@vanillagreen/pi-claude-bridge 1.9.0 → 3.2.2

package/src/index.ts

@@ -1,21 +1,19 @@
 import { type AssistantMessage, type AssistantMessageEventStream, type Context, type Model, type SimpleStreamOptions, type Tool } from "@earendil-works/pi-ai";
 import * as piAi from "@earendil-works/pi-ai";
-import { type ExtensionAPI, type ExtensionUIContext } from "@earendil-works/pi-coding-agent";
-import { createSdkMcpServer, query, type EffortLevel, type SDKMessage, type SDKUserMessage, type SettingSource } from "@anthropic-ai/claude-agent-sdk";
+import { type ExtensionAPI } from "@earendil-works/pi-coding-agent";
+import { createSdkMcpServer, type SDKUserMessage } from "@anthropic-ai/claude-agent-sdk";
 import type { Base64ImageSource, ContentBlockParam, MessageParam } from "@anthropic-ai/sdk/resources";
 import { PROVIDER_ID, messageContentToText } from "./convert.js";
-import { buildModels, fallbackModelForPrimaryModel, modelDisplayName } from "./models.js";
-import { MCP_SERVER_NAME, MCP_TOOL_PREFIX, extractSkillsBlock } from "./skills.js";
+import { buildModels, modelDisplayName } from "./models.js";
+import { MCP_SERVER_NAME, MCP_TOOL_PREFIX } from "./skills.js";
 import { extractAllToolResults as _extractAllToolResults, type McpResult } from "./extract-tool-results.js";
-import { QueryContext, ctx, drainPendingToolCalls, stackDepth, pushContext, popContext, toolCallDrainCause } from "./query-state.js";
-import { loadConfig, normalizeEffortLevel, recordProjectTrust, type Config } from "./config.js";
-import { decideRegistration, hasClaudeCredentials } from "./auth-presence.js";
-import { extractAgentsAppend } from "./agents-md.js";
-import { buildPromptContextAppend } from "./prompt-context.js";
+import { QueryContext, ctx, deleteQueryLane, drainPendingToolCalls, drainStrandedToolCalls, popContext, stackDepth, pushContext, summarizeDroppedUserMessages, takeQueuedOrParkedResult, toolCallDrainCause, type DeferredUserMessage } from "./query-state.js";
+import { teardownQuery } from "./query-teardown.js";
+import { loadConfig, recordProjectTrust, registerExternalConfigResolver } from "./config.js";
+import { hasClaudeCredentials } from "./auth-presence.js";
+import { NATIVE_PROVIDER_UNSUPPORTED_MESSAGE, buildNativeProvider, supportsNativeProvider } from "./native-provider.js";
 import { jsonSchemaToZodShape } from "./typebox-to-zod.js";
-import { readFileSync as nodeReadFileSync } from "node:fs";
 import { resolveGetModels } from "./pi-ai-compat.js";
-import { listAccountConnectors, resolveClaudeOAuth } from "./connector-inventory.js";
 // Re-exported from the extension entry point ON PURPOSE. Consuming apps
 // regenerate their vendored package.json with a CLOSED exports map
 // ({".": "./bundle/index.js"}), which makes Node reject BOTH a subpath import
@@ -25,6 +23,8 @@ import { listAccountConnectors, resolveClaudeOAuth } from "./connector-inventory
 // path their existing manifest already allows, and incidentally keeps esbuild
 // from tree-shaking helpers index.ts never calls itself.
 export {
+	connectorProxyUrl,
+	connectorServerName,
 	connectorServerNamespace,
 	connectorsListUrl,
 	credentialCandidatePaths,
@@ -34,27 +34,70 @@ export {
 	type ConnectorEntry,
 	type ConnectorInventory,
 } from "./connector-inventory.js";
+export { connectorCachePath, connectorCacheScopeKey, readCachedConnectors, scopeKeyFor, writeCachedConnectors } from "./connector-cache.js";
+export { connectorServersSnapshot, primeConnectorServers } from "./connector-runtime.js";
 import { debug, diagDump, makeCliDebugOptions, moduleInstanceId } from "./debug.js";
-import { preflightClaudeExecutable, resolveClaudeExecutable, spawnClaudeCodeWithDiagnostics } from "./claude-executable.js";
-import { argKeys, extensionApi, piUI, reportToolResultMismatch, safeNotify, safeToolCallSummary, setExtensionApi, setPiUI, setSharedSession, sharedSession } from "./bridge-state.js";
-import { connectorQueryOptions, connectorWriteModeFor, connectorsEnabledFor } from "./connectors.js";
-import { restoreSharedSessionFromPi, schedulePersistSharedSession, syncSharedSession } from "./session-persistence.js";
+import { preflightClaudeExecutable, resolveClaudeExecutable } from "./claude-executable.js";
+import { appendIntegrityEntry, argKeys, deleteSharedSessionLane, extensionApi, getSharedSession, markSessionForRebuild, recordStartedLane, reportToolResultMismatch, safeNotify, safeToolCallSummary, setExtensionApi, setPiUI, setSharedSession, takeStartedLane, type SessionState } from "./bridge-state.js";
+import { connectorsEnabledFor, isChildExecutedTool } from "./connectors.js";
+import { primeConnectorServers } from "./connector-runtime.js";
+import { cancelScheduledSessionPersistence, conversationFingerprint, restoreSharedSessionFromPi, schedulePersistSharedSession, syncSharedSession } from "./session-persistence.js";
 import { STREAM_IDLE_BACKOFF_HINT_MS, activeStreamIdleWatchdogs, buildStreamIdleTimeoutErrorMessage, createStreamIdleWatchdog, formatDurationShort, streamIdleTimeoutMsFromEnv } from "./stream-idle-watchdog.js";
-import { RATE_LIMIT_AUTO_RESUME_EVENT, RATE_LIMIT_TOKEN, formatAllowedRateLimitWarning, formatResetTimestamp, isExtraUsageRequiredMessage, uniqueNonEmptyLines } from "./rate-limit.js";
+import { RATE_LIMIT_TOKEN, formatResetTimestamp } from "./rate-limit.js";
 import { mapToolArgs } from "./tool-mapping.js";
-import { ensureTurnStarted, finalizeCurrentStream, parsePartialJson, processAssistantMessage, processStreamEvent, updateTurnOutputModel } from "./assistant-stream.js";
+import { finalizeCurrentStream, finalizeToolUseTurnFromMcpInvocation, scheduleToolUseTurnEnd, updateTurnOutputModel } from "./assistant-stream.js";
+import {
+	accountSessionScope,
+	classifyClaudeFailure,
+	CLAUDE_BRIDGE_ACCOUNT_HOST_SYMBOL,
+	rateLimitResetFromInfo,
+	rateLimitResetMs,
+	rateLimitTypeFromInfo,
+	resolveClaudeAccountRouter,
+	RetryEventBuffer,
+	safeRouterCall,
+	type ClaudeAccountRoute,
+} from "./account-router.js";
+import { BRIDGE_ACCOUNT_HOST } from "./account-host.js";
+import { registerBridgeCommands } from "./bridge-commands.js";
+import { consumeQuery, emitRateLimitEvent, type ClaudeAttemptFailure } from "./consume-query.js";
+import { buildClaudeQueryOptions } from "./query-options.js";
+import { sdkQueryFactory } from "./sdk-query.js";
+import { currentRequestLaneId, runInRequestLane } from "./request-lane.js";
 
 // Re-exports: the module decomposition must not change the bundle entry's
 // public surface — unit tests and downstream consumers import these from
 // bundle/index.js.
+export { probeClaudeAccountProfile } from "./account-host.js";
+export { __testSetSdkQueryFactory } from "./sdk-query.js";
+export { resolveConfiguredEffort } from "./query-options.js";
 export { classifyClaudeExecutableBytes, preflightClaudeExecutable, resolveClaudeExecutable, spawnClaudeCodeWithDiagnostics, wrapClaudeSpawnErrorForSdk, type ClaudeExecutableFileType, type ClaudeExecutablePreflightResult } from "./claude-executable.js";
-export { __testGetBridgeIntegrityState, __testSetBridgeIntegrityState, reportToolResultMismatch } from "./bridge-state.js";
-export { CLAUDE_AI_CONNECTOR_TOOL_PATTERNS, CLAUDE_BRIDGE_TOOL_ISOLATION, CONNECTOR_DISCOVERY_TOOLS, CONNECTOR_WRITE_TOOLS, DISALLOWED_BUILTIN_TOOLS, connectorQueryOptions, connectorWriteDenyHook, connectorWriteModeFor, connectorWriteModeFromEnv, connectorsEnabledFor, connectorsEnabledFromEnv, isConnectorWriteTool, toolIsolationForQuery } from "./connectors.js";
-export { restoreSharedSessionFromPi, shouldRestorePersistedBridgeEntry } from "./session-persistence.js";
+export { __testGetBridgeIntegrityState, __testSetBridgeIntegrityState, INTEGRITY_CUSTOM_TYPE, appendIntegrityEntry, reportToolResultMismatch } from "./bridge-state.js";
+export { CONNECTOR_CALL_CUSTOM_TYPE, connectorResultByteSize, flushConnectorCallAudit, recordConnectorCallResult, setConnectorCallAuditSink, type ConnectorCallAuditData, type ConnectorCallAuditSink, type ConnectorCallOutcome } from "./connector-audit.js";
+export { CLAUDE_AI_CONNECTOR_TOOL_PATTERNS, connectorMcpServers, connectorDeclarationsDisabled, CLAUDE_BRIDGE_TOOL_ISOLATION, CONNECTOR_DISCOVERY_TOOLS, CONNECTOR_WRITE_TOOLS, DISALLOWED_BUILTIN_TOOLS, connectorBuiltinAllowlistHook, connectorQueryOptions, connectorWriteDenyHook, connectorWriteModeFor, connectorWriteModeFromEnv, connectorsEnabledFor, connectorsEnabledFromEnv, denyAllToolsHook, isAllowlistedConnectorSessionTool, isChildExecutedTool, isChildInternalTool, isConnectorTool, isConnectorWriteTool, settingSourcesForQuery, toolIsolationForQuery } from "./connectors.js";
+export { cancelScheduledSessionPersistence, conversationFingerprint, conversationFingerprintsMatch, planIncrementalPromptBatch, restoreSharedSessionFromPi, shouldRestorePersistedBridgeEntry } from "./session-persistence.js";
+export { NATIVE_PROVIDER_UNSUPPORTED_MESSAGE, buildNativeProvider, claudeAuthSourceLabel, supportsNativeProvider } from "./native-provider.js";
 export { DEFAULT_STREAM_IDLE_TIMEOUT_MS, STREAM_IDLE_BACKOFF_HINT_MS, STREAM_IDLE_TIMEOUT_ENV, buildStreamIdleTimeoutErrorMessage, createStreamIdleWatchdog, streamIdleTimeoutMsFromEnv, type StreamIdleTimeoutInfo, type StreamIdleWatchdog, type StreamIdleWatchdogState } from "./stream-idle-watchdog.js";
-export { ALLOWED_RATE_LIMIT_WARNING_UTILIZATION_THRESHOLD, formatAllowedRateLimitWarning, formatResetTimestamp, isExtraUsageRequiredMessage, normalizeRateLimitUtilization, uniqueNonEmptyLines } from "./rate-limit.js";
+export { ALLOWED_RATE_LIMIT_WARNING_UTILIZATION_THRESHOLD, formatAllowedRateLimitWarning, formatResetTimestamp, isUsageLimitMessage, normalizeRateLimitUtilization, resetTimestampMs, uniqueNonEmptyLines } from "./rate-limit.js";
 export { mapToolName } from "./tool-mapping.js";
-export { processAssistantMessage, processStreamEvent } from "./assistant-stream.js";
+export { cancelScheduledToolUseEnd, endToolUseTurn, finalizeToolUseTurnFromMcpInvocation, noteChildExecutedToolResults, processAssistantMessage, processStreamEvent, reapStaleQueuedResults, scheduleToolUseTurnEnd } from "./assistant-stream.js";
+export {
+	accountSessionScope,
+	claudeDirForProfile,
+	classifyClaudeFailure,
+	CLAUDE_ACCOUNT_ROUTER_SYMBOL,
+	CLAUDE_BRIDGE_ACCOUNT_HOST_SYMBOL,
+	commitsVisibleOutput,
+	rateLimitResetFromInfo,
+	rateLimitResetMs,
+	rateLimitTypeFromInfo,
+	RetryEventBuffer,
+	subscriberProfileEnv,
+	type ClaudeAccountFailureKind,
+	type ClaudeAccountRoute,
+	type ClaudeAccountRouterV1,
+	type ClaudeBridgeAccountHostV1,
+} from "./account-router.js";
 
