@hyperdreamer/pi-webui 1.10.7 → 1.11.0-beta.10

package/dist/server/sessions/piSessionService.js

@@ -7,27 +7,37 @@ import { projectBrowserMessage } from "../browserMessageProjection.js";
 import { pageMessagesAtSafeBoundary } from "./messagePaging.js";
 import { exportSessionHistoryHtml } from "./sessionHistoryExport.js";
 import { BUILTIN_COMMANDS } from "./builtinCommands.js";
-import { SessionCommandService, clientSessionFromRuntime } from "./sessionCommandService.js";
-import { projectSessionTree } from "./sessionTreeProjection.js";
-import { SessionArchiveStore } from "./sessionArchiveStore.js";
-import { SessionMetadataStore } from "./sessionMetadataStore.js";
-import { findArchiveCandidateByIdOrPrefix, planSessionArchiveTree } from "./sessionArchiveTree.js";
-import { deterministicSessionName, fallbackSessionName, generateShortSessionName } from "./sessionNameGenerator.js";
+import { SessionCommandService, clientSessionFromRuntime, } from "./sessionCommandService.js";
+import { projectSessionTree, } from "./sessionTreeProjection.js";
+import { SessionArchiveStore, } from "./sessionArchiveStore.js";
+import { SessionMetadataStore, SessionMetadataOrderConflictError } from "./sessionMetadataStore.js";
+import { findArchiveCandidateByIdOrPrefix, planSessionArchiveTree, } from "./sessionArchiveTree.js";
+import { deterministicSessionName, fallbackSessionName, generateShortSessionName, } from "./sessionNameGenerator.js";
 import { computeEditPreview } from "./editPreview.js";
-import { attachmentsToInlineImages, saveAttachmentsToWorkspace } from "./attachmentService.js";
+import { attachmentsToInlineImages, saveAttachmentsToWorkspace, } from "./attachmentService.js";
 import { parsePromptAttachments } from "../../shared/promptAttachments.js";
 import { isKnownThinkingLevel } from "../../shared/thinkingLevels.js";
-import { SESSION_TREE_CUSTOM_INSTRUCTIONS_MAX_LENGTH, SESSION_UNREAD_LIMIT } from "../../shared/apiTypes.js";
+import { SESSION_TREE_CUSTOM_INSTRUCTIONS_MAX_LENGTH, SESSION_UNREAD_LIMIT, } from "../../shared/apiTypes.js";
+import { assertSubmittedSessionsCurrent, SessionReorderDomainError, validateSessionReorder, } from "./sessionReorder.js";
 import { canonicalizeStoredCwd, cwdPathsEqual } from "../workingDirectory.js";
-import { createSpawnSessionToolDefinition } from "./spawnSessionTool.js";
-import { createSubsessionToolDefinitions } from "./spawnSubsessionTool.js";
+import { createSpawnSessionToolDefinition, } from "./spawnSessionTool.js";
+import { createSubsessionToolDefinitions, } from "./spawnSubsessionTool.js";
+import { createModelPolicyToolDefinition, } from "./modelPolicyTool.js";
+import { buildModelPolicyCapability, } from "./modelPolicyCapability.js";
 import { buildTranscriptView } from "./subsessionTranscript.js";
-import { planForceCleanup, planSessionCleanup, summarizeForceCleanupExecution, summarizeSessionCleanupExecution } from "./sessionCleanup.js";
+import { planForceCleanup, planSessionCleanup, summarizeForceCleanupExecution, summarizeSessionCleanupExecution, } from "./sessionCleanup.js";
 import { SessionNotificationStore, } from "./sessionNotificationStore.js";
 import { plainTextTheme } from "./plainTextTheme.js";
-import { SessionUnreadStore } from "./sessionUnreadStore.js";
-import { createModelTierRegistry, isModelTier, runtimeThinkingLevels } from "./modelTierRegistry.js";
-const noopLogger = { info() { } };
+import { SessionUnreadStore, } from "./sessionUnreadStore.js";
+import { createModelTierRegistry, isModelTier, runtimeThinkingLevels, } from "./modelTierRegistry.js";
+import { createUtilityModelExtension, } from "./utilityModelExtension.js";
+import { createUtilityModelResolver, runWithUtilityModelFallback, } from "./utilityModelResolver.js";
+import { inspectSessionModelPolicy, planSessionModelPolicyUpdate, serializeSessionModelPolicy, SESSION_MODEL_POLICY_CUSTOM_TYPE, } from "./sessionModelPolicy.js";
+const noopLogger = {
+    info() {
+        /* no-op */
+    },
+};
 const DEFAULT_UNREAD_PUBLICATION_RETRY_MS = 1_000;
 const MAX_UNREAD_PUBLICATION_RETRY_MS = 30_000;
 const MAX_PENDING_UNREAD_MUTATIONS = SESSION_UNREAD_LIMIT + 1;
@@ -89,13 +99,13 @@ function requirePromptText(value) {
         throw new Error("Prompt text is required");
     return value;
 }
-function leadingTierDirective(prompt) {
-    const match = /^(?:\uFEFF)?\/tier-([^\s\r\n]+)(?:[ \t]*(?:\r?\n|$))/u.exec(prompt);
+function leadingTierEcho(prompt) {
+    const match = /^(?:\uFEFF)?Model tier: ([^\s\r\n]+)(?:[ \t]*(?:\r?\n|$))/u.exec(prompt);
     if (match === null)
         return undefined;
     const value = match[1];
     if (value === undefined || !isModelTier(value))
-        throw new Error(`Unknown leading tier directive: /tier-${value ?? ""}`);
+        throw new Error(`Unknown leading model tier label: ${value ?? ""}`);
     return value;
 }
 function parsePromptStreamingBehavior(value) {
@@ -105,7 +115,10 @@ function parsePromptStreamingBehavior(value) {
         return value;
     throw new Error('Prompt streamingBehavior must be "steer" or "followUp"');
 }
-const CLEAR_RUNTIME_NOTIFICATIONS = { kind: "clear", reason: "runtime-close" };
+const CLEAR_RUNTIME_NOTIFICATIONS = {
+    kind: "clear",
+    reason: "runtime-close",
+};
 const DEFER_RUNTIME_NOTIFICATIONS = { kind: "defer" };
 function resourceDiagnosticToWarning(diagnostic, source) {
     return {
@@ -116,7 +129,11 @@ function resourceDiagnosticToWarning(diagnostic, source) {
     };
 }
 function runtimeDiagnosticToWarning(diagnostic) {
-    return { severity: diagnostic.type, message: diagnostic.message, source: "runtime" };
+    return {
+        severity: diagnostic.type,
+        message: diagnostic.message,
+        source: "runtime",
+    };
 }
 /**
  * Compute the live warnings for a runtime by re-reading its current resource
@@ -140,7 +157,12 @@ export function collectRuntimeWarnings(runtime) {
         for (const diagnostic of resourceLoader.getThemes().diagnostics)
             warnings.push(resourceDiagnosticToWarning(diagnostic, "theme"));
         for (const error of resourceLoader.getExtensions().errors) {
-            warnings.push({ severity: "error", message: `${error.path}: ${error.error}`, source: "extension", path: error.path });
+            warnings.push({
+                severity: "error",
+                message: `${error.path}: ${error.error}`,
+                source: "extension",
+                path: error.path,
+            });
         }
     }
     return warnings;
@@ -206,7 +228,10 @@ export function dismissSessionWarning(session, dismissId) {
     if (dismissId !== ANTHROPIC_EXTRA_USAGE_DISMISS_ID) {
         throw new Error(`Unknown session warning dismiss id: ${dismissId}`);
     }
-    session.settingsManager.setWarnings({ ...session.settingsManager.getWarnings(), anthropicExtraUsage: false });
+    session.settingsManager.setWarnings({
+        ...session.settingsManager.getWarnings(),
+        anthropicExtraUsage: false,
+    });
 }
 function defaultCreateAgentRuntime(createRuntime, options) {
     if (!(options.sessionManager instanceof SessionManager))
@@ -234,32 +259,72 @@ function createRuntimeWithOneShotSessionOptions(createRuntime, initialModel, ini
         return createRuntime({
             ...options,
             ...(model === undefined ? {} : { initialModel: model }),
-            ...(thinkingLevel === undefined ? {} : { initialThinkingLevel: thinkingLevel }),
-            ...(toolsEnabled === undefined ? {} : { delegationToolsEnabled: toolsEnabled }),
+            ...(thinkingLevel === undefined
+                ? {}
+                : { initialThinkingLevel: thinkingLevel }),
+            ...(toolsEnabled === undefined
+                ? {}
+                : { delegationToolsEnabled: toolsEnabled }),
         });
     };
 }
-export function createPiWebUiCustomToolDefinitions(cwd, delegationEnabled, spawn, subsessions) {
+export function createPiWebUiCustomToolDefinitions(cwd, delegationEnabled, spawn, subsessions, modelPolicy) {
     return [
         createPiWebUiEditToolDefinition(cwd),
-        ...(delegationEnabled && spawn !== undefined ? [createSpawnSessionToolDefinition(cwd, { spawn })] : []),
-        ...(delegationEnabled && subsessions !== undefined ? createSubsessionToolDefinitions(cwd, subsessions) : []),
+        ...(delegationEnabled && spawn !== undefined
+            ? [createSpawnSessionToolDefinition(cwd, { spawn })]
+            : []),
+        ...(delegationEnabled && subsessions !== undefined
+            ? createSubsessionToolDefinitions(cwd, subsessions)
+            : []),
+        // Paired with the subsession tools: the policy view exists so a dispatching
+        // agent can verify tier dispatch before using it, so it is pointless without
+        // the dispatch capability and misleading if advertised separately.
+        ...(delegationEnabled &&
+            subsessions !== undefined &&
+            modelPolicy !== undefined
+            ? [createModelPolicyToolDefinition(modelPolicy)]
+            : []),
     ];
 }
-function createDefaultRuntimeFactory(modelRuntime, sessionManagers, spawn, subsessions) {
-    return async ({ cwd, agentDir, sessionManager, sessionStartEvent, initialModel, initialThinkingLevel, delegationToolsEnabled }) => {
-        const services = await createAgentSessionServices({ cwd, agentDir, modelRuntime });
-        const resolvedDelegationToolsEnabled = delegationToolsEnabled
-            ?? await sessionAllowsDelegationTools(sessionManager, sessionManagers);
-        const customTools = createPiWebUiCustomToolDefinitions(cwd, resolvedDelegationToolsEnabled, spawn, subsessions);
-        const result = await createAgentSessionFromServices({
+export function createDefaultRuntimeFactory(modelRuntime, sessionManagers, utilityModelResolver, logger, spawn, subsessions, modelPolicy, sdk = {
+    createServices: createAgentSessionServices,
+    createFromServices: createAgentSessionFromServices,
+}) {
+    return async ({ cwd, agentDir, sessionManager, sessionStartEvent, initialModel, initialThinkingLevel, delegationToolsEnabled, }) => {
+        const runtimeRefs = {};
+        const services = await sdk.createServices({
+            cwd,
+            agentDir,
+            modelRuntime,
+            resourceLoaderOptions: {
+                extensionFactories: [
+                    createUtilityModelExtension({
+                        // Pi's ExtensionContext exposes Model<any>; production candidates still come from ModelRuntime's Model<Api> snapshot.
+                        // eslint-disable-next-line @typescript-eslint/no-unsafe-assignment
+                        resolver: utilityModelResolver,
+                        modelRuntime,
+                        refs: runtimeRefs,
+                        logger,
+                    }),
+                ],
+            },
+        });
+        runtimeRefs.settingsManager = services.settingsManager;
+        const resolvedDelegationToolsEnabled = delegationToolsEnabled ??
+            (await sessionAllowsDelegationTools(sessionManager, sessionManagers));
+        const customTools = createPiWebUiCustomToolDefinitions(cwd, resolvedDelegationToolsEnabled, spawn, subsessions, modelPolicy);
+        const result = await sdk.createFromServices({
             services,
             sessionManager,
             customTools,
             ...(sessionStartEvent === undefined ? {} : { sessionStartEvent }),
             ...(initialModel === undefined ? {} : { model: initialModel }),
-            ...(initialThinkingLevel === undefined ? {} : { thinkingLevel: initialThinkingLevel }),
+            ...(initialThinkingLevel === undefined
+                ? {}
+                : { thinkingLevel: initialThinkingLevel }),
         });
+        runtimeRefs.streamFunction = result.session.agent.streamFunction;
         return { ...result, services, diagnostics: services.diagnostics };
     };
 }
@@ -269,16 +334,29 @@ function createPiWebUiEditToolDefinition(cwd) {
         name: editTool.name,
         label: editTool.label,
         description: editTool.description,
-        ...(editTool.promptSnippet === undefined ? {} : { promptSnippet: editTool.promptSnippet }),
-        ...(editTool.promptGuidelines === undefined ? {} : { promptGuidelines: editTool.promptGuidelines }),
+        ...(editTool.promptSnippet === undefined
+            ? {}
+            : { promptSnippet: editTool.promptSnippet }),
+        ...(editTool.promptGuidelines === undefined
+            ? {}
+            : { promptGuidelines: editTool.promptGuidelines }),
         parameters: editTool.parameters,
-        ...(editTool.renderShell === undefined ? {} : { renderShell: editTool.renderShell }),
-        ...(editTool.prepareArguments === undefined ? {} : { prepareArguments: editTool.prepareArguments }),
-        ...(editTool.executionMode === undefined ? {} : { executionMode: editTool.executionMode }),
+        ...(editTool.renderShell === undefined
+            ? {}
+            : { renderShell: editTool.renderShell }),
+        ...(editTool.prepareArguments === undefined
+            ? {}
+            : { prepareArguments: editTool.prepareArguments }),
+        ...(editTool.executionMode === undefined
+            ? {}
+            : { executionMode: editTool.executionMode }),
         async execute(toolCallId, params, signal, onUpdate, ctx) {
             const preview = await computeEditPreview(params.path, params.edits, cwd);
             if (signal?.aborted !== true) {
-                onUpdate?.({ content: [{ type: "text", text: "Edit preview computed." }], details: { preview } });
+                onUpdate?.({
+                    content: [{ type: "text", text: "Edit preview computed." }],
+                    details: { preview },
+                });
             }
             return editTool.execute(toolCallId, params, signal, onUpdate, ctx);
         },
@@ -291,6 +369,43 @@ export class PiSessionService {
         this.pendingSessionOpens = new Map();
         this.activities = new Map();
         this.generationMetrics = new WeakMap();
+        this.modelPolicyInspections = new WeakMap();
+        this.modelPolicyLadderValidations = new WeakMap();
+        /**
+         * Reason the newest persisted policy entry is unusable. Recomputed on every
+         * inspection refresh, so repairing the entry clears it.
+         */
+        this.modelPolicyEntryReasons = new WeakMap();
+        /**
+         * `MODEL_POLICY_BLOCKED` runtime state from an application whose restoration
+         * could not be proven. Deliberately *not* cleared by inspection refresh: only
+         * an explicit successful policy application clears it, because the runtime
+         * tuple — not the persisted entry — is what became ambiguous.
+         *
+         * Keyed by session *id* rather than by the runtime session object so the block
+         * is daemon-owned: it survives a runtime rebind, a reload, and a close/reopen
+         * of the same session, none of which prove anything about the ambiguous tuple.
+         */
+        this.modelPolicyRuntimeBlocks = new Map();
+        /**
+         * Sessions inside the apply-and-persist window of a policy transition. During
+         * that window the runtime tuple is transient (model set, thinking not yet, or
+         * persistence not yet confirmed), so no prompt may reach Pi.
+         */
+        this.modelPolicyMutationCounts = new Map();
+        /**
+         * Tuple last *confirmed* by the policy runtime adapter, captured when the
+         * outermost policy mutation opens and dropped when it closes.
+         *
+         * A status may be published from inside the transition window (the runtime
+         * subscription and the heartbeat both reach `publishStatus`), where the live
+         * runtime tuple is mid-apply: the model is set but the thinking level is not,
+         * so reading it would report a pair that was never requested and never
+         * persisted. `ClientSessionModelPolicyStatus.resolved` promises the last
+         * confirmed tuple, so the window reports this instead of live state. Keyed by
+         * session id to match the mutation counter it is scoped by.
+         */
+        this.modelPolicyConfirmedSelections = new Map();
         /** Runtime-identity gate held while Pi may await abandoned-branch summarization. */
         this.treeNavigations = new WeakSet();
         /** Counts async operations that may append an entry before they settle. */
@@ -321,42 +436,90 @@ export class PiSessionService {
         this.pendingUnreadMutations = [];
         this.unreadPublicationFlushRequested = false;
         this.unreadPublicationStopped = false;
+        /**
+         * Serializes reorder against every other mutation that can change sibling
+         * membership, pin state, or current/archive membership (pin, unpin,
+         * detach-parent, archive, archiveMany, archiveTree, restore, and cleanup),
+         * so no such mutation can interleave with a reorder's before/after catalog
+         * reads and its atomic metadata write.
+         */
+        this.sessionOrderMutationQueue = Promise.resolve();
         this.archiveStore = deps.archiveStore ?? new SessionArchiveStore();
         this.metadataStore = deps.metadataStore ?? new SessionMetadataStore();
+        this.clearParentSessionFile = deps.clearParentSession ?? clearParentSession;
         this.agentDir = deps.agentDir;
         this.sessionManager = deps.sessionManager;
         this.modelRuntime = deps.modelRuntime;
         this.spawnTargets = deps.spawnTargets;
         this.logger = deps.logger ?? noopLogger;
+        this.utilityModelResolver =
+            deps.utilityModelResolver ??
+                createUtilityModelResolver({
+                    loadConfig: () => {
+                        const loaded = loadPiWebUiConfig();
+                        return {
+                            ...(loaded.config.utilityModels === undefined
+                                ? {}
+                                : { utilityModels: loaded.config.utilityModels }),
+                            ...(loaded.utilityModelsError === undefined
+                                ? {}
+                                : { utilityModelsError: loaded.utilityModelsError }),
+                        };
+                    },
+                    modelRuntime: this.modelRuntime,
+                    logger: this.logger,
+                });
         this.now = deps.now ?? (() => new Date());
-        this.notificationStore = deps.notificationStore ?? new SessionNotificationStore();
+        this.notificationStore =
+            deps.notificationStore ?? new SessionNotificationStore();
         this.unreadStore = deps.unreadStore ?? new SessionUnreadStore();
         this.unreadPublicationRetryInitialMs = Math.max(0, deps.unreadPublicationRetryDelayMs ?? DEFAULT_UNREAD_PUBLICATION_RETRY_MS);
         this.unreadPublicationRetryDelayMs = this.unreadPublicationRetryInitialMs;
         // Subsessions are a beta capability gated behind their own flag, and they
         // also require the spawn capability (they share its project-scope resolver).
         const subsessionsActive = this.spawnTargets !== undefined && deps.subsessionsEnabled === true;
-        this.createRuntime = deps.createRuntime ?? createDefaultRuntimeFactory(this.modelRuntime, this.sessionManager, this.spawnTargets === undefined ? undefined : (input) => this.spawnSession(input), !subsessionsActive ? undefined : {
-            spawn: (input) => this.spawnSubsession(input),
-            list: (parentSessionId, parentSessionFile) => this.listSubsessions(parentSessionId, parentSessionFile),
-            check: (parentSessionId, sessionId, parentSessionFile) => this.checkSubsession(parentSessionId, sessionId, parentSessionFile),
-            read: (parentSessionId, sessionId, query, parentSessionFile) => this.readSubsession(parentSessionId, sessionId, query, parentSessionFile),
-        });
-        this.createAgentRuntime = deps.createAgentRuntime ?? defaultCreateAgentRuntime;
-        this.modelTierRegistry = deps.modelTierRegistry ?? createModelTierRegistry({
-            loadConfig: () => {
-                const loaded = loadPiWebUiConfig();
-                return {
-                    ...(loaded.config.modelTiers === undefined ? {} : { modelTiers: loaded.config.modelTiers }),
-                    ...(loaded.modelTiersError === undefined ? {} : { modelTiersError: loaded.modelTiersError }),
-                };
-            },
-            models: () => this.modelRuntime.getAvailableSnapshot(),
-            supportedThinkingLevels: runtimeThinkingLevels,
-        });
+        this.createRuntime =
+            deps.createRuntime ??
