@tea-agent/loop-agent 0.33.7-beta.0 → 0.34.0

package/dist/worker/console/chat/pi-runtime.js

@@ -9,60 +9,64 @@
  *   - Chat sessions are persisted to a DEDICATED sessionDir (not the user's
  *     default ~/.pi/agent/sessions). Naming prefix `operator-chat-` makes them
  *     auditable and cleanable (plan Q4 / Q8).
- *   - The ResourceLoader is configured to NOT auto-load user extensions/skills
- *     (noContextFiles / closed surface); credential/model plane is shared via
- *     the same agentDir auth.json/models.json.
+ *   - The ResourceLoader uses the SDK's standard OPEN surface (ADR 0012):
+ *     user/project AGENTS.md context files, user (~/.pi/agent/skills/) and
+ *     project (.agents/skills/ init projection) skills, and user/project
+ *     extensions all load via the SDK DefaultResourceLoader; credential/model
+ *     plane is shared via the same agentDir auth.json/models.json.
  *   - Active tools are pinned to the operator-chat surface at session create
  *     AND re-pinned before each prompt (three-gate, design §7.5 / ADR 0011):
  *     the FULL operator action set PLUS full Pi builtins
- *     (read/write/edit/bash/grep/find/ls) and optional safe-*. Non-Pi write
+ *     (read/write/edit/bash/grep/find/ls) and optional safe-*, PLUS extension
+ *     tools registered by user/project extensions (ADR 0012). Non-Pi write
  *     channels (apply_patch/full-tools/shell/coding-chat) stay excluded.
  *
  * The actual SDK calls are injected via `PiSdkBindings` so this module is
  * unit-testable without a live Pi install. Production bindings come from
  * `createDefaultPiSdkBindings()`.
  */
-import { randomBytes } from "node:crypto";
+import { createHash, randomBytes } from "node:crypto";
 import { access } from "node:fs/promises";
 import path from "node:path";
 import { projectCompactSnapshot, } from "./chat-event-store.js";
 import { extractUsageSample } from "./usage.js";
 import { OPERATOR_CHAT_ALLOWED_TOOLS, authorizeOperatorChatTool, assertNoWriteToolInList, } from "./tools.js";
 import { createOperatorChatResourceLoader, } from "./resource-loader.js";
-import { loadOperatorChatInstructionSkills, composeInstructionSkillsPrompt, OPERATOR_CHAT_ALLOWED_INSTRUCTION_SKILLS, } from "./instruction-skills.js";
 import { buildModelCallableToolSchemas } from "./tool-adapter.js";
-import { resolveDefaultChatModel, } from "./model-resolver.js";
+import { resolveDefaultChatModel, resolveLowChatModel, } from "./model-resolver.js";
 import { filterActiveInterviewTools } from "../interview/tools.js";
+import { RUNTIME_CONTEXT_TEXT_MAX, redactRuntimeText, } from "./runtime-context.js";
 /**
  * Base system prompt fragment every General Operator Chat session receives.
  *
- * Establishes the operator-vs-implementer role boundary (ADR 0005 D2) and the
- * current tool surface contract (2026-07-25 widening): the Chat exposes the
- * FULL operator action surface (all registry actions, including high-risk
- * mutations like contractApply / runDag / dagRerun) PLUS the built-in
- * read/explore tools (bash / read / grep / find / ls). The ONLY thing still
- * forbidden is direct file-WRITING via coding tools (edit / write /
- * apply_patch / full-tools / shell / coding-chat) — those are excluded from
- * the SDK registry entirely and can never be activated.
+ * 2026-08-11 (ADR 0013): this is a SHORT runtime responsibility layer only.
+ * Project governance (operator-only policy, allowedPaths/forbiddenPaths,
+ * writer writeSet, taskKind routing, verification matrix, DAG recovery
+ * commands, closeout) lives in the loaded target-project AGENTS.md. The
+ * prompt below covers: Operator identity, the real tool surface (operator_*
+ * first + Pi tools, obey AGENTS.md), denied non-Pi runtimes, safe-* probes,
+ * init/init-upgrade fallback for uninitialized repos, DAG supervision with
+ * 15/30/60s adaptive polling (operationGet/status/dagReport/dagDoctor), R2
+ * recovery (fresh eligible dagRerunPlan → dagRerun; ineligible → same-task
+ * rerun/advance, resume, Worker retry) and G2 bounded writeSet auto-approval.
  *
- * Instruction skills are appended AFTER this as read-only context (plan D1).
+ * The old Human Gate tutorial paragraphs (prepare + browser Human Gate,
+ * "confirmDagConfirmation is a human-only action", the long "Recovery default
+ * order" table) are REMOVED — bounded DAGs start and recover autonomously
+ * (AC-01: ≤ 1900 chars and ≤ 80% of the 2498-char baseline).
  */
 export const OPERATOR_CHAT_SYSTEM_PROMPT_BASE = [
     "You are the General Operator Chat for loop-agent / agent-worker.",
-    "You are an OPERATOR first: orchestrate and inspect via operator_* tools, and you also have full Pi repository tools (read, write, edit, bash, grep, find, ls) plus optional safe-read/safe-grep/git-status/git-diff.",
-    "Capability honesty (ADR 0011): read/write/edit/bash ARE available. Prefer governed loop-agent / Agent DAG paths (implement-pi / repair-pi) and Human Gate for large refactors, public contracts, credentials, or production-risk changes — treat direct write/edit/bash as soft-disciplined, not as a second DAG kernel.",
-    "safe-read / safe-grep enforce a repo-relative path boundary, a sensitive-file denylist (.env* / *.key / *.pem / .git/** / auth.json / sessions/**) and secret scrubbing. Prefer them for sensitive probes; avoid dumping secrets via raw read/bash.",
-    "You do NOT have apply_patch / full-tools / shell / coding-chat as alternate coding runtimes — those non-Pi channels stay denied.",
-    "High-risk mutations still use prepare + browser Human Gate. Prepare contract via interview then apply via contractApply, prepare DAG runs via prepareDagConfirmation, prepare other mutations via prepareMutationGate, then confirm in the browser Human Gate. When a high-risk action (contractApply / runDag / dagRerun / etc.) fails on missing prepared state, diagnose with status/doctor/dagReport/inspect/contractShow/read/safe-read/safe-grep.",
-    "You cannot self-confirm a DAG run: confirmDagConfirmation is a human-only action (executed by the browser with a server-signed confirmation token). You may only prepare it via prepareDagConfirmation; the user must confirm in the UI.",
-    "Prefer read-only diagnosis (status, doctor, dagReport, inspect, contractShow, read, safe-read, safe-grep, git-status) before mutating.",
-    "Recovery default order (save tokens/time; do NOT open a new task-id for provider flake): (1) dagReport/doctor/status — read primaryFailure.nodeId + primaryRecovery; (2) for completed failed|partial_failed standalone runs prefer dagRerunPlan then prepareMutationGate/dagRerun from the failed or safe upstream node (plan → planHash → human gate); (3) paused → approve path / resume, never treat resume as failure retry; (4) only when plan is ineligible (writer/decision/fingerprint) or contract/source truly changed: standaloneTaskRerun or same-task task advance — never invent a fresh task-id without cause; (5) Worker-owned failures use workerTaskRetry, not dagRerun. Never use direct write/edit as a substitute for repair-pi.",
+    "Operate through operator_* tools first. Pi read/write/edit/bash/grep/find/ls are available, but obey the loaded repository AGENTS.md. apply_patch, full-tools, shell, and coding-chat are denied alternate runtimes. Prefer safe-read/safe-grep for sensitive probes.",
+    "If a repository has no loop-agent harness and the user requests initialization, run `loop-agent init instructions --repo-root .` then `loop-agent init --repo-root . --profile full --merge`; finish the generated setup, init doctor, inspect, docs audit, and quick verification. For updates use `loop-agent init upgrade --repo-root . --json` until stable; use init check-update only for an explicitly read-only request.",
+    "After a DAG is started or accepted, do not end on accepted/queued/running or an operationId. Supervise it to a terminal outcome. Poll operationGet, task status, dagReport, and dagDoctor after about 15 seconds on start/change, every 30 seconds during progress, and every 60 seconds after 3 minutes unchanged. Report only meaningful node/rank changes, review/verify/closeout, recovery, liveness concerns, and terminal outcomes.",
+    "On failure read primaryFailure, primaryRecovery, and doctor evidence. If meaningful progress exists, wait. Otherwise use a fresh eligible dagRerunPlan and rerun its safe node; when ineligible follow AGENTS.md/runtime recovery for same-task rerun/advance, resume, or Worker retry. Auto-approve only a bounded writeSet inside allowedPaths, outside forbiddenPaths, without broad/destructive risk, and with structured verification.",
+    "Continue until success, user stop, or no safe eligible recovery remains because limits, bindings, auth/quota recovery, or required external authorization are exhausted. Never create a new task for a transient failure or replace repair-pi with direct edits.",
 ].join("\n");
 /** Compose the inspectable system prompt actually injected into Operator Chat. */
 export function composeOperatorChatSystemPrompt(input) {
     return [
         OPERATOR_CHAT_SYSTEM_PROMPT_BASE,
-        ...(input.skillFragment?.trim() ? [input.skillFragment.trim()] : []),
         ...(input.systemPromptSuffix?.trim()
             ? [input.systemPromptSuffix.trim()]
             : []),
@@ -102,6 +106,49 @@ export function OPERATOR_CHAT_ACTIVE_TOOL_NAMES() {
         ...OPERATOR_CHAT_SAFE_EXPLORE_TOOL_IDS,
     ];
 }
+/**
+ * Non-Pi write / coding channels that must never be activated in Operator
+ * Chat even when a user/project extension registers them (ADR 0011 / 0012).