 // Compat (#2): use factory if available (pi-ai ≥0.66), else fall back to constructor (gsd-pi etc.)
 const _piAi = piAi as any;
@@ -89,86 +132,32 @@ const newAssistantMessageEventStream: () => AssistantMessageEventStream =
 //
 // Both are released on session_shutdown (incl. /reload) by releaseProviderTokens
 // so the next module load starts clean. See applyProviderRegistration for the
-// state machine and auth-presence.ts/decideRegistration for the pure decision.
+// native (pi >=0.81) upsert flow.
 const PRIMARY_INSTANCE_KEY = Symbol.for("claude-bridge:primaryInstance");
 const ACTIVE_STREAM_SIMPLE_KEY = Symbol.for("claude-bridge:activeStreamSimple");
-const COMMANDS_REGISTERED_KEY = Symbol.for("claude-bridge:commandsRegistered");
+// Deliberately NOT Symbol.for: rotation state rides options between the retry
+// re-entry and the original call within ONE module instance only.
+const ROTATION_STATE_KEY = Symbol("claude-bridge:rotationState");
+
+/** Hard cap on account-rotation attempts per request (CHANGELOG 3.0.0). */
+const MAX_ROTATION_ATTEMPTS = 16;
+
+interface RotationRequestState {
+	excludedProfileIds: Set<string>;
+	attempts: number;
+	/** Model id already announced via toast for this request, so up to
+	 *  MAX_ROTATION_ATTEMPTS don't repeat an identical switch notice. */
+	announcedModelId?: string;
+}
+
+type BridgeStreamOptions = SimpleStreamOptions & {
+	[ROTATION_STATE_KEY]?: RotationRequestState;
+};
 
 // MODELS is buildModels(getModels("anthropic")) — projection kept in models.js.
 const MODELS = buildModels(getModels("anthropic"));
 
-let extraUsageHelperInFlight: Promise<string> | null = null;
-
-function emitRateLimitEvent(payload: Record<string, unknown>): void {
-	try {
-		extensionApi?.events?.emit?.(RATE_LIMIT_AUTO_RESUME_EVENT, payload);
-	} catch {
-		// Cross-extension broker is best-effort only.
-	}
-}
-
-function extraUsageAllowed(config: Config): boolean {
-	return config.provider?.allowExtraUsage === true;
-}
 
-function sdkTextFromMessage(message: SDKMessage): string | undefined {
-	if (message.type === "result") return (message as any).result;
-	if (message.type === "assistant") {
-		const content = (message as any).message?.content;
-		if (!Array.isArray(content)) return undefined;
-		return content
-			.map((block) => block?.type === "text" && typeof block.text === "string" ? block.text : "")
-			.filter(Boolean)
-			.join("\n");
-	}
-	return undefined;
-}
-
-async function runExtraUsageHelper(cwd: string, config = loadConfig(cwd)): Promise<string> {
-	const providerSettings = config.provider ?? {};
-	const claudeExecutable = resolveClaudeExecutable(providerSettings.pathToClaudeCodeExecutable);
-	if (claudeExecutable) preflightClaudeExecutable(claudeExecutable, cwd);
-
-	const helperQuery = query({
-		prompt: "/extra-usage",
-		options: {
-			cwd,
-			env: { ...process.env, ENABLE_CLAUDEAI_MCP_SERVERS: "0", DISABLE_AUTO_COMPACT: "1" },
-			maxTurns: 1,
-			...(claudeExecutable ? { pathToClaudeCodeExecutable: claudeExecutable } : {}),
-			spawnClaudeCodeProcess: spawnClaudeCodeWithDiagnostics,
-			...makeCliDebugOptions("extra-usage"),
-		},
-	});
-	const outputs: string[] = [];
-	try {
-		for await (const message of helperQuery) {
-			const text = sdkTextFromMessage(message)?.trim();
-			if (text && outputs[outputs.length - 1] !== text) outputs.push(text);
-		}
-	} finally {
-		helperQuery.close();
-	}
-	return outputs.join("\n").trim() || "Claude Code /extra-usage completed.";
-}
-
-function launchExtraUsageHelperIfAllowed(cwd: string, config: Config, reason: string): boolean {
-	if (!extraUsageAllowed(config)) return false;
-	if (extraUsageHelperInFlight) return true;
-	extraUsageHelperInFlight = runExtraUsageHelper(cwd, config)
-		.then((message) => {
-			piUI?.notify(`Claude extra usage helper: ${message}`, "info");
-			return message;
-		})
-		.catch((error) => {
-			const message = error instanceof Error ? error.message : String(error);
-			piUI?.notify(`Claude extra usage helper failed after ${reason}: ${message}`, "error");
-			throw error;
-		})
-		.finally(() => { extraUsageHelperInFlight = null; });
-	void extraUsageHelperInFlight.catch(() => {});
-	return true;
-}
 
 // Pi doesn't pass tool results directly — it appends them to the context and calls
 // the provider again. Thin wrapper over extract-tool-results.js that adds per-turn
@@ -183,49 +172,99 @@ function extractAllToolResults(context: Context): McpResult[] {
 	return results;
 }
 
-/** Extract the last user message from context as a prompt string. Returns null if last message is not a user message. */
+/** Combine one or more consecutive user messages into a single SDK prompt.
+ *
+ *  Representation divergence, accepted on purpose: this MERGES N pi user
+ *  messages into ONE Claude user record ("\n\n"-joined), while a REBUILD
+ *  (convertPiMessages in convert.ts) imports the same pi history as N separate
+ *  user records. Streaming N SDKUserMessages instead would collapse N pi turns
+ *  into one Pi reply with double-counted usage, so the join stays. The merged
+ *  form is only ever a query's live prompt — it is never re-imported, so the
+ *  two representations never meet in one session file. */
 function extractUserPrompt(messages: Context["messages"]): string | null {
-	const last = messages[messages.length - 1];
-	if (!last || last.role !== "user") return null;
-	if (typeof last.content === "string") return last.content;
-	return messageContentToText(last.content) || "";
+	if (messages.length === 0 || messages.some((message) => message.role !== "user")) return null;
+	return messages.map((message) =>
+		typeof message.content === "string" ? message.content : messageContentToText(message.content) || "",
+	).join("\n\n");
 }
 
-/** Extract the last user message as ContentBlockParam[] (preserving images).
- *  Returns null if no images — caller should fall back to string prompt. */
+/** Combine consecutive user messages as ContentBlockParam[] while preserving images.
+ *  Returns null if no images — caller should fall back to the string prompt.
+ *  Same N-into-1 merge as extractUserPrompt (see its comment for why). */
 function extractUserPromptBlocks(messages: Context["messages"]): ContentBlockParam[] | null {
-	const last = messages[messages.length - 1];
-	if (!last || last.role !== "user") return null;
-	if (typeof last.content === "string") {
-		debug(`extractUserPromptBlocks: content is string (length=${last.content.length})`);
-		return null;
-	}
-	if (!Array.isArray(last.content)) {
-		debug(`extractUserPromptBlocks: content is ${typeof last.content}`);
-		return null;
-	}
-	debug(`extractUserPromptBlocks: ${last.content.length} blocks, types=${last.content.map((b: any) => b.type).join(",")}`);
+	if (messages.length === 0 || messages.some((message) => message.role !== "user")) return null;
+
 	let hasImage = false;
 	const blocks: ContentBlockParam[] = [];
-	for (const block of last.content) {
-		if (block.type === "text" && block.text) {
-			blocks.push({ type: "text", text: block.text });
-		} else if (block.type === "image") {
-			debug(`image block: mimeType=${(block as any).mimeType}, data length=${((block as any).data ?? "").length}, keys=${Object.keys(block).join(",")}`);
-			if (!(block as any).data || !(block as any).mimeType) {
-				debug(`image block missing data or mimeType, skipping`);
-				continue;
+	for (let messageIndex = 0; messageIndex < messages.length; messageIndex++) {
+		const content = messages[messageIndex].content;
+		if (messageIndex > 0) blocks.push({ type: "text", text: "\n\n" });
+		if (typeof content === "string") {
+			if (content) blocks.push({ type: "text", text: content });
+			continue;
+		}
+		if (!Array.isArray(content)) {
+			debug(`extractUserPromptBlocks: content is ${typeof content}`);
+			continue;
+		}
+		debug(`extractUserPromptBlocks: ${content.length} blocks, types=${content.map((b: any) => b.type).join(",")}`);
+		for (const block of content) {
+			if (block.type === "text" && block.text) {
+				blocks.push({ type: "text", text: block.text });
+			} else if (block.type === "image") {
+				debug(`image block: mimeType=${(block as any).mimeType}, data length=${((block as any).data ?? "").length}, keys=${Object.keys(block).join(",")}`);
+				if (!(block as any).data || !(block as any).mimeType) {
+					debug(`image block missing data or mimeType, skipping`);
+					continue;
+				}
+				hasImage = true;
+				blocks.push({
+					type: "image",
+					source: { type: "base64", media_type: block.mimeType as Base64ImageSource["media_type"], data: block.data },
+				});
 			}
-			hasImage = true;
-			blocks.push({
-				type: "image",
-				source: { type: "base64", media_type: block.mimeType as Base64ImageSource["media_type"], data: block.data },
-			});
 		}
 	}
 	return hasImage ? blocks : null;
 }
 
+export interface DeferredUserReplayPlan {
+	// Index where the trailing consecutive user run begins (=== messages.length
+	// when the context doesn't end in a user message; never below the caller's
+	// capturedThrough bound).
+	runStart: number;
+	userMessageCount: number;
+	// All trailing user messages combined into one replay prompt, or null when
+	// there is nothing usable to replay (no trailing users, or all-empty text
+	// with no image blocks).
+	prompt: string | null;
+	// Present when the run carries image blocks — the replay must send these
+	// (via wrapPromptStream) or the images are silently lost (vstack#993).
+	blocks: ContentBlockParam[] | null;
+}
+
+/** Plan replay of user messages pi injected mid-query (steer drain, followUp).
+ *  Captures the ENTIRE trailing consecutive user run, not just the last
+ *  message — dropping the earlier ones was silent input loss (vstack#967) —
+ *  but never walks below `capturedThrough`, the position an earlier callback
+ *  of the SAME query already captured (or deliberately held at, for an
+ *  all-empty run). Without that lower bound a second mid-query steer re-planned
+ *  the whole run from scratch and the first steer was queued — and delivered to
+ *  Claude — twice (vstack#1009). */
+export function planDeferredUserReplay(messages: Context["messages"], capturedThrough = 0): DeferredUserReplayPlan {
+	let runStart = messages.length;
+	while (runStart > capturedThrough && messages[runStart - 1]?.role === "user") runStart--;
+	const trailingUsers = messages.slice(runStart);
+	const prompt = trailingUsers.length > 0 ? extractUserPrompt(trailingUsers) : null;
+	const blocks = trailingUsers.length > 0 ? extractUserPromptBlocks(trailingUsers) : null;
+	return {
+		runStart,
+		userMessageCount: trailingUsers.length,
+		prompt: prompt?.trim() ? prompt : null,
+		blocks,
+	};
+}
+
 async function* wrapPromptStream(blocks: ContentBlockParam[]): AsyncIterable<SDKUserMessage> {
 	yield {
 		type: "user",
@@ -243,7 +282,7 @@ async function* wrapPromptStream(blocks: ContentBlockParam[]): AsyncIterable<SDK
 // them without activating the extension. `ctx()`, `pushContext()`, `popContext()`
 // are imported at the top of this file.
 