+                createDefaultRuntimeFactory(this.modelRuntime, this.sessionManager, this.utilityModelResolver, this.logger, this.spawnTargets === undefined
+                    ? undefined
+                    : (input) => this.spawnSession(input), !subsessionsActive
+                    ? undefined
+                    : {
+                        spawn: (input) => this.spawnSubsession(input),
+                        list: (parentSessionId, parentSessionFile) => this.listSubsessions(parentSessionId, parentSessionFile),
+                        check: (parentSessionId, sessionId, parentSessionFile) => this.checkSubsession(parentSessionId, sessionId, parentSessionFile),
+                        read: (parentSessionId, sessionId, query, parentSessionFile) => this.readSubsession(parentSessionId, sessionId, query, parentSessionFile),
+                    }, !subsessionsActive
+                    ? undefined
+                    : {
+                        inspect: (sessionId) => this.modelPolicyCapability(sessionId),
+                    });
+        this.createAgentRuntime =
+            deps.createAgentRuntime ?? defaultCreateAgentRuntime;
+        this.modelTierRegistry =
+            deps.modelTierRegistry ??
+                createModelTierRegistry({
+                    loadConfig: () => {
+                        const loaded = loadPiWebUiConfig();
+                        return {
+                            ...(loaded.config.modelTiers === undefined
+                                ? {}
+                                : { modelTiers: loaded.config.modelTiers }),
+                            ...(loaded.modelTiersError === undefined
+                                ? {}
+                                : { modelTiersError: loaded.modelTiersError }),
+                        };
+                    },
+                    models: () => this.modelRuntime.getAvailableSnapshot(),
+                    supportedThinkingLevels: runtimeThinkingLevels,
+                });
         this.workspaceActivity = deps.workspaceActivity;
-        this.heartbeat = setInterval(() => { this.publishHeartbeats(); }, deps.heartbeatIntervalMs ?? 2000);
-        this.commandService = new SessionCommandService((sessionId) => this.getActive(sessionId), (sessionId, text) => this.prompt(sessionId, text, undefined, undefined, { echoUserMessage: false }), events, {
+        this.heartbeat = setInterval(() => {
+            this.publishHeartbeats();
+        }, deps.heartbeatIntervalMs ?? 2000);
+        this.commandService = new SessionCommandService((sessionId) => this.getActive(sessionId), (sessionId, text) => this.prompt(sessionId, text, undefined, undefined, {
+            echoUserMessage: false,
+        }), events, {
             onCompactionStart: (session) => {
                 this.beginSessionEntryMutation(session, "compact the session");
                 this.publishActivity(session, "compacting", "active");
@@ -369,7 +532,8 @@ export class PiSessionService {
             },
             reloadSession: (session) => this.reloadSessionRuntime(session),
             getSessionTree: (session) => {
-                if (typeof session.sessionManager.getTree !== "function" || typeof session.navigateTree !== "function")
+                if (typeof session.sessionManager.getTree !== "function" ||
+                    typeof session.navigateTree !== "function")
                     return undefined;
                 return projectSessionTree(session.sessionManager.getTree(), session.sessionManager.getLeafId());
             },
@@ -413,47 +577,58 @@ export class PiSessionService {
         return previewResponseFromPlan(await this.cleanupPlan(request));
     }
     async cleanup(request) {
-        const plan = await this.cleanupPlan(request);
-        if (plan.deleteRecords.length > 0 && this.archiveStore.deleteArchived === undefined && this.archiveStore.deleteArchivedMany === undefined)
-            throw new Error("Archive store does not support deletion");
-        const archiveInputs = [];
-        const readyArchiveInputs = [];
-        const deleteRecords = [];
-        const readyDeleteRecords = [];
-        const skippedBusySessionIds = new Set(plan.skippedBusySessionIds);
-        for (const input of plan.archiveInputs) {
-            if (this.activeSessionHasWork(input.sessionId)) {
-                skippedBusySessionIds.add(input.sessionId);
-                continue;
+        return await this.runSessionOrderMutation(async () => {
+            const plan = await this.cleanupPlan(request);
+            if (plan.deleteRecords.length > 0 &&
+                this.archiveStore.deleteArchived === undefined &&
+                this.archiveStore.deleteArchivedMany === undefined)
+                throw new Error("Archive store does not support deletion");
+            const archiveInputs = [];
+            const readyArchiveInputs = [];
+            const deleteRecords = [];
+            const readyDeleteRecords = [];
+            const skippedBusySessionIds = new Set(plan.skippedBusySessionIds);
+            for (const input of plan.archiveInputs) {
+                if (this.activeSessionHasWork(input.sessionId)) {
+                    skippedBusySessionIds.add(input.sessionId);
+                    continue;
+                }
+                await this.closeActive(input.sessionId, {
+                    kind: "clear",
+                    reason: "archive",
+                });
+                readyArchiveInputs.push(input);
             }
-            await this.closeActive(input.sessionId, { kind: "clear", reason: "archive" });
-            readyArchiveInputs.push(input);
-        }
-        await this.archiveStoreArchiveMany(readyArchiveInputs);
-        archiveInputs.push(...readyArchiveInputs);
-        await this.forgetUnreadSessions(readyArchiveInputs);
-        for (const record of plan.deleteRecords) {
-            if (this.activeSessionHasWork(record.sessionId)) {
-                skippedBusySessionIds.add(record.sessionId);
-                continue;
+            await this.archiveStoreArchiveMany(readyArchiveInputs);
+            archiveInputs.push(...readyArchiveInputs);
+            await this.forgetUnreadSessions(readyArchiveInputs);
+            for (const record of plan.deleteRecords) {
+                if (this.activeSessionHasWork(record.sessionId)) {
+                    skippedBusySessionIds.add(record.sessionId);
+                    continue;
+                }
+                await this.closeActive(record.sessionId, {
+                    kind: "clear",
+                    reason: "delete",
+                });
+                readyDeleteRecords.push(record);
             }
-            await this.closeActive(record.sessionId, { kind: "clear", reason: "delete" });
-            readyDeleteRecords.push(record);
-        }
-        await this.ensureArchivedRecordsMoved(readyDeleteRecords);
-        const deletedSessionIds = new Set(await this.archiveStoreDeleteArchivedMany(readyDeleteRecords.map((record) => record.sessionId)));
-        deleteRecords.push(...readyDeleteRecords.filter((record) => deletedSessionIds.has(record.sessionId)));
-        await this.forgetUnreadSessions(deleteRecords);
-        return summarizeSessionCleanupExecution({
-            archiveInputs,
-            deleteRecords,
-            thresholds: plan.thresholds,
-            generatedAt: plan.generatedAt,
-            skippedBusySessionIds: [...skippedBusySessionIds],
+            await this.ensureArchivedRecordsMoved(readyDeleteRecords);
+            const deletedSessionIds = new Set(await this.archiveStoreDeleteArchivedMany(readyDeleteRecords.map((record) => record.sessionId)));
+            deleteRecords.push(...readyDeleteRecords.filter((record) => deletedSessionIds.has(record.sessionId)));
+            await this.forgetUnreadSessions(deleteRecords);
+            return summarizeSessionCleanupExecution({
+                archiveInputs,
+                deleteRecords,
+                thresholds: plan.thresholds,
+                generatedAt: plan.generatedAt,
+                skippedBusySessionIds: [...skippedBusySessionIds],
+            });
         });
     }
     async forceCleanup() {
-        if (this.archiveStore.deleteArchived === undefined && this.archiveStore.deleteArchivedMany === undefined)
+        if (this.archiveStore.deleteArchived === undefined &&
+            this.archiveStore.deleteArchivedMany === undefined)
             throw new Error("Archive store does not support deletion");
         const archivedRecords = await this.archiveStore.list();
         const plan = planForceCleanup({
@@ -468,7 +643,10 @@ export class PiSessionService {
                 skippedBusySessionIds.add(record.sessionId);
                 continue;
             }
-            await this.closeActive(record.sessionId, { kind: "clear", reason: "delete" });
+            await this.closeActive(record.sessionId, {
+                kind: "clear",
+                reason: "delete",
+            });
             readyDeleteRecords.push(record);
         }
         await this.ensureArchivedRecordsMoved(readyDeleteRecords);
@@ -496,6 +674,9 @@ export class PiSessionService {
         this.pendingSessionOpens.clear();
         this.activities.clear();
         this.compactionPromptQueues.clear();
+        this.modelPolicyRuntimeBlocks.clear();
+        this.modelPolicyMutationCounts.clear();
+        this.modelPolicyConfirmedSelections.clear();
         this.authLossWarnings.clear();
         this.subsessionParents.clear();
         this.subsessionChildren.clear();
@@ -517,12 +698,68 @@ export class PiSessionService {
         await this.publishUnreadMutations([]);
     }
     async list(cwd) {
-        const [sessions, archivedRecords, pinnedPaths] = await Promise.all([
+        const [sessions, archivedRecords, metadata] = await Promise.all([
             this.sessionManager.list(cwd),
             this.archiveStore.list(),
-            this.metadataStore.pinnedPaths(),
+            this.metadataStore.snapshot(),
+        ]);
+        return this.listFromSnapshots(cwd, sessions, archivedRecords, metadata);
+    }
+    /**
+     * Run `operation` inside the exclusive ordering queue shared by every
+     * mutation that can change sibling membership, pin state, or
+     * current/archive membership, so reorder's before/after catalog reads
+     * never interleave with a concurrent pin, detach, archive, or restore.
+     */
+    async runSessionOrderMutation(operation) {
+        const previous = this.sessionOrderMutationQueue;
+        let release = () => undefined;
+        this.sessionOrderMutationQueue = new Promise((resolve) => { release = resolve; });
+        await previous.catch(() => undefined);
+        try {
+            return await operation();
+        }
+        finally {
+            release();
+        }
+    }
+    async reorder(ref, request) {
+        return await this.runSessionOrderMutation(async () => {
+            const target = { id: ref.id, cwd: canonicalizeStoredCwd(ref.cwd) };
+            const before = await this.listReorderCatalog(request.catalogCwds);
+            const validated = validateSessionReorder(target, request, uniqueSessionsByIdentity(before));
+            try {
+                await this.metadataStore.replaceOrder(validated.sessionPaths, request.scope, request.pinned);
+            }
+            catch (error) {
+                if (error instanceof SessionMetadataOrderConflictError) {
+                    throw new SessionReorderDomainError("conflict", error.message);
+                }
+                throw error;
+            }
+            const after = await this.listReorderCatalog(request.catalogCwds);
+            assertSubmittedSessionsCurrent(target, request, uniqueSessionsByIdentity(after));
+            return validated.response;
+        });
+    }
+    /**
+     * Read one coherent metadata/archive view across every requested CWD.
+     * Gateway session-list reads run in parallel per CWD, but the metadata and
+     * archive snapshots are each taken exactly once for the whole call, so the
+     * result is one atomic before/after catalog rather than one per CWD.
+     */
+    async listReorderCatalog(cwds) {
+        const metadataPromise = this.metadataStore.snapshot();
+        const archivePromise = this.archiveStore.list();
+        const sessionListsPromise = Promise.all(cwds.map((cwd) => this.sessionManager.list(cwd)));
+        const [metadata, archivedRecords, sessionLists] = await Promise.all([
+            metadataPromise,
+            archivePromise,
+            sessionListsPromise,
         ]);
-        const pinnedPathSet = new Set(pinnedPaths);
+        return (await Promise.all(cwds.map((cwd, index) => this.listFromSnapshots(cwd, sessionLists[index] ?? [], archivedRecords, metadata)))).flat();
+    }
+    async listFromSnapshots(cwd, sessions, archivedRecords, metadata) {
         const sessionsById = new Map(sessions.map((session) => [session.id, session]));
         const archivedForCwd = await Promise.all(archivedRecords
             .filter((record) => record.cwd === cwd)
@@ -533,7 +770,7 @@ export class PiSessionService {
         }
         const unarchivedSessions = sessions
             .filter((session) => !archivedById.has(session.id))
-            .map((entry) => mergeSessionMetadata(clientSessionFromListEntry(entry), pinnedPathSet));
+            .map((entry) => mergeSessionMetadata(clientSessionFromListEntry(entry), metadata));
         const reconcilableSessionIds = this.reconcilableSessionIds(cwd, unarchivedSessions.map((session) => session.id), archivedById);
         this.workspaceActivity?.reconcileSessionActivity(cwd, reconcilableSessionIds);
         await this.publishUnreadMutations(this.unreadStore.reconcileCwd(canonicalizeStoredCwd(cwd), reconcilableSessionIds));
@@ -541,17 +778,31 @@ export class PiSessionService {
             .sort(compareArchivedRecords)
             .map((record) => clientSessionFromArchivedRecord(record, sessionsById.get(record.sessionId)))
             .filter(isDefined)
-            .map((session) => mergeSessionMetadata(session, pinnedPathSet));
+            .map((session) => mergeSessionMetadata(session, metadata));
         return [...unarchivedSessions, ...archivedSessions];
     }
-    async start(cwd, options = {}) {
-        return this.startSession(cwd, options);
+    async start(cwd, options) {
+        const modelPolicy = options?.modelPolicy;
+        return this.startSession(cwd, {
+            initializeModelPolicy: modelPolicy ?? true,
+        });
     }
     async startSession(cwd, options) {
-        const active = await this.create(this.sessionManager.create(cwd, options.parentSession === undefined ? undefined : { parentSession: options.parentSession }), cwd, {
-            ...(options.initialModel === undefined ? {} : { initialModel: options.initialModel }),
-            ...(options.initialThinkingLevel === undefined ? {} : { initialThinkingLevel: options.initialThinkingLevel }),
-            ...(options.creationProvenance === undefined ? {} : { creationProvenance: options.creationProvenance }),
+        const active = await this.create(this.sessionManager.create(cwd, options.parentSession === undefined
+            ? undefined
+            : { parentSession: options.parentSession }), cwd, {
+            ...(options.initialModel === undefined
+                ? {}
+                : { initialModel: options.initialModel }),
+            ...(options.initialThinkingLevel === undefined
+                ? {}
+                : { initialThinkingLevel: options.initialThinkingLevel }),
+            ...(options.creationProvenance === undefined
+                ? {}
+                : { creationProvenance: options.creationProvenance }),
+            ...(options.initializeModelPolicy === undefined
+                ? {}
+                : { initializeModelPolicy: options.initializeModelPolicy }),
         });
         const { session } = active.runtime;
         const created = {
@@ -565,7 +816,9 @@ export class PiSessionService {
             firstMessage: "",
             // Include the parent so listeners can nest the new session in the tree
             // immediately, instead of showing it flat until the next reload.
-            ...(options.parentSession === undefined ? {} : { parentSessionPath: options.parentSession }),
+            ...(options.parentSession === undefined
+                ? {}
+                : { parentSessionPath: options.parentSession }),
         };
         // Broadcast so other clients (and the spawning agent's UI) can add the new
         // session to their list without a manual reload.
