opts.onToolResult) {
+                        for (const r of toolResults) {
+                            const call = executableCalls.find(c => c.id === r.callId);
+                            if (!call)
+                                continue; // plan/submit synthetics and hook-blocked calls are not host results
+                            let decision;
+                            try {
+                                decision = await this.opts.onToolResult({
+                                    callId: r.callId, name: call.name, arguments: call.arguments,
+                                    output: r.output, isError: r.isError,
+                                });
+                            }
+                            catch {
+                                decision = undefined;
+                            }
+                            if (!decision)
+                                continue;
+                            if (typeof decision.replaceOutput === "string")
+                                r.output = decision.replaceOutput;
+                            if (decision.note)
+                                this.injectNote(decision.note);
+                        }
+                    }
                     await this.opts.sessionLog.append(sessionId, {
                         kind: "tool_completed",
                         turn: runtime.turn(),
@@ -1423,6 +1588,13 @@ export class RuntimeRunner {
                     // P1-B B3: a `skill` call that resolved successfully activates that skill in the kernel, so
                     // the next `call_provider` narrows the toolset to its declared tools. Fed before `tool_results`
                     // (which computes the next action). Errs-open: a failed/missing skill load doesn't activate.
+                    //
+                    // Strict dynamic context control: a skill is METHOD content — how to do something — reused
+                    // for the rest of the run, unlike a one-off memory/knowledge lookup (fact content, relevant
+                    // for the moment it's used). So its text ALSO goes into the durable `knowledge` slot here
+                    // (in addition to the ordinary tool_result already headed for `history`, where it will decay
+                    // with the compression pyramid like any other tool output — that's fine, the permanent copy
+                    // now lives in `knowledge`). First activation only (see `knowledgePushedSkills`).
                     for (const call of allCalls) {
                         if (call.name !== "skill")
                             continue;
@@ -1431,8 +1603,21 @@ export class RuntimeRunner {
                             continue;
                         try {
                             const name = JSON.parse(call.arguments || "{}").name;
-                            if (name)
-                                kernelApply(runtime, this.pendingObservations, { kind: "skill_activated", name });
+                            if (!name)
+                                continue;
+                            kernelApply(runtime, this.pendingObservations, {
+                                kind: "skill_activated",
+                                name,
+                                ...(this.opts.skillLeaseTurns !== undefined ? { lease_turns: this.opts.skillLeaseTurns } : {}),
+                            });
+                            // K1: keyed `skill:<name>` — the kernel-side upsert dedupes across runner instances
+                            // (wake re-push of an already-pinned skill upserts instead of duplicating). With a
+                            // lease configured, the Set optimization is skipped: an expired-then-reloaded skill
+                            // must re-pin, and only the kernel knows the lease state — its upsert dedupes anyway.
+                            if (this.opts.skillLeaseTurns !== undefined || !this.knowledgePushedSkills.has(name)) {
+                                this.knowledgePushedSkills.add(name);
+                                this.pushKnowledge({ role: "system", content: res.output, toolCalls: [] }, undefined, { key: `skill:${name}` });
+                            }
                         }
                         catch { /* malformed skill args — skip activation */ }
                     }
@@ -1558,6 +1743,38 @@ export class RuntimeRunner {
         this.currentSessionId = null;
         this.dashboard = null;
     }
+    /** I4 + K4: fetch long-term memory hits for the current goal and land them in `history` as an
+     *  ordinary user turn — single-use retrieval content that decays with the compression pyramid,
+     *  never pinned into `knowledge`. Called once before turn 1 (`phase: "initial"`) and re-fired
+     *  after each sprint renewal (`phase: "renewal"`): renewal drops the old history INCLUDING the
+     *  earlier memory hits, so the new sprint gets a fresh recall pass. Errs-open throughout. */
+    async prefetchMemoryIntoHistory(runtime, phase) {
+        if (!this.opts.preQueryMemory || !this.opts.dreamStore || !this.opts.agentId)
+            return;
+        try {
+            const queries = await this.opts.preQueryMemory({
+                goal: this.currentGoal,
+                runSpec: this.opts.runSpec,
+                phase,
+            });
+            const lines = [];
+            for (const q of queries ?? []) {
+                if (typeof q !== "string" || !q.trim())
+                    continue;
+                const hits = await this.opts.dreamStore.search(this.opts.agentId, q, 5);
+                for (const hit of hits) {
+                    lines.push(`[memory score=${hit.score.toFixed(3)}] ${hit.text}`);
+                }
+            }
+            if (lines.length > 0) {
+                kernelApply(runtime, this.pendingObservations, {
+                    kind: "add_history_message",
+                    message: { role: "user", content: lines.join("\n") },
+                });
+            }
+        }
+        catch { /* errs-open — a faulty pre-fetch never breaks the run */ }
+    }
     async appendObservations(sessionId, runtime, nextArchiveStart) {
         const turn = runtime.turn();
         const preservedRefs = runtime.preservedRefs();
@@ -1580,9 +1797,6 @@ export class RuntimeRunner {
                     }
                 }
             }
-            if (obs.kind === "page_out" && obs.archived) {
-                this.localPageOutCache.push(...obs.archived);
-            }
             if (obs.kind === "large_result_spooled") {
                 const pending = this.pendingSpoolOutputs.get(obs.call_id ?? "");
                 if (pending) {
@@ -1624,6 +1838,12 @@ export class RuntimeRunner {
                 && obs.archived.length > 0) {
                 void this.archiveSemanticPageOut(obs.archived, compressionAction(obs.action));
             }
+            // K4: a sprint renewal dropped the old history — including any earlier memory hits — so
+            // re-run the preQueryMemory prefetch for the new sprint (live observations only: this
+            // consumer sits on the live drain path, same placement as the semantic page-out archival).
+            if (obs.kind === "renewed") {
+                await this.prefetchMemoryIntoHistory(runtime, "renewal");
+            }
         }
         return nextArchiveStart;
     }