-function resolveMcpTools(context: Context, excludeToolName?: string): {
+export function resolveMcpTools(context: Context, excludeToolName?: string): {
 	mcpTools: Tool[];
 	customToolNameToSdk: Map<string, string>;
 	customToolNameToPi: Map<string, string>;
@@ -256,10 +295,29 @@ function resolveMcpTools(context: Context, excludeToolName?: string): {
 
 	for (const tool of context.tools) {
 		if (tool.name === excludeToolName) continue;
+		// Never re-offer a tool the child owns natively. The claude.ai connector
+		// namespace belongs to the child's own MCP servers, so a Pi tool sitting
+		// on it would be advertised a SECOND time under our prefix — two names
+		// for one capability, and the model picking the wrong one gets a real
+		// `Tool ... not found` from the dispatcher (memsira#320). It would also
+		// be uncallable in any case: a `tool_use` under that namespace is treated
+		// as child-executed and never handed to Pi (isChildExecutedTool), so
+		// filtering here is what makes the two halves agree end to end.
+		if (isChildExecutedTool(tool.name)) {
+			debug(`resolveMcpTools: not re-offering child-native tool ${tool.name}`);
+			continue;
+		}
 		const sdkName = `${MCP_TOOL_PREFIX}${tool.name}`;
 		mcpTools.push(tool);
+		// Case-insensitive aliases mean two tools differing only by case would
+		// silently overwrite each other's mapping — surface it if it ever happens.
+		const lowerName = tool.name.toLowerCase();
+		const collision = customToolNameToSdk.get(lowerName);
+		if (collision !== undefined && collision !== sdkName) {
+			debug(`WARNING: resolveMcpTools lowercase alias collision: ${tool.name} overwrites mapping previously held by ${collision}`);
+		}
 		customToolNameToSdk.set(tool.name, sdkName);
-		customToolNameToSdk.set(tool.name.toLowerCase(), sdkName);
+		customToolNameToSdk.set(lowerName, sdkName);
 		customToolNameToPi.set(sdkName, tool.name);
 		customToolNameToPi.set(sdkName.toLowerCase(), tool.name);
 	}
@@ -267,54 +325,12 @@ function resolveMcpTools(context: Context, excludeToolName?: string): {
 	return { mcpTools, customToolNameToSdk, customToolNameToPi };
 }
 
-/** Finalizes the current pi turn when the SDK invokes an MCP tool handler
- *  before emitting `message_stop` or the completed assistant message.
- *
- *  Observed with Claude Code under pi 0.80's steer draining (tool result and
- *  drained steer arrive in one provider call): the NEXT tool turn's tool_use
- *  streams in, the SDK invokes the MCP handler — and neither terminal event
- *  ever arrives. The invocation itself proves the assistant turn is committed,
- *  so end the pi stream here exactly like the `message_stop` path; otherwise
- *  the handler blocks on a result pi will never deliver (deadlock). No-op when
- *  the turn already ended (stream null) or the tool call isn't part of the
- *  currently streamed turn. */
-function finalizeToolUseTurnFromMcpInvocation(
-	queryCtx: QueryContext,
-	toolCallId: string,
-	toolName: string,
-	mappedArgs: Record<string, unknown>,
-): void {
-	if (!queryCtx.currentPiStream || !queryCtx.turnOutput) return;
-	let idx = queryCtx.turnBlocks.findIndex((b: any) => b.type === "toolCall" && b.id === toolCallId);
-	if (idx >= 0) {
-		const block = queryCtx.turnBlocks[idx] as any;
-		if ("partialJson" in block) {
-			// Stream ended before content_block_stop — settle the args from the
-			// partial JSON the same way content_block_stop would have.
-			block.arguments = mapToolArgs(block.name, parsePartialJson(block.partialJson, block.arguments));
-			queryCtx.updateToolCallArgs(block.id, block.arguments);
-			delete block.partialJson;
-			delete block.index;
-			queryCtx.currentPiStream.push({ type: "toolcall_end", contentIndex: idx, toolCall: block, partial: queryCtx.turnOutput });
-		}
-	} else {
-		// The invocation can arrive before the tool_use is streamed at all
-		// (observed after a tool-result+steer provider call reset the turn):
-		// synthesize the toolCall from the claim — the MCP call carries the
-		// authoritative id, name, and arguments.
-		queryCtx.turnBlocks.push({ type: "toolCall", id: toolCallId, name: toolName, arguments: mappedArgs });
-		idx = queryCtx.turnBlocks.length - 1;
-		const block = queryCtx.turnBlocks[idx] as any;
-		queryCtx.currentPiStream.push({ type: "toolcall_start", contentIndex: idx, partial: queryCtx.turnOutput });
-		queryCtx.currentPiStream.push({ type: "toolcall_end", contentIndex: idx, toolCall: block, partial: queryCtx.turnOutput });
-	}
-	queryCtx.turnSawToolCall = true;
-	queryCtx.turnOutput.stopReason = "toolUse";
-	debug(`mcp handler: finalizing tool_use turn from MCP invocation [${toolCallId}] (${toolName}) — SDK invoked the tool before message_stop/assistant message`);
-	queryCtx.currentPiStream.push({ type: "done", reason: "toolUse", message: queryCtx.turnOutput });
-	queryCtx.currentPiStream.end();
-	queryCtx.currentPiStream = null;
-}
+// finalizeToolUseTurnFromMcpInvocation moved to assistant-stream.ts: it is now
+// the grace-timer ACTION armed by scheduleToolUseTurnEnd rather than an
+// immediate end. The CLI invokes MCP handlers before message_delta arrives on
+// every tool-use turn, and message_delta is what carries the real output-token
+// count — ending the pi stream at handler invocation is what froze pi's
+// per-turn output figures at the message_start placeholders (1–7 tokens).
 
 // Creates an MCP server that bridges pi tools to the SDK. Each tool handler
 // blocks on a Promise until pi delivers the tool result via streamSimple.
@@ -341,23 +357,47 @@ function buildMcpServers(tools: Tool[], queryCtx: QueryContext): Record<string,
 					turnToolCallIds: queryCtx.turnToolCallIds,
 					turnToolCalls: safeToolCallSummary(queryCtx.turnToolCalls),
 				});
+				appendIntegrityEntry("tool_handler_unmatched", {
+					toolName: tool.name,
+					argKeys: argKeys(mappedArgs),
+					available: claim.available,
+					turnToolCallIds: queryCtx.turnToolCallIds,
+				});
 				return { content: [{ type: "text", text: `Claude bridge internal error: no matching tool_call id for ${tool.name}` }], isError: true } satisfies McpResult;
 			}
-			if (claim.match !== "tool-args" || claim.ambiguous) {
+			if (claim.argsMismatch) {
+				// Claimed anyway (sole same-name candidate) — record the divergence so
+				// a schema/validator drift stays visible without stranding the call.
+				debug(`mcp handler: ${tool.name} [${toolCallId}] claimed sole same-name call despite args mismatch`);
+				diagDump("tool_claim_args_mismatch", {
+					toolName: tool.name,
+					toolCallId,
+					handlerArgKeys: argKeys(mappedArgs),
+					recordedArgKeys: argKeys(queryCtx.turnToolCalls.find((call) => call.id === toolCallId)?.arguments),
+				});
+			} else if (claim.match !== "tool-args" || claim.ambiguous) {
 				debug(`mcp handler: ${tool.name} [${toolCallId}] claimed by ${claim.match}${claim.ambiguous ? " (ambiguous)" : ""}`);
 			}
-			if (toolCallId && queryCtx.pendingResults.has(toolCallId)) {
-				const result = queryCtx.pendingResults.get(toolCallId)!;
-				queryCtx.pendingResults.delete(toolCallId);
+			const earlyResult = toolCallId ? takeQueuedOrParkedResult(queryCtx, toolCallId) : undefined;
+			if (earlyResult !== undefined) {
 				queryCtx.markToolResultResolved(toolCallId);
-				debug(`mcp handler: ${tool.name} [${toolCallId}] → resolved from queue (${queryCtx.pendingResults.size} remaining)`);
-				return result;
+				debug(`mcp handler: ${tool.name} [${toolCallId}] → resolved from queue/parked (${queryCtx.pendingResults.size} queued, ${queryCtx.reapedResults.size} parked remaining)`);
+				return earlyResult;
 			}
 			debug(`mcp handler: ${tool.name} [${toolCallId}] → waiting`);
-			finalizeToolUseTurnFromMcpInvocation(queryCtx, toolCallId, tool.name, mappedArgs);
+			// Don't end the pi turn here — message_delta (real output tokens) and
+			// message_stop are normally milliseconds behind this invocation. Arm the
+			// grace timer instead; it force-finalizes only if they never arrive.
+			scheduleToolUseTurnEnd(
+				queryCtx,
+				() => finalizeToolUseTurnFromMcpInvocation(queryCtx, toolCallId, tool.name, mappedArgs),
+				`mcp-invocation:${tool.name}`,
+			);
 			return new Promise<McpResult>((resolve) => {
 				queryCtx.pendingToolCalls.set(toolCallId, {
 					toolName: tool.name,
+					args: mappedArgs,
+					generation: queryCtx.callbackGeneration,
 					resolve: (result) => {
 						queryCtx.markToolResultResolved(toolCallId);
 						resolve(result);
@@ -370,32 +410,6 @@ function buildMcpServers(tools: Tool[], queryCtx: QueryContext): Record<string,
 	return { [MCP_SERVER_NAME]: server };
 }
 
-// --- Effort level mapping ---
-// Pi reasoning levels → CC SDK effort levels
-
-const REASONING_TO_EFFORT: Record<string, EffortLevel> = {
-	minimal: "low", low: "low", medium: "medium", high: "high", xhigh: "max", max: "max",
-};
-
-function normalizeEffortOverrideModelKey(value: string): string {
-	const key = value.trim().toLowerCase();
-	return key.startsWith(`${PROVIDER_ID}/`) ? key.slice(PROVIDER_ID.length + 1) : key;
-}
-
-export function resolveConfiguredEffort(
-	modelId: string,
-	reasoningEffort: EffortLevel | undefined,
-	providerConfig?: Config["provider"],
-): EffortLevel | undefined {
-	const target = normalizeEffortOverrideModelKey(modelId);
-	for (const [key, rawEffort] of Object.entries(providerConfig?.modelEffortOverrides ?? {})) {
-		const normalizedKey = normalizeEffortOverrideModelKey(key);
-		if (normalizedKey !== "*" && normalizedKey !== target) continue;
-		const effort = normalizeEffortLevel(rawEffort) as EffortLevel | undefined;
-		if (effort) return effort;
-	}
-	return (normalizeEffortLevel(providerConfig?.forceEffort) as EffortLevel | undefined) ?? reasoningEffort;
-}
 
 // --- Provider: streaming function ---
 //
@@ -412,113 +426,6 @@ export function resolveConfiguredEffort(
 // currentPiStream, so any leftover messages hit the `!ctx().currentPiStream` guard
 // in consumeQuery and are skipped before resetTurnState runs.
 