@@ -583,9 +836,14 @@ export class PiSessionService {
         const decision = await this.spawnTargets.resolveSpawnTarget(input.spawningCwd, input.cwd);
         if (!decision.allowed)
             throw spawnTargetError(decision);
-        const created = await this.start(decision.cwd, input.model === undefined ? {} : { initialModel: input.model });
+        const created = await this.startSession(decision.cwd, input.model === undefined ? {} : { initialModel: input.model });
         await this.prompt(created.id, input.prompt);
-        this.logger.info({ spawningCwd: input.spawningCwd, sessionId: created.id, cwd: decision.cwd, promptLength: input.prompt.length }, "spawn_session started a new session");
+        this.logger.info({
+            spawningCwd: input.spawningCwd,
+            sessionId: created.id,
+            cwd: decision.cwd,
+            promptLength: input.prompt.length,
+        }, "spawn_session started a new session");
         return { sessionId: created.id, cwd: decision.cwd };
     }
     /**
@@ -603,9 +861,9 @@ export class PiSessionService {
         let initialModel = input.model;
         let initialThinkingLevel;
         if (input.tier !== undefined) {
-            const echoedTier = leadingTierDirective(input.prompt);
+            const echoedTier = leadingTierEcho(input.prompt);
             if (echoedTier !== undefined && echoedTier !== input.tier) {
-                throw new Error(`Leading tier directive /tier-${echoedTier} disagrees with typed tier ${input.tier}`);
+                throw new Error(`Leading Model tier: ${echoedTier} label disagrees with typed tier ${input.tier}`);
             }
             const resolved = this.modelTierRegistry.resolve(input.tier);
             if (!isKnownThinkingLevel(resolved.thinkingLevel)) {
@@ -615,7 +873,9 @@ export class PiSessionService {
             initialThinkingLevel = resolved.thinkingLevel;
         }
         const created = await this.startSession(decision.cwd, {
-            ...(input.parentSessionFile === undefined ? {} : { parentSession: input.parentSessionFile }),
+            ...(input.parentSessionFile === undefined
+                ? {}
+                : { parentSession: input.parentSessionFile }),
             ...(initialModel === undefined ? {} : { initialModel }),
             ...(initialThinkingLevel === undefined ? {} : { initialThinkingLevel }),
             creationProvenance: "tracked-subsession",
@@ -632,7 +892,12 @@ export class PiSessionService {
         this.persistSubsessionLink(link);
         this.persistSubsessionChildMarker(input.parentSessionId, created.id);
         await this.prompt(created.id, input.prompt);
-        this.logger.info({ parentSessionId: input.parentSessionId, sessionId: created.id, cwd: decision.cwd, promptLength: input.prompt.length }, "spawn_subsession started a tracked child session");
+        this.logger.info({
+            parentSessionId: input.parentSessionId,
+            sessionId: created.id,
+            cwd: decision.cwd,
+            promptLength: input.prompt.length,
+        }, "spawn_subsession started a tracked child session");
         return { sessionId: created.id, cwd: decision.cwd };
     }
     /** Summaries of the tracked subsessions spawned by `parentSessionId`. */
@@ -643,7 +908,10 @@ export class PiSessionService {
         if (childIds === undefined)
             return [];
         const authorizedChildIds = [...childIds].filter((childId) => this.subsessionLinkBelongsToParent(parentSessionId, parentFile, childId));
-        return Promise.all(authorizedChildIds.map(async (childId) => ({ sessionId: childId, ...(await this.subsessionSummaryFields(childId)) })));
+        return Promise.all(authorizedChildIds.map(async (childId) => ({
+            sessionId: childId,
+            ...(await this.subsessionSummaryFields(childId)),
+        })));
     }
     /** Status and final result of a subsession, scoped to the caller's children. */
     async checkSubsession(parentSessionId, sessionId, parentSessionFile) {
@@ -672,7 +940,8 @@ export class PiSessionService {
     async openSubsession(parentSessionId, sessionId, parentSessionFile) {
         const parentFile = nonEmptyString(parentSessionFile);
         await this.hydrateSubsessionsForParent(parentSessionId, parentFile);
-        if (this.subsessionParents.get(sessionId) !== parentSessionId || !this.subsessionLinkBelongsToParent(parentSessionId, parentFile, sessionId)) {
+        if (this.subsessionParents.get(sessionId) !== parentSessionId ||
+            !this.subsessionLinkBelongsToParent(parentSessionId, parentFile, sessionId)) {
             throw new Error(`Session ${sessionId} is not one of your subsessions`);
         }
         return this.getOrOpenTrackedSubsession(sessionId);
@@ -681,19 +950,24 @@ export class PiSessionService {
         const link = this.subsessionLinks.get(childSessionId);
         if (link?.parentSessionId !== parentSessionId)
             return false;
-        return parentSessionFile === undefined || trackedLinkParentFileMatches(link, parentSessionFile);
+        return (parentSessionFile === undefined ||
+            trackedLinkParentFileMatches(link, parentSessionFile));
     }
     activeChildForSubsessionLink(link) {
         const active = this.active.get(link.childSessionId);
         if (active === undefined)
             return undefined;
-        return activeSessionFileMatches(active, link.childSessionFile) ? active : undefined;
+        return activeSessionFileMatches(active, link.childSessionFile)
+            ? active
+            : undefined;
     }
     activeParentForSubsessionLink(link) {
         const active = this.active.get(link.parentSessionId);
         if (active === undefined)
             return undefined;
-        return activeSessionFileMatches(active, link.parentSessionFile) ? active : undefined;
+        return activeSessionFileMatches(active, link.parentSessionFile)
+            ? active
+            : undefined;
     }
     subsessionLinkForActiveChild(session) {
         const childId = session.sessionId;
@@ -701,12 +975,15 @@ export class PiSessionService {
         const link = this.subsessionLinks.get(childId);
         if (parentId === undefined || link?.parentSessionId !== parentId)
             return undefined;
-        return sessionFileMatches(session, link.childSessionFile) ? link : undefined;
+        return sessionFileMatches(session, link.childSessionFile)
+            ? link
+            : undefined;
     }
     async registerVerifiedSubsession(link) {
         const { childSessionId, parentSessionId } = link;
         const previousParentId = this.subsessionParents.get(childSessionId);
-        if (previousParentId !== undefined && previousParentId !== parentSessionId) {
+        if (previousParentId !== undefined &&
+            previousParentId !== parentSessionId) {
             const previousChildren = this.subsessionChildren.get(previousParentId);
             previousChildren?.delete(childSessionId);
             if (previousChildren?.size === 0)
@@ -760,7 +1037,11 @@ export class PiSessionService {
             parent.sessionManager.appendCustomEntry(SUBSESSION_LINK_CUSTOM_TYPE, persistedParentSubsessionLinkData(link));
         }
         catch (error) {
-            this.logger.info({ parentSessionId: link.parentSessionId, sessionId: link.childSessionId, error: error instanceof Error ? error.message : String(error) }, "failed to persist subsession link");
+            this.logger.info({
+                parentSessionId: link.parentSessionId,
+                sessionId: link.childSessionId,
+                error: error instanceof Error ? error.message : String(error),
+            }, "failed to persist subsession link");
         }
     }
     persistSubsessionChildMarker(parentSessionId, childSessionId) {
@@ -773,7 +1054,11 @@ export class PiSessionService {
             child.sessionManager.appendCustomEntry(SUBSESSION_CHILD_LINK_CUSTOM_TYPE, persistedChildSubsessionLinkData(parentSessionId, childSessionId));
         }
         catch (error) {
-            this.logger.info({ parentSessionId, sessionId: childSessionId, error: error instanceof Error ? error.message : String(error) }, "failed to persist subsession child marker");
+            this.logger.info({
+                parentSessionId,
+                sessionId: childSessionId,
+                error: error instanceof Error ? error.message : String(error),
+            }, "failed to persist subsession child marker");
         }
     }
     async hydrateSubsessionsForParent(parentSessionId, parentSessionFile) {
@@ -781,7 +1066,9 @@ export class PiSessionService {
         if (this.subsessionHydratedParents.has(hydrationKey))
             return;
         const activeParent = this.active.get(parentSessionId);
-        if (activeParent !== undefined && (parentSessionFile === undefined || activeSessionFileMatches(activeParent, parentSessionFile))) {
+        if (activeParent !== undefined &&
+            (parentSessionFile === undefined ||
+                activeSessionFileMatches(activeParent, parentSessionFile))) {
             const activeParentFile = nonEmptyString(activeParent.runtime.session.sessionFile);
             const complete = await this.registerPersistedSubsessionLinks(parentSessionId, activeParent.runtime.session.sessionManager, activeParentFile);
             if (complete)
@@ -790,7 +1077,8 @@ export class PiSessionService {
         }
         if (parentSessionFile === undefined)
             return;
-        if ((await readSessionHeaderSummary(parentSessionFile))?.id !== parentSessionId)
+        if ((await readSessionHeaderSummary(parentSessionFile))?.id !==
+            parentSessionId)
             return;
         let parentManager;
         try {
@@ -832,8 +1120,11 @@ export class PiSessionService {
         return trackedSubsessionLinkFromParentLink(parentSessionId, link, parentSessionFile);
     }
     async parentLinkHasValidChildTarget(parentSessionFile, link) {
-        return link.spawnedSessionFile !== undefined
-            && await sessionFileHeaderMatches(link.spawnedSessionFile, { sessionId: link.spawnedSessionId, parentSessionFile });
+        return (link.spawnedSessionFile !== undefined &&
+            (await sessionFileHeaderMatches(link.spawnedSessionFile, {
+                sessionId: link.spawnedSessionId,
+                parentSessionFile,
+            })));
     }
     async recoverSubsessionTrackingForOpenedSession(session) {
         const link = await this.verifiedSubsessionLinkFromOpenedChild(session);
@@ -857,7 +1148,10 @@ export class PiSessionService {
         if (active !== undefined)
             return active.runtime.session;
         if (link.childSessionFile !== undefined) {
-            if (!(await sessionFileHeaderMatches(link.childSessionFile, { sessionId, parentSessionFile: link.parentSessionFile })))
+            if (!(await sessionFileHeaderMatches(link.childSessionFile, {
+                sessionId,
+                parentSessionFile: link.parentSessionFile,
+            })))
                 throw new Error("Session not found");
             const sessionManager = this.sessionManager.open(link.childSessionFile);
             return (await this.create(sessionManager, link.cwd ?? sessionManager.getCwd())).runtime.session;
@@ -868,9 +1162,16 @@ export class PiSessionService {
         const link = this.subsessionLinks.get(childSessionId);
         const active = link === undefined ? undefined : this.activeChildForSubsessionLink(link);
         if (active !== undefined) {
-            return { cwd: active.runtime.cwd, status: this.subsessionStatus(active.runtime.session) };
+            return {
+                cwd: active.runtime.cwd,
+                status: this.subsessionStatus(active.runtime.session),
+            };
         }
-        if (link?.childSessionFile !== undefined && (await sessionFileHeaderMatches(link.childSessionFile, { sessionId: childSessionId, parentSessionFile: link.parentSessionFile }))) {
+        if (link?.childSessionFile !== undefined &&
+            (await sessionFileHeaderMatches(link.childSessionFile, {
+                sessionId: childSessionId,
+                parentSessionFile: link.parentSessionFile,
+            }))) {
             return { cwd: link.cwd ?? "", status: "idle" };
         }
         if (link?.cwd !== undefined)
@@ -890,7 +1191,9 @@ export class PiSessionService {
             return [];
         return [...childIds].filter((childId) => {
             const link = this.subsessionLinks.get(childId);
-            const active = link === undefined ? undefined : this.activeChildForSubsessionLink(link);
+            const active = link === undefined
+                ? undefined
+                : this.activeChildForSubsessionLink(link);
             return active !== undefined && this.hasActiveWork(active.runtime.session);
         });
     }
@@ -932,11 +1235,13 @@ export class PiSessionService {
         const parentSessionFile = link.parentSessionFile;
         if (parentSessionFile === undefined)
             throw new Error(`Parent session ${parentSessionId} is not available for subsession notification`);
-        if ((await readSessionHeaderSummary(parentSessionFile))?.id !== parentSessionId) {
+        if ((await readSessionHeaderSummary(parentSessionFile))?.id !==
+            parentSessionId) {
             throw new Error(`Parent session ${parentSessionId} is not available for subsession notification`);
         }
         const sessionManager = this.sessionManager.open(parentSessionFile);
-        return (await this.create(sessionManager, sessionManager.getCwd())).runtime.session;
+        return (await this.create(sessionManager, sessionManager.getCwd())).runtime
+            .session;
     }
     /**
      * Deliver a subsession-completion notice to the parent as a system-authored
@@ -954,18 +1259,31 @@ export class PiSessionService {
                 this.deferredSubsessionNotifications.set(session, pending);
                 return;
             }
-            await this.deliverSubsessionNotification(session, { parentId, childId, text });
+            await this.deliverSubsessionNotification(session, {
+                parentId,
+                childId,
+                text,
+            });
         }
         catch (error) {
             this.logSubsessionNotificationFailure(parentId, childId, error);
         }
     }
     async deliverSubsessionNotification(session, notification) {
-        await this.runSessionEntryMutation(session, "deliver a subsession notification", () => session.sendCustomMessage({ customType: SUBSESSION_NOTIFICATION_CUSTOM_TYPE, content: notification.text, display: true, details: { sessionId: notification.childId } }, { triggerTurn: true, deliverAs: "followUp" }));
+        await this.runSessionEntryMutation(session, "deliver a subsession notification", () => session.sendCustomMessage({
+            customType: SUBSESSION_NOTIFICATION_CUSTOM_TYPE,
+            content: notification.text,
+            display: true,
+            details: { sessionId: notification.childId },
+        }, { triggerTurn: true, deliverAs: "followUp" }));
         this.publishStatus(session);
     }
     logSubsessionNotificationFailure(parentId, childId, error) {
-        this.logger.info({ parentSessionId: parentId, sessionId: childId, error: error instanceof Error ? error.message : String(error) }, "failed to notify parent of subsession completion");
+        this.logger.info({
+            parentSessionId: parentId,
+            sessionId: childId,
+            error: error instanceof Error ? error.message : String(error),
+        }, "failed to notify parent of subsession completion");
     }
     async exportHistory(ref) {
         return exportSessionHistoryHtml(await this.sessionFileForHistory(ref));
@@ -977,6 +1295,43 @@ export class PiSessionService {
     async status(ref) {
         return this.statusFromSession(await this.getOrOpen(ref));
     }
+    async modelPolicy(ref) {
+        const session = await this.getOrOpen(ref);
+        const inspection = this.inspectAndCacheSessionModelPolicy(session);
+        return {
+            contractVersion: 1,
+            ...(inspection.kind === "invalid" ? {} : { policy: inspection.policy }),
+            session: this.statusFromSession(session),
+        };
+    }
+    /**
+     * The only interface that changes a session's Exact/Tiered policy. Applies one
+     * complete transition atomically and publishes a single confirmed status; a
+     * corrupt newest entry is repaired only by the explicit update supplied here,
+     * never executed as a silent fallback. A transition that fails after the plan
+     * is resolved publishes one error/blocked status before the route error, so
+     * other clients learn the session refused the change.
+     */
+    async setModelPolicy(ref, update) {
+        const action = "change the session model policy";
+        await this.assertWritable(ref);
+        const session = await this.getOrOpen(ref);
+        this.assertModelPolicyMutationIdle(session, action);
+        const inspection = this.inspectAndCacheSessionModelPolicy(session);
+        // A malformed newest entry contributes only a starting exact branch for the
+        // new explicit entry; it is never treated as an executable current policy.
+        const current = inspection.kind === "invalid" ? inspection.fallback : inspection.policy;
+        const policy = await this.applySessionModelPolicy(session, current, update, {
+            action,
+            onTransitionFailure: (reason) => {
+                this.publishModelPolicyTransitionFailure(session, reason);
+            },
+        });
+        const resolved = this.exactSelectionFromSession(session);
+        this.publishActivity(session, `model policy: ${policy.mode}`, "idle", policy.mode === "tiered" ? policy.tier : resolved.model.id);
+        this.publishStatus(session);
+        return this.modelPolicy(ref);
+    }
     async systemPrompt(ref) {
         const systemPrompt = (await this.getOrOpen(ref)).state.systemPrompt;
         return systemPrompt === undefined ? {} : { systemPrompt };
@@ -1011,17 +1366,16 @@ export class PiSessionService {
     async setModel(ref, provider, modelId) {
         await this.assertWritable(ref);
         const session = await this.getOrOpen(ref);
-        this.assertTreeNavigationInactive(session, "change models");
+        const currentPolicy = this.assertExactModelPolicyMutationAllowed(session, "change models");
         await session.modelRuntime.refresh({ allowNetwork: false });
-        this.assertTreeNavigationInactive(session, "change models");
+        this.assertModelPolicyMutationIdle(session, "change models");
         const candidates = session.scopedModels.length > 0
             ? session.scopedModels.map((scoped) => scoped.model)
             : session.modelRuntime.getAvailableSnapshot();
-        const model = candidates.find((candidate) => candidate.provider === provider && candidate.id === modelId)
-            ?? session.modelRuntime.getModel(provider, modelId);
+        const model = candidates.find((candidate) => candidate.provider === provider && candidate.id === modelId) ?? session.modelRuntime.getModel(provider, modelId);
         if (model === undefined)
             throw new Error(`Model not found: ${provider}/${modelId}`);
-        await this.runSessionEntryMutation(session, "change models", () => session.setModel(model));
+        await this.runExactModelPolicyMutation(session, "change models", currentPolicy, () => session.setModel(model));
         this.publishActivity(session, `model: ${model.id}`, "idle", model.provider);
         this.publishStatus(session);
         return this.statusFromSession(session);
@@ -1029,9 +1383,16 @@ export class PiSessionService {
     async cycleModel(ref, direction) {
         await this.assertWritable(ref);
         const session = await this.getOrOpen(ref);
-        const result = await this.runSessionEntryMutation(session, "change models", () => session.cycleModel(direction));
-        if (result === undefined)
-            throw new Error(session.scopedModels.length > 0 ? "Only one model in scope" : "Only one model available");
+        const currentPolicy = this.assertExactModelPolicyMutationAllowed(session, "change models");
+        const result = await this.runExactModelPolicyMutation(session, "change models", currentPolicy, async () => {
+            const cycled = await session.cycleModel(direction);
+            if (cycled === undefined) {
+                throw new Error(session.scopedModels.length > 0
+                    ? "Only one model in scope"
+                    : "Only one model available");
+            }
+            return cycled;
+        });
         this.publishActivity(session, `model: ${result.model.id}`, "idle", result.model.provider);
         this.publishStatus(session);
         return this.statusFromSession(session);
@@ -1043,14 +1404,17 @@ export class PiSessionService {
     async setThinkingLevel(ref, level) {
         await this.assertWritable(ref);
         const session = await this.getOrOpen(ref);
-        this.assertTreeNavigationInactive(session, "change the thinking level");
+        const currentPolicy = this.assertExactModelPolicyMutationAllowed(session, "change the thinking level");
         // pi owns the valid set; validate against the session's live levels rather
         // than a hardcoded union so this stays correct if pi changes the set.
         const available = session.getAvailableThinkingLevels();
         const match = available.find((candidate) => candidate === level);
         if (match === undefined)
             throw new Error(`Invalid thinking level: ${level}`);
-        session.setThinkingLevel(match);
+        await this.runExactModelPolicyMutation(session, "change the thinking level", currentPolicy, () => {
+            session.setThinkingLevel(match);
+            return Promise.resolve();
+        });
         this.publishActivity(session, `thinking: ${session.thinkingLevel}`, "idle");
         this.publishStatus(session);
         return this.statusFromSession(session);
@@ -1058,10 +1422,13 @@ export class PiSessionService {
     async cycleThinkingLevel(ref) {
         await this.assertWritable(ref);
         const session = await this.getOrOpen(ref);
-        this.assertTreeNavigationInactive(session, "change the thinking level");
-        const level = session.cycleThinkingLevel();
-        if (level === undefined)
-            throw new Error("Current model does not support thinking");
+        const currentPolicy = this.assertExactModelPolicyMutationAllowed(session, "change the thinking level");
+        const level = await this.runExactModelPolicyMutation(session, "change the thinking level", currentPolicy, () => {
+            const cycled = session.cycleThinkingLevel();
+            if (cycled === undefined)
+                throw new Error("Current model does not support thinking");
+            return Promise.resolve(cycled);
+        });
         this.publishActivity(session, `thinking: ${level}`, "idle");
         this.publishStatus(session);
         return this.statusFromSession(session);
@@ -1070,13 +1437,31 @@ export class PiSessionService {
         const session = await this.getOrOpen(ref);
         const commands = [...BUILTIN_COMMANDS];
         for (const command of session.extensionRunner.getRegisteredCommands()) {
-            commands.push({ name: command.invocationName, ...(command.description === undefined ? {} : { description: command.description }), source: "extension" });
+            commands.push({
+                name: command.invocationName,
+                ...(command.description === undefined
+                    ? {}
+                    : { description: command.description }),
+                source: "extension",
+            });
         }
         for (const template of session.promptTemplates) {
-            commands.push({ name: template.name, ...(template.description === undefined ? {} : { description: template.description }), source: "prompt" });
+            commands.push({
+                name: template.name,
+                ...(template.description === undefined
+                    ? {}
+                    : { description: template.description }),
+                source: "prompt",
+            });
         }
         for (const skill of session.resourceLoader.getSkills().skills) {
-            commands.push({ name: `skill:${skill.name}`, ...(skill.description === undefined ? {} : { description: skill.description }), source: "skill" });
+            commands.push({
+                name: `skill:${skill.name}`,
+                ...(skill.description === undefined
+                    ? {}
+                    : { description: skill.description }),
+                source: "skill",
+            });
         }
         return commands.sort((a, b) => a.name.localeCompare(b.name));
     }
@@ -1088,15 +1473,20 @@ export class PiSessionService {
         // as a transient line that vanishes on reload.
         const echoUserMessage = options?.echoUserMessage !== false;
         const requestedBehavior = parsePromptStreamingBehavior(streamingBehavior);
-        const parsedAttachments = parsePromptAttachments(attachments, { enforceInlineSizeLimit: false });
+        const parsedAttachments = parsePromptAttachments(attachments, {
+            enforceInlineSizeLimit: false,
+        });
         const images = (await attachmentsToInlineImages(parsedAttachments)).map((entry) => entry.image);
         await this.assertWritable(ref);
         const session = await this.getOrOpen(ref);
         this.assertTreeNavigationInactive(session, "send a prompt");
+        this.assertPromptModelPolicyAllowed(session);
         this.maybeGenerateSessionName(session, promptText);
         const isQueued = session.isStreaming || session.isCompacting;
         const behavior = isQueued ? requestedBehavior ?? "followUp" : undefined;
-        if (isQueued && images.length === 0 && this.hasQueuedMessageText(session, promptText)) {
+        if (isQueued &&
+            images.length === 0 &&
+            this.hasQueuedMessageText(session, promptText)) {
             this.publishActivity(session, "duplicate queued message ignored", "active");
             this.publishStatus(session);
             return;
@@ -1105,30 +1495,95 @@ export class PiSessionService {
             this.enqueuePromptDuringCompaction(session, promptText, behavior ?? "followUp", images, echoUserMessage);
             return;
         }
+        if (this.isModelPolicyMutationActive(session)) {
+            this.retainPromptDuringModelPolicyMutation(session, promptText, behavior ?? "followUp", images, echoUserMessage);
+            return;
+        }
         void this.submitPrompt(session, promptText, behavior, images, echoUserMessage);
     }
     submitPrompt(session, text, behavior, images = [], echoUserMessage = true) {
-        this.publishActivity(session, behavior === "steer" ? "steering queued" : behavior === "followUp" ? "message queued" : "prompt accepted", "active");
+        // A policy transition may have opened while this prompt waited in the
+        // compaction queue. The runtime tuple is transient until the transition
+        // persists, so retain the input instead of reaching Pi with a partial pair.