+ * Mirrors the NON_PI_WRITE_CHANNELS guard in tools.ts for the Gate 2 pin.
+ */
+const OPERATOR_CHAT_EXTENSION_DENIED_TOOL_IDS = new Set([
+    "apply_patch",
+    "apply-patch",
+    "full-tools",
+    "full_tools",
+    "coding-chat",
+    "coding_chat",
+    "shell",
+].map((t) => t.toLowerCase()));
+/**
+ * Gate 2 active-tool set for a live session (ADR 0012): the operator-chat
+ * baseline (operator actions + Pi builtins + safe explore) PLUS extension
+ * tools registered by user/project extensions. SDK setActiveToolsByName is
+ * REPLACEMENT-style, so extension tools would be disabled by the fixed
+ * baseline; this helper re-adds every registry tool that is not part of the
+ * baseline and not on the deny surface (apply_patch/full-tools/shell/
+ * coding-chat). Unknown/denied names are never activated; Gate 3 still
+ * re-authorizes every tool call per invocation.
+ */
+export function computeOperatorChatActiveToolNames(session) {
+    const baseline = OPERATOR_CHAT_ACTIVE_TOOL_NAMES();
+    if (!session?.getAllTools)
+        return baseline;
+    const baselineLower = new Set(baseline.map((t) => t.toLowerCase()));
+    const extras = [];
+    for (const tool of session.getAllTools()) {
+        const name = tool?.name;
+        if (!name || typeof name !== "string")
+            continue;
+        const lower = name.toLowerCase();
+        if (baselineLower.has(lower))
+            continue;
+        if (OPERATOR_CHAT_EXTENSION_DENIED_TOOL_IDS.has(lower))
+            continue;
+        extras.push(name);
+    }
+    return extras.length > 0 ? [...baseline, ...extras] : baseline;
+}
 /**
  * Build Pi custom ToolDefinition objects for every whitelisted operator action.
  * Each tool's execute() routes into the operator action dispatcher (Gate 3).
@@ -382,6 +429,138 @@ export const THINKING_LEVELS = [
     "xhigh",
     "max",
 ];
+/**
+ * Structured critical-failure error for snapshot projection (RF-02). Model
+ * enumeration or system prompt projection failures throw this so consuming
+ * routes can return 503 PI_RUNTIME_UNAVAILABLE instead of a fake-empty 200.
+ * Partial ResourceLoader / package-inventory failures are NOT critical — they
+ * keep the 200 snapshot and surface as structured diagnostics instead.
+ */
+export class RuntimeSnapshotUnavailableError extends Error {
+    code = "PI_RUNTIME_UNAVAILABLE";
+    constructor(message) {
+        super(message);
+        this.name = "RuntimeSnapshotUnavailableError";
+    }
+}
+/**
+ * Browser-safe projection of a live runtime snapshot (design §2.2 / RF-03).
+ *
+ * Every browser-visible string runs the shared secret-scrub chain
+ * (scrubSecrets + ghp_/Bearer redaction via redactRuntimeText) and a fixed
+ * per-field length limit: 200 (names/spec/source/origin), 400 (paths/errors/
+ * diagnostic messages), 600 (skill descriptions), 80 (package versions);
+ * truncation uses the fixed `…[truncated N chars …]` marker. The server-only
+ * `raw` prompt and the RAW-based `sha256`/`characters` pass through untouched,
+ * and real empty lists stay empty.
+ *
+ * Pure + deterministic and exported so the route harness reuses the exact
+ * production implementation (same code path as getRuntimeSnapshot).
+ */
+export function projectRuntimeSnapshot(input) {
+    const field = (value, max) => value === undefined ? undefined : redactRuntimeText(value, max);
+    const projectSkill = (skill) => ({
+        name: field(skill.name, 200) ?? "",
+        description: field(skill.description, 600) ?? "",
+        path: field(skill.path, 400) ?? "",
+        ...(skill.baseDir ? { baseDir: field(skill.baseDir, 400) } : {}),
+        scope: skill.scope,
+        source: field(skill.source, 200) ?? "",
+        enabled: skill.enabled,
+        diagnostics: skill.diagnostics.map((diag) => field(diag, 400) ?? ""),
+    });
+    const projectExtension = (ext) => ({
+        name: field(ext.name, 200) ?? "",
+        path: field(ext.path, 400) ?? "",
+        ...(ext.resolvedPath
+            ? { resolvedPath: field(ext.resolvedPath, 400) }
+            : {}),
+        source: field(ext.source, 200) ?? "",
+        scope: ext.scope,
+        ...(ext.origin ? { origin: field(ext.origin, 200) } : {}),
+        enabled: ext.enabled,
+        ...(ext.error ? { error: field(ext.error, 400) } : {}),
+    });
+    const projectPackage = (pkg) => ({
+        spec: field(pkg.spec, 200) ?? "",
+        scope: pkg.scope,
+        enabled: pkg.enabled,
+        ...(pkg.version ? { version: field(pkg.version, 80) } : {}),
+        ...(pkg.configuredVersion
+            ? { configuredVersion: field(pkg.configuredVersion, 80) }
+            : {}),
+        ...(pkg.packageName ? { packageName: field(pkg.packageName, 200) } : {}),
+        ...(pkg.path ? { path: field(pkg.path, 400) } : {}),
+        ...(pkg.installedPath ? { installedPath: field(pkg.installedPath, 400) } : {}),
+        ...(pkg.cwd ? { cwd: field(pkg.cwd, 400) } : {}),
+        resolved: pkg.resolved.map((resource) => ({
+            type: resource.type,
+            name: field(resource.name, 200) ?? "",
+            path: field(resource.path, 400) ?? "",
+            source: field(resource.source, 200) ?? "",
+            scope: resource.scope,
+        })),
+        diagnostics: pkg.diagnostics.map((diag) => field(diag, 400) ?? ""),
+    });
+    const projectDiagnostic = (diag) => ({
+        type: diag.type,
+        ...(diag.code ? { code: diag.code } : {}),
+        message: field(diag.message, 400) ?? "",
+        ...(diag.path ? { path: field(diag.path, 400) } : {}),
+        ...(diag.retryable !== undefined
+            ? { retryable: diag.retryable }
+            : {}),
+    });
+    return {
+        sessionId: input.sessionId,
+        revision: input.revision,
+        loadedAt: input.loadedAt,
+        selection: {
+            ...(input.selection.model
+                ? {
+                    model: {
+                        provider: input.selection.model.provider,
+                        id: input.selection.model.id,
+                        ...(input.selection.model.name
+                            ? { name: field(input.selection.model.name, 200) }
+                            : {}),
+                    },
+                }
+                : {}),
+            thinkingSelection: input.selection.thinkingSelection,
+            ...(input.selection.effectiveThinkingLevel
+                ? { effectiveThinkingLevel: input.selection.effectiveThinkingLevel }
+                : {}),
+        },
+        models: input.models.map((model) => ({
+            provider: model.provider,
+            id: model.id,
+            ...(model.name ? { name: field(model.name, 200) } : {}),
+            ...(model.hasCredentials !== undefined
+                ? { hasCredentials: model.hasCredentials }
+                : {}),
+        })),
+        thinkingLevels: input.thinkingLevels.map((option) => ({ ...option })),
+        systemPrompt: {
+            ...(input.systemPrompt.raw !== undefined
+                ? { raw: input.systemPrompt.raw }
+                : {}),
+            text: redactRuntimeText(input.systemPrompt.text, RUNTIME_CONTEXT_TEXT_MAX),
+            sha256: input.systemPrompt.sha256,
+            characters: input.systemPrompt.characters,
+        },
+        activeTools: [...input.activeTools],
+        contextFiles: input.contextFiles.map((file) => ({
+            path: field(file.path, 400) ?? "",
+            characters: file.characters,
+        })),
+        skills: input.skills.map(projectSkill),
+        extensions: input.extensions.map(projectExtension),
+        packages: input.packages.map(projectPackage),
+        diagnostics: input.diagnostics.map(projectDiagnostic),
+        hasBash: input.hasBash,
+    };
+}
 /**
  * Extract the latest assistant text fragment from an SDK message object.