-/** Background consumer: iterates the SDK generator, pushing events to currentPiStream.
- *  Runs until the query ends. Per turn, the SDK yields stream_events (deltas), then
- *  an assistant message (completed blocks). On tool_use, the stream is ended by
- *  whichever path handles it first (processStreamEvent or processAssistantMessage),
- *  and the MCP handler blocks the generator until pi delivers the tool result. */
-async function consumeQuery(
-	sdkQuery: ReturnType<typeof query>,
-	customToolNameToPi: Map<string, string>,
-	model: Model<any>,
-	cwd: string,
-	bridgeConfig: Config,
-	wasAborted: () => boolean,
-): Promise<{ capturedSessionId?: string }> {
-	let capturedSessionId: string | undefined;
-
-	for await (const message of sdkQuery) {
-		if (wasAborted()) break;
-		const queryCtx = ctx();
-		activeStreamIdleWatchdogs.get(queryCtx)?.noteChunk();
-		if (!queryCtx.turnOutput) continue;
-		if (!queryCtx.currentPiStream && !(message.type === "assistant" && queryCtx.turnSawToolCall)) continue;
-
-		switch (message.type) {
-			case "stream_event":
-				processStreamEvent(message, customToolNameToPi, model);
-				break;
-			case "assistant":
-				processAssistantMessage(message, model, customToolNameToPi);
-				break;
-			case "result":
-				if (!ctx().turnSawStreamEvent && message.subtype === "success") {
-					ensureTurnStarted();
-					const text = message.result || "";
-					ctx().turnBlocks.push({ type: "text", text });
-					const idx = ctx().turnBlocks.length - 1;
-					ctx().currentPiStream?.push({ type: "text_start", contentIndex: idx, partial: ctx().turnOutput });
-					ctx().currentPiStream?.push({ type: "text_delta", contentIndex: idx, delta: text, partial: ctx().turnOutput });
-					ctx().currentPiStream?.push({ type: "text_end", contentIndex: idx, content: text, partial: ctx().turnOutput });
-				} else if (message.subtype !== "success" && isExtraUsageRequiredMessage(message)) {
-					const errorLines = Array.isArray((message as any).errors) ? uniqueNonEmptyLines((message as any).errors) : [];
-					const errors = errorLines.length > 0 ? errorLines.join("\n") : String(message.subtype ?? "Claude Code rate limit");
-					const openedExtraUsage = launchExtraUsageHelperIfAllowed(cwd, bridgeConfig, "result error");
-					ctx().handledTerminalError = true;
-					ctx().turnOutput.stopReason = "error";
-					ctx().turnOutput.errorMessage = `${errors}${openedExtraUsage ? "\n\nOpened Claude Code /extra-usage helper. Complete billing/admin flow in the browser, then retry the prompt." : "\n\nRun /claude-bridge:extra, or enable Allow extra usage helper in settings."}`;
-					ctx().currentPiStream?.push({ type: "error", reason: "error", error: ctx().turnOutput });
-					ctx().currentPiStream?.end();
-					ctx().currentPiStream = null;
-				}
-				break;
-			case "system":
-				if ((message as any).subtype === "init" && (message as any).session_id) {
-					capturedSessionId = (message as any).session_id;
-				} else if ((message as any).subtype === "model_refusal_fallback") {
-					const originalModel = (message as any).original_model;
-					const fallbackModel = (message as any).fallback_model;
-					updateTurnOutputModel(fallbackModel);
-					debug("consumeQuery: model_refusal_fallback", JSON.stringify({ originalModel, fallbackModel }));
-					// Notify only for reroutes we configured, so an unexpected pairing from
-					// Claude Code is still logged above but not announced as one of ours.
-					if (typeof fallbackModel === "string" && typeof originalModel === "string" && fallbackModelForPrimaryModel(originalModel) === fallbackModel) {
-						safeNotify(
-							`Claude bridge switched ${modelDisplayName(originalModel)} to ${modelDisplayName(fallbackModel)} after Claude Code safety fallback.`,
-							"info",
-						);
-					}
-				}
-				break;
-			case "user":
-				break; // SDK echo of user prompt — not needed
-			case "rate_limit_event": {
-				const info = (message as any).rate_limit_info;
-				debug("consumeQuery: rate_limit_event", JSON.stringify(info).slice(0, 300));
-				if (info?.status === "rejected") {
-					const resetsAt = formatResetTimestamp(info.resetsAt);
-					const resetAtMs = typeof info.resetsAt === "string" ? Date.parse(info.resetsAt) : undefined;
-					const reason = `${info.rateLimitType ?? "unknown"} rate limit`;
-					const launchedExtraUsage = isExtraUsageRequiredMessage(info) && launchExtraUsageHelperIfAllowed(cwd, bridgeConfig, reason);
-					emitRateLimitEvent({
-						model: model.id,
-						provider: PROVIDER_ID,
-						rateLimitType: info.rateLimitType,
-						reason,
-						resetAt: info.resetsAt,
-						...(Number.isFinite(resetAtMs) ? { resetAtMs } : {}),
-						source: "claude-bridge",
-						status: "rejected",
-					});
-					piUI?.notify(`${RATE_LIMIT_TOKEN} Claude ${reason} hit — resets ${resetsAt}${launchedExtraUsage ? "; opened /extra-usage helper" : ""}`, "warning");
-				} else if (info?.status === "allowed_warning") {
-					const warning = formatAllowedRateLimitWarning(info);
-					if (warning) piUI?.notify(warning, "warning");
-					else debug("consumeQuery: suppressed low/ambiguous allowed_warning rate_limit_event", JSON.stringify(info).slice(0, 300));
-				}
-				break;
-			}
-			default:
-				debug("consumeQuery: unhandled SDK message type", message.type);
-				break;
-		}
-	}
-
-	// DEBUG: trace when consumeQuery exits
-	debug(`consumeQuery: for-await loop exited, wasAborted=${wasAborted()}, capturedSessionId=${capturedSessionId?.slice(0, 8) ?? "none"}`);
-
-	return { capturedSessionId };
-}
 
 // Claim the primary-instance token for this module instance if unclaimed, and
 // report whether this instance is the primary. First-loaded instance wins,
@@ -532,12 +439,15 @@ function claimPrimaryInstance(): boolean {
 
 // Release both process-global tokens this instance owns. Called on
 // session_shutdown (incl. /reload) so the freshly loaded instance starts clean.
-// NOTE: this does NOT unregister the provider — the ModelRegistry's
-// registeredProviders is a process-lifetime Map that survives module reload, so
-// retraction on logout is handled by applyProviderRegistration's defensive
-// unregister on the next load/session_start, not here.
+// NOTE: this does NOT unregister the provider — pi's provider registry is
+// process-lifetime state that survives module reload; the next loaded instance
+// simply upserts its own provider object over ours (registerNativeProvider is
+// replace-by-id), and logout-hiding is the provider's own auth check.
 function releaseProviderTokens(event: string): void {
 	const g = globalThis as Record<symbol, any>;
+	if (g[CLAUDE_BRIDGE_ACCOUNT_HOST_SYMBOL] === BRIDGE_ACCOUNT_HOST) {
+		g[CLAUDE_BRIDGE_ACCOUNT_HOST_SYMBOL] = undefined;
+	}
 	if (g[ACTIVE_STREAM_SIMPLE_KEY] === streamClaudeAgentSdk) {
 		debug(`${event}: clearing ACTIVE_STREAM_SIMPLE_KEY`);
 		g[ACTIVE_STREAM_SIMPLE_KEY] = undefined;
@@ -548,68 +458,99 @@ function releaseProviderTokens(event: string): void {
 	}
 }
 