+        if (this.isModelPolicyMutationActive(session)) {
+            this.retainPromptDuringModelPolicyMutation(session, text, behavior ?? "followUp", images, echoUserMessage, "front");
+            return Promise.resolve();
+        }
+        // Re-check before any activity publication or provider call: a prompt held
+        // in the compaction queue may have waited while the policy entry changed.
+        try {
+            this.assertPromptModelPolicyAllowed(session);
+        }
+        catch (error) {
+            const message = error instanceof Error ? error.message : String(error);
+            this.publishActivity(session, "error", "error", message);
+            this.events.publish(session.sessionId, {
+                type: "session.error",
+                message,
+            });
+            return Promise.resolve();
+        }
+        this.publishActivity(session, behavior === "steer"
+            ? "steering queued"
+            : behavior === "followUp"
+                ? "message queued"
+                : "prompt accepted", "active");
         if (behavior === undefined && echoUserMessage)
-            this.events.publish(session.sessionId, { type: "message.append", message: userMessage(text, images) });
+            this.events.publish(session.sessionId, {
+                type: "message.append",
+                message: userMessage(text, images),
+            });
         const promptOptions = buildPromptOptions(behavior, images);
         const promptPromise = this.runSessionEntryMutation(session, "send a prompt", () => session.prompt(text, promptOptions)).catch((error) => {
             const message = error instanceof Error ? error.message : String(error);
             this.publishActivity(session, "error", "error", message);
-            this.events.publish(session.sessionId, { type: "session.error", message });
+            this.events.publish(session.sessionId, {
+                type: "session.error",
+                message,
+            });
         });
         void promptPromise;
         return promptPromise;
     }
     enqueuePromptDuringCompaction(session, text, kind, images = [], echoUserMessage = true) {
         const queue = this.compactionPromptQueues.get(session.sessionId) ?? [];
-        queue.push({ kind, text, ...(images.length > 0 ? { images } : {}), ...(echoUserMessage ? {} : { echoUserMessage: false }) });
+        queue.push({
+            kind,
+            text,
+            ...(images.length > 0 ? { images } : {}),
+            ...(echoUserMessage ? {} : { echoUserMessage: false }),
+        });
         this.compactionPromptQueues.set(session.sessionId, queue);
         this.publishActivity(session, "message queued during compaction", "active");
         this.publishStatus(session);
     }
+    /**
+     * Hold prompt input for the duration of a policy transition, reusing the
+     * existing queue so the post-mutation drain submits it once the confirmed
+     * model/thinking pair is persisted. A prompt taken back out of the queue is
+     * re-retained at the front so relative order is preserved.
+     */
+    retainPromptDuringModelPolicyMutation(session, text, kind, images = [], echoUserMessage = true, position = "back") {
+        const queue = this.compactionPromptQueues.get(session.sessionId) ?? [];
+        const queued = {
+            kind,
+            text,
+            ...(images.length > 0 ? { images } : {}),
+            ...(echoUserMessage ? {} : { echoUserMessage: false }),
+        };
+        if (position === "front")
+            queue.unshift(queued);
+        else
+            queue.push(queued);
+        this.compactionPromptQueues.set(session.sessionId, queue);
+        this.publishActivity(session, "message queued during model policy change", "active");
+        this.publishStatus(session);
+    }
     async saveAttachments(ref, attachments, folder) {
-        const parsed = parsePromptAttachments(attachments, { enforceInlineSizeLimit: false, allowFileAttachments: true });
+        const parsed = parsePromptAttachments(attachments, {
+            enforceInlineSizeLimit: false,
+            allowFileAttachments: true,
+        });
         if (parsed.length === 0)
             return [];
         await this.assertWritable(ref);
@@ -1147,26 +1602,46 @@ export class PiSessionService {
         if (session.isBashRunning)
             throw new Error("A bash command is already running");
         this.publishActivity(session, "running bash", "active", command);
-        this.events.publish(session.sessionId, { type: "shell.start", command, excludeFromContext: isExcluded });
+        this.events.publish(session.sessionId, {
+            type: "shell.start",
+            command,
+            excludeFromContext: isExcluded,
+        });
         void this.runSessionEntryMutation(session, "run a shell command", () => session.executeBash(command, (chunk) => {
-            this.events.publish(session.sessionId, { type: "shell.chunk", chunk });
+            this.events.publish(session.sessionId, {
+                type: "shell.chunk",
+                chunk,
+            });
             this.publishActivity(session, "running bash", "active", command);
             this.publishStatus(session);
-        }, { excludeFromContext: isExcluded })).then((result) => {
+        }, { excludeFromContext: isExcluded }))
+            .then((result) => {
             this.events.publish(session.sessionId, {
                 type: "shell.end",
                 output: result.output,
-                ...(result.exitCode === undefined ? {} : { exitCode: result.exitCode }),
+                ...(result.exitCode === undefined
+                    ? {}
+                    : { exitCode: result.exitCode }),
                 cancelled: result.cancelled,
                 truncated: result.truncated,
-                ...(result.fullOutputPath === undefined ? {} : { fullOutputPath: result.fullOutputPath }),
+                ...(result.fullOutputPath === undefined
+                    ? {}
+                    : { fullOutputPath: result.fullOutputPath }),
             });
             this.publishActivity(session, "bash complete", result.exitCode === 0 ? "idle" : "error", command);
             this.publishStatus(session);
-        }).catch((error) => {
+        })
+            .catch((error) => {
             const message = error instanceof Error ? error.message : String(error);
-            this.events.publish(session.sessionId, { type: "shell.end", output: message, isError: true });
-            this.events.publish(session.sessionId, { type: "session.error", message });
+            this.events.publish(session.sessionId, {
+                type: "shell.end",
+                output: message,
+                isError: true,
+            });
+            this.events.publish(session.sessionId, {
+                type: "session.error",
+                message,
+            });
             this.publishActivity(session, "bash failed", "error", message);
             this.publishStatus(session);
         });
@@ -1198,7 +1673,13 @@ export class PiSessionService {
         await this.assertWritable(ref);
         const active = await this.getActive(ref);
         const sourceSession = active.runtime.session;
-        const result = await this.runTreeExclusiveOperation([{ sessionId: sourceSession.sessionId, session: sourceSession, runtime: active.runtime }], "Stop current session activity before replacing the session", () => active.runtime.fork(entryId));
+        const result = await this.runTreeExclusiveOperation([
+            {
+                sessionId: sourceSession.sessionId,
+                session: sourceSession,
+                runtime: active.runtime,
+            },
+        ], "Stop current session activity before replacing the session", () => active.runtime.fork(entryId));
         if (result.cancelled)
             return { cancelled: true };
         const session = clientSessionFromRuntime(active.runtime);
@@ -1221,7 +1702,8 @@ export class PiSessionService {
         // may enter this runtime until Pi's potentially asynchronous summary settles.
         this.treeNavigations.add(session);
         try {
-            if (expectedLeafId !== undefined && session.sessionManager.getLeafId() !== expectedLeafId) {
+            if (expectedLeafId !== undefined &&
+                session.sessionManager.getLeafId() !== expectedLeafId) {
                 throw new Error("The session changed since /tree was opened. Reopen /tree and try again.");
             }
             this.publishActivity(session, options.summarize ? "summarizing branch" : "navigating session tree", "active");
@@ -1229,19 +1711,32 @@ export class PiSessionService {
             const result = await session.navigateTree(targetId, options);
             if (result.cancelled) {
                 if (this.isCurrentActiveSession(session)) {
-                    this.publishActivity(session, result.aborted === true ? "branch summary aborted" : "tree navigation cancelled", "idle");
+                    this.publishActivity(session, result.aborted === true
+                        ? "branch summary aborted"
+                        : "tree navigation cancelled", "idle");
                 }
-                return { cancelled: true, ...(result.aborted === undefined ? {} : { aborted: result.aborted }) };
+                return {
+                    cancelled: true,
+                    ...(result.aborted === undefined ? {} : { aborted: result.aborted }),
+                };
             }
             if (this.isCurrentActiveSession(session))
                 this.publishActivity(session, "session tree navigated", "idle");
-            return { cancelled: false, ...(result.editorText === undefined ? {} : { editorText: result.editorText }) };
+            return {
+                cancelled: false,
+                ...(result.editorText === undefined
+                    ? {}
+                    : { editorText: result.editorText }),
+            };
         }
         catch (error) {
             const message = error instanceof Error ? error.message : String(error);
             if (this.isCurrentActiveSession(session)) {
                 this.publishActivity(session, "tree navigation failed", "error", message);
-                this.events.publish(session.sessionId, { type: "session.error", message });
+                this.events.publish(session.sessionId, {
+                    type: "session.error",
+                    message,
+                });
             }
             throw error;
         }
@@ -1265,13 +1760,16 @@ export class PiSessionService {
             const priorGeneration = this.notificationGenerationBySession.get(session);
             let candidateGeneration;
             try {
-                await session.reload(priorGeneration === undefined ? undefined : {
-                    beforeSessionStart: () => {
-                        candidateGeneration = this.notificationStore.beginReplacement(priorGeneration, notificationIdentityForSession(session));
-                        this.notificationGenerationBySession.set(session, candidateGeneration);
-                        this.replaceSessionNotificationContext(session, candidateGeneration);
-                    },
-                });
+                await session.reload(priorGeneration === undefined
+                    ? undefined
+                    : {
+                        beforeSessionStart: () => {
+                            candidateGeneration =
+                                this.notificationStore.beginReplacement(priorGeneration, notificationIdentityForSession(session));
+                            this.notificationGenerationBySession.set(session, candidateGeneration);
+                            this.replaceSessionNotificationContext(session, candidateGeneration);
+                        },
+                    });
                 if (candidateGeneration !== undefined) {
                     this.publishNotificationMutations(this.notificationStore.commitReplacement(candidateGeneration));
                 }
@@ -1285,141 +1783,191 @@ export class PiSessionService {
                 }
                 const message = error instanceof Error ? error.message : String(error);
                 this.publishActivity(session, "reload failed", "error", message);
-                this.events.publish(session.sessionId, { type: "session.error", message });
+                this.events.publish(session.sessionId, {
+                    type: "session.error",
+                    message,
+                });
                 this.publishStatus(session);
                 throw error;
             }
         });
     }
     async archive(ref) {
-        const session = await this.getOrOpen(ref);
-        if (this.hasActiveWork(session))
-            throw new Error("Stop current session activity before archiving");
-        await this.runTreeExclusiveOperation([{ sessionId: session.sessionId, session }], "Stop current session activity before archiving", async () => {
-            const archiveInput = await this.archiveInputForSession(session);
-            await this.closeActive(session.sessionId, { kind: "clear", reason: "archive" });
-            await this.archiveStore.archive(archiveInput);
-            await this.forgetUnreadSessions([archiveInput]);
+        await this.runSessionOrderMutation(async () => {
+            const session = await this.getOrOpen(ref);
+            if (this.hasActiveWork(session))
+                throw new Error("Stop current session activity before archiving");
+            await this.runTreeExclusiveOperation([{ sessionId: session.sessionId, session }], "Stop current session activity before archiving", async () => {
+                const archiveInput = await this.archiveInputForSession(session);
+                await this.closeActive(session.sessionId, {
+                    kind: "clear",
+                    reason: "archive",
+                });
+                await this.archiveStore.archive(archiveInput);
+                await this.forgetUnreadSessions([archiveInput]);
+            });
         });
     }
     async archiveMany(refs) {
-        const uniqueRefs = uniqueBulkSessionRefs(refs);
-        const [archivedRecords, sessionContext] = await Promise.all([
-            this.archiveStore.list(),
-            this.bulkSessionLookupContext(uniqueRefs),
-        ]);
-        const failures = [];
-        const alreadyArchivedSessionIds = [];
-        const unreadArchivedIdentities = [];
-        const planItems = [];
-        for (const ref of uniqueRefs) {
-            const archived = findArchivedRecordForBulkRef(archivedRecords, ref);
-            if (archived !== undefined) {
-                this.publishNotificationMutations(this.notificationStore.clearSession(archived.sessionId, "archive"));
-                alreadyArchivedSessionIds.push(archived.sessionId);
-                unreadArchivedIdentities.push(archived);
-                continue;
-            }
-            const active = this.activeForLookup(bulkRefToLookup(ref));
-            const listed = findListedSessionForBulkRef(sessionContext, ref);
-            const resolvedSessionId = active?.runtime.session.sessionId ?? listed?.id ?? ref.id;
-            if (active !== undefined && this.hasActiveWork(active.runtime.session)) {
-                failures.push({ sessionId: resolvedSessionId, error: "Stop current session activity before archiving" });
-                continue;
-            }
-            try {
-                if (listed !== undefined) {
-                    planItems.push({ input: archiveInputFromListEntry(listed) });
+        return await this.runSessionOrderMutation(async () => {
+            const uniqueRefs = uniqueBulkSessionRefs(refs);
+            const [archivedRecords, sessionContext] = await Promise.all([
+                this.archiveStore.list(),
+                this.bulkSessionLookupContext(uniqueRefs),
+            ]);
+            const failures = [];
+            const alreadyArchivedSessionIds = [];
+            const unreadArchivedIdentities = [];
+            const planItems = [];
+            for (const ref of uniqueRefs) {
+                const archived = findArchivedRecordForBulkRef(archivedRecords, ref);
+                if (archived !== undefined) {
+                    this.publishNotificationMutations(this.notificationStore.clearSession(archived.sessionId, "archive"));
+                    alreadyArchivedSessionIds.push(archived.sessionId);
+                    unreadArchivedIdentities.push(archived);
+                    continue;
                 }
-                else if (active !== undefined) {
-                    planItems.push({ input: archiveInputFromActiveSession(active.runtime.session) });
+                const active = this.activeForLookup(bulkRefToLookup(ref));
+                const listed = findListedSessionForBulkRef(sessionContext, ref);
+                const resolvedSessionId = active?.runtime.session.sessionId ?? listed?.id ?? ref.id;
+                if (active !== undefined && this.hasActiveWork(active.runtime.session)) {
+                    failures.push({
+                        sessionId: resolvedSessionId,
+                        error: "Stop current session activity before archiving",
+                    });
+                    continue;
                 }
-                else {
-                    failures.push({ sessionId: ref.id, error: "Session not found" });
+                try {
+                    if (listed !== undefined) {
+                        planItems.push({ input: archiveInputFromListEntry(listed) });
+                    }
+                    else if (active !== undefined) {
+                        planItems.push({
+                            input: archiveInputFromActiveSession(active.runtime.session),
+                        });
+                    }
+                    else {
+                        failures.push({ sessionId: ref.id, error: "Session not found" });
+                    }
+                }
+                catch (error) {
+                    failures.push({
+                        sessionId: resolvedSessionId,
+                        error: errorMessage(error),
+                    });
                 }
             }
-            catch (error) {
-                failures.push({ sessionId: resolvedSessionId, error: errorMessage(error) });
-            }
-        }
-        const readyPlanItems = [];
-        for (const item of planItems) {
-            const active = this.activeForLookup({ id: item.input.sessionId, cwd: item.input.cwd });
-            if (active !== undefined && this.hasActiveWork(active.runtime.session)) {
-                failures.push({ sessionId: item.input.sessionId, error: "Stop current session activity before archiving" });
-                continue;
+            const readyPlanItems = [];
+            for (const item of planItems) {
+                const active = this.activeForLookup({
+                    id: item.input.sessionId,
+                    cwd: item.input.cwd,
+                });
+                if (active !== undefined && this.hasActiveWork(active.runtime.session)) {
+                    failures.push({
+                        sessionId: item.input.sessionId,
+                        error: "Stop current session activity before archiving",
+                    });
+                    continue;
+                }
+                readyPlanItems.push(active === undefined ? item : { ...item, active });
             }
-            readyPlanItems.push(active === undefined ? item : { ...item, active });
-        }
-        const readyInputs = [];
-        const archivedSessionIds = [...alreadyArchivedSessionIds];
-        await this.runTreeExclusiveOperation(readyPlanItems.map(({ input, active }) => ({
-            sessionId: input.sessionId,
-            ...(active === undefined ? {} : { session: active.runtime.session, runtime: active.runtime }),
-        })), "Stop current session activity before archiving", async () => {
-            for (const item of readyPlanItems) {
+            const readyInputs = [];
+            const archivedSessionIds = [...alreadyArchivedSessionIds];
+            await this.runTreeExclusiveOperation(readyPlanItems.map(({ input, active }) => ({
+                sessionId: input.sessionId,
+                ...(active === undefined
+                    ? {}
+                    : { session: active.runtime.session, runtime: active.runtime }),
+            })), "Stop current session activity before archiving", async () => {
+                for (const item of readyPlanItems) {
+                    try {
+                        await this.closeActive(item.input.sessionId, {
+                            kind: "clear",
+                            reason: "archive",
+                        });
+                        readyInputs.push(item.input);
+                    }
+                    catch (error) {
+                        failures.push({
+                            sessionId: item.input.sessionId,
+                            error: errorMessage(error),
+                        });
+                    }
+                }
                 try {
-                    await this.closeActive(item.input.sessionId, { kind: "clear", reason: "archive" });
-                    readyInputs.push(item.input);
+                    const archived = await this.archiveStoreArchiveMany(readyInputs);
+                    archivedSessionIds.push(...archived.map((record) => record.sessionId));
+                    unreadArchivedIdentities.push(...archived);
                 }
                 catch (error) {
-                    failures.push({ sessionId: item.input.sessionId, error: errorMessage(error) });
+                    for (const input of readyInputs)
+                        failures.push({
+                            sessionId: input.sessionId,
+                            error: errorMessage(error),
+                        });
                 }
-            }
-            try {
-                const archived = await this.archiveStoreArchiveMany(readyInputs);
-                archivedSessionIds.push(...archived.map((record) => record.sessionId));
-                unreadArchivedIdentities.push(...archived);
-            }
-            catch (error) {
-                for (const input of readyInputs)
-                    failures.push({ sessionId: input.sessionId, error: errorMessage(error) });
-            }
+            });
+            await this.forgetUnreadSessions(unreadArchivedIdentities);
+            return {
+                archived: true,
+                archivedSessionIds: uniqueStrings(archivedSessionIds),
+                failures,
+                generatedAt: new Date().toISOString(),
+            };
         });
-        await this.forgetUnreadSessions(unreadArchivedIdentities);
-        return {
-            archived: true,
-            archivedSessionIds: uniqueStrings(archivedSessionIds),
-            failures,
-            generatedAt: new Date().toISOString(),
-        };
     }
     async archiveTree(ref) {
-        const session = await this.getOrOpen(ref);
-        const catalog = await this.workspaceArchiveCandidates(session.sessionManager.getCwd());
-        const root = findArchiveCandidateByIdOrPrefix(catalog, session.sessionId) ?? archiveCandidateFromActiveSession(session, false);
-        const plan = planSessionArchiveTree(root, catalog);
-        const busy = plan.targets.map((target) => target.activeSession).find((target) => target !== undefined && this.hasActiveWork(target));
-        if (busy !== undefined)
-            throw new Error(`Stop current session activity before archiving ${sessionDisplayName(busy)}`);
-        const archiveInputs = plan.unarchivedTargets.map((target) => archiveInputFromCandidate(target));
-        await this.runTreeExclusiveOperation(plan.unarchivedTargets.map((target) => ({
-            sessionId: target.id,
-            ...(target.activeSession === undefined ? {} : { session: target.activeSession }),
-        })), `Stop current session activity before archiving ${sessionDisplayName(session)}`, async () => {
-            for (const target of plan.targets) {
-                if (target.archived)
-                    this.publishNotificationMutations(this.notificationStore.clearSession(target.id, "archive"));
-            }
-            for (const input of archiveInputs)
-                await this.closeActive(input.sessionId, { kind: "clear", reason: "archive" });
-            await this.archiveStoreArchiveMany(archiveInputs);
+        return await this.runSessionOrderMutation(async () => {
+            const session = await this.getOrOpen(ref);
+            const catalog = await this.workspaceArchiveCandidates(session.sessionManager.getCwd());
+            const root = findArchiveCandidateByIdOrPrefix(catalog, session.sessionId) ??