  * Tolerant of multiple message shapes the SDK emits.
@@ -423,6 +602,33 @@ function readSessionManagerId(manager) {
     }
     return undefined;
 }
+function readSessionManagerFile(manager) {
+    if (!manager || typeof manager !== "object")
+        return undefined;
+    const record = manager;
+    if (typeof record.getSessionFile === "function") {
+        try {
+            const value = record.getSessionFile();
+            if (typeof value === "string" && value.trim())
+                return value;
+        }
+        catch {
+            // ignore
+        }
+    }
+    if (typeof record.sessionFile === "string" && record.sessionFile.trim()) {
+        return record.sessionFile;
+    }
+    return undefined;
+}
+/** Structured materialization failure for dependent Chat endpoints. */
+export class PiSessionInitFailedError extends Error {
+    code = "PI_SESSION_INIT_FAILED";
+    constructor(message) {
+        super(message);
+        this.name = "PiSessionInitFailedError";
+    }
+}
 /**
  * Console Pi runtime — holds Chat sessions and drives prompt() with three-gate
  * tool enforcement. Session-per-sessionId; cross-request reuse via open().
@@ -433,9 +639,27 @@ export class ConsolePiRuntime {
     sessions = new Map();
     modelRuntimes = new Map();
     sessionManagers = new Map();
+    /** Per-session SDK service scope (resourceLoader / settingsManager) used by the live runtime snapshot. */
+    serviceScopes = new Map();
+    /** Snapshot revision: bumped on create / reopen / model / thinking / reload. */
+    revisions = new Map();
+    /** RF-01: per-session reload in-flight lock (concurrent second call → PI_SESSION_BUSY). */
+    reloadInFlight = new Set();
+    /** At most one detached automatic-title task per durable Console session. */
+    titleInFlight = new Set();
+    /** Composer thinking selection ("auto" = no explicit override). */
+    thinkingSelections = new Map();
     mainlineLeaves = new Map();
+    /** Per-sessionId single-flight materialization (create fast-path / readiness fence). */
+    sessionInit = new Map();
+    /** Resolved model binding after materialization (create may return before this is known). */
+    sessionModels = new Map();
+    /** SessionIds disposed while materialization was still in flight. */
+    disposedSessions = new Set();
+    /** Session-less tool definition caches (no AgentSession state). */
+    operatorCustomToolsPromise;
+    exploreCustomToolsPromise;
     bindings;
-    disabledInstructionSkills = new Set();
     constructor(options) {
         this.options = options;
         this.loader = createOperatorChatResourceLoader();
@@ -461,9 +685,6 @@ export class ConsolePiRuntime {
             })),
         };
     }
-    setDisabledInstructionSkills(names) {
-        this.disabledInstructionSkills = new Set(names);
-    }
     /** Operator action context used by custom-tool dispatchers (Gate 3). */
     get actionContext() {
         return this.options.actionContext;
@@ -472,18 +693,20 @@ export class ConsolePiRuntime {
      * Resolve the Chat default model descriptor from harness.json
      * executors.pi.MED + the SDK available-model list. Returns undefined when
      * harness is unset or no provider surfaces the model. No hardcoded fallback.
+     *
+     * Prefer reusing an already-built modelRuntime (same services object as
+     * formal materialization) so create does not construct throwaway services.
      */
-    async resolveDefaultModel() {
+    async resolveDefaultModel(modelRuntime) {
         let available;
         try {
-            // Build a throwaway services just to read modelRuntime.snapshot. This is
-            // cheap (SDK caches); tests inject bindings that stub listAvailableModels.
-            const { services } = await this.bindings.createServices({
-                cwd: this.options.cwd,
-                agentDir: await safeGetAgentDir(this.bindings),
-            });
+            const runtime = modelRuntime ??
+                (await this.bindings.createServices({
+                    cwd: this.options.cwd,
+                    agentDir: await safeGetAgentDir(this.bindings),
+                })).services.modelRuntime;
             available = this.bindings.listAvailableModels({
-                modelRuntime: services.modelRuntime,
+                modelRuntime: runtime,
             });
         }
         catch {
@@ -498,65 +721,120 @@ export class ConsolePiRuntime {
         };
     }
     /**
-     * Load the operator-context instruction skills (plan D1) and compose the
-     * read-only methodology fragment for the Chat system prompt. Returns an
-     * empty string when no skills load (e.g. skills dir missing) so the
-     * session still boots — skills are context, not a hard dependency.
+     * Fast create: durable SessionManager/JSONL shell first, then single-flight
+     * AgentSession materialization in the background. 201 may report
+     * `initializing: true`; dependent routes wait on the same promise.
      */
-    async composeSystemPromptSkills() {
-        try {
-            const result = await loadOperatorChatInstructionSkills(this.options.skillsDir, OPERATOR_CHAT_ALLOWED_INSTRUCTION_SKILLS.filter((name) => !this.disabledInstructionSkills.has(name)));
-            return composeInstructionSkillsPrompt(result.loaded);
+    async createSession(init) {
+        const sessionId = `operator-chat-${randomBytes(12).toString("hex")}`;
+        this.disposedSessions.delete(sessionId);
+        const sessionManager = await this.bindings.createSessionManager({
+            cwd: this.options.cwd,
+            sessionDir: this.options.sessionDir,
+            sessionId,
+        });
+        const sessionFile = readSessionManagerFile(sessionManager);
+        if (!sessionFile) {
+            throw new Error(`chat session shell missing sessionFile for ${sessionId}`);
         }
-        catch (error) {
-            process.stderr.write(`[console] chat instruction-skills load failed: ${error instanceof Error ? error.message : String(error)}\n`);
-            return "";
+        this.sessionManagers.set(sessionId, sessionManager);
+        this.thinkingSelections.set(sessionId, "auto");
+        // Detached single-flight materialization; dependent routes await the same promise.
+        void this.startMaterialization(sessionId, {
+            sessionManager,
+            model: init?.model,
+            systemPromptSuffix: init?.systemPromptSuffix,
+            // Create path must resolve default model from the SAME services object
+            // used for formal materialization (no throwaway createServices).
+            resolveDefaultModel: !init?.model,
+        });
+        return {
+            sessionId,
+            sessionFile,
+            createdAt: new Date().toISOString(),
+            model: init?.model,
+            activeTools: OPERATOR_CHAT_ACTIVE_TOOL_NAMES(),
+            initializing: true,
+        };
+    }
+    /**
+     * Wait for single-flight materialization. Ready sessions resolve immediately;
+     * failed materialization throws PiSessionInitFailedError.