package/dist/runtime/sub-agent-orchestrator.js

@@ -10,7 +10,9 @@ function terminationFromStatus(status) {
         normalized === "timeout" ||
         normalized === "user_abort" ||
         normalized === "error" ||
-        normalized === "milestone_exceeded") {
+        normalized === "milestone_exceeded" ||
+        normalized === "context_overflow" ||
+        normalized === "no_progress") {
         return normalized;
     }
     return status;
@@ -87,6 +89,9 @@ export class SubAgentOrchestrator {
             provider: resolveProvider(ctx.parentOpts, ctx.spec.modelHint),
             // M4/G5: cap the child run at the node's token budget (falls back to the inherited cap).
             maxTotalTokens: ctx.spec.tokenBudget ?? ctx.parentOpts.maxTotalTokens,
+            // O3: per-child turn / wall-clock caps (fall back to the inherited limits).
+            maxTurns: ctx.spec.maxTurns ?? ctx.parentOpts.maxTurns,
+            timeoutMs: ctx.spec.maxWallMs ?? ctx.parentOpts.timeoutMs,
             executionPlane: execPlane,
             agentId: ctx.spec.identity.agentId,
             systemPrompt,
@@ -127,6 +132,9 @@ export class SubAgentOrchestrator {
                 provider: resolveProvider(ctx.parentOpts, ctx.spec.modelHint),
                 // M4/G5: cap the child run at the node's token budget (falls back to the inherited cap).
                 maxTotalTokens: ctx.spec.tokenBudget ?? ctx.parentOpts.maxTotalTokens,
+                // O3: per-child turn / wall-clock caps (fall back to the inherited limits).
+                maxTurns: ctx.spec.maxTurns ?? ctx.parentOpts.maxTurns,
+                timeoutMs: ctx.spec.maxWallMs ?? ctx.parentOpts.timeoutMs,
                 executionPlane: execPlane,
                 agentId: ctx.spec.identity.agentId,
                 sessionLog: ctx.sessionLog,

package/dist/types/agent.d.ts

@@ -2,7 +2,12 @@ import type { Message, ToolSchema } from "../types.js";
 export type KernelAgentRole = "explore" | "plan" | "implement" | "verify" | "custom";
 export type AgentIsolation = "shared" | "read_only" | "worktree" | "remote";
 export type ContextInheritance = "none" | "system_only" | "full";
-export type TerminationReason = "completed" | "max_turns" | "token_budget" | "timeout" | "user_abort" | "error" | "milestone_exceeded";
+export type TerminationReason = "completed" | "max_turns" | "token_budget" | "timeout" | "user_abort" | "error" | "milestone_exceeded"
+/** v0.2.35 recovery ladder: compaction exhausted and the prompt still exceeds the provider window. */
+ | "context_overflow"
+/** Repeat-fuse escalation: the same tool call (name AND args) re-issued past `terminateAfter` —
+ *  a stall, distinct from `max_turns` which productive runs can also hit. */
+ | "no_progress";
 export type MilestonePolicy = "require_verifier" | "terminate" | "auto_pass";
 export interface AgentIdentity {
     agentId: string;
@@ -28,6 +33,12 @@ export interface AgentRunSpec {
     modelHint?: string;
     /** M4/G5: cumulative token cap for this sub-agent's run (sets the child kernel's `maxTotalTokens`). */
     tokenBudget?: number;
+    /** O3: per-child turn cap (sets the child runner's `maxTurns`; falls back to the parent's). A child
+     *  that exhausts it terminates `max_turns` — the parent reads the termination and decides retry/skip. */
+    maxTurns?: number;
+    /** O3: per-child wall-clock cap in milliseconds (sets the child runner's `timeoutMs`; falls back to
+     *  the parent's). A hung child terminates `timeout` instead of stalling the parent indefinitely. */
+    maxWallMs?: number;
 }
 /** Kernel process-table observation (Phase 3 canonical spawn signal). */
 export interface AgentProcessChangedObservation {

package/dist/types.d.ts

@@ -93,6 +93,10 @@ export interface UsageEvent extends StreamEvent {
         tools?: number;
         messages?: number;
     };
+    /** Provider stop reason for the response — `max_tokens` (Anthropic) / `length` (OpenAI) flag an
+     *  output-cap truncation, which drives the kernel's max-output-tokens recovery. Absent when the
+     *  provider doesn't report one. */
+    stopReason?: string;
 }
 export type ToolChunk = string | {
     type: "text";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@deepstrike/sdk",
-  "version": "0.2.34",
+  "version": "0.2.36",
   "description": "DeepStrike Node.js SDK",
   "type": "module",
   "main": "dist/index.js",
@@ -72,7 +72,7 @@
   },
   "dependencies": {
     "@anthropic-ai/sdk": "^0.99.0",
-    "@deepstrike/core": "0.2.34",
+    "@deepstrike/core": "0.2.36",
     "@google/generative-ai": "^0.24.1",
     "openai": "^5.23.2"
   },