+                archiveCandidateFromActiveSession(session, false);
+            const plan = planSessionArchiveTree(root, catalog);
+            const busy = plan.targets
+                .map((target) => target.activeSession)
+                .find((target) => target !== undefined && this.hasActiveWork(target));
+            if (busy !== undefined)
+                throw new Error(`Stop current session activity before archiving ${sessionDisplayName(busy)}`);
+            const archiveInputs = plan.unarchivedTargets.map((target) => archiveInputFromCandidate(target));
+            await this.runTreeExclusiveOperation(plan.unarchivedTargets.map((target) => ({
+                sessionId: target.id,
+                ...(target.activeSession === undefined
+                    ? {}
+                    : { session: target.activeSession }),
+            })), `Stop current session activity before archiving ${sessionDisplayName(session)}`, async () => {
+                for (const target of plan.targets) {
+                    if (target.archived)
+                        this.publishNotificationMutations(this.notificationStore.clearSession(target.id, "archive"));
+                }
+                for (const input of archiveInputs)
+                    await this.closeActive(input.sessionId, {
+                        kind: "clear",
+                        reason: "archive",
+                    });
+                await this.archiveStoreArchiveMany(archiveInputs);
+            });
+            await this.forgetUnreadSessions(plan.targets.map((target) => ({ sessionId: target.id, cwd: target.cwd })));
+            return {
+                archived: true,
+                sessionIds: archiveInputs.map((input) => input.sessionId),
+                archivedCount: archiveInputs.length,
+                skippedAlreadyArchivedCount: plan.skippedAlreadyArchivedCount,
+            };
         });
-        await this.forgetUnreadSessions(plan.targets.map((target) => ({ sessionId: target.id, cwd: target.cwd })));
-        return {
-            archived: true,
-            sessionIds: archiveInputs.map((input) => input.sessionId),
-            archivedCount: archiveInputs.length,
-            skippedAlreadyArchivedCount: plan.skippedAlreadyArchivedCount,
-        };
     }
     async restore(ref) {
-        const archived = await this.getArchived(ref);
-        if (archived === undefined)
-            throw new Error("Session not found");
-        await this.closeActive(archived.sessionId, { kind: "clear", reason: "restore" });
-        await this.archiveStore.restore(archived.sessionId);
-        await this.forgetUnreadSessions([archived]);
+        await this.runSessionOrderMutation(async () => {
+            const archived = await this.getArchived(ref);
+            if (archived === undefined)
+                throw new Error("Session not found");
+            await this.closeActive(archived.sessionId, {
+                kind: "clear",
+                reason: "restore",
+            });
+            await this.archiveStore.restore(archived.sessionId);
+            await this.forgetUnreadSessions([archived]);
+        });
     }
     async deleteArchived(ref) {
         const record = await this.getArchived(ref);
@@ -1427,14 +1975,18 @@ export class PiSessionService {
             throw new Error("Archived session not found");
         if (this.archiveStore.deleteArchived === undefined)
             throw new Error("Archive store does not support deletion");
-        await this.closeActive(record.sessionId, { kind: "clear", reason: "delete" });
+        await this.closeActive(record.sessionId, {
+            kind: "clear",
+            reason: "delete",
+        });
         if (record.archivePath === undefined)
             await this.ensureArchivedRecordMoved(record);
         await this.archiveStore.deleteArchived(record.sessionId);
         await this.forgetUnreadSessions([record]);
     }
     async deleteArchivedMany(refs) {
-        if (this.archiveStore.deleteArchived === undefined && this.archiveStore.deleteArchivedMany === undefined)
+        if (this.archiveStore.deleteArchived === undefined &&
+            this.archiveStore.deleteArchivedMany === undefined)
             throw new Error("Archive store does not support deletion");
         const uniqueRefs = uniqueBulkSessionRefs(refs);
         const archivedRecords = await this.archiveStore.list();
@@ -1443,12 +1995,21 @@ export class PiSessionService {
         for (const ref of uniqueRefs) {
             const record = findArchivedRecordForBulkRef(archivedRecords, ref);
             if (record === undefined) {
-                failures.push({ sessionId: ref.id, error: "Archived session not found" });
+                failures.push({
+                    sessionId: ref.id,
+                    error: "Archived session not found",
+                });
                 continue;
             }
-            const active = this.activeForLookup({ id: record.sessionId, cwd: record.cwd });
+            const active = this.activeForLookup({
+                id: record.sessionId,
+                cwd: record.cwd,
+            });
             if (active !== undefined && this.hasActiveWork(active.runtime.session)) {
-                failures.push({ sessionId: record.sessionId, error: "Stop current session activity before deleting archived session" });
+                failures.push({
+                    sessionId: record.sessionId,
+                    error: "Stop current session activity before deleting archived session",
+                });
                 continue;
             }
             planItems.push({ record });
@@ -1456,11 +2017,17 @@ export class PiSessionService {
         const readyRecords = [];
         for (const item of planItems) {
             try {
-                await this.closeActive(item.record.sessionId, { kind: "clear", reason: "delete" });
+                await this.closeActive(item.record.sessionId, {
+                    kind: "clear",
+                    reason: "delete",
+                });
                 readyRecords.push(item.record);
             }
             catch (error) {
-                failures.push({ sessionId: item.record.sessionId, error: errorMessage(error) });
+                failures.push({
+                    sessionId: item.record.sessionId,
+                    error: errorMessage(error),
+                });
             }
         }
         const moveFailures = await this.moveLegacyArchivedRecordsForDelete(readyRecords);
@@ -1496,11 +2063,19 @@ export class PiSessionService {
             const { sessionId, cwd } = notificationIdentityForSession(session);
             let candidateGeneration;
             try {
-                await this.closeActive(sessionId, priorGeneration === undefined ? CLEAR_RUNTIME_NOTIFICATIONS : DEFER_RUNTIME_NOTIFICATIONS);
-                candidateGeneration = priorGeneration === undefined
-                    ? undefined
-                    : this.notificationStore.beginReplacement(priorGeneration, { sessionId, cwd });
-                const reopened = await this.getActive(ref, candidateGeneration === undefined ? {} : { notificationGeneration: candidateGeneration });
+                await this.closeActive(sessionId, priorGeneration === undefined
+                    ? CLEAR_RUNTIME_NOTIFICATIONS
+                    : DEFER_RUNTIME_NOTIFICATIONS);
+                candidateGeneration =
+                    priorGeneration === undefined
+                        ? undefined
+                        : this.notificationStore.beginReplacement(priorGeneration, {
+                            sessionId,
+                            cwd,
+                        });
+                const reopened = await this.getActive(ref, candidateGeneration === undefined
+                    ? {}
+                    : { notificationGeneration: candidateGeneration });
                 if (candidateGeneration !== undefined) {
                     this.publishNotificationMutations(this.notificationStore.commitReplacement(candidateGeneration));
                 }
@@ -1516,30 +2091,39 @@ export class PiSessionService {
         this.publishStatus(reopenedSession);
     }
     async detachParent(ref) {
-        const session = await this.getOrOpen(ref);
-        const sessionFile = session.sessionFile;
-        if (sessionFile === undefined || sessionFile === "")
-            throw new Error("Session is not persisted");
-        await clearParentSession(sessionFile);
-        clearParentSessionHeader(session.sessionManager);
-        this.unregisterSubsession(session.sessionId);
-        await this.forgetUnreadSessions([{ sessionId: session.sessionId, cwd: session.sessionManager.getCwd() }]);
+        await this.runSessionOrderMutation(async () => {
+            const session = await this.getOrOpen(ref);
+            const sessionFile = session.sessionFile;
+            if (sessionFile === undefined || sessionFile === "")
+                throw new Error("Session is not persisted");
+            await this.clearParentSessionFile(sessionFile);
+            clearParentSessionHeader(session.sessionManager);
+            await this.metadataStore.clearOrder(sessionFile);
+            this.unregisterSubsession(session.sessionId);
+            await this.forgetUnreadSessions([
+                { sessionId: session.sessionId, cwd: session.sessionManager.getCwd() },
+            ]);
+        });
     }
     async pin(ref) {
-        const session = await this.getOrOpen(ref);
-        const sessionFile = session.sessionFile;
-        if (sessionFile === undefined || sessionFile === "")
-            throw new Error("Session is not persisted");
-        await this.metadataStore.pin(sessionFile);
-        return this.sessionInfoFromActive(session, { pinned: true });
+        return await this.runSessionOrderMutation(async () => {
+            const session = await this.getOrOpen(ref);
+            const sessionFile = session.sessionFile;
+            if (sessionFile === undefined || sessionFile === "")
+                throw new Error("Session is not persisted");
+            await this.metadataStore.pin(sessionFile);
+            return this.sessionInfoFromActive(session, { pinned: true });
+        });
     }
     async unpin(ref) {
-        const session = await this.getOrOpen(ref);
-        const sessionFile = session.sessionFile;
-        if (sessionFile === undefined || sessionFile === "")
-            throw new Error("Session is not persisted");
-        await this.metadataStore.unpin(sessionFile);
-        return this.sessionInfoFromActive(session, { pinned: false });
+        return await this.runSessionOrderMutation(async () => {
+            const session = await this.getOrOpen(ref);
+            const sessionFile = session.sessionFile;
+            if (sessionFile === undefined || sessionFile === "")
+                throw new Error("Session is not persisted");
+            await this.metadataStore.unpin(sessionFile);
+            return this.sessionInfoFromActive(session, { pinned: false });
+        });
     }
     sessionInfoFromActive(session, overrides) {
         const parentSessionPath = session.sessionManager.getHeader?.()?.parentSession;
@@ -1552,7 +2136,9 @@ export class PiSessionService {
             modified: new Date().toISOString(),
             messageCount: session.messages.length,
             firstMessage: "",
-            ...(session.sessionName === undefined ? {} : { name: session.sessionName }),
+            ...(session.sessionName === undefined
+                ? {}
+                : { name: session.sessionName }),
             ...(parentSessionPath === undefined ? {} : { parentSessionPath }),
             ...overrides,
         };
@@ -1614,9 +2200,13 @@ export class PiSessionService {
         }
         const [sessionsByCwd, allSessions] = await Promise.all([
             this.listSessionsByCwd([...cwdSet]),
-            needsAllSessions ? this.sessionManager.listAll?.() ?? Promise.resolve([]) : Promise.resolve(undefined),
+            needsAllSessions
+                ? this.sessionManager.listAll?.() ?? Promise.resolve([])
+                : Promise.resolve(undefined),
         ]);
-        return allSessions === undefined ? { sessionsByCwd } : { sessionsByCwd, allSessions };
+        return allSessions === undefined
+            ? { sessionsByCwd }
+            : { sessionsByCwd, allSessions };
     }
     async listSessionsByCwd(cwds) {
         const uniqueCwds = uniqueStrings(cwds);
@@ -1653,7 +2243,10 @@ export class PiSessionService {
             sessionsByCwd = await this.listSessionsByCwd(legacyRecords.map((record) => record.cwd));
         }
         catch (error) {
-            return legacyRecords.map((record) => ({ sessionId: record.sessionId, error: errorMessage(error) }));
+            return legacyRecords.map((record) => ({
+                sessionId: record.sessionId,
+                error: errorMessage(error),
+            }));
         }
         const moveInputs = legacyRecords
             .map((record) => findSessionByIdOrPrefix(sessionsByCwd.get(record.cwd) ?? [], record.sessionId))
@@ -1669,17 +2262,25 @@ export class PiSessionService {
             const failedIds = new Set(moveInputs.map((input) => input.sessionId));
             return legacyRecords
                 .filter((record) => failedIds.has(record.sessionId))
-                .map((record) => ({ sessionId: record.sessionId, error: errorMessage(error) }));
+                .map((record) => ({
+                sessionId: record.sessionId,
+                error: errorMessage(error),
+            }));
         }
     }
     async cleanupPlan(request) {
-        const [sessions, archivedRecords] = await Promise.all([this.sessionManager.listAll?.() ?? [], this.archiveStore.list()]);
+        const [sessions, archivedRecords] = await Promise.all([
+            this.sessionManager.listAll?.() ?? [],
+            this.archiveStore.list(),
+        ]);
         return planSessionCleanup({
             sessions,
             archivedRecords,
             activeSessions: this.cleanupActiveSessionStatuses(),
             thresholds: request.thresholds,
-            ...(request.projectCwds === undefined ? {} : { projectCwds: request.projectCwds }),
+            ...(request.projectCwds === undefined
+                ? {}
+                : { projectCwds: request.projectCwds }),
             now: this.now(),
         });
     }
@@ -1697,7 +2298,8 @@ export class PiSessionService {
         const sessionIds = new Set(listedSessionIds);
         for (const active of new Set(this.active.values())) {
             const session = active.runtime.session;
-            if (session.sessionManager.getCwd() === cwd && !archivedById.has(session.sessionId))
+            if (session.sessionManager.getCwd() === cwd &&
+                !archivedById.has(session.sessionId))
                 sessionIds.add(session.sessionId);
         }
         return [...sessionIds];
@@ -1716,7 +2318,9 @@ export class PiSessionService {
         const session = (await this.sessionManager.list(record.cwd)).find((candidate) => candidate.id === record.sessionId);
         if (session === undefined)
             return record;
-        const [moved] = await this.archiveStoreArchiveMany([archiveInputFromListEntry(session)]);
+        const [moved] = await this.archiveStoreArchiveMany([
+            archiveInputFromListEntry(session),
+        ]);
         return moved ?? record;
     }
     async ensureArchivedRecordsMoved(records) {
@@ -1725,7 +2329,9 @@ export class PiSessionService {
             return;
         const sessionsByCwd = await this.listSessionsByCwd(legacyRecords.map((record) => record.cwd));
         const moveInputs = legacyRecords
-            .map((record) => sessionsByCwd.get(record.cwd)?.find((candidate) => candidate.id === record.sessionId))
+            .map((record) => sessionsByCwd
+            .get(record.cwd)
+            ?.find((candidate) => candidate.id === record.sessionId))
             .filter(isDefined)
             .map(archiveInputFromListEntry);
         await this.archiveStoreArchiveMany(moveInputs);
@@ -1741,7 +2347,10 @@ export class PiSessionService {
         return archiveInputFromActiveSession(session);
     }
     async workspaceArchiveCandidates(cwd) {
-        const [sessions, archivedRecords] = await Promise.all([this.sessionManager.list(cwd), this.archiveStore.list()]);
+        const [sessions, archivedRecords] = await Promise.all([
+            this.sessionManager.list(cwd),
+            this.archiveStore.list(),
+        ]);
         const candidates = new Map();
         const archivedById = new Map();
         for (const record of archivedRecords) {
@@ -1767,15 +2376,22 @@ export class PiSessionService {
         }
         for (const active of new Set(this.active.values())) {
             const session = active.runtime.session;
-            if (session.sessionManager.getCwd() !== cwd || archivedById.has(session.sessionId))
+            if (session.sessionManager.getCwd() !== cwd ||
+                archivedById.has(session.sessionId))
                 continue;
             const existing = candidates.get(session.sessionId);
-            candidates.set(session.sessionId, { ...(existing ?? archiveCandidateFromActiveSession(session, false)), activeSession: session });
+            candidates.set(session.sessionId, {
+                ...(existing ?? archiveCandidateFromActiveSession(session, false)),
+                activeSession: session,
+            });
         }
         return [...candidates.values()];
     }
     async listSessionNames(cwd) {
-        const [sessions, archivedRecords] = await Promise.all([this.sessionManager.list(cwd), this.archiveStore.list()]);
+        const [sessions, archivedRecords] = await Promise.all([
+            this.sessionManager.list(cwd),
+            this.archiveStore.list(),
+        ]);
         const names = new Set();
         for (const session of sessions)
             addSessionName(names, session.name);
@@ -1796,7 +2412,9 @@ export class PiSessionService {
             await Promise.allSettled(pendingOpens);
         const active = this.active.get(sessionId);
         if (notificationPolicy.kind === "clear") {
-            const generation = active === undefined ? undefined : this.notificationGenerationBySession.get(active.runtime.session);
+            const generation = active === undefined
+                ? undefined
+                : this.notificationGenerationBySession.get(active.runtime.session);
             const mutations = generation === undefined
                 ? this.notificationStore.clearSession(sessionId, notificationPolicy.reason)
                 : this.notificationStore.clearGeneration(generation, notificationPolicy.reason);
@@ -1848,7 +2466,7 @@ export class PiSessionService {
             throw branchSummaryAbortError;
     }
     async assertWritable(ref) {
-        if (await this.getArchived(ref) !== undefined)
+        if ((await this.getArchived(ref)) !== undefined)
             throw new Error("Archived sessions are read-only. Restore the session to continue.");
     }
     async getOrOpen(ref) {
@@ -1867,7 +2485,7 @@ export class PiSessionService {
             return archived.archivePath;
         const match = isPiSessionRef(ref)
             ? (await this.sessionManager.list(ref.cwd)).find((session) => session.id === ref.id || session.id.startsWith(ref.id))
-            : (await this.sessionManager.listAll?.() ?? []).find((session) => session.id === ref || session.id.startsWith(ref));
+            : ((await this.sessionManager.listAll?.()) ?? []).find((session) => session.id === ref || session.id.startsWith(ref));
         if (match === undefined || match.path === "")
             throw new Error("Session not found");
         return match.path;
@@ -1883,7 +2501,7 @@ export class PiSessionService {
         }
         const match = isPiSessionRef(ref)
             ? (await this.sessionManager.list(ref.cwd)).find((s) => s.id === ref.id || s.id.startsWith(ref.id))
-            : (await this.sessionManager.listAll?.() ?? []).find((s) => s.id === ref || s.id.startsWith(ref));