+     */
+    async ensureSessionReady(sessionId) {
+        const state = this.sessionInit.get(sessionId);
+        if (!state) {
+            if (this.sessions.has(sessionId))
+                return;
+            throw new Error(`chat session not found: ${sessionId}`);
+        }
+        if (state.status === "ready")
+            return;
+        if (state.status === "failed")
+            throw state.error;
+        await state.promise;
+        const next = this.sessionInit.get(sessionId);
+        if (next?.status === "failed")
+            throw next.error;
+        if (this.disposedSessions.has(sessionId) || !this.sessions.has(sessionId)) {
+            throw new Error(`chat session not found: ${sessionId}`);
         }
     }
-    /** Create a new isolated Chat session pinned to the operator-chat tool set. */
-    async createSession(init) {
-        const sessionId = `operator-chat-${randomBytes(12).toString("hex")}`;
+    startMaterialization(sessionId, init) {
+        const existing = this.sessionInit.get(sessionId);
+        if (existing?.status === "initializing")
+            return existing.promise;
+        if (existing?.status === "ready")
+            return Promise.resolve();
+        if (existing?.status === "failed")
+            return Promise.reject(existing.error);
+        const promise = this.materializeSession(sessionId, init)
+            .then(() => {
+            if (this.disposedSessions.has(sessionId)) {
+                // Late materialization after delete: never register ready state.
+                this.sessionInit.delete(sessionId);
+                return;
+            }
+            this.sessionInit.set(sessionId, { status: "ready" });
+        })
+            .catch((error) => {
+            const failed = new PiSessionInitFailedError(error instanceof Error ? error.message : String(error));
+            if (!this.disposedSessions.has(sessionId)) {
+                this.sessionInit.set(sessionId, { status: "failed", error: failed });
+            }
+            else {
+                this.sessionInit.delete(sessionId);
+            }
+            // Observe rejection so detached create path has no unhandled rejection.
+            process.stderr.write(`[console] chat session init failed (${sessionId}): ${failed.message}\n`);
+        });
+        this.sessionInit.set(sessionId, { status: "initializing", promise });
+        return promise;
+    }
+    async materializeSession(sessionId, init) {
+        if (this.disposedSessions.has(sessionId))
+            return;
         const agentDir = await safeGetAgentDir(this.bindings);
-        // Resolve default model from harness.json executors.pi.MED (no hardcode).
-        // Caller may pass an explicit model; otherwise we read the repo harness and
-        // search the SDK available-model list for a credentialled provider.
-        let model = init?.model;
-        if (!model) {
-            const resolved = await this.resolveDefaultModel();
-            if (resolved)
-                model = resolved;
-        }
-        // Final fallback only when nothing resolved: let the SDK pick its default
-        // (we do NOT hardcode a provider here).
-        // Load operator-context instruction skills (plan D1) and compose the
-        // read-only methodology fragment injected into the Chat system prompt.
-        // Skills are NEVER registered as executable tools (D1 hard rule).
-        const skillFragment = await this.composeSystemPromptSkills();
         const appendSystemPrompt = [
             OPERATOR_CHAT_SYSTEM_PROMPT_BASE,
-            ...(skillFragment ? [skillFragment] : []),
-            ...(init?.systemPromptSuffix ? [init.systemPromptSuffix] : []),
+            ...(init.systemPromptSuffix ? [init.systemPromptSuffix] : []),
         ];
+        // Single services construction for formal materialization (+ optional
+        // default-model resolve from the same modelRuntime).
         const { services } = await this.bindings.createServices({
             cwd: this.options.cwd,
             agentDir,
             resourceLoaderOptions: {
-                // Closed surface: do not load user/project extensions, skills,
-                // AGENTS.md, context files. The Chat tool surface is fixed by
-                // the whitelist, not by filesystem discovery.
-                noContextFiles: true,
-                noSkills: true,
-                noExtensions: true,
-                // Inject the audited instruction skills as READ-ONLY context
-                // (plan D1). appendSystemPrompt is the SDK's documented entry
-                // point for adding system-prompt text without enabling tools.
                 appendSystemPrompt,
             },
         });
+        if (this.disposedSessions.has(sessionId))
+            return;
         const modelRuntime = services.modelRuntime;
-        // Resolve the concrete SDK model only when we have a descriptor. When no
-        // model is resolved (harness unset + no snapshot match), we omit `model`
-        // and let the SDK session use its own default (no hardcoded fallback).
+        let model = init.model;
+        if (!model && init.resolveDefaultModel) {
+            model = await this.resolveDefaultModel(modelRuntime);
+        }
         const resolvedModel = model
             ? (this.bindings.resolveModel({
                 modelRuntime,
@@ -564,61 +842,13 @@ export class ConsolePiRuntime {
                 modelId: model.modelId,
             }) ?? undefined)
             : undefined;
-        const sessionManager = await this.bindings.createSessionManager({
-            cwd: this.options.cwd,
-            sessionDir: this.options.sessionDir,
-            sessionId,
-        });
-        // Gate 1: pin the tool set at session create. assertNoWriteTool guards
-        // that no file-WRITING coding tool slipped into the allowed list (bash
-        // is intentionally allowed since the 2026-07-25 widening).
         assertNoWriteToolInList(OPERATOR_CHAT_ALLOWED_TOOLS);
-        // Build custom Pi tools that route whitelisted operator actions into
-        // the dispatcher (Gate 3 lives inside each tool's execute()).
-        let operatorCustomTools = [];
-        if (this.options.actionContext) {
-            try {
-                operatorCustomTools = await buildCustomOperatorTools({
-                    actionContext: this.options.actionContext,
-                });
-            }
-            catch (error) {
-                // If custom-tool build fails (e.g. typebox unavailable), fall back to
-                // a tool-less session — Chat still works as text-only, and the
-                // failure is surfaced via doctor / readiness diagnostics.
-                process.stderr.write(`[console] chat custom-tools build failed: ${error instanceof Error ? error.message : String(error)}\n`);
-            }
-        }
-        // M0-A: also register the safe explore tools (safe-read / safe-grep /
-        // git-status / git-diff) so the model can probe the repo without bash.
-        let exploreCustomTools = [];
-        try {
-            exploreCustomTools = await buildExploreCustomTools({
-                repoRoot: this.options.cwd,
-            });
-        }
-        catch (error) {
-            process.stderr.write(`[console] chat explore-tools build failed: ${error instanceof Error ? error.message : String(error)}\n`);
-        }
-        const customTools = [...operatorCustomTools, ...exploreCustomTools];
-        // Tool surface (roadmap M0):
-        //   - ALL model-callable operator actions are registered as customTools.
-        //   - Safe explore tools (safe-read / safe-grep / git-status / git-diff)
-        //     are also registered as customTools (bash is GONE — M0-A removes
-        //     the write-via-redirect escape).
-        //   - Built-in find/ls are registered by passing `tools:` (Gate 1). The
-        //     default builtin read/bash/edit/write are EXCLUDED: read/bash/grep
-        //     are replaced by the safe custom versions above; edit/write stay
-        //     excluded (file-writing never activated).
-        //     by passing `tools: OPERATOR_CHAT_BUILTIN_EXPLORE_TOOLS` (Gate 1).
-        //     This is REQUIRED: the SDK's default builtin set is only
-        //     `read, bash, edit, write` (grep/find/ls are NOT default builtins —
-        //     see SDK CreateAgentSessionOptions.tools docs). Without `tools`, the
+        const customTools = await this.loadCustomTools();
+        if (this.disposedSessions.has(sessionId))
+            return;
         const { session } = await this.bindings.createSessionFromServices({
             services,
-            sessionManager,
-            // Gate 1 (ADR 0011): full Pi builtins registered; only non-Pi write
-            // channels excluded (apply_patch / full-tools / shell / coding-chat).
+            sessionManager: init.sessionManager,
             tools: [...OPERATOR_CHAT_BUILTIN_EXPLORE_TOOLS],
             excludeTools: [
                 "apply_patch",
@@ -629,23 +859,82 @@ export class ConsolePiRuntime {
                 "coding_chat",
                 "shell",
             ],
-            ...(customTools && customTools.length > 0 ? { customTools } : {}),
+            ...(customTools.length > 0 ? { customTools } : {}),
             ...(resolvedModel ? { model: resolvedModel } : {}),
         });
-        // Gate 2: re-pin active tools (defensive — some SDK paths may seed
-        // defaults). Active set = all operator actions + built-in explore tools.
-        // File-writing tools are excluded above and thus cannot appear here.