-// Conditional (un)registration driven by real credential presence + instance
-// primacy. Run at extension load, on every session_start, and at pre-spawn
-// (fail-fast) so a `claude login` / logout is reflected without a /reload.
+// Native (pi >=0.81) provider registration. Run at extension load, on every
+// session_start, and at pre-spawn.
 //
-// decideRegistration encodes the pure state machine; this wrapper performs the
-// matching token mutations so tokens and registration never diverge:
-//   - register:   claim the stream guard, THEN registerProvider. If register
-//     throws/queue-fails, release the stream guard (but keep primacy) so a
-//     later re-check can retry cleanly (self-healing); errors are swallowed so
-//     a session_start handler can't crash the dispatch.
-//   - unregister: pi.unregisterProvider (idempotent), THEN release the stream
-//     guard if we own it. Defensive even when we never registered — this is the
-//     only retraction path for a stale registration surviving /reload. At LOAD
-//     the SDK's unregister only filters the pending-registration queue and can't
-//     mutate the persistent registry (loader.js), so the effective retraction
-//     lands on the post-load session_start re-check; the load-time call is a
-//     harmless idempotent no-op that also cancels any same-pass queued register.
-// Non-primary instances (subagents) always decide noop and touch nothing.
+// 2.x registers UNCONDITIONALLY (once primary): credential-driven availability
+// is the provider's own auth.check/resolve reporting configured-ness, so pi
+// hides/shows claude-bridge models itself — the 1.x register/unregister state
+// machine (decideRegistration) is gone. What each trigger does now:
+//   - load: build + register the provider (queued by the loader until bindCore).
+//   - session_start: re-upsert the SAME provider object. registerNativeProvider
+//     is upsert-by-id and kicks pi's model-snapshot/availability refresh, so a
+//     `claude login`/logout since the last session boundary is reflected
+//     deterministically — the same guarantee the 1.x re-check gave — without
+//     depending on pi's own refresh cadence.
+//   - pre-spawn: same re-upsert, from the fail-fast path, so a mid-session
+//     logout also flips availability at first use.
+// Non-primary instances (subagents) never touch registration: pi's native
+// registry REPLACES by id, so an unguarded subagent re-register would swap in
+// its own streamSimple — the exact split-brain the tokens exist to prevent.
+// On a pre-0.81 host the extension declines loudly (once) instead of
+// registering wrongly through the legacy overload.
+let nativeProviderInstance: unknown;
+let notifiedNativeUnsupported = false;
+
 function applyProviderRegistration(trigger: string): void {
 	const pi = extensionApi;
 	if (!pi) { debug(`${trigger}: applyProviderRegistration skipped — no extensionApi`); return; }
 	const g = globalThis as Record<symbol, any>;
 	const isPrimary = claimPrimaryInstance();
-	const credentialed = hasClaudeCredentials();
-	const registered = g[ACTIVE_STREAM_SIMPLE_KEY] === streamClaudeAgentSdk;
-	const decision = decideRegistration({ credentialed, isPrimary, registered });
-	debug(`${trigger}: registration decision=${decision} credentialed=${credentialed} isPrimary=${isPrimary} registered=${registered} (module=${moduleInstanceId})`);
-	if (decision === "register") {
-		// Claim ordering: stream guard BEFORE registerProvider so a concurrent
-		// subagent can never observe a registered provider without an owner.
-		g[ACTIVE_STREAM_SIMPLE_KEY] = streamClaudeAgentSdk;
-		try {
-			pi.registerProvider(PROVIDER_ID, {
-				baseUrl: "claude-bridge",
-				apiKey: "not-used",
-				api: "claude-bridge",
-				models: MODELS,
-				// Cast: pi-ai AssistantMessageEventStream diamond dep between pi-coding-agent and pi-agent-core
-				streamSimple: streamClaudeAgentSdk as any,
-			});
-		} catch (err) {
-			// Self-heal: release ONLY the stream guard we just claimed so a later
-			// re-check (primary + credentialed + not-registered → register) retries.
-			// Keep PRIMARY_INSTANCE_KEY: releasing it would reopen the subagent
-			// ownership-steal window, and retry does not need it released.
-			if (g[ACTIVE_STREAM_SIMPLE_KEY] === streamClaudeAgentSdk) g[ACTIVE_STREAM_SIMPLE_KEY] = undefined;
-			debug(`${trigger}: registerProvider threw; released stream guard for retry (kept primary):`, err);
-		}
-	} else if (decision === "unregister") {
-		try {
-			pi.unregisterProvider(PROVIDER_ID);
-		} catch (err) {
-			debug(`${trigger}: unregisterProvider threw (ignored):`, err);
+	if (!isPrimary) {
+		debug(`${trigger}: registration noop — non-primary instance (module=${moduleInstanceId})`);
+		return;
+	}
+	if (!supportsNativeProvider(_piAi)) {
+		debug(`${trigger}: host pi-ai lacks createProvider; refusing to register (module=${moduleInstanceId})`);
+		if (!notifiedNativeUnsupported) {
+			notifiedNativeUnsupported = true;
+			safeNotify(NATIVE_PROVIDER_UNSUPPORTED_MESSAGE, "error");
 		}
+		return;
+	}
+	const credentialed = hasClaudeCredentials() || Boolean(resolveClaudeAccountRouter());
+	debug(`${trigger}: native registration upsert, credentialed=${credentialed} (module=${moduleInstanceId})`);
+	// Start the connector inventory now, not on the first turn: the query path
+	// can only read a synchronous snapshot, so priming here is what gets the
+	// declarations in place before turn 1 (vstack#832). Fire and forget —
+	// registration must not wait on the network. Primes the DEFAULT credential
+	// scope only; managed profiles are primed per request in their own scope.
+	if (hasClaudeCredentials() && connectorsEnabledFor(loadConfig(process.cwd()))) primeConnectorServers();
+	// Claim ordering: stream guard BEFORE registerProvider so a concurrent
+	// subagent can never observe a registered provider without an owner.
+	g[ACTIVE_STREAM_SIMPLE_KEY] = streamClaudeAgentSdk;
+	try {
+		nativeProviderInstance ??= buildNativeProvider(
+			_piAi,
+			MODELS,
+			streamClaudeAgentSdk as (...args: unknown[]) => unknown,
+			process.env,
+			// Availability includes a companion account pool: the router owns
+			// credentials the direct existence probes cannot see.
+			() => hasClaudeCredentials() || Boolean(resolveClaudeAccountRouter()),
+		);
+		(pi.registerProvider as (provider: unknown) => void)(nativeProviderInstance);
+	} catch (err) {
+		// Self-heal: release ONLY the stream guard we just claimed so a later
+		// re-check retries cleanly. Keep PRIMARY_INSTANCE_KEY: releasing it would
+		// reopen the subagent ownership-steal window.
 		if (g[ACTIVE_STREAM_SIMPLE_KEY] === streamClaudeAgentSdk) g[ACTIVE_STREAM_SIMPLE_KEY] = undefined;
+		debug(`${trigger}: registerProvider threw; released stream guard for retry (kept primary):`, err);
 	}
 }
 
 /** Provider entry point. Pi calls this for each new prompt and each tool result.
- *  Two cases: tool result delivery (active query) or fresh query. */
-function streamClaudeAgentSdk(model: Model<any>, context: Context, options?: SimpleStreamOptions): AssistantMessageEventStream {
+ *  Two cases: tool result delivery (active query) or fresh query. Exported for
+ *  the rotation-stream unit tests, which drive it with a fake SDK factory. */
+export function streamClaudeAgentSdk(model: Model<any>, context: Context, options?: SimpleStreamOptions): AssistantMessageEventStream {
+	return runInRequestLane(options?.sessionId, () => streamClaudeAgentSdkInLane(model, context, options));
+}
+
+function streamClaudeAgentSdkInLane(model: Model<any>, context: Context, options?: SimpleStreamOptions): AssistantMessageEventStream {
 	const stream = newAssistantMessageEventStream();
+	// The lane this request runs in, for callbacks that fire OUTSIDE it: an
+	// AbortSignal listener runs in the aborter's async context, not ours.
+	const laneId = currentRequestLaneId();
+	// Pi marks its compaction and branch-summary one-shots with cacheRetention
+	// "none" and a fresh sessionId per call; no session_shutdown ever prunes
+	// those lanes. Map the hint onto lane lifetime: nothing about this request
+	// is retained once it settles.
+	const ephemeralLane = laneId !== undefined && options?.cacheRetention === "none";
+	const releaseEphemeralLane = (): void => {
+		if (!ephemeralLane) return;
+		deleteSharedSessionLane(laneId);
+		deleteQueryLane(laneId);
+	};
 
 	// DEBUG: trace followUp message triggering
 	const lastMsgRole = context.messages[context.messages.length - 1]?.role;
@@ -624,13 +565,20 @@ function streamClaudeAgentSdk(model: Model<any>, context: Context, options?: Sim
 		const queryCtx = ctx();
 		queryCtx.currentPiStream = stream;
 		queryCtx.resetTurnState(model);
+		// A fresh callback separates handlers registered for settled turns from
+		// ones racing this callback's own stream — the stranded drain below only
+		// ever touches the former.
+		queryCtx.callbackGeneration += 1;
 		activeStreamIdleWatchdogs.get(queryCtx)?.refresh();
 		const allResults = extractAllToolResults(context);
 		debug(`provider: tool results, ${allResults.length} results, ${queryCtx.pendingToolCalls.size} waiting handlers, ctx.msgs=${context.messages.length}`);
 		const unmatchedResultIds: string[] = [];
 		for (const result of allResults) {
 			const id = result.toolCallId;
-			if (id && !queryCtx.hasRecordedToolCall(id)) {
+			if (id && !queryCtx.hasRecordedToolCall(id) && !queryCtx.forwardedToolCallIds.has(id)) {
+				// A forwarded id is always legitimate even after the per-message
+				// records reset — Pi only answers calls it was handed (steer-split
+				// results land here after a boundary wiped the turn records).
 				queryCtx.markToolResultUnmatched(id);
 				unmatchedResultIds.push(id);
 				debug(`ERROR: tool result [${id}] has no registered tool_call id; refusing to queue or deliver`);
@@ -649,7 +597,9 @@ function streamClaudeAgentSdk(model: Model<any>, context: Context, options?: Sim
 				debug(`WARNING: tool result without toolCallId, cannot match`);
 			}
 			if (queryCtx.pendingToolCalls.size > 0 && queryCtx.pendingResults.size > 0) {
-				debug(`BUG: both maps non-empty! handlers=${queryCtx.pendingToolCalls.size} results=${queryCtx.pendingResults.size}`);
+				// Legitimate under staggered SDK invocation (a waiting steer-split
+				// handler while a sibling's result queues) — informational only.
+				debug(`note: handlers and queued results coexist: handlers=${queryCtx.pendingToolCalls.size} results=${queryCtx.pendingResults.size}`);
 			}
 		}
 		if (unmatchedResultIds.length > 0) {
@@ -657,13 +607,33 @@ function streamClaudeAgentSdk(model: Model<any>, context: Context, options?: Sim
 				content: [{ type: "text", text: `Claude bridge internal error: ${unmatchedResultIds.length} tool result(s) did not match any registered tool_call id. The turn was stopped to avoid delivering tool output to the wrong call. Unmatched ids: ${unmatchedResultIds.slice(0, 8).join(", ")}${unmatchedResultIds.length > 8 ? ", ..." : ""}` }],
 				isError: true,
 			};
-			for (const pending of queryCtx.pendingToolCalls.values()) pending.resolve(errorResult);
+			for (const [pendingId, pending] of queryCtx.pendingToolCalls) {
+				// The model is told these calls were stopped; an unforwarded one must
+				// never be dispatched by a later replay behind that message’s back.
+				if (!queryCtx.forwardedToolCallIds.has(pendingId)) queryCtx.deadToolCallIds.add(pendingId);
+				pending.resolve(errorResult);
+			}
 			queryCtx.pendingToolCalls.clear();
 			reportToolResultMismatch(queryCtx, "unmatched tool result", cwd);
 		}
 		if (queryCtx.pendingToolCalls.size > 0) {
-			debug(`WARNING: ${queryCtx.pendingToolCalls.size} MCP handlers still waiting after delivering ${allResults.length} results`);
-			piUI?.notify(`Claude bridge: ${queryCtx.pendingToolCalls.size} tool handler(s) still waiting — provider may be stuck`, "warning");
+			// A waiting handler whose call never reached Pi can never be answered —
+			// fail it now with a retryable error instead of letting the SDK await it
+			// forever (the 2026-08-17 five-and-a-half-hour deadlock, vstack#1469).
+			// Forwarded-but-unanswered handlers stay: steer-split batches legitimately
+			// deliver their results in a later callback.
+			const stranded = drainStrandedToolCalls(queryCtx);
+			if (stranded.length > 0) {
+				const names = stranded.map((entry) => entry.toolName).join(", ");
+				debug(`provider: failed ${stranded.length} stranded MCP handler(s) never forwarded to Pi: ${names}`);
+				diagDump("tool_handlers_stranded", { count: stranded.length, stranded });
+				appendIntegrityEntry("tool_handlers_stranded", { count: stranded.length, stranded });
+				safeNotify(`Claude bridge: failed ${stranded.length} tool call(s) that never reached Pi before their turn ended (${names}). The model saw a retryable error.`, "warning");
+			}
+			if (queryCtx.pendingToolCalls.size > 0) {
+				debug(`WARNING: ${queryCtx.pendingToolCalls.size} MCP handlers still waiting after delivering ${allResults.length} results`);
+				safeNotify(`Claude bridge: ${queryCtx.pendingToolCalls.size} tool handler(s) still waiting — provider may be stuck`, "warning");
+			}
 		}
 