+            : ((await this.sessionManager.listAll?.()) ?? []).find((s) => s.id === ref || s.id.startsWith(ref));
         if (!match)
             throw new Error("Session not found");
         return this.openExistingSession(match.id, match.cwd, () => this.sessionManager.open(match.path), options);
@@ -1929,23 +2547,31 @@ export class PiSessionService {
         if (exact !== undefined && lookupMatchesActiveSession(ref, exact))
             return exact;
         for (const [candidateId, active] of this.active.entries()) {
-            if (candidateId.startsWith(sessionId) && lookupMatchesActiveSession(ref, active))
+            if (candidateId.startsWith(sessionId) &&
+                lookupMatchesActiveSession(ref, active))
                 return active;
         }
         return undefined;
     }
     async create(sessionManager, cwd, options = {}) {
-        const delegationToolsEnabled = options.creationProvenance !== "tracked-subsession"
-            && await sessionAllowsDelegationTools(sessionManager, this.sessionManager);
+        const delegationToolsEnabled = options.creationProvenance !== "tracked-subsession" &&
+            (await sessionAllowsDelegationTools(sessionManager, this.sessionManager));
         const runtime = await this.createAgentRuntime(this.createRuntime, {
             cwd,
             agentDir: this.agentDir,
             sessionManager,
             delegationToolsEnabled,
-            ...(options.initialModel === undefined ? {} : { initialModel: options.initialModel }),
-            ...(options.initialThinkingLevel === undefined ? {} : { initialThinkingLevel: options.initialThinkingLevel }),
+            ...(options.initialModel === undefined
+                ? {}
+                : { initialModel: options.initialModel }),
+            ...(options.initialThinkingLevel === undefined
+                ? {}
+                : { initialThinkingLevel: options.initialThinkingLevel }),
         });
-        const active = { runtime, unsubscribe: noop };
+        const active = {
+            runtime,
+            unsubscribe: noop,
+        };
         let boundSession = runtime.session;
         let notificationGeneration = options.notificationGeneration;
         let notificationOwnership = options.notifications === "disabled"
@@ -1969,6 +2595,7 @@ export class PiSessionService {
         if (notificationGeneration !== undefined)
             this.notificationGenerationBySession.set(runtime.session, notificationGeneration);
         try {
+            this.inspectAndCacheSessionModelPolicy(runtime.session);
             if (options.creationProvenance === "tracked-subsession") {
                 await this.publishUnreadMutations(this.unreadStore.excludeSession(runtime.session.sessionId, canonicalizeStoredCwd(runtime.session.sessionManager.getCwd())));
             }
@@ -1987,6 +2614,7 @@ export class PiSessionService {
                         candidateGeneration = this.notificationStore.beginReplacement(priorGeneration, notificationIdentityForSession(session));
                         this.notificationGenerationBySession.set(session, candidateGeneration);
                     }
+                    this.inspectAndCacheSessionModelPolicy(session);
                     this.bindRuntime(active, session);
                     boundSession = session;
                     await this.bindSessionExtensions(session, candidateGeneration);
@@ -2005,7 +2633,11 @@ export class PiSessionService {
                 }
             });
             this.active.set(runtime.session.sessionId, active);
-            if (notificationOwnership === "replacement" && notificationGeneration !== undefined) {
+            if (options.initializeModelPolicy !== undefined) {
+                await this.initializeSessionModelPolicy(runtime.session, options.initializeModelPolicy);
+            }
+            if (notificationOwnership === "replacement" &&
+                notificationGeneration !== undefined) {
                 this.publishNotificationMutations(this.notificationStore.commitReplacement(notificationGeneration));
                 notificationOwnership = "external";
             }
@@ -2053,7 +2685,10 @@ export class PiSessionService {
             onError: (error) => {
                 const message = `${error.extensionPath}: ${error.error}`;
                 this.publishActivity(session, "extension error", "error", message);
-                this.events.publish(session.sessionId, { type: "session.error", message });
+                this.events.publish(session.sessionId, {
+                    type: "session.error",
+                    message,
+                });
             },
         });
     }
@@ -2106,7 +2741,8 @@ export class PiSessionService {
         const previousCwd = canonicalizeStoredCwd(previous.sessionManager.getCwd());
         this.unreadStore.forgetActivity(previous.sessionId, previousCwd);
         const nextCwd = canonicalizeStoredCwd(next.sessionManager.getCwd());
-        if (previous.sessionId === next.sessionId && cwdPathsEqual(previousCwd, nextCwd))
+        if (previous.sessionId === next.sessionId &&
+            cwdPathsEqual(previousCwd, nextCwd))
             return;
         await this.publishUnreadMutations(this.unreadStore.forgetSession(previous.sessionId, previousCwd));
     }
@@ -2129,11 +2765,14 @@ export class PiSessionService {
     publishUnreadMutations(mutations) {
         this.enqueueUnreadMutations(mutations);
         this.unreadPublicationFlushRequested = true;
-        if (this.unreadPublication === undefined && this.unreadPublicationRetryTimer !== undefined) {
+        if (this.unreadPublication === undefined &&
+            this.unreadPublicationRetryTimer !== undefined) {
             const failure = this.unreadPublicationFailure;
             return Promise.reject(failure instanceof Error
                 ? failure
-                : new Error("Session unread publication is awaiting retry", { cause: failure }));
+                : new Error("Session unread publication is awaiting retry", {
+                    cause: failure,
+                }));
         }
         return this.ensureUnreadPublication();
     }
@@ -2156,7 +2795,8 @@ export class PiSessionService {
         return publication;
     }
     async drainUnreadPublication() {
-        while (this.unreadPublicationFlushRequested || this.pendingUnreadMutations.length > 0) {
+        while (this.unreadPublicationFlushRequested ||
+            this.pendingUnreadMutations.length > 0) {
             this.unreadPublicationFlushRequested = false;
             const batch = this.pendingUnreadMutations.splice(0);
             let publishedCount = 0;
@@ -2190,7 +2830,8 @@ export class PiSessionService {
             this.pendingUnreadMutations.splice(0, excess);
     }
     scheduleUnreadPublicationRetry() {
-        if (this.unreadPublicationStopped || this.unreadPublicationRetryTimer !== undefined)
+        if (this.unreadPublicationStopped ||
+            this.unreadPublicationRetryTimer !== undefined)
             return;
         const delay = this.unreadPublicationRetryDelayMs;
         this.unreadPublicationRetryDelayMs = Math.min(Math.max(delay * 2, this.unreadPublicationRetryInitialMs), Math.max(MAX_UNREAD_PUBLICATION_RETRY_MS, this.unreadPublicationRetryInitialMs));
@@ -2259,8 +2900,11 @@ export class PiSessionService {
     recordGenerationProgress(session, message) {
         const current = this.generationMetrics.get(session);
         const providerTokens = providerOutputTokens(message);
-        const estimatedTokens = providerTokens === undefined && current?.estimated !== false ? estimatedOutputTokens(message) : undefined;
-        const outputTokens = providerTokens ?? (current?.estimated === false ? current.outputTokens : estimatedTokens);
+        const estimatedTokens = providerTokens === undefined && current?.estimated !== false
+            ? estimatedOutputTokens(message)
+            : undefined;
+        const outputTokens = providerTokens ??
+            (current?.estimated === false ? current.outputTokens : estimatedTokens);
         if (outputTokens === undefined)
             return;
         this.generationMetrics.set(session, {
@@ -2274,15 +2918,20 @@ export class PiSessionService {
         if (metrics === undefined)
             return undefined;
         const elapsedMs = this.now().getTime() - metrics.startedAt;
-        const tokensPerSecond = elapsedMs >= MIN_GENERATION_RATE_ELAPSED_MS ? metrics.outputTokens * 1_000 / elapsedMs : undefined;
+        const tokensPerSecond = elapsedMs >= MIN_GENERATION_RATE_ELAPSED_MS
+            ? (metrics.outputTokens * 1_000) / elapsedMs
+            : undefined;
         return {
             outputTokens: metrics.outputTokens,
-            ...(tokensPerSecond === undefined || !Number.isFinite(tokensPerSecond) ? {} : { tokensPerSecond }),
+            ...(tokensPerSecond === undefined || !Number.isFinite(tokensPerSecond)
+                ? {}
+                : { tokensPerSecond }),
             ...(metrics.estimated ? { estimated: true } : {}),
         };
     }
     scheduleCompactionQueueDrain(sessionId, delayMs = 0) {
-        if (!this.compactionPromptQueues.has(sessionId) || this.compactionDrainTimers.has(sessionId))
+        if (!this.compactionPromptQueues.has(sessionId) ||
+            this.compactionDrainTimers.has(sessionId))
             return;
         const timer = setTimeout(() => {
             this.compactionDrainTimers.delete(sessionId);
@@ -2295,7 +2944,7 @@ export class PiSessionService {
         if (active === undefined)
             return;
         const { session } = active.runtime;
-        if (session.isCompacting) {
+        if (session.isCompacting || this.isModelPolicyMutationActive(session)) {
             this.scheduleCompactionQueueDrain(sessionId, 100);
             return;
         }
@@ -2313,7 +2962,9 @@ export class PiSessionService {
             return;
         this.publishStatus(session);
         const submitted = this.submitPrompt(session, prompt.text, undefined, prompt.images, prompt.echoUserMessage ?? true);
-        void submitted.finally(() => { this.scheduleCompactionQueueDrain(sessionId); });
+        void submitted.finally(() => {
+            this.scheduleCompactionQueueDrain(sessionId);
+        });
     }
     takeCompactionPromptQueue(sessionId) {
         const queued = this.compactionPromptQueues.get(sessionId) ?? [];
@@ -2341,7 +2992,10 @@ export class PiSessionService {
         this.compactionDrainTimers.clear();
     }
     maybeGenerateSessionName(session, firstMessage) {
-        if (session.sessionName !== undefined || session.messages.length !== 0 || session.isStreaming || session.isCompacting)
+        if (session.sessionName !== undefined ||
+            session.messages.length !== 0 ||
+            session.isStreaming ||
+            session.isCompacting)
             return;
         const deterministicName = deterministicSessionName(firstMessage);
         if (deterministicName !== undefined) {
@@ -2351,10 +3005,21 @@ export class PiSessionService {
         const model = session.model;
         if (model === undefined)
             return;
-        void generateShortSessionName(session.agent.streamFunction, model, firstMessage).then((name) => {
+        void runWithUtilityModelFallback(this.utilityModelResolver, "lightweight", model, (candidate) => generateShortSessionName(session.agent.streamFunction, candidate, firstMessage), (candidate, error) => {
+            this.logger.info({
+                provider: candidate.provider,
+                modelId: candidate.id,
+                error: error instanceof Error ? error.message : String(error),
+            }, "utility title model failed");
+        })
+            .then((name) => {
             this.applyGeneratedSessionName(session, name ?? fallbackSessionName(firstMessage));
-        }).catch(() => {
-            this.applyGeneratedSessionName(session, fallbackSessionName(firstMessage));
+        })
+            .catch((error) => {
+            this.logger.info({
+                sessionId: session.sessionId,
+                error: error instanceof Error ? error.message : String(error),
+            }, "failed to apply generated session name");
         });
     }
     applyGeneratedSessionName(session, name) {
@@ -2375,7 +3040,10 @@ export class PiSessionService {
                 this.applyGeneratedSessionName(session, generatedName);
             }
             catch (error) {
-                this.logger.info({ sessionId: session.sessionId, error: error instanceof Error ? error.message : String(error) }, "failed to apply deferred session name");
+                this.logger.info({
+                    sessionId: session.sessionId,
+                    error: error instanceof Error ? error.message : String(error),
+                }, "failed to apply deferred session name");
             }
         }
         const notifications = this.deferredSubsessionNotifications.get(session) ?? [];
@@ -2410,7 +3078,9 @@ export class PiSessionService {
             this.authLossWarnings.delete(warningKey);
             return;
         }
-        if (removedProviderId === undefined || model.provider !== removedProviderId || this.authLossWarnings.has(warningKey))
+        if (removedProviderId === undefined ||
+            model.provider !== removedProviderId ||
+            this.authLossWarnings.has(warningKey))
             return;
         this.authLossWarnings.add(warningKey);
         this.events.publish(session.sessionId, {
@@ -2429,7 +3099,11 @@ export class PiSessionService {
     publishSessionName(session) {
         const event = session.sessionName === undefined
             ? { type: "session.name", sessionId: session.sessionId }
-            : { type: "session.name", sessionId: session.sessionId, name: session.sessionName };
+            : {
+                type: "session.name",
+                sessionId: session.sessionId,
+                name: session.sessionName,
+            };
         this.events.publish(session.sessionId, event);
         this.events.publishGlobal(event);
     }
@@ -2469,17 +3143,20 @@ export class PiSessionService {
         return "active";
     }
     hasActiveWork(session) {
-        return this.treeNavigations.has(session)
-            || this.isSessionEntryMutationActive(session)
-            || this.isTreeExclusiveOperationActive(session)
-            || sessionHasActiveWork(session, this.compactionQueuedMessages(session.sessionId).length);
+        return (this.treeNavigations.has(session) ||
+            this.isSessionEntryMutationActive(session) ||
+            this.isTreeExclusiveOperationActive(session) ||
+            sessionHasActiveWork(session, this.compactionQueuedMessages(session.sessionId).length));
     }
     async runTreeExclusiveOperation(targets, activeError, operation) {
         const sessionIds = new Set();
         const runtimes = new Set();
         const sessions = new Set();
         for (const target of targets) {
-            const runtime = target.runtime ?? (target.session === undefined ? undefined : this.activeRuntimeForSession(target.session));
+            const runtime = target.runtime ??
+                (target.session === undefined
+                    ? undefined
+                    : this.activeRuntimeForSession(target.session));
             const session = target.session ?? runtime?.session;
             if (session !== undefined && this.hasActiveWork(session))
                 throw new Error(activeError);
@@ -2518,7 +3195,8 @@ export class PiSessionService {
         if (this.isTreeExclusiveSessionIdentityActive(session.sessionId))
             return true;
         const runtime = this.activeRuntimeForSession(session);
-        return runtime !== undefined && (this.treeExclusiveRuntimeOperationCounts.get(runtime) ?? 0) > 0;
+        return (runtime !== undefined &&
+            (this.treeExclusiveRuntimeOperationCounts.get(runtime) ?? 0) > 0);
     }
     activeRuntimeForSession(session) {
         for (const active of new Set(this.active.values())) {
@@ -2610,11 +3288,18 @@ export class PiSessionService {
     }
     publishActivity(session, label, phase, detail) {
         const at = new Date().toISOString();
-        const stored = detail === undefined ? { phase, label, at } : { phase, label, detail, at };
+        const stored = detail === undefined
+            ? { phase, label, at }
+            : { phase, label, detail, at };
         this.activities.set(session.sessionId, stored);
-        const activity = detail === undefined ? { sessionId: session.sessionId, phase, label, at } : { sessionId: session.sessionId, phase, label, detail, at };
+        const activity = detail === undefined
+            ? { sessionId: session.sessionId, phase, label, at }
+            : { sessionId: session.sessionId, phase, label, detail, at };
         this.workspaceActivity?.applySessionActivity(session.sessionManager.getCwd(), activity);
-        this.events.publish(session.sessionId, { type: "activity.update", activity });
+        this.events.publish(session.sessionId, {
+            type: "activity.update",
+            activity,
+        });
         this.events.publishGlobal({ type: "activity.update", activity });
         this.observeUnreadActivityState(session);
     }
@@ -2634,12 +3319,393 @@ export class PiSessionService {
         const stored = { phase: "idle", label: "idle", at };
         this.activities.set(session.sessionId, stored);
         const activity = { sessionId: session.sessionId, ...stored };
-        this.events.publish(session.sessionId, { type: "activity.update", activity });
+        this.events.publish(session.sessionId, {
+            type: "activity.update",
+            activity,
+        });
         this.events.publishGlobal({ type: "activity.update", activity });
     }
+    /**
+     * Read-only capability view for `get_model_policy`, built from the session's
+     * own cached inspection so it cannot disagree with what the HTTP route reports.
+     */
+    modelPolicyCapability(sessionId) {
+        // The tool only ever asks about its own session, which is live by definition
+        // while a tool call is executing. A miss means the runtime was torn down
+        // mid-call, which is a terminal read failure rather than a policy answer.
+        const session = this.active.get(sessionId)?.runtime.session;
+        if (session === undefined)
+            throw new Error(`Session ${sessionId} is not active`);
+        const inspection = this.inspectAndCacheSessionModelPolicy(session);
+        return buildModelPolicyCapability({
+            policy: inspection.kind === "invalid" ? undefined : inspection.policy,
+            currentRuntime: this.exactSelectionFromSession(session),
+            ladder: this.modelTierRegistry.validate(),
+            resolveTier: (tier) => {
+                const resolved = this.modelTierRegistry.resolve(tier);
+                return {
+                    model: { provider: resolved.model.provider, id: resolved.model.id },
+                    thinkingLevel: resolved.thinkingLevel,
+                };
+            },
+            blockedReason: this.modelPolicyBlockedReason(session),
+        });
+    }
+    exactSelectionFromSession(session) {
+        const model = session.model;
+        if (model === undefined ||
+            typeof model.provider !== "string" ||
+            model.provider.trim() === "" ||
+            typeof model.id !== "string" ||
+            model.id.trim() === "") {
+            throw new Error("Session model policy requires a resolved runtime model provider and id");
+        }
+        if (typeof session.thinkingLevel !== "string" ||
+            session.thinkingLevel.trim() === "") {
+            throw new Error("Session model policy requires a resolved runtime thinking level");
+        }
+        return {
+            model: { provider: model.provider, id: model.id },
+            thinkingLevel: session.thinkingLevel,
+        };
+    }
+    policyEntries(session) {
+        return (session.sessionManager.getEntries?.() ??