-        session.setActiveToolsByName(OPERATOR_CHAT_ACTIVE_TOOL_NAMES());
+        if (this.disposedSessions.has(sessionId)) {
+            try {
+                session.dispose();
+            }
+            catch {
+                // ignore late dispose cleanup
+            }
+            return;
+        }
+        session.setActiveToolsByName(computeOperatorChatActiveToolNames(session));
+        // Register then re-check dispose race: a concurrent dispose must win.
         this.sessions.set(sessionId, session);
-        this.sessionManagers.set(sessionId, sessionManager);
+        this.sessionManagers.set(sessionId, init.sessionManager);
         this.modelRuntimes.set(sessionId, modelRuntime);
-        return {
-            sessionId,
-            sessionFile: session.sessionFile,
-            createdAt: new Date().toISOString(),
-            model,
-            activeTools: session.getActiveToolNames(),
-        };
+        this.sessionModels.set(sessionId, model);
+        this.serviceScopes.set(sessionId, {
+            resourceLoader: services.resourceLoader,
+            settingsManager: services.settingsManager,
+        });
+        this.revisions.set(sessionId, 1);
+        if (!this.thinkingSelections.has(sessionId)) {
+            this.thinkingSelections.set(sessionId, "auto");
+        }
+        if (this.disposedSessions.has(sessionId)) {
+            try {
+                session.dispose();
+            }
+            catch {
+                // ignore
+            }
+            this.sessions.delete(sessionId);
+            this.sessionManagers.delete(sessionId);
+            this.modelRuntimes.delete(sessionId);
+            this.sessionModels.delete(sessionId);
+            this.serviceScopes.delete(sessionId);
+            this.revisions.delete(sessionId);
+            this.thinkingSelections.delete(sessionId);
+        }
+    }
+    /** Cached session-less custom tool definitions (operator + explore). */
+    async loadCustomTools() {
+        const [operatorCustomTools, exploreCustomTools] = await Promise.all([
+            this.loadOperatorCustomTools(),
+            this.loadExploreCustomTools(),
+        ]);
+        return [...operatorCustomTools, ...exploreCustomTools];
+    }
+    loadOperatorCustomTools() {
+        if (!this.options.actionContext)
+            return Promise.resolve([]);
+        if (!this.operatorCustomToolsPromise) {
+            this.operatorCustomToolsPromise = buildCustomOperatorTools({
+                actionContext: this.options.actionContext,
+            }).catch((error) => {
+                process.stderr.write(`[console] chat custom-tools build failed: ${error instanceof Error ? error.message : String(error)}\n`);
+                // Allow a later create/reopen to retry after a transient failure.
+                this.operatorCustomToolsPromise = undefined;
+                return [];
+            });
+        }
+        return this.operatorCustomToolsPromise;
+    }
+    loadExploreCustomTools() {
+        if (!this.exploreCustomToolsPromise) {
+            this.exploreCustomToolsPromise = buildExploreCustomTools({
+                repoRoot: this.options.cwd,
+            }).catch((error) => {
+                process.stderr.write(`[console] chat explore-tools build failed: ${error instanceof Error ? error.message : String(error)}\n`);
+                this.exploreCustomToolsPromise = undefined;
+                return [];
+            });
+        }
+        return this.exploreCustomToolsPromise;
     }
     async forkSession(init) {
         if (!this.bindings.forkSessionManager)
@@ -661,10 +950,15 @@ export class ConsolePiRuntime {
             sessionManager,
             model: init.model,
         });
-        built.session.setActiveToolsByName(OPERATOR_CHAT_ACTIVE_TOOL_NAMES());
+        built.session.setActiveToolsByName(computeOperatorChatActiveToolNames(built.session));
         this.sessions.set(sessionId, built.session);
         this.sessionManagers.set(sessionId, sessionManager);
         this.modelRuntimes.set(sessionId, built.modelRuntime);
+        this.sessionModels.set(sessionId, init.model);
+        this.serviceScopes.set(sessionId, built.services);
+        this.revisions.set(sessionId, 1);
+        this.thinkingSelections.set(sessionId, "auto");
+        this.sessionInit.set(sessionId, { status: "ready" });
         return {
             sessionId,
             sessionFile: built.session.sessionFile,
@@ -709,12 +1003,14 @@ export class ConsolePiRuntime {
         };
     }
     async listModels(sessionId) {
+        await this.ensureSessionReady(sessionId);
         const modelRuntime = this.modelRuntimes.get(sessionId);
         if (!this.sessions.has(sessionId) || !modelRuntime)
             throw new Error(`chat session not active: ${sessionId}`);
         return this.bindings.listAvailableModels({ modelRuntime });
     }
     async applyModel(sessionId, model) {
+        await this.ensureSessionReady(sessionId);
         const session = this.sessions.get(sessionId);
         const modelRuntime = this.modelRuntimes.get(sessionId);
         if (!session || !modelRuntime)
@@ -729,26 +1025,46 @@ export class ConsolePiRuntime {
         if (!resolved)
             throw new Error("MODEL_NOT_AVAILABLE");
         await session.setModel(resolved);
+        this.bumpRevision(sessionId);
         return {
             provider: session.model?.provider ?? model.provider,
             modelId: session.model?.id ?? session.model?.modelId ?? model.modelId,
         };
     }
+    /**
+     * Apply a thinking-level selection. `auto` records the selection WITHOUT
+     * sending any explicit override (the SDK keeps its own default); an explicit
+     * level calls `session.setThinkingLevel`. Returns the effective value.
+     */
     applyThinkingLevel(sessionId, level) {
+        const state = this.sessionInit.get(sessionId);
+        if (state?.status === "failed")
+            throw state.error;
+        if (state?.status === "initializing") {
+            throw new Error(`chat session not active: ${sessionId}`);
+        }
         const session = this.sessions.get(sessionId);
         if (!session)
             throw new Error(`chat session not active: ${sessionId}`);
+        if (level === "auto") {
+            this.thinkingSelections.set(sessionId, "auto");
+            this.bumpRevision(sessionId);
+            return "auto";
+        }
         if (!THINKING_LEVELS.includes(level) || !session.setThinkingLevel)
             throw new Error("THINKING_LEVEL_UNSUPPORTED");
         session.setThinkingLevel(level);
+        this.thinkingSelections.set(sessionId, level);
+        this.bumpRevision(sessionId);
         return session.thinkingLevel ?? level;
     }
     getRuntimeSelection(sessionId) {
         const session = this.sessions.get(sessionId);
         if (!session)
             return { activeTools: [] };
-        const provider = session.model?.provider;
-        const modelId = session.model?.id ?? session.model?.modelId;
+        const stored = this.sessionModels.get(sessionId);
+        const provider = session.model?.provider ?? stored?.provider;
+        const modelId = session.model?.id ?? session.model?.modelId ?? stored?.modelId;
         return {
             ...(provider && modelId ? { model: { provider, modelId } } : {}),
             ...(session.thinkingLevel
@@ -757,6 +1073,393 @@ export class ConsolePiRuntime {
             activeTools: session.getActiveToolNames(),
         };
     }
+    bumpRevision(sessionId) {
+        this.revisions.set(sessionId, (this.revisions.get(sessionId) ?? 0) + 1);
+    }
+    /**
+     * Resolve the RAW system prompt actually injected into the Pi session
+     * (design §2.2 / AC-03). Fallback chain: agent.state.systemPrompt →
+     * session.systemPrompt getter → ResourceLoader.getSystemPrompt() → the
+     * composed operator-chat base prompt. Never returns empty.
+     */
+    async getRuntimeSystemPrompt(sessionId) {
+        await this.ensureSessionReady(sessionId).catch(() => undefined);
+        const session = this.sessions.get(sessionId);
+        if (!session)
+            return composeOperatorChatSystemPrompt({});
+        const fromState = session.state?.systemPrompt;
+        const fromGetter = session.systemPrompt;
+        const loader = this.serviceScopes.get(sessionId)?.resourceLoader;
+        return (fromState ||
+            fromGetter ||
+            loader?.getSystemPrompt?.() ||
+            composeOperatorChatSystemPrompt({}));
+    }
+    /**
+     * Read the RAW system prompt for the snapshot, converting any projection
+     * failure into the structured critical error (RF-02): a broken system prompt
+     * source must fail the whole snapshot with 503 PI_RUNTIME_UNAVAILABLE rather
+     * than silently fabricate prompt text.