 		// Detect user messages (steer/followUp) that pi injected into context
@@ -674,16 +644,53 @@ function streamClaudeAgentSdk(model: Model<any>, context: Context, options?: Sim
 		//   - A followUp is delivered between tool-result turns.
 		// The bridge can't forward these mid-query (the SDK query is in progress),
 		// so we save them for replay as continuation queries after consumeQuery ends.
+		// The cursor may only advance over messages actually captured for replay:
+		// claiming Claude owns a user message that was never deferred is permanent
+		// silent input loss (vstack#967 — only the LAST of several trailing user
+		// messages was captured while the cursor skipped them all).
+		let capturedThrough = context.messages.length;
 		if (lastMsgRole === "user") {
-			const userPrompt = extractUserPrompt(context.messages);
-			if (userPrompt) {
-				ctx().deferredUserMessages.push(userPrompt);
-				debug(`provider: deferred user message for replay after query: ${userPrompt.slice(0, 60)}`);
+			// Bound the plan at this query's own captured position (latestCursor
+			// Math.max-advances with every callback's capturedThrough below), so a
+			// second steer callback only queues messages BEYOND what the first one
+			// already owns — re-planning the whole trailing run queued the earlier
+			// steer twice (vstack#1009). latestCursor, not the shared record's
+			// cursor, deliberately: it lives on this QueryContext, so it is correct
+			// for reentrant and detached foreign queries too, whose contexts the
+			// shared cursor does not index (vstack#1001).
+			const replay = planDeferredUserReplay(context.messages, queryCtx.latestCursor);
+			// Image-only runs have no usable text but must still replay — capture
+			// whenever EITHER form has content (vstack#993).
+			if (replay.prompt || replay.blocks) {
+				ctx().deferredUserMessages.push({ text: replay.prompt ?? "", blocks: replay.blocks ?? undefined });
+				debug(`provider: deferred ${replay.userMessageCount} user message(s) for replay after query${replay.blocks ? ` (${replay.blocks.length} blocks incl. images)` : ""}: ${(replay.prompt ?? "[image-only]").slice(0, 60)}`);
+			} else {
+				capturedThrough = replay.runStart;
+				diagDump("deferred_user_replay_skipped", {
+					contextLength: context.messages.length,
+					runStart: replay.runStart,
+					userMessageCount: replay.userMessageCount,
+					messageRoles: context.messages.map((m, i) => `[${i}]${m.role}`).join(" "),
+				});
 			}
 		}
 
-		if (sharedSession) sharedSession.cursor = context.messages.length;
-		queryCtx.latestCursor = Math.max(queryCtx.latestCursor, context.messages.length);
+		// Cursor may only ADVANCE, and only for a query that holds the record's
+		// claim. A reentrant subagent call routed through this instance arrives
+		// here with a SHORT foreign context (its own [user…] conversation, not
+		// the one the cursor indexes) — writing its length used to shrink the
+		// parent cursor and make the next REUSE replay already-owned history.
+		// The stackDepth guard covers a pushed subagent context; the detached
+		// flag covers a foreign one-shot on the top-level ctx, whose GROWN
+		// mid-query context could otherwise out-length the parent's cursor and
+		// advance it past history Claude never saw (vstack#1001); Math.max
+		// remains the backstop for a legacy-record foreign context the
+		// fingerprint guard could not classify.
+		const activeSession = getSharedSession();
+		if (activeSession && stackDepth() === 0 && !queryCtx.detachedFromSharedSession) {
+			setSharedSession({ ...activeSession, cursor: Math.max(activeSession.cursor, capturedThrough) });
+		}
+		queryCtx.latestCursor = Math.max(queryCtx.latestCursor, capturedThrough);
 		return stream;
 	}
 
@@ -693,12 +700,17 @@ function streamClaudeAgentSdk(model: Model<any>, context: Context, options?: Sim
 	const lastMsg = context.messages[context.messages.length - 1];
 	if (lastMsg?.role === "toolResult") {
 		debug(`provider: orphaned tool result after abort, emitting end_turn`);
-		if (sharedSession) sharedSession.cursor = context.messages.length;
+		// The detached flag deliberately survives query end: an orphaned result
+		// from a foreign one-shot indexes ITS conversation, and writing that
+		// length here would move (even shrink) the parent's cursor (vstack#1001).
+		const activeSession = getSharedSession();
+		if (activeSession && stackDepth() === 0 && !ctx().detachedFromSharedSession) setSharedSession({ ...activeSession, cursor: context.messages.length });
 		const c = ctx();  // capture current context for the microtask
 		queueMicrotask(() => {
 			c.resetTurnState(model);
 			stream.push({ type: "done", reason: "stop", message: c.turnOutput });
 			stream.end();
+			releaseEphemeralLane();
 		});
 		return stream;
 	}
@@ -708,13 +720,13 @@ function streamClaudeAgentSdk(model: Model<any>, context: Context, options?: Sim
 	// Fail-fast credential re-check (only for a fresh query — NEVER for
 	// tool-result delivery of an in-flight query, handled above, where creds were
 	// valid at start and failing mid-turn would break tool pairing). This bounds
-	// the retraction-latency window from "next session boundary" to "first use":
-	// if credentials vanished since the last session_start, (a) trigger the same
-	// re-evaluation applyProviderRegistration does (primary-only; retracts the
-	// stale registration), and (b) fail this request with a clear, actionable
+	// the logout-visibility window from "next session boundary" to "first use":
+	// if neither a direct Claude login nor a companion account pool exists,
+	// (a) re-upsert the provider (primary-only) so pi's availability recompute
+	// hides the models, and (b) fail this request with a clear, actionable
 	// message instead of letting the SDK spawn die with a generic error. The
 	// check is cheap (existsSync + env reads only, no credential contents).
-	if (!hasClaudeCredentials()) {
+	if (!hasClaudeCredentials() && !resolveClaudeAccountRouter()) {
 		try { applyProviderRegistration("pre-spawn"); } catch { /* best effort */ }
 		const message = "Claude account not connected — connect an account (or run `claude login`) and retry.";
 		debug(`provider: pre-spawn credential check failed; failing fast: ${message}`);
@@ -729,6 +741,7 @@ function streamClaudeAgentSdk(model: Model<any>, context: Context, options?: Sim
 		queueMicrotask(() => {
 			stream.push({ type: "error", reason: "error", error: errorOutput });
 			stream.end();
+			releaseEphemeralLane();
 		});
 		return stream;
 	}
@@ -743,25 +756,167 @@ function streamClaudeAgentSdk(model: Model<any>, context: Context, options?: Sim
 	ctx().currentPiStream = stream;
 	ctx().pendingToolCalls.clear();
 	ctx().pendingResults.clear();
+	ctx().reapedResults.clear();
+	ctx().forwardedToolCallIds.clear();
+	ctx().deadToolCallIds.clear();
+	ctx().callbackGeneration = 0;
 	ctx().deferredUserMessages = [];
 	ctx().resetTurnState(model);
 	ctx().resetToolTracking();
 	ctx().latestCursor = 0;
+	ctx().committedOutput = false;
+	// A reentrant query never claims the shared record; a foreign-conversation
+	// one-shot joins it below once syncSharedSession has ruled.
+	ctx().detachedFromSharedSession = isReentrant;
+
+	// --- Account routing (optional) ---
+	// A companion router selects the subscription profile for this attempt.
+	// Rotation state rides the options object so a retry re-entry excludes the
+	// profiles that already failed this request.
+	const router = resolveClaudeAccountRouter();
+	const rotationOptions = options as BridgeStreamOptions | undefined;
+	const rotationState: RotationRequestState = rotationOptions?.[ROTATION_STATE_KEY] ?? {
+		excludedProfileIds: new Set<string>(),
+		attempts: 0,
+	};
+	let account: ClaudeAccountRoute | undefined;
+	if (router) {
+		try {
+			account = router.acquire({
+				modelId: model.id,
+				sessionId: options?.sessionId,
+				excludedProfileIds: [...rotationState.excludedProfileIds],
+				forceRerank: rotationState.attempts > 0,
+				reason: rotationState.attempts > 0 ? "automatic-failover" : undefined,
+			});
+			rotationState.attempts += 1;
+		} catch (error) {
+			// No profile is available (all cooling down / none configured). Fail
+			// the request before spawning anything, carrying the router's reset
+			// hint so pi-qol can schedule an auto-resume.
+			const message = error instanceof Error ? error.message : String(error);
+			const resetAtMs = Number((error as { resetAtMs?: unknown })?.resetAtMs);
+			const rateLimitType = (error as { rateLimitType?: unknown })?.rateLimitType;
+			if (ctx().turnOutput) {
+				ctx().turnOutput.stopReason = "error";
+				ctx().turnOutput.errorMessage = message;
+				if (Number.isFinite(resetAtMs)) {
+					Object.assign(ctx().turnOutput as AssistantMessage & Record<string, unknown>, { resetAtMs, rateLimitType });
+				}
+			}
+			if (Number.isFinite(resetAtMs)) {
+				emitRateLimitEvent({
+					model: model.id,
+					provider: model.provider,
+					rateLimitType: rateLimitType ?? "all_accounts",
+					reason: message,
+					resetAt: new Date(resetAtMs).toISOString(),
+					resetAtMs,
+					source: "claude-bridge",
+					status: "rejected",
+				});
+			}
+			const errorOutput = ctx().turnOutput!;
+			if (isReentrant) popContext();
+			queueMicrotask(() => {
+				stream.push({ type: "error", reason: "error", error: errorOutput });
+				stream.end();
+				releaseEphemeralLane();
+			});
+			return stream;
+		}
+	}
+	const queryModel = account?.modelId && account.modelId !== model.id
+		? { ...model, id: account.modelId, name: modelDisplayName(account.modelId) }
+		: model;
+	if (queryModel.id !== model.id) {
+		// Stamp the output model on EVERY attempt (each retry resets turn state),
+		// but toast each distinct model at most once per request: with up to 16
+		// rotation attempts, every retry re-enters this block and would otherwise
+		// repeat an identical switch notice. A DIFFERENT model first selected
+		// mid-rotation still announces itself.
+		updateTurnOutputModel(queryModel.id);
+		if (rotationState.announcedModelId !== queryModel.id) {
+			rotationState.announcedModelId = queryModel.id;
+			safeNotify(
+				account?.fallbackReason === "fable-quota"
+					? `Every ready account rejected Claude Fable; using ${modelDisplayName(queryModel.id)}.`
+					: `Pi Claude switched to ${modelDisplayName(queryModel.id)}.`,
+				"info",
+			);
+		}
+	}
+	// Buffer protocol setup events until the first visible output so a failed
+	// pre-output attempt can be retried on another profile without leaking a
+	// duplicate `start` frame into Pi. The query context is captured ONCE here:
+	// commit can fire while a reentrant subagent context is pushed, and stamping
+	// the live ctx() then would mark the WRONG query as committed and leave this
+	// one replayable after visible output.
+	const attemptCtx = ctx();
+	const attemptBuffer = account
+		? new RetryEventBuffer(stream, () => attemptCtx.markOutputCommitted())
+		: undefined;
+	if (attemptBuffer) attemptCtx.currentPiStream = attemptBuffer as unknown as AssistantMessageEventStream;
 
 	const { mcpTools, customToolNameToSdk, customToolNameToPi } = resolveMcpTools(context);
-	const promptBlocks = extractUserPromptBlocks(context.messages);
-	let promptText = extractUserPrompt(context.messages) ?? "";
 
-	// Guard: empty prompt means the last context message isn't a user message.
-	// This should never happen with the state stack fix — dump diagnostics if it does.
-	if (!promptText && !promptBlocks) {
+	// Config + executable preflight run BEFORE syncSharedSession on purpose: the
+	// sync's REBUILD path is destructive (deleteSession + createSession + save),
+	// so a misconfigured executable must fail this query while the previous
+	// session file is still intact.
+	const bridgeConfig = loadConfig(cwd);
+	const providerSettings = bridgeConfig.provider ?? {};
+	const claudeExecutable = resolveClaudeExecutable(providerSettings.pathToClaudeCodeExecutable);
+	const claudeExecutablePreflight = claudeExecutable ? preflightClaudeExecutable(claudeExecutable, cwd) : undefined;
+
+	const accountScope = accountSessionScope(account);
+	const cursorBeforeSync = getSharedSession()?.cursor ?? null;
+	// A REENTRANT (subagent) query never touches the module-level shared
+	// session: syncSharedSession's REBUILD path is destructive to the PARENT's
+	// session file, and any resume id borrowed from the parent would splice the
+	// subagent's turn into the parent's conversation of record. It runs as a
+	// clean one-shot instead (Case-1 semantics — no resume, prompt is the
+	// trailing message; the child session id lives in the QueryContext only).
+	const syncResult = isReentrant
+		? { sessionId: null, promptStart: context.messages.length - 1 }
+		: syncSharedSession(context.messages, cwd, customToolNameToSdk, queryModel.id, accountScope);
+	const { sessionId: resumeSessionId, promptStart } = syncResult;
+	// A FOREIGN-conversation query (conversation-fingerprint mismatch against
+	// the shared record — a subagent-shaped request arriving while the parent
+	// is IDLE, vstack#1001) also runs as a clean one-shot and gets the same
+	// hands-off treatment as a reentrant one below: never persist over the
+	// module-level record, never mark it for rebuild. The flag also rides the
+	// QueryContext so the mismatch/abort/teardown paths that mutate the record
+	// OUTSIDE this closure (reportToolResultMismatch, the cursor advances in
+	// the delivery paths above) observe the same non-claim.
+	const foreignContext = syncResult.foreignContext === true;
+	if (foreignContext) ctx().detachedFromSharedSession = true;
+	// Identity anchor stamped onto every record this outermost query persists,
+	// so the record created by a Case-1 clean start is protected from the very
+	// next idle-window foreign query.
+	const conversationFp = isReentrant || foreignContext ? undefined : conversationFingerprint(context.messages);
+	const promptMessages = context.messages.slice(promptStart);
+	const promptBlocks = extractUserPromptBlocks(promptMessages);
+	let promptText = extractUserPrompt(promptMessages) ?? "";
+
+	// Guard: a prompt with no usable content means the last context message
+	// isn't a user message (or the batch was all-empty — joined batches turn ""
+	// into "\n\n", so test the trimmed text, not truthiness). Should never
+	// happen with the state stack fix — dump diagnostics if it does.
+	if (!promptText.trim() && !promptBlocks) {
 		diagDump("empty_prompt", {
 			contextLength: context.messages.length,
 			lastMsgRole: lastMsg?.role,
 			isReentrant,
 			stackDepth: stackDepth(),
 			activeQueryExists: ctx().activeQuery !== null,
-			sharedSession: sharedSession ? { sessionId: sharedSession.sessionId.slice(0, 8), cursor: sharedSession.cursor } : null,
+			cursorBeforeSync,
+			promptStart,
+			promptRoles: promptMessages.map((m) => m.role).join(" "),
+			sharedSession: (() => {
+				const activeSession = getSharedSession();
+				return activeSession ? { sessionId: activeSession.sessionId.slice(0, 8), cursor: activeSession.cursor } : null;
+			})(),
 			messageRoles: context.messages.map((m, i) => `[${i}]${m.role}`).join(" "),
 		});
 		// Recover: use a continuation prompt so the SDK doesn't send an empty text block
@@ -772,109 +927,78 @@ function streamClaudeAgentSdk(model: Model<any>, context: Context, options?: Sim
 		? wrapPromptStream(promptBlocks)
 		: promptText;
 	const mcpServers = buildMcpServers(mcpTools, ctx());
-	const bridgeConfig = loadConfig(cwd);
-	const providerSettings = bridgeConfig.provider ?? {};
-	// Whether to expose the Claude account's claude.ai cloud MCP connectors
-	// (Gmail/Calendar/Drive). Enabled via env or config; drives setting-sources,
-	// tool isolation, and the ENABLE_CLAUDEAI_MCP_SERVERS child-env gate below.
-	const enableCloudMcp = connectorsEnabledFor(bridgeConfig);
-	// Connector WRITE control: read-only by default (writes denied); the one-shot
-	// approved-write executor sets CLAUDE_BRIDGE_CONNECTOR_WRITE=allow / config.
-	const connectorWriteMode = connectorWriteModeFor(bridgeConfig);
-	const appendSystemPrompt = providerSettings.appendSystemPrompt !== false;
-	const agentsAppend = appendSystemPrompt ? extractAgentsAppend() : undefined;
-	const skillsAppend = appendSystemPrompt ? extractSkillsBlock(context.systemPrompt) : undefined;
-	const promptContextAppend = buildPromptContextAppend(context.systemPrompt, cwd, bridgeConfig.promptContext ?? {});
-	const appendParts = [agentsAppend, skillsAppend, promptContextAppend.text].filter((part): part is string => Boolean(part));
-	const systemPromptAppend = appendParts.length > 0 ? appendParts.join("\n\n") : undefined;
-
-	// MCP auto-loading suppression: with appendSystemPrompt=true (default), the
-	// SDK uses isolation mode and avoids filesystem settings. If users turn that
-	// off, load user/project settings but pass --strict-mcp-config so Claude Code
-	// ignores auto-discovered filesystem MCP servers while Pi owns tool execution.
-	// claude.ai cloud MCP connectors only load when Claude Code resolves its
-	// filesystem setting sources. The SDK treats settingSources=undefined as
-	// isolation (no sources), which drops the connectors even with
-	// ENABLE_CLAUDEAI_MCP_SERVERS=1. When connectors are enabled we force the CLI
-	// default source set so Gmail/Calendar/Drive surface.
-	const settingSources: SettingSource[] | undefined = enableCloudMcp
-		? (providerSettings.settingSources ?? ["user", "project", "local"])
-		: appendSystemPrompt
-			? undefined
-			: providerSettings.settingSources ?? ["user", "project"];
-	const strictMcpConfigEnabled = !appendSystemPrompt && providerSettings.strictMcpConfig !== false;
-	const claudeExecutable = resolveClaudeExecutable(providerSettings.pathToClaudeCodeExecutable);
-	const claudeExecutablePreflight = claudeExecutable ? preflightClaudeExecutable(claudeExecutable, cwd) : undefined;
-	const { sessionId: resumeSessionId } = syncSharedSession(context.messages, cwd, customToolNameToSdk, model.id);
-
-	// Prefer the model's own thinkingLevelMap when present (pi-ai 0.72+ ships
-	// per-model overrides — e.g. opus-4-7 wants xhigh→xhigh, not xhigh→max).
-	// Fall back to our generic table for older pi-ai or unmapped levels.
-	const requestedEffort = options?.reasoning
-		? ((model as any).thinkingLevelMap?.[options.reasoning] as EffortLevel | undefined)
-			?? REASONING_TO_EFFORT[options.reasoning]
-		: undefined;
-	const effort = resolveConfiguredEffort(model.id, requestedEffort, providerSettings);
-
-	const extraArgs: Record<string, string | null> = {};
-	if (strictMcpConfigEnabled) extraArgs["strict-mcp-config"] = null;
-	// Opus 4.7 defaults thinking.display to "omitted" (empty thinking text in stream).
-	// Force summarized so thinking_delta events arrive. See anthropics/claude-agent-sdk-python#830.
-	if (effort) extraArgs["thinking-display"] = "summarized";
-	const fallbackModel = fallbackModelForPrimaryModel(model.id);
-
-	// Suppress claude.ai cloud MCP servers (Figma/Canva/etc. auto-discovered via OAuth
-	// when the user is logged into Anthropic). These are a separate code path from
-	// filesystem MCP and are NOT blocked by --strict-mcp-config or settingSources=undefined.
-	// The native CC binary gates them on env var ENABLE_CLAUDEAI_MCP_SERVERS: setting it
-	// to "0"/"false"/"no"/"off" makes the loader return early before any cloud fetch.
-	// DISABLE_AUTO_COMPACT=1: pi owns context-management and propagates its own
-	// /compact via session_compact (see handler in default export). Letting CC
-	// also autocompact would double-flush the prompt cache and races pi's
-	// threshold with CC's, including CC's anti-thrashing guard (issue #8).
-	// Manual /compact in CC still works (we never invoke it).
-	// When connectors are enabled, allow claude.ai cloud MCP servers so the
-	// authenticated account's Gmail/Calendar/Drive tools load. Default stays "0".
-	const childEnv = { ...process.env, ENABLE_CLAUDEAI_MCP_SERVERS: enableCloudMcp ? "1" : "0", DISABLE_AUTO_COMPACT: "1" };
-	const queryOptions: NonNullable<Parameters<typeof query>[0]["options"]> = {
+	// Pure SDK query-option assembly — see buildClaudeQueryOptions for the
+	// connector, prompt-append, setting-source, effort, and env rationale.
+	const built = buildClaudeQueryOptions({
 		cwd,
-		model: model.id,
-		env: childEnv,
-		...connectorQueryOptions(enableCloudMcp, connectorWriteMode),
-		permissionMode: "bypassPermissions",
-		includePartialMessages: true,
-		...(fallbackModel ? { fallbackModel } : {}),
-		...(providerSettings.fastMode ? { settings: { fastMode: true } } : {}),
-		systemPrompt: {
-			type: "preset", preset: "claude_code",
-			append: systemPromptAppend ? systemPromptAppend : undefined,
-		},
-		extraArgs,
-		...(effort ? { effort } : {}),
-		...(settingSources ? { settingSources } : {}),
-		...(mcpServers ? { mcpServers } : {}),
-		...(resumeSessionId ? { resume: resumeSessionId } : {}),
-		...(claudeExecutable ? { pathToClaudeCodeExecutable: claudeExecutable } : {}),
-		spawnClaudeCodeProcess: spawnClaudeCodeWithDiagnostics,
-		...makeCliDebugOptions("provider"),
-	};
+		requestedModel: model,
+		queryModel,
+		account,
+		bridgeConfig,
+		systemPrompt: context.systemPrompt,
+		reasoning: options?.reasoning,
+		resumeSessionId,
+		mcpServers,
+		claudeExecutable,
+	});
+	const { queryOptions } = built;
 
 	debug("provider: fresh query",
-		`model=${model.id} msgs=${context.messages.length} tools=${mcpTools.length}`,
-		`resume=${resumeSessionId?.slice(0, 8) ?? "none"} effort=${effort ?? "default"}`,
-		`fallback=${fallbackModel ?? "none"}`,
-		`appendSys=${appendSystemPrompt} promptCtx=${promptContextAppend.labels.join(",") || "none"} strictMcp=${strictMcpConfigEnabled} fastMode=${providerSettings.fastMode === true} connectors=${enableCloudMcp}`,
+		`model=${queryModel.id} requested=${model.id} msgs=${context.messages.length} tools=${mcpTools.length}`,
+		`resume=${resumeSessionId?.slice(0, 8) ?? "none"} effort=${built.effort ?? "default"} account=${account?.label ?? "legacy"}`,
+		`fallback=${built.fallbackModel ?? "none"}`,
+		`appendSys=${built.appendSystemPrompt} promptCtx=${built.promptContextLabels.join(",") || "none"} strictMcp=${built.strictMcpConfigEnabled} fastMode=${providerSettings.fastMode === true} connectors=${built.enableCloudMcp}`,
 		`claudeExec=${claudeExecutablePreflight ? `${claudeExecutablePreflight.fileType}:${claudeExecutablePreflight.path}` : "sdk-default"}`,
 		`prompt=${promptText.slice(0, 60)}${promptBlocks ? " [+images]" : ""}`);
 
 	// 3. Start SDK query and claim it for this context
 	let wasAborted = false;
 	let streamIdleTimedOut = false;
-	const sdkQuery = query({ prompt, options: queryOptions });
+	let retryRequested = false;
+	let retryFailure: ClaudeAttemptFailure | undefined;
+	const sdkQuery = sdkQueryFactory({ prompt, options: queryOptions });
 	ctx().activeQuery = sdkQuery;
 
 	// 4. Capture context for abort handling (must be AFTER pushContext)
 	const abortCtx = ctx();
+	// Failure metadata consumeQuery observed, surviving an iterator THROW (the
+	// .catch below reuses it instead of re-classifying — see C5 note there).
+	const attemptFailure: { failure?: ClaudeAttemptFailure } = {};
+	// A reentrant (subagent) query must never write the module-level shared
+	// session: its completion/failure handlers would overwrite the PARENT's
+	// record with the child's session id and cursor. A foreign-conversation
+	// one-shot (vstack#1001) has exactly the same non-claim on the record.
+	const persistSession = (next: SessionState | null): void => {
+		if (isReentrant || foreignContext) return;
+		setSharedSession(next && conversationFp ? { conversationFingerprint: conversationFp, ...next } : next);
+	};
+	const markRebuildForThisQuery = (opts: { forceRotate?: boolean } = {}): void => {
+		if (isReentrant || foreignContext) return;
+		markSessionForRebuild(opts);
+	};
+	// #967 invariant: a deferred (mid-query) user message may be dropped only
+	// LOUDLY — the cursor already advanced over it on the promise of replay.
+	// Callers that keep a session record after a non-empty drop must persist it
+	// with needsRebuild so the next turn re-imports the steers from Pi history.
+	const dropDeferredUserMessages = (site: string, undelivered?: DeferredUserMessage): DeferredUserMessage[] => {
+		const dropped = [...(undelivered !== undefined ? [undelivered] : []), ...abortCtx.deferredUserMessages];
+		abortCtx.deferredUserMessages = [];
+		if (dropped.length > 0) {
+			diagDump("deferred_user_messages_dropped", summarizeDroppedUserMessages(site, dropped));
+		}
+		return dropped;
+	};
+	let accountFailureRecorded = false;
+	const recordAttemptFailure = (failure: ClaudeAttemptFailure): void => {
+		// Rate-limit failures carry rateLimitInfo and were already recorded via
+		// router.recordRateLimit in consumeQuery.
+		if (
+			accountFailureRecorded || !account || !router || !failure.kind ||
+			failure.rateLimitInfo || wasAborted || options?.signal?.aborted
+		) return;
+		safeRouterCall("recordFailure", () => router.recordFailure(account.profileId, failure.kind!, queryModel.id));
+		accountFailureRecorded = true;
+	};
 
 	const requestAbort = () => {
 		// interrupt() asks the CLI to stop gracefully; close() kills it immediately.
@@ -882,6 +1006,39 @@ function streamClaudeAgentSdk(model: Model<any>, context: Context, options?: Sim
 		void sdkQuery.interrupt().catch(() => {});
 		try { sdkQuery.close(); } catch {}
 	};
+
+	// Decide whether a classified failure may be replayed on the next profile.
+	// Records the failure with the router either way (a post-output failure is
+	// not replayable but the next prompt's routing should still avoid the
+	// unhealthy account). The buffer's own committed flag backs up the context
+	// flag in case the two ever disagree. Shared by the stream-idle watchdog and
+	// the completion/error handlers below.
+	const requestRotation = (failure: ClaudeAttemptFailure): boolean => {
+		recordAttemptFailure(failure);
+		const committed = abortCtx.committedOutput || attemptBuffer?.hasCommittedOutput === true;
+		// Rotation retries re-enter streamClaudeAgentSdk from the outer promise
+		// chain — an outermost-only path. A reentrant (subagent) query that fails
+		// just fails; it must never queue a retry or burn a profile exclusion.
+		const eligible = Boolean(!isReentrant && account && router && failure.kind && !committed && !wasAborted && !options?.signal?.aborted && rotationState.attempts < MAX_ROTATION_ATTEMPTS);
+		debug("provider: account rotation decision", JSON.stringify({
+			eligible,
+			account: account?.label,
+			kind: failure.kind,
+			committedOutput: committed,
+			wasAborted,
+			signalAborted: options?.signal?.aborted === true,
+			attempts: rotationState.attempts,
+		}));
+		if (!eligible || !account || !router || !failure.kind) return false;
+		rotationState.excludedProfileIds.add(account.profileId);
+		retryRequested = true;
+		retryFailure = failure;
+		attemptBuffer?.discard();
+		abortCtx.currentPiStream = null;
+		debug(`provider: rotating account after ${failure.kind}, from=${account.label}, attempt=${rotationState.attempts}`);
+		return true;
+	};
+
 	const streamIdleTimeoutMs = streamIdleTimeoutMsFromEnv();
 	const streamIdleWatchdog = streamIdleTimeoutMs > 0
 		? createStreamIdleWatchdog({
@@ -895,15 +1052,24 @@ function streamClaudeAgentSdk(model: Model<any>, context: Context, options?: Sim
 			onTimeout: ({ idleMs, timeoutMs }) => {
 				if (streamIdleTimedOut || wasAborted || options?.signal?.aborted || abortCtx.activeQuery !== sdkQuery) return;
 				streamIdleTimedOut = true;
-				abortCtx.deferredUserMessages = [];
-				abortCtx.handledTerminalError = true;
-				if (sharedSession) setSharedSession({ ...sharedSession, needsRebuild: true, forceRotate: true });
+				dropDeferredUserMessages("stream-idle-timeout");
+				markRebuildForThisQuery({ forceRotate: true });
 				const errorMessage = buildStreamIdleTimeoutErrorMessage(timeoutMs);
-				debug("provider: stream idle timeout", `model=${model.id}`, `timeout=${timeoutMs}`, `idle=${idleMs}`);
+				debug("provider: stream idle timeout", `model=${queryModel.id}`, `timeout=${timeoutMs}`, `idle=${idleMs}`);
+				const idleFailure: ClaudeAttemptFailure = { kind: "network", message: errorMessage };
+				// A managed attempt that went idle before ANY visible output can move
+				// to the next profile instead of surfacing the timeout. The idle
+				// specifics (needsRebuild/forceRotate, killing the child) stay here;
+				// eligibility and retry bookkeeping are requestRotation's.
+				if (requestRotation(idleFailure)) {
+					requestAbort();
+					return;
+				}
+				abortCtx.handledTerminalError = true;
 				emitRateLimitEvent({
 					idleMs,
-					model: model.id,
-					provider: PROVIDER_ID,
+					model: queryModel.id,
+					provider: queryModel.provider,
 					rateLimitType: "stream_idle",
 					reason: "Claude Code stream idle timeout",
 					retryAfterMs: STREAM_IDLE_BACKOFF_HINT_MS,
@@ -911,7 +1077,7 @@ function streamClaudeAgentSdk(model: Model<any>, context: Context, options?: Sim
 					status: "rejected",
 					timeoutMs,
 				});
-				piUI?.notify(`${RATE_LIMIT_TOKEN} Claude stream idle timeout after ${formatDurationShort(timeoutMs)} — retrying via rate-limit backoff`, "warning");
+				safeNotify(`${RATE_LIMIT_TOKEN} Claude stream idle timeout after ${formatDurationShort(timeoutMs)} — retrying via rate-limit backoff`, "warning");
 				if (abortCtx.turnOutput) {
 					abortCtx.turnOutput.stopReason = "error";
 					abortCtx.turnOutput.errorMessage = errorMessage;
@@ -933,84 +1099,180 @@ function streamClaudeAgentSdk(model: Model<any>, context: Context, options?: Sim
 		activeStreamIdleWatchdogs.set(abortCtx, streamIdleWatchdog);
 		streamIdleWatchdog.refresh();
 	}
-	const onAbort = () => {
+	// Runs in the ABORTER's async context (AbortSignal listeners do not inherit
+	// AsyncLocalStorage), so re-enter this request's lane explicitly: the
+	// mismatch report marks the shared record of whatever lane is current.
+	const onAbort = () => runInRequestLane(laneId, () => {
 		wasAborted = true;
 		// Prevent stale deferred messages from being replayed by parent on pop
-		abortCtx.deferredUserMessages = [];
-		reportToolResultMismatch(abortCtx, "abort", cwd, { forceRotate: true });
+		dropDeferredUserMessages("abort");
+		reportToolResultMismatch(abortCtx, "abort", cwd, {
+			expectedInterruption: true,
+			forceRotate: true,
+		});
 		const drained = drainPendingToolCalls(abortCtx, "abort");
 		if (drained > 0) debug(`provider: abort drained ${drained} waiting MCP handler(s) as errors`);
 		abortCtx.pendingResults.clear();
 		requestAbort();
-	};
+	});
 	if (options?.signal) {
 		if (options.signal.aborted) onAbort();
 		else options.signal.addEventListener("abort", onAbort, { once: true });
 	}
 
-	// Background consumer — runs until query ends
-	consumeQuery(sdkQuery, customToolNameToPi, model, cwd, bridgeConfig, () => wasAborted)
-		.then(async ({ capturedSessionId }) => {
-			debug(`provider: consumeQuery completed, stopReason=${ctx().turnOutput?.stopReason}, error=${ctx().turnOutput?.errorMessage}, aborted=${wasAborted}`);
+	const surfaceFailure = (failure: ClaudeAttemptFailure, aborted = false): void => {
+		attemptBuffer?.commit();
+		if (failure.rateLimitInfo) {
+			// Managed rate-limit that will NOT rotate — this is the single place its
+			// event + toast are emitted (the legacy path emitted inline instead).
+			const info = failure.rateLimitInfo;
+			const resetAt = rateLimitResetFromInfo(info);
+			const resetAtMs = rateLimitResetMs(info);
+			emitRateLimitEvent({
+				model: queryModel.id, provider: queryModel.provider, rateLimitType: rateLimitTypeFromInfo(info),
+				reason: failure.message, resetAt,
+				...(Number.isFinite(resetAtMs) ? { resetAtMs } : {}),
+				source: "claude-bridge", status: "rejected",
+			});
+			safeNotify(`${RATE_LIMIT_TOKEN} Claude ${failure.message} — resets ${formatResetTimestamp(resetAtMs ?? resetAt)}`, "warning");
+		}
+		if (abortCtx.turnOutput) {
+			abortCtx.turnOutput.stopReason = aborted ? "aborted" : "error";
+			abortCtx.turnOutput.errorMessage = failure.message;
+		}
+		abortCtx.currentPiStream?.push({ type: "error", reason: aborted ? "aborted" : "error", error: abortCtx.turnOutput! });
+		abortCtx.currentPiStream?.end();
+		abortCtx.currentPiStream = null;
+	};
+
+	// Background consumer — runs until this attempt's query ends. Before any
+	// visible output, a classified failure on a managed attempt is replayed once
+	// on each remaining profile; after output/connector dispatch, replay is
+	// forbidden and the failure surfaces.
+	// The handlers below use the CAPTURED abortCtx, never the live ctx(): the two
+	// only differ while a reentrant (subagent) context is pushed, and a parent
+	// query CAN end in that window (abort, child process death throwing out of
+	// the generator). Live-ctx handlers there mutated the subagent's turn state
+	// and stream and skipped the parent's own teardown entirely.
+	consumeQuery(sdkQuery, abortCtx, customToolNameToPi