+            session.sessionManager.getBranch());
+    }
+    inspectAndCacheSessionModelPolicy(session) {
+        const inspection = inspectSessionModelPolicy(this.policyEntries(session), this.exactSelectionFromSession(session));
+        const ladderValidation = this.modelTierRegistry.validate();
+        this.modelPolicyInspections.set(session, inspection);
+        this.modelPolicyLadderValidations.set(session, ladderValidation);
+        if (inspection.kind === "invalid")
+            this.modelPolicyEntryReasons.set(session, inspection.reason);
+        else
+            this.modelPolicyEntryReasons.delete(session);
+        return inspection;
+    }
+    /** Effective block: an unproven runtime restoration outranks an entry defect. */
+    modelPolicyBlockedReason(session) {
+        return (this.modelPolicyRuntimeBlocks.get(session.sessionId) ??
+            this.modelPolicyEntryReasons.get(session));
+    }
+    /**
+     * Root-session policy initialization. `true` records the runtime's own tuple;
+     * an update applies the requested transition. Both complete before the caller
+     * of `start()` sees the session, so no prompt can precede the policy.
+     */
+    async initializeSessionModelPolicy(session, initializer) {
+        const current = {
+            mode: "exact",
+            exact: this.exactSelectionFromSession(session),
+        };
+        if (initializer === true) {
+            this.appendSessionModelPolicy(session, current);
+            this.inspectAndCacheSessionModelPolicy(session);
+            return;
+        }
+        // Root creation reports failure through its own abort/dispose cleanup rather
+        // than publishing a failed transition for a session no client has seen.
+        await this.applySessionModelPolicy(session, current, initializer, {
+            action: "initialize the session model policy",
+        });
+    }
+    /**
+     * The single policy transition path. Validates the complete target before any
+     * setter, re-checks that no conflicting work started during that async
+     * validation, applies model then thinking under the serialized entry-mutation
+     * seam, verifies the effective pair, and only then persists and caches.
+     */
+    async applySessionModelPolicy(session, current, update, options) {
+        const plan = planSessionModelPolicyUpdate(current, update, (tier) => {
+            const resolved = this.modelTierRegistry.resolve(tier);
+            return {
+                model: { provider: resolved.model.provider, id: resolved.model.id },
+                thinkingLevel: resolved.thinkingLevel,
+            };
+        });
+        // Validation happens before the mutation opens, so a rejected target leaves
+        // the runtime and the persisted policy untouched.
+        const target = await this.resolveAvailableExactSelection(session, plan.target);
+        // Refresh/validation awaited above, so a prompt or another mutation may have
+        // started meanwhile. Re-check here — synchronously adjacent to the mutation
+        // open, and *outside* it so the mutation is never its own conflict — to close
+        // the await-to-setter race without touching tree-navigation behavior.
+        this.assertModelPolicyMutationIdle(session, options.action);
+        return this.runSessionModelPolicyMutation(session, "change session model policy", async () => {
+            const previous = this.exactSelectionFromSession(session);
+            try {
+                await this.applyExactSelection(session, target);
+                this.appendSessionModelPolicy(session, plan.policy);
+            }
+            catch (error) {
+                const reason = error instanceof Error ? error.message : String(error);
+                if (!(await this.restoreExactSelection(session, previous))) {
+                    this.modelPolicyRuntimeBlocks.set(session.sessionId, `MODEL_POLICY_BLOCKED: ${reason}; the previous model and thinking pair could not be restored`);
+                }
+                this.inspectAndCacheSessionModelPolicy(session);
+                options.onTransitionFailure?.(reason);
+                throw error;
+            }
+            this.modelPolicyRuntimeBlocks.delete(session.sessionId);
+            this.inspectAndCacheSessionModelPolicy(session);
+            return plan.policy;
+        });
+    }
+    /**
+     * Serialized policy-transition seam. Adds the policy-mutation marker on top of
+     * the shared entry-mutation lifecycle so prompt submission can tell a transient
+     * policy window apart from ordinary session work, and drains any prompt input
+     * retained during that window once the tuple is settled again.
+     */
+    async runSessionModelPolicyMutation(session, action, operation) {
+        // Captured before the first setter runs, so this is the confirmed tuple the
+        // window reports. Only the outermost mutation records it: a nested mutation
+        // opens on an already-transient tuple, which would not be confirmed.
+        if (!this.isModelPolicyMutationActive(session))
+            this.recordConfirmedExactSelection(session);
+        this.modelPolicyMutationCounts.set(session.sessionId, (this.modelPolicyMutationCounts.get(session.sessionId) ?? 0) + 1);
+        try {
+            return await this.runSessionEntryMutation(session, action, operation);
+        }
+        finally {
+            decrementMapCount(this.modelPolicyMutationCounts, session.sessionId);
+            if (!this.isModelPolicyMutationActive(session)) {
+                // The tuple is settled again (applied, restored, or blocked), so live
+                // runtime state is authoritative once more.
+                this.modelPolicyConfirmedSelections.delete(session.sessionId);
+                this.scheduleCompactionQueueDrain(session.sessionId);
+            }
+        }
+    }
+    /**
+     * Remember the pre-transition tuple for the status projection. A session whose
+     * runtime has no resolved model has no confirmed tuple to report; that case is
+     * left to the existing `exactSelectionFromSession` failure rather than
+     * substituting anything.
+     */
+    recordConfirmedExactSelection(session) {
+        try {
+            this.modelPolicyConfirmedSelections.set(session.sessionId, this.exactSelectionFromSession(session));
+        }
+        catch {
+            this.modelPolicyConfirmedSelections.delete(session.sessionId);
+        }
+    }
+    isModelPolicyMutationActive(session) {
+        return (this.modelPolicyMutationCounts.get(session.sessionId) ?? 0) > 0;
+    }
+    /**
+     * Tell other clients a policy transition failed. Called after the failure state
+     * (including any `MODEL_POLICY_BLOCKED`) is recorded and before the route error
+     * propagates, so the published status already carries the blocked reason.
+     */
+    publishModelPolicyTransitionFailure(session, reason) {
+        this.publishActivity(session, "model policy change failed", "error", reason);
+        this.publishStatus(session);
+    }
+    /**
+     * Reject a policy mutation that could race Pi's own entry writes. Tree
+     * navigation is reported first because it is the more specific state.
+     */
+    assertModelPolicyMutationIdle(session, action) {
+        this.assertTreeNavigationInactive(session, action);
+        if (this.hasActiveWork(session))
+            throw new Error(`Stop current session activity before you ${action}`);
+    }
+    /**
+     * Gate for the direct Exact model/thinking routes. They act only in Exact
+     * mode: while Tiered is active the ladder owns the runtime tuple, and while
+     * the runtime is blocked no tuple change may be recorded as authoritative.
+     */
+    assertExactModelPolicyMutationAllowed(session, action) {
+        this.assertModelPolicyMutationIdle(session, action);
+        const inspection = this.inspectAndCacheSessionModelPolicy(session);
+        const runtimeBlock = this.modelPolicyRuntimeBlocks.get(session.sessionId);
+        if (runtimeBlock !== undefined)
+            throw new Error(`Cannot ${action}: ${runtimeBlock}`);
+        if (inspection.kind === "invalid") {
+            throw new Error(`Cannot ${action}: the session model policy entry is invalid (${inspection.reason}). Repair the policy first.`);
+        }
+        if (inspection.policy.mode === "tiered") {
+            throw new Error(`Cannot ${action} directly while the session model policy is Tiered. Change the model policy instead.`);
+        }
+        return inspection.policy;
+    }
+    /**
+     * Run one Exact route operation and record Pi's *confirmed* resulting pair as
+     * the new authoritative policy inside the same serialized mutation. Pi's own
+     * model-selection clamp is therefore persisted as-is rather than replaced by
+     * an invented target thinking level.
+     */
+    async runExactModelPolicyMutation(session, action, currentPolicy, operation) {
+        let transitionFailure;
+        try {
+            return await this.runSessionModelPolicyMutation(session, action, async () => {
+                const previous = this.exactSelectionFromSession(session);
+                const result = await operation();
+                const policy = {
+                    mode: "exact",
+                    exact: this.exactSelectionFromSession(session),
+                    ...(currentPolicy.tier === undefined
+                        ? {}
+                        : { tier: currentPolicy.tier }),
+                };
+                try {
+                    this.appendSessionModelPolicy(session, policy);
+                }
+                catch (error) {
+                    const reason = error instanceof Error ? error.message : String(error);
+                    if (!(await this.restoreExactSelection(session, previous))) {
+                        this.modelPolicyRuntimeBlocks.set(session.sessionId, `MODEL_POLICY_BLOCKED: ${reason}; the previous model and thinking pair could not be restored`);
+                    }
+                    this.inspectAndCacheSessionModelPolicy(session);
+                    // Only a failure that already moved the runtime tuple is announced; an
+                    // operation precondition ("Only one model available") keeps its plain
+                    // route error and publishes nothing.
+                    transitionFailure = reason;
+                    throw error;
+                }
+                this.inspectAndCacheSessionModelPolicy(session);
+                return result;
+            });
+        }
+        catch (error) {
+            // Published after the mutation closed so the status reports the settled
+            // (blocked or restored) state rather than "updating session".
+            if (transitionFailure !== undefined)
+                this.publishModelPolicyTransitionFailure(session, transitionFailure);
+            throw error;
+        }
+    }
+    /**
+     * Refuse to reach a provider while the authoritative policy is unusable. This
+     * covers a malformed newest entry and an unproven restoration; it deliberately
+     * does no tier remapping.
+     */
+    assertPromptModelPolicyAllowed(session) {
+        const inspection = this.inspectAndCacheSessionModelPolicy(session);
+        const runtimeBlock = this.modelPolicyRuntimeBlocks.get(session.sessionId);
+        if (runtimeBlock !== undefined)
+            throw new Error(`Cannot send a prompt: ${runtimeBlock}`);
+        if (inspection.kind === "invalid") {
+            throw new Error(`Cannot send a prompt: the session model policy entry is invalid (${inspection.reason}). Repair the policy first.`);
+        }
+    }
+    /**
+     * Bind an exact selection to a currently available runtime model and prove the
+     * target thinking level is supported by that *incoming* model. Pi's
+     * `setThinkingLevel` clamps silently, so this check must precede every setter.
+     */
+    async resolveAvailableExactSelection(session, selection) {
+        await session.modelRuntime.refresh({ allowNetwork: false });
+        const candidates = session.scopedModels.length > 0
+            ? session.scopedModels.map((scoped) => scoped.model)
+            : session.modelRuntime.getAvailableSnapshot();
+        const model = candidates.find((candidate) => candidate.provider === selection.model.provider &&
+            candidate.id === selection.model.id);
+        const described = `${selection.model.provider}/${selection.model.id}`;
+        if (model === undefined)
+            throw new Error(`Model not found: ${described}`);
+        if (!isKnownThinkingLevel(selection.thinkingLevel)) {
+            throw new Error(`Unknown thinking level ${selection.thinkingLevel} for ${described}`);
+        }
+        if (!runtimeThinkingLevels(model).includes(selection.thinkingLevel)) {
+            throw new Error(`Thinking level ${selection.thinkingLevel} is unsupported by ${described}`);
+        }
+        return {
+            model,
+            selection: {
+                model: { provider: model.provider, id: model.id },
+                thinkingLevel: selection.thinkingLevel,
+            },
+        };
+    }
+    /**
+     * Model first, then thinking: `setThinkingLevel` clamps against the currently
+     * selected model, so the reverse order can discard a level the incoming model
+     * supports. The effective pair is verified afterwards; a clamped substitute is
+     * a failed transition, never a success.
+     */
+    async applyExactSelection(session, target) {
+        const level = target.selection.thinkingLevel;
+        if (!isKnownThinkingLevel(level))
+            throw new Error(`Unknown thinking level ${level}`);
+        await session.setModel(target.model);
+        session.setThinkingLevel(level);
+        const effective = this.exactSelectionFromSession(session);
+        if (effective.model.provider !== target.selection.model.provider ||
+            effective.model.id !== target.selection.model.id ||
+            effective.thinkingLevel !== level) {
+            throw new Error(`Session model policy could not activate ${target.selection.model.provider}/${target.selection.model.id} at thinking level ${level}` +
+                `; the runtime reports ${effective.model.provider}/${effective.model.id} at thinking level ${effective.thinkingLevel}`);
+        }
+    }
+    /**
+     * Put the previous exact pair back in the same model-then-thinking order.
+     * Returns whether the previous pair is *proven* active again; a false result
+     * means the runtime tuple is ambiguous and the session must refuse prompts.
+     */
+    async restoreExactSelection(session, previous) {
+        try {
+            const current = this.exactSelectionFromSession(session);
+            if (current.model.provider === previous.model.provider &&
+                current.model.id === previous.model.id &&
+                current.thinkingLevel === previous.thinkingLevel) {
+                return true;
+            }
+            const target = await this.resolveAvailableExactSelection(session, previous);
+            await this.applyExactSelection(session, target);
+            return true;
+        }
+        catch {
+            return false;
+        }
+    }
+    appendSessionModelPolicy(session, policy) {
+        if (session.sessionManager.appendCustomEntry === undefined) {
+            throw new Error("Cannot persist the session model policy: session persistence is unavailable");
+        }
+        session.sessionManager.appendCustomEntry(SESSION_MODEL_POLICY_CUSTOM_TYPE, serializeSessionModelPolicy(policy));
+    }
+    modelPolicyStatusFromSession(session) {
+        const inspection = this.modelPolicyInspections.get(session);
+        if (inspection === undefined)
+            throw new Error("Session model policy inspection is unavailable");
+        const ladderValidation = this.modelPolicyLadderValidations.get(session);
+        if (ladderValidation === undefined)
+            throw new Error("Session model tier validation is unavailable");
+        // Inside a transition the live tuple is half-applied, so report the tuple
+        // this session last confirmed. `mode` already comes from the unchanged
+        // entry, keeping the published pair internally consistent.
+        const confirmed = this.isModelPolicyMutationActive(session)
+            ? this.modelPolicyConfirmedSelections.get(session.sessionId)
+            : undefined;
+        const resolved = confirmed ?? this.exactSelectionFromSession(session);
+        const blockedReason = this.modelPolicyBlockedReason(session);
+        if (inspection.kind === "invalid") {
+            return {
+                mode: "exact",
+                resolved,
+                ladderValid: ladderValidation.valid,
+                ...(blockedReason === undefined ? {} : { blockedReason }),
+            };
+        }
+        return {
+            mode: inspection.policy.mode,
+            ...(inspection.policy.tier === undefined
+                ? {}
+                : { tier: inspection.policy.tier }),
+            resolved,
+            ladderValid: ladderValidation.valid,
+            ...(blockedReason === undefined ? {} : { blockedReason }),
+        };
+    }
     statusFromSession(session) {
         const stats = session.getSessionStats();
-        const model = session.model === undefined ? undefined : modelToClientModel(session.model);
+        const model = session.model === undefined
+            ? undefined
+            : modelToClientModel(session.model);
         const generation = this.generationForStatus(session);
         const contextUsage = session.getContextUsage();
         const warnings = this.warningsForSession(session);
@@ -2648,6 +3714,7 @@ export class PiSessionService {
             persisted: sessionFileExists(session.sessionFile),
             ...(model === undefined ? {} : { model }),
             thinkingLevel: session.thinkingLevel,
+            modelPolicy: this.modelPolicyStatusFromSession(session),
             isStreaming: session.isStreaming,
             isCompacting: session.isCompacting,
             isBashRunning: session.isBashRunning,
@@ -2676,7 +3743,8 @@ export class PiSessionService {
         return warnings;
     }
     pendingMessageCount(session) {
-        return session.pendingMessageCount + this.compactionQueuedMessages(session.sessionId).length;
+        return (session.pendingMessageCount +
+            this.compactionQueuedMessages(session.sessionId).length);
     }
     compactionQueuedMessages(sessionId) {
         return this.compactionPromptQueues.get(sessionId) ?? [];
@@ -2691,7 +3759,9 @@ function previewResponseFromPlan(plan) {
         thresholds: plan.thresholds,
         projects: plan.projects,
         totals: plan.totals,
-        ...(plan.skippedBusySessionIds.length === 0 ? {} : { skippedBusySessionIds: plan.skippedBusySessionIds }),
+        ...(plan.skippedBusySessionIds.length === 0
+            ? {}
+            : { skippedBusySessionIds: plan.skippedBusySessionIds }),
     };
 }
 function uniqueBulkSessionRefs(refs) {
@@ -2710,19 +3780,36 @@ function bulkRefToLookup(ref) {
     return ref.cwd === undefined ? ref.id : { id: ref.id, cwd: ref.cwd };
 }
 function findArchivedRecordForBulkRef(records, ref) {
-    return records.find((record) => (ref.cwd === undefined || record.cwd === ref.cwd) && (record.sessionId === ref.id || record.sessionId.startsWith(ref.id)));
+    return records.find((record) => (ref.cwd === undefined || record.cwd === ref.cwd) &&
+        (record.sessionId === ref.id || record.sessionId.startsWith(ref.id)));
 }
 function findListedSessionForBulkRef(context, ref) {
     if (ref.cwd !== undefined)
         return findSessionByIdOrPrefix(context.sessionsByCwd.get(ref.cwd) ?? [], ref.id);
-    return context.allSessions === undefined ? undefined : findSessionByIdOrPrefix(context.allSessions, ref.id);
+    return context.allSessions === undefined
+        ? undefined
+        : findSessionByIdOrPrefix(context.allSessions, ref.id);
 }
 function findSessionByIdOrPrefix(sessions, sessionId) {
-    return sessions.find((session) => session.id === sessionId) ?? sessions.find((session) => session.id.startsWith(sessionId));
+    return (sessions.find((session) => session.id === sessionId) ??
+        sessions.find((session) => session.id.startsWith(sessionId)));
 }
 function uniqueStrings(values) {
     return [...new Set(values)];
 }
+/**
+ * Reconcile duplicate catalog entries by canonical CWD + id, matching the
+ * last-writer-wins convention other catalog reconciliation helpers use. The
+ * reorder loader can read the same session more than once when overlapping
+ * catalog CWDs are requested (e.g. a cross-workspace children scope).