+     */
+    async readRawSystemPrompt(sessionId) {
+        try {
+            return await this.getRuntimeSystemPrompt(sessionId);
+        }
+        catch (error) {
+            throw new RuntimeSnapshotUnavailableError(`system prompt projection failed: ${error instanceof Error ? error.message : String(error)}`);
+        }
+    }
+    /**
+     * Official Pi session reload (AC-05 / AC-06). Rejects with a structured
+     * code while the session is busy (streaming / compacting / bash in flight /
+     * duplicate reload) — never aborts, never silently queues.
+     */
+    async reloadSession(sessionId) {
+        try {
+            await this.ensureSessionReady(sessionId);
+        }
+        catch (error) {
+            if (error instanceof PiSessionInitFailedError) {
+                return { ok: false, code: error.code, message: error.message };
+            }
+            return {
+                ok: false,
+                code: "PI_SESSION_NOT_FOUND",
+                message: error instanceof Error ? error.message : String(error),
+            };
+        }
+        const session = this.sessions.get(sessionId);
+        if (!session) {
+            return {
+                ok: false,
+                code: "PI_SESSION_NOT_FOUND",
+                message: `chat session not active: ${sessionId}`,
+            };
+        }
+        // RF2-03: the per-sessionId in-flight lock is checked FIRST — before the
+        // streaming/compacting/bash/support checks. JS runs check-then-add in one
+        // synchronous segment, so two concurrent calls cannot both pass; the lock
+        // is released in `finally` on BOTH the success and the error path, and
+        // different sessions never block each other. Priority matters: the first
+        // reload() may synchronously flip isIdle/isCompacting/isBashRunning/
+        // hasPendingBashMessages to busy, and a second concurrent call must still
+        // report the reload-in-flight busy (not the streaming/compacting one).
+        if (this.reloadInFlight.has(sessionId)) {
+            return {
+                ok: false,
+                code: "PI_SESSION_BUSY",
+                message: "session is busy (reload in flight); reload rejected without abort",
+            };
+        }
+        const busyReasons = [];
+        if (session.isStreaming === true || session.isIdle === false)
+            busyReasons.push("streaming");
+        if (session.isCompacting === true)
+            busyReasons.push("compacting");
+        if (session.isBashRunning === true)
+            busyReasons.push("bash running");
+        if (session.hasPendingBashMessages === true)
+            busyReasons.push("bash messages pending");
+        if (busyReasons.length > 0) {
+            return {
+                ok: false,
+                code: "PI_SESSION_BUSY",
+                message: `session is busy (${busyReasons.join(", ")}); reload rejected without abort`,
+            };
+        }
+        if (typeof session.reload !== "function") {
+            return {
+                ok: false,
+                code: "PI_RELOAD_FAILED",
+                message: "this Pi runtime does not support session.reload()",
+            };
+        }
+        this.reloadInFlight.add(sessionId);
+        try {
+            await session.reload();
+        }
+        catch (error) {
+            return {
+                ok: false,
+                code: "PI_RELOAD_FAILED",
+                message: error instanceof Error ? error.message : String(error),
+            };
+        }
+        finally {
+            this.reloadInFlight.delete(sessionId);
+        }
+        this.bumpRevision(sessionId);
+        return { ok: true, revision: this.revisions.get(sessionId) ?? 0 };
+    }
+    /**
+     * Project the unified live runtime snapshot (design §2.2). The current Pi
+     * session is the single source of truth: real system prompt, real model /
+     * thinking selection (auto + effective), the session modelRuntime model
+     * list, and the session ResourceLoader inventories. Undefined when the
+     * session is not active — callers fail closed instead of fabricating data.
+     */
+    async getRuntimeSnapshot(sessionId, options) {
+        try {
+            await this.ensureSessionReady(sessionId);
+        }
+        catch (error) {
+            if (error instanceof PiSessionInitFailedError)
+                throw error;
+            // Inactive / unknown session: fail closed with undefined (no fabricated snapshot).
+            return undefined;
+        }
+        const session = this.sessions.get(sessionId);
+        if (!session)
+            return undefined;
+        const services = this.serviceScopes.get(sessionId);
+        const modelRuntime = this.modelRuntimes.get(sessionId);
+        const resourceLoader = services?.resourceLoader;
+        const settingsManager = services?.settingsManager;
+        const thinkingSelection = this.thinkingSelections.get(sessionId) ?? "auto";
+        const effectiveThinkingLevel = session.thinkingLevel ??
+            settingsManager?.getDefaultThinkingLevel?.() ??
+            (thinkingSelection === "auto" ? undefined : thinkingSelection);
+        const rawSystemPrompt = await this.readRawSystemPrompt(sessionId);
+        // Models come from the session modelRuntime. A model-enumeration failure
+        // is a CRITICAL projection failure (RF-02): it throws
+        // RuntimeSnapshotUnavailableError so consuming routes return 503
+        // PI_RUNTIME_UNAVAILABLE — never a fabricated empty model list.
+        let models = [];
+        if (modelRuntime) {
+            try {
+                models = this.bindings
+                    .listAvailableModels({ modelRuntime })
+                    .map((entry) => ({
+                    provider: entry.provider,
+                    id: entry.id,
+                    ...(entry.name ? { name: entry.name } : {}),
+                    hasCredentials: entry.hasCredentials,
+                }));
+            }
+            catch (error) {
+                throw new RuntimeSnapshotUnavailableError(`model enumeration failed: ${error instanceof Error ? error.message : String(error)}`);
+            }
+        }
+        // Thinking options: auto is always offered; explicit levels only when the
+        // runtime session supports setThinkingLevel (xhigh/max ship with the SDK
+        // and therefore surface only when this runtime provides them).
+        const supportedLevels = typeof session.setThinkingLevel === "function"
+            ? [...THINKING_LEVELS]
+            : [];
+        const thinkingLevels = [
+            { value: "auto" },
+            ...supportedLevels.map((value) => ({ value })),
+        ];
+        // Resource inventories from the session ResourceLoader (ADR 0012 open
+        // surface). Missing loader → real empty lists, never fabricated entries.
+        // Each subface is isolated (RF-02): a throwing subface keeps the other
+        // inventories AND surfaces a structured retryable diagnostic instead of
+        // silently dropping the whole resource projection.
+        const contextFiles = [];
+        const skills = [];
+        const extensions = [];
+        const diagnostics = [];
+        let resolvedResources = [];
+        const resourceFailure = (subface, error) => {
+            diagnostics.push({
+                type: "error",
+                code: "RESOURCE_LOAD_FAILED",
+                message: `${subface} inventory failed: ${error instanceof Error ? error.message : String(error)}`,
+                retryable: true,
+            });
+        };
+        if (resourceLoader) {
+            try {
+                const agentsFiles = resourceLoader.getAgentsFiles?.();
+                for (const file of agentsFiles?.agentsFiles ?? []) {
+                    if (!file.path)
+                        continue;
+                    contextFiles.push({
+                        path: file.path,
+                        characters: file.content?.length ?? 0,
+                    });
+                }
+            }
+            catch (error) {
+                resourceFailure("context files", error);
+            }
+            try {
+                const skillsResult = resourceLoader.getSkills?.();
+                for (const skill of skillsResult?.skills ?? []) {
+                    skills.push({
+                        name: skill.name,
+                        description: skill.description ?? "",
+                        path: skill.filePath,
+                        ...(skill.baseDir ? { baseDir: skill.baseDir } : {}),
+                        scope: skill.sourceInfo?.scope ?? "unknown",
+                        source: skill.sourceInfo?.source ?? "",
+                        enabled: !skill.disableModelInvocation,
+                        diagnostics: [],
+                    });
+                    resolvedResources.push({
+                        type: "skill",
+                        name: skill.name,
+                        path: skill.filePath,
+                        source: skill.sourceInfo?.source ?? "",
+                        scope: skill.sourceInfo?.scope ?? "unknown",
+                    });
+                }
+                for (const diag of skillsResult?.diagnostics ?? []) {
+                    if (!diag?.message)
+                        continue;
+                    diagnostics.push({
+                        type: diag.type ?? "warning",
+                        message: diag.message,
+                        ...(diag.path ? { path: diag.path } : {}),
+                    });
+                }
+            }
+            catch (error) {
+                resourceFailure("skills", error);
+            }
+            try {
+                const extResult = resourceLoader.getExtensions?.();
+                for (const ext of extResult?.extensions ?? []) {
+                    const path = ext.resolvedPath ?? ext.path ?? "";
+                    extensions.push({
+                        name: ext.sourceInfo?.source ?? ext.path ?? "extension",
+                        path,
+                        ...(ext.resolvedPath ? { resolvedPath: ext.resolvedPath } : {}),
+                        source: ext.sourceInfo?.source ?? "",
+                        scope: ext.sourceInfo?.scope ?? "unknown",
+                        ...(ext.sourceInfo?.origin ? { origin: ext.sourceInfo.origin } : {}),
+                        enabled: true,
+                    });
+                    resolvedResources.push({
+                        type: "extension",
+                        name: ext.sourceInfo?.source ?? ext.path ?? "extension",
+                        path,
+                        source: ext.sourceInfo?.source ?? "",
+                        scope: ext.sourceInfo?.scope ?? "unknown",
+                    });
+                }
+                for (const err of extResult?.errors ?? []) {
+                    if (!err?.error)
+                        continue;
+                    diagnostics.push({
+                        type: "error",
+                        message: err.error,
+                        ...(err.path ? { path: err.path } : {}),
+                    });
+                }
+            }
+            catch (error) {
+                resourceFailure("extensions", error);
+            }
+            try {
+                const promptsResult = resourceLoader.getPrompts?.();
+                for (const prompt of promptsResult?.prompts ?? []) {
+                    resolvedResources.push({
+                        type: "prompt",
+                        name: prompt.name,
+                        path: prompt.filePath,
+                        source: prompt.sourceInfo?.source ?? "",
+                        scope: prompt.sourceInfo?.scope ?? "unknown",
+                    });
+                }
+                for (const diag of promptsResult?.diagnostics ?? []) {
+                    if (!diag?.message)
+                        continue;
+                    diagnostics.push({
+                        type: diag.type ?? "warning",
+                        message: diag.message,
+                        ...(diag.path ? { path: diag.path } : {}),
+                    });
+                }
+            }
+            catch (error) {
+                resourceFailure("prompts", error);
+            }
+            try {
+                const themesResult = resourceLoader.getThemes?.();
+                for (const theme of themesResult?.themes ?? []) {
+                    if (!theme.path)
+                        continue;
+                    resolvedResources.push({
+                        type: "theme",
+                        name: theme.name ?? theme.path,
+                        path: theme.path,
+                        source: "",
+                        scope: "unknown",
+                    });
+                }
+                for (const diag of themesResult?.diagnostics ?? []) {
+                    if (!diag?.message)
+                        continue;
+                    diagnostics.push({
+                        type: diag.type ?? "warning",
+                        message: diag.message,
+                        ...(diag.path ? { path: diag.path } : {}),
+                    });
+                }
+            }
+            catch (error) {
+                resourceFailure("themes", error);
+            }
+        }
+        // Packages: Pi settings specs + resolved resource metadata. Fields the SDK
+        // does not expose stay absent (real missing, never fabricated). A
+        // readPackageInventory failure is a PARTIAL failure (RF-02): the snapshot
+        // stays 200 with a structured retryable diagnostic — never a silent
+        // fake-empty package list.
+        const { readPackageInventory } = await import("./pi-console-config.js");
+        let packages = [];
+        try {
+            packages = (await readPackageInventory(await safeGetAgentDir(this.bindings), this.options.cwd, resolvedResources));
+        }
+        catch (error) {
+            packages = [];
+            diagnostics.push({
+                type: "error",
+                code: "PACKAGE_INVENTORY_FAILED",
+                message: error instanceof Error ? error.message : String(error),
+                retryable: true,
+            });
+        }
+        return projectRuntimeSnapshot({
+            sessionId,
+            revision: this.revisions.get(sessionId) ?? 0,
+            loadedAt: new Date().toISOString(),
+            selection: {
+                ...(session.model?.provider &&
+                    (session.model?.id ?? session.model?.modelId)
+                    ? {
+                        model: {
+                            provider: session.model.provider,
+                            id: session.model.id ?? session.model.modelId,
+                            ...(session.model.name ? { name: session.model.name } : {}),
+                        },
+                    }
+                    : {}),
+                thinkingSelection,
+                ...(effectiveThinkingLevel
+                    ? { effectiveThinkingLevel: effectiveThinkingLevel }
+                    : {}),
+            },
+            models,
+            thinkingLevels,
+            systemPrompt: {
+                ...(options?.includeRaw ? { raw: rawSystemPrompt } : {}),
+                // The RAW prompt flows into the projection: text is scrubbed +
+                // length-limited while sha256/characters stay RAW-based (design §2.2).
+                text: rawSystemPrompt,
+                sha256: createHash("sha256").update(rawSystemPrompt).digest("hex"),
+                characters: rawSystemPrompt.length,
+            },
+            activeTools: session.getActiveToolNames(),
+            contextFiles,
+            skills,
+            extensions,
+            packages,
+            diagnostics,
+            hasBash: true,
+        });
+    }
     /**
      * Re-open a previously persisted Chat session after Console restart or
      * browser refresh (roadmap M1-S04 / S05).
@@ -772,6 +1475,24 @@ export class ConsolePiRuntime {
      */
     async reopenSession(init) {
         const sessionId = init.sessionId;
+        // Wait for in-flight create materialization rather than racing reopen.
+        const initState = this.sessionInit.get(sessionId);
+        if (initState?.status === "initializing") {
+            try {
+                await initState.promise;
+            }
+            catch {
+                // failure recorded on sessionInit
+            }
+        }
+        const failed = this.sessionInit.get(sessionId);
+        if (failed?.status === "failed") {
+            return {
+                ok: false,
+                code: "PI_SESSION_INIT_FAILED",
+                message: failed.error.message,
+            };
+        }
         // Already active in-memory: idempotent reopen is a no-op success.
         if (this.sessions.has(sessionId)) {
             return { ok: true, handle: await this.snapshotActive(sessionId) };
@@ -838,10 +1559,15 @@ export class ConsolePiRuntime {
                     message: `reopened Pi sessionId mismatch: expected ${sessionId}, got ${reportedId}`,
                 };
             }
-            session.setActiveToolsByName(OPERATOR_CHAT_ACTIVE_TOOL_NAMES());
+            session.setActiveToolsByName(computeOperatorChatActiveToolNames(session));
             this.sessions.set(sessionId, session);
             this.sessionManagers.set(sessionId, sessionManager);
             this.modelRuntimes.set(sessionId, built.modelRuntime);
+            this.sessionModels.set(sessionId, init.model);
+            this.serviceScopes.set(sessionId, built.services);
+            this.revisions.set(sessionId, 1);
+            this.thinkingSelections.set(sessionId, "auto");
+            this.sessionInit.set(sessionId, { status: "ready" });
             return {
                 ok: true,
                 handle: {
@@ -864,35 +1590,40 @@ export class ConsolePiRuntime {
     /** Build a handle for an already-active session (idempotent reopen path). */
     async snapshotActive(sessionId) {
         const session = this.sessions.get(sessionId);
+        const stored = this.sessionModels.get(sessionId);
+        const fromSession = session.model?.provider
+            ? {
+                provider: session.model.provider,
+                modelId: session.model.id ??
+                    session.model.modelId ??
+                    "",
+            }
+            : undefined;
+        const model = stored ??
+            (fromSession?.modelId ? fromSession : undefined);
         return {
             sessionId,
             sessionFile: session.sessionFile,
             createdAt: new Date().toISOString(),
-            model: undefined,
+            model,
             activeTools: session.getActiveToolNames(),
         };
     }
     /**
-     * Shared services + pinned-tool materialization for both createSession and
-     * reopenSession. Loads closed-surface services, resolves the model, builds
-     * the operator + safe explore customTools, and calls the SDK with the same
-     * excludeTools / tools policy (M0-A three-gate).
+     * Shared services + pinned-tool materialization for reopen/fork paths.
+     * Create uses startMaterialization instead so the durable shell can return
+     * before AgentSession is ready. Tool definitions reuse runtime-level caches.
      */
     async buildSessionWithServices(init) {
         const agentDir = await safeGetAgentDir(this.bindings);
-        const skillFragment = await this.composeSystemPromptSkills();
         const appendSystemPrompt = [
             OPERATOR_CHAT_SYSTEM_PROMPT_BASE,
-            ...(skillFragment ? [skillFragment] : []),
             ...(init.systemPromptSuffix ? [init.systemPromptSuffix] : []),
         ];
         const { services } = await this.bindings.createServices({
             cwd: this.options.cwd,
             agentDir,
             resourceLoaderOptions: {
-                noContextFiles: true,
-                noSkills: true,
-                noExtensions: true,
                 appendSystemPrompt,
             },
         });
@@ -905,27 +1636,7 @@ export class ConsolePiRuntime {
             }) ?? undefined)
             : undefined;
         assertNoWriteToolInList(OPERATOR_CHAT_ALLOWED_TOOLS);
-        let operatorCustomTools = [];
-        if (this.options.actionContext) {
-            try {
-                operatorCustomTools = await buildCustomOperatorTools({
-                    actionContext: this.options.actionContext,
-                });
-            }
-            catch (error) {
-                process.stderr.write(`[console] chat custom-tools build failed: ${error instanceof Error ? error.message : String(error)}\n`);
-            }
-        }
-        let exploreCustomTools = [];
-        try {
-            exploreCustomTools = await buildExploreCustomTools({
-                repoRoot: this.options.cwd,
-            });
-        }
-        catch (error) {
-            process.stderr.write(`[console] chat explore-tools build failed: ${error instanceof Error ? error.message : String(error)}\n`);
-        }
-        const customTools = [...operatorCustomTools, ...exploreCustomTools];
+        const customTools = await this.loadCustomTools();
         const { session } = await this.bindings.createSessionFromServices({
             services,
             sessionManager: init.sessionManager,
@@ -939,10 +1650,17 @@ export class ConsolePiRuntime {
                 "coding_chat",
                 "shell",
             ],
-            ...(customTools && customTools.length > 0 ? { customTools } : {}),
+            ...(customTools.length > 0 ? { customTools } : {}),
             ...(resolvedModel ? { model: resolvedModel } : {}),
         });
-        return { session, modelRuntime };
+        return {
+            session,
+            modelRuntime,
+            services: {
+                resourceLoader: services.resourceLoader,
+                settingsManager: services.settingsManager,
+            },
+        };
     }
     /** Re-open a previously created session (cross-request). */
     open(sessionId) {
@@ -957,17 +1675,20 @@ export class ConsolePiRuntime {
      * (the dispatcher is wired by the HTTP layer, see chat-session.ts).
      */
     async prompt(sessionId, text, onEvent, options) {
+        // First message while creating waits on the same materialization promise.
+        await this.ensureSessionReady(sessionId);
         const session = this.sessions.get(sessionId);
         if (!session) {
             throw new Error(`chat session not found: ${sessionId}`);
         }
         // Gate 2 (re-pin before each turn): interview turns pass through the
         // existing closed interview allow/deny registry. The next ordinary turn
-        // explicitly restores the normal Operator Chat set.
+        // explicitly restores the normal Operator Chat set (baseline + extension
+        // tools, ADR 0012).
         const requestedTools = OPERATOR_CHAT_ACTIVE_TOOL_NAMES();
         const activeTools = options?.mode === "requirement-interview"
             ? filterActiveInterviewTools(requestedTools).allowed
-            : requestedTools;
+            : computeOperatorChatActiveToolNames(session);
         session.setActiveToolsByName(activeTools);
         const unsub = session.subscribe((event) => {
             const mapped = mapSdkEvent(sessionId, event);
@@ -1025,6 +1746,92 @@ export class ConsolePiRuntime {
             unsub();
         }
     }
+    /** Generate exactly one title in an isolated in-memory, tool-less LOW session. */
+    async generateTitle(sessionId, firstUserText) {
+        if (this.titleInFlight.has(sessionId))
+            return undefined;
+        this.titleInFlight.add(sessionId);
+        let session;
+        let unsubscribe;
+        let timeout;
+        try {
+            const { services } = await this.bindings.createServices({
+                cwd: this.options.cwd,
+                agentDir: await safeGetAgentDir(this.bindings),
+                // The detached title worker has a closed title-only resource surface:
+                // no project/user context, extensions, skills, prompt templates, or
+                // themes. Its sole system prompt is deliberately minimal; never append
+                // the operator-chat prompt or any loaded resource text.
+                resourceLoaderOptions: {
+                    noContextFiles: true,
+                    noSkills: true,
+                    noExtensions: true,
+                    noPromptTemplates: true,
+                    noThemes: true,
+                    systemPrompt: "Generate one concise plain-text session title in the user's primary language. Return only the title.",
+                },
+            });
+            const low = await resolveLowChatModel(this.options.cwd, this.bindings.listAvailableModels({ modelRuntime: services.modelRuntime }));
+            if (!low)
+                return undefined;
+            const model = this.bindings.resolveModel({
+                modelRuntime: services.modelRuntime,
+                provider: low.provider,
+                modelId: low.modelId,
+            });
+            if (!model)
+                return undefined;
+            if (!this.bindings.createInMemorySessionManager)
+                return undefined;
+            const sessionManager = await this.bindings.createInMemorySessionManager({
+                cwd: this.options.cwd,
+            });
+            const created = await this.bindings.createSessionFromServices({
+                services,
+                sessionManager,
+                noTools: "all",
+                tools: [],
+                customTools: [],
+                model,
+            });
+            session = created.session;
+            let output = "";
+            unsubscribe = session.subscribe((event) => {
+                if (event.type === "message_end")
+                    output = extractAssistantText(event.message);
+            });
+            const controller = new AbortController();
+            timeout = setTimeout(() => controller.abort(), 10_000);
+            await Promise.race([
+                session.prompt(`User message:\n${firstUserText.slice(0, 1200)}`, { signal: controller.signal }),
+                new Promise((_, reject) => controller.signal.addEventListener("abort", () => reject(new Error("TITLE_TIMEOUT")), { once: true })),
+            ]);
+            return output;
+        }
+        catch {
+            return undefined;
+        }
+        finally {
+            if (timeout)
+                clearTimeout(timeout);
+            unsubscribe?.();
+            try {
+                await session?.abort?.();
+            }
+            catch { /* abort converges before disposal */ }
+            try {
+                session?.dispose();
+            }
+            catch { /* isolated title cleanup is best-effort */ }
+            this.titleInFlight.delete(sessionId);
+        }
+    }
+    /** Pi session_info mirror after durable automatic-title persistence.
+     * Callers own the detached catch boundary so synchronous throws and rejected
+     * mirror Promises are both observed without affecting durable Chat state. */
+    async setSessionName(sessionId, title) {
+        await this.sessions.get(sessionId)?.setSessionName?.(title);
+    }
     async compact(sessionId, customInstructions) {
         const session = this.sessions.get(sessionId);
         if (!session)
@@ -1037,6 +1844,9 @@ export class ConsolePiRuntime {
         return projectCompactSnapshot(result ?? {});
     }
     dispose(sessionId) {
+        // Mark disposed first so a late materialization never registers ready.
+        this.disposedSessions.add(sessionId);
+        this.sessionInit.delete(sessionId);
         const session = this.sessions.get(sessionId);
         if (session) {
             try {
@@ -1045,11 +1855,16 @@ export class ConsolePiRuntime {
             catch {
                 // ignore
             }
-            this.sessions.delete(sessionId);
-            this.sessionManagers.delete(sessionId);
-            this.mainlineLeaves.delete(sessionId);
-            this.modelRuntimes.delete(sessionId);
         }
+        this.sessions.delete(sessionId);
+        this.sessionManagers.delete(sessionId);
+        this.mainlineLeaves.delete(sessionId);
+        this.modelRuntimes.delete(sessionId);
+        this.sessionModels.delete(sessionId);
+        this.serviceScopes.delete(sessionId);
+        this.revisions.delete(sessionId);
+        this.thinkingSelections.delete(sessionId);
+        this.reloadInFlight.delete(sessionId);
     }
     disposeAll() {
         for (const id of [...this.sessions.keys()])
@@ -1199,6 +2014,10 @@ export function createDefaultPiSdkBindings() {
                 id: opts.sessionId,
             });
         },
+        createInMemorySessionManager: async (opts) => {
+            const sdk = (await loadSdk());
+            return sdk.SessionManager.inMemory(opts.cwd);
+        },
         forkSessionManager: async (opts) => {
             const sdk = (await loadSdk());
             return sdk.SessionManager.forkFrom(opts.sourcePath, opts.targetCwd, opts.targetSessionDir, { id: opts.targetSessionId });