+ */
+function uniqueSessionsByIdentity(sessions) {
+    const byIdentity = new Map();
+    for (const session of sessions) {
+        byIdentity.set(JSON.stringify([canonicalizeStoredCwd(session.cwd), session.id]), session);
+    }
+    return [...byIdentity.values()];
+}
 function errorMessage(error) {
     return error instanceof Error ? error.message : String(error);
 }
@@ -2756,7 +3843,9 @@ function clientSessionFromListEntry(session) {
         modified: session.modified.toISOString(),
         messageCount: session.messageCount,
         firstMessage: session.firstMessage,
-        ...(session.parentSessionPath === undefined ? {} : { parentSessionPath: session.parentSessionPath }),
+        ...(session.parentSessionPath === undefined
+            ? {}
+            : { parentSessionPath: session.parentSessionPath }),
     };
 }
 function archiveInputFromListEntry(session) {
@@ -2769,7 +3858,9 @@ function archiveInputFromListEntry(session) {
         messageCount: session.messageCount,
         firstMessage: session.firstMessage,
         ...(session.name === undefined ? {} : { name: session.name }),
-        ...(session.parentSessionPath === undefined ? {} : { parentSessionPath: session.parentSessionPath }),
+        ...(session.parentSessionPath === undefined
+            ? {}
+            : { parentSessionPath: session.parentSessionPath }),
     };
 }
 function archiveInputFromActiveSession(session) {
@@ -2796,7 +3887,9 @@ function archiveCandidateFromListEntry(session) {
         cwd: session.cwd,
         archived: false,
         listEntry: session,
-        ...(session.parentSessionPath === undefined ? {} : { parentSessionPath: session.parentSessionPath }),
+        ...(session.parentSessionPath === undefined
+            ? {}
+            : { parentSessionPath: session.parentSessionPath }),
     };
 }
 function archiveCandidateFromArchivedRecord(record, fallback) {
@@ -2835,7 +3928,10 @@ function archiveInputFromCandidate(candidate) {
     throw new Error(`Session is not available for archiving: ${candidate.id}`);
 }
 function sessionHasActiveWork(session, extraQueuedMessageCount = 0) {
-    return session.isStreaming || session.isCompacting || session.isBashRunning || session.pendingMessageCount + extraQueuedMessageCount > 0;
+    return (session.isStreaming ||
+        session.isCompacting ||
+        session.isBashRunning ||
+        session.pendingMessageCount + extraQueuedMessageCount > 0);
 }
 function sessionDisplayName(session) {
     return session.sessionName ?? session.sessionId;
@@ -2846,7 +3942,11 @@ function clientSessionFromArchivedRecord(record, fallback) {
     const modified = record.modified ?? fallback?.modified.toISOString();
     const messageCount = record.messageCount ?? fallback?.messageCount;
     const firstMessage = record.firstMessage ?? fallback?.firstMessage;
-    if (path === undefined || created === undefined || modified === undefined || messageCount === undefined || firstMessage === undefined)
+    if (path === undefined ||
+        created === undefined ||
+        modified === undefined ||
+        messageCount === undefined ||
+        firstMessage === undefined)
         return undefined;
     const name = record.name ?? fallback?.name;
     const parentSessionPath = record.parentSessionPath ?? fallback?.parentSessionPath;
@@ -2879,10 +3979,28 @@ function archivedTimestamp(record) {
 function isDefined(value) {
     return value !== undefined;
 }
-function mergeSessionMetadata(session, pinnedPaths) {
-    if (!pinnedPaths.has(session.path))
-        return session;
-    return { ...session, pinned: true };
+function mergeSessionMetadata(session, metadata) {
+    const entry = metadata[session.path];
+    const pinned = entry?.pinned === true;
+    const scope = session.parentSessionPath === undefined
+        ? { kind: "root", cwd: canonicalizeStoredCwd(session.cwd) }
+        : { kind: "children", parentSessionPath: session.parentSessionPath };
+    const order = entry?.order;
+    const manualOrder = session.archived !== true
+        && order?.pinned === pinned
+        && sessionReorderScopesEqual(order.scope, scope)
+        ? order.position
+        : undefined;
+    return {
+        ...session,
+        ...(pinned ? { pinned: true } : {}),
+        ...(manualOrder === undefined ? {} : { manualOrder }),
+    };
+}
+function sessionReorderScopesEqual(a, b) {
+    if (a.kind === "root")
+        return b.kind === "root" && a.cwd === b.cwd;
+    return b.kind === "children" && a.parentSessionPath === b.parentSessionPath;
 }
 /**
  * Resolve the delegation capability from server-owned, persisted session
@@ -2946,9 +4064,11 @@ function findReciprocalParentSubsessionLink(managers, parentSessionFile, parentS
         const link = parsePersistedParentSubsessionLink(entry);
         if (link === undefined)
             continue;
-        if (link.spawnedBySessionId !== parentSessionId || link.spawnedSessionId !== childSessionId)
+        if (link.spawnedBySessionId !== parentSessionId ||
+            link.spawnedSessionId !== childSessionId)
             continue;
-        if (link.spawnedSessionFile === undefined || !sessionPathsEqual(link.spawnedSessionFile, childSessionFile))
+        if (link.spawnedSessionFile === undefined ||
+            !sessionPathsEqual(link.spawnedSessionFile, childSessionFile))
             continue;
         return link;
     }
@@ -2958,7 +4078,9 @@ function trackedSubsessionLinkFromParentLink(parentSessionId, link, parentSessio
     return {
         parentSessionId,
         childSessionId: link.spawnedSessionId,
-        ...(link.spawnedSessionFile === undefined ? {} : { childSessionFile: link.spawnedSessionFile }),
+        ...(link.spawnedSessionFile === undefined
+            ? {}
+            : { childSessionFile: link.spawnedSessionFile }),
         parentSessionFile,
         ...(link.cwd === undefined ? {} : { cwd: link.cwd }),
     };
@@ -2968,7 +4090,9 @@ function persistedParentSubsessionLinkData(link) {
         version: 1,
         spawnedBySessionId: link.parentSessionId,
         spawnedSessionId: link.childSessionId,
-        ...(link.childSessionFile === undefined ? {} : { spawnedSessionFile: link.childSessionFile }),
+        ...(link.childSessionFile === undefined
+            ? {}
+            : { spawnedSessionFile: link.childSessionFile }),
         ...(link.cwd === undefined ? {} : { cwd: link.cwd }),
     };
 }
@@ -2980,33 +4104,45 @@ function persistedChildSubsessionLinkData(parentSessionId, childSessionId) {
     };
 }
 function parsePersistedParentSubsessionLink(entry) {
-    if (!isRecord(entry) || entry["type"] !== "custom" || entry["customType"] !== SUBSESSION_LINK_CUSTOM_TYPE)
+    if (!isRecord(entry) ||
+        entry["type"] !== "custom" ||
+        entry["customType"] !== SUBSESSION_LINK_CUSTOM_TYPE)
         return undefined;
     const data = entry["data"];
     if (!isRecord(data))
         return undefined;
     const spawnedBySessionId = getString(data, "spawnedBySessionId");
     const spawnedSessionId = getString(data, "spawnedSessionId");
-    if (spawnedBySessionId === undefined || spawnedBySessionId === "" || spawnedSessionId === undefined || spawnedSessionId === "")
+    if (spawnedBySessionId === undefined ||
+        spawnedBySessionId === "" ||
+        spawnedSessionId === undefined ||
+        spawnedSessionId === "")
         return undefined;
     const spawnedSessionFile = getString(data, "spawnedSessionFile");
     const cwd = getString(data, "cwd");
     return {
         spawnedBySessionId,
         spawnedSessionId,
-        ...(spawnedSessionFile === undefined || spawnedSessionFile === "" ? {} : { spawnedSessionFile }),
+        ...(spawnedSessionFile === undefined || spawnedSessionFile === ""
+            ? {}
+            : { spawnedSessionFile }),
         ...(cwd === undefined || cwd === "" ? {} : { cwd }),
     };
 }
 function parsePersistedChildSubsessionLink(entry) {
-    if (!isRecord(entry) || entry["type"] !== "custom" || entry["customType"] !== SUBSESSION_CHILD_LINK_CUSTOM_TYPE)
+    if (!isRecord(entry) ||
+        entry["type"] !== "custom" ||
+        entry["customType"] !== SUBSESSION_CHILD_LINK_CUSTOM_TYPE)
         return undefined;
     const data = entry["data"];
     if (!isRecord(data))
         return undefined;
     const spawnedBySessionId = getString(data, "spawnedBySessionId");
     const spawnedSessionId = getString(data, "spawnedSessionId");
-    if (spawnedBySessionId === undefined || spawnedBySessionId === "" || spawnedSessionId === undefined || spawnedSessionId === "")
+    if (spawnedBySessionId === undefined ||
+        spawnedBySessionId === "" ||
+        spawnedSessionId === undefined ||
+        spawnedSessionId === "")
         return undefined;
     return { spawnedBySessionId, spawnedSessionId };
 }
@@ -3031,13 +4167,16 @@ function sessionFileExists(sessionFile) {
 }
 function sessionFileMatches(session, expectedSessionFile) {
     const sessionFile = nonEmptyString(session.sessionFile);
-    return sessionFile !== undefined && expectedSessionFile !== undefined && sessionPathsEqual(sessionFile, expectedSessionFile);
+    return (sessionFile !== undefined &&
+        expectedSessionFile !== undefined &&
+        sessionPathsEqual(sessionFile, expectedSessionFile));
 }
 function activeSessionFileMatches(active, expectedSessionFile) {
     return sessionFileMatches(active.runtime.session, expectedSessionFile);
 }
 function trackedLinkParentFileMatches(link, parentSessionFile) {
-    return link.parentSessionFile !== undefined && sessionPathsEqual(link.parentSessionFile, parentSessionFile);
+    return (link.parentSessionFile !== undefined &&
+        sessionPathsEqual(link.parentSessionFile, parentSessionFile));
 }
 async function readSessionHeaderSummary(sessionFile) {
     let file;
@@ -3049,10 +4188,15 @@ async function readSessionHeaderSummary(sessionFile) {
         if (firstLine === undefined || firstLine === "")
             return undefined;
         const header = JSON.parse(firstLine);
-        if (!isRecord(header) || header["type"] !== "session" || typeof header["id"] !== "string")
+        if (!isRecord(header) ||
+            header["type"] !== "session" ||
+            typeof header["id"] !== "string")
             return undefined;
         const parentSession = getString(header, "parentSession");
-        return { id: header["id"], ...(parentSession === undefined ? {} : { parentSession }) };
+        return {
+            id: header["id"],
+            ...(parentSession === undefined ? {} : { parentSession }),
+        };
     }
     catch {
         return undefined;
@@ -3067,7 +4211,8 @@ async function sessionFileHeaderMatches(sessionFile, expected) {
         return false;
     if (expected.parentSessionFile === undefined)
         return true;
-    return header.parentSession !== undefined && sessionPathsEqual(header.parentSession, expected.parentSessionFile);
+    return (header.parentSession !== undefined &&
+        sessionPathsEqual(header.parentSession, expected.parentSessionFile));
 }
 async function clearParentSession(sessionFile) {
     const content = await readFile(sessionFile, "utf8");
@@ -3092,8 +4237,12 @@ function clearSessionQueue(session) {
 }
 function queuedMessagesFromSession(session, extraQueuedMessages = []) {
     return [
-        ...session.getSteeringMessages().map((text) => ({ kind: "steer", text })),
-        ...session.getFollowUpMessages().map((text) => ({ kind: "followUp", text })),
+        ...session
+            .getSteeringMessages()
+            .map((text) => ({ kind: "steer", text })),
+        ...session
+            .getFollowUpMessages()
+            .map((text) => ({ kind: "followUp", text })),
         ...extraQueuedMessages,
     ];
 }
@@ -3145,7 +4294,8 @@ function historyMessages(session) {
                 messages.push({
                     ...historyMessage,
                     entryId,
-                    ...(previousMessage?.role === "assistant" && previousMessage.entryId !== undefined
+                    ...(previousMessage?.role === "assistant" &&
+                        previousMessage.entryId !== undefined
                         ? { previousAssistantEntryId: previousMessage.entryId }
                         : {}),
                     ...(messages.length > 0 ? { canFork: true } : {}),
@@ -3158,17 +4308,30 @@ function historyMessages(session) {
             continue;
         }
         if (entry["type"] === "custom_message" && entry["display"] === true) {
-            messages.push({ role: "custom", content: entry["content"], customType: entry["customType"], details: entry["details"] });
+            messages.push({
+                role: "custom",
+                content: entry["content"],
+                customType: entry["customType"],
+                details: entry["details"],
+            });
             previousMessage = { role: "custom", entryId: undefined };
             continue;
         }
         if (entry["type"] === "compaction") {
-            messages.push({ role: "system", source: "compaction", content: `Compacted history:\n\n${stringValue(entry["summary"])}` });
+            messages.push({
+                role: "system",
+                source: "compaction",
+                content: `Compacted history:\n\n${stringValue(entry["summary"])}`,
+            });
             previousMessage = { role: "system", entryId: undefined };
             continue;
         }
         if (entry["type"] === "branch_summary") {
-            messages.push({ role: "system", source: "branch_summary", content: `Branch summary:\n\n${stringValue(entry["summary"])}` });
+            messages.push({
+                role: "system",
+                source: "branch_summary",
+                content: `Branch summary:\n\n${stringValue(entry["summary"])}`,
+            });
             previousMessage = { role: "system", entryId: undefined };
         }
     }
@@ -3201,7 +4364,9 @@ function finalAssistantText(messages) {
             continue;
         const texts = [];
         for (const part of content) {
-            if (isRecord(part) && part["type"] === "text" && typeof part["text"] === "string")
+            if (isRecord(part) &&
+                part["type"] === "text" &&
+                typeof part["text"] === "string")
                 texts.push(part["text"]);
         }
         if (texts.length > 0)
@@ -3212,23 +4377,52 @@ function finalAssistantText(messages) {
 function toClientEvent(event) {
     const eventType = getString(event, "type");
     const assistantMessageEvent = getProperty(event, "assistantMessageEvent");
-    if (eventType === "message_update" && getString(assistantMessageEvent, "type") === "text_delta") {
-        return { type: "assistant.delta", text: getString(assistantMessageEvent, "delta") ?? "" };
+    if (eventType === "message_update" &&
+        getString(assistantMessageEvent, "type") === "text_delta") {
+        return {
+            type: "assistant.delta",
+            text: getString(assistantMessageEvent, "delta") ?? "",
+        };
     }
-    if (eventType === "message_update" && getString(assistantMessageEvent, "type") === "thinking_delta") {
-        return { type: "assistant.thinking.delta", text: getString(assistantMessageEvent, "delta") ?? "" };
+    if (eventType === "message_update" &&
+        getString(assistantMessageEvent, "type") === "thinking_delta") {
+        return {
+            type: "assistant.thinking.delta",
+            text: getString(assistantMessageEvent, "delta") ?? "",
+        };
     }
     if (eventType === "tool_execution_start") {
         const args = getProperty(event, "args");
-        return { type: "tool.start", toolName: getString(event, "toolName") ?? "", toolCallId: getString(event, "toolCallId") ?? "", summary: summarizeToolArgs(args), args };
+        return {
+            type: "tool.start",
+            toolName: getString(event, "toolName") ?? "",
+            toolCallId: getString(event, "toolCallId") ?? "",
+            summary: summarizeToolArgs(args),
+            args,
+        };
     }
     if (eventType === "tool_execution_update") {
         const partialResult = getProperty(event, "partialResult");
-        return { type: "tool.update", toolName: getString(event, "toolName") ?? "", toolCallId: getString(event, "toolCallId") ?? "", text: stringifyToolResult(partialResult), content: toolResultContent(partialResult), details: toolResultDetails(partialResult) };
+        return {
+            type: "tool.update",
+            toolName: getString(event, "toolName") ?? "",
+            toolCallId: getString(event, "toolCallId") ?? "",
+            text: stringifyToolResult(partialResult),
+            content: toolResultContent(partialResult),
+            details: toolResultDetails(partialResult),
+        };
     }
     if (eventType === "tool_execution_end") {
         const result = getProperty(event, "result");
-        return { type: "tool.end", toolName: getString(event, "toolName") ?? "", toolCallId: getString(event, "toolCallId") ?? "", text: stringifyToolResult(result), content: toolResultContent(result), details: toolResultDetails(result), isError: getBoolean(event, "isError") === true };
+        return {
+            type: "tool.end",
+            toolName: getString(event, "toolName") ?? "",
+            toolCallId: getString(event, "toolCallId") ?? "",
+            text: stringifyToolResult(result),
+            content: toolResultContent(result),
+            details: toolResultDetails(result),
+            isError: getBoolean(event, "isError") === true,
+        };
     }
     if (eventType === "agent_start")
         return { type: "agent.start" };
@@ -3236,7 +4430,9 @@ function toClientEvent(event) {
         return { type: "agent.end" };
     if (eventType === "message_end") {
         const message = getProperty(event, "message");
-        return message === undefined ? { type: "message.end" } : { type: "message.end", message };
+        return message === undefined
+            ? { type: "message.end" }
+            : { type: "message.end", message };
     }
     return { type: "pi.event", eventType: eventType ?? "unknown" };
 }
@@ -3249,13 +4445,18 @@ function summarizeToolArgs(args) {
     const path = getString(args, "path");
     if (path !== undefined)
         return path;
-    if (typeof args["oldText"] === "string" && typeof args["newText"] === "string")
+    if (typeof args["oldText"] === "string" &&
+        typeof args["newText"] === "string")
         return "edit text replacement";
     const edits = args["edits"];
     if (Array.isArray(edits))
         return `${String(edits.length)} edit${edits.length === 1 ? "" : "s"}`;
-    const entries = Object.entries(args).filter(([, value]) => value != null).slice(0, 3);
-    return entries.map(([key, value]) => `${key}: ${shortToolValue(value)}`).join(" · ");
+    const entries = Object.entries(args)
+        .filter(([, value]) => value != null)
+        .slice(0, 3);
+    return entries
+        .map(([key, value]) => `${key}: ${shortToolValue(value)}`)
+        .join(" · ");
 }
 function shortToolValue(value) {
     if (typeof value === "string")
@@ -3288,11 +4489,16 @@ function stringifyToolResult(result) {
     if (typeof result === "string")
         return result;
     if (Array.isArray(result))
-        return result.map(stringifyToolResult).filter((text) => text !== "").join("\n");
+        return result
+            .map(stringifyToolResult)
+            .filter((text) => text !== "")
+            .join("\n");
     if (isRecord(result)) {
         if (getString(result, "type") === "image")
             return "[image]";
-        const text = getString(result, "text") ?? getString(result, "content") ?? getString(result, "output");
+        const text = getString(result, "text") ??
+            getString(result, "content") ??
+            getString(result, "output");
         if (text !== undefined)
             return text;
         const content = getProperty(result, "content");
@@ -3318,7 +4524,9 @@ function getBoolean(value, key) {
 }
 function providerOutputTokens(message) {
     const output = getProperty(getProperty(message, "usage"), "output");
-    return typeof output === "number" && Number.isFinite(output) && output > 0 ? output : undefined;
+    return typeof output === "number" && Number.isFinite(output) && output > 0
+        ? output
+        : undefined;
 }
 /** Match Pi Web's 4-characters-per-token live approximation. */
 function estimatedOutputTokens(message) {
@@ -3353,7 +4561,9 @@ function stringifyPrimitive(value) {
         return "";
     if (typeof value === "string")
         return value;
-    if (typeof value === "number" || typeof value === "boolean" || typeof value === "bigint")
+    if (typeof value === "number" ||
+        typeof value === "boolean" ||
+        typeof value === "bigint")
         return String(value);
     return "";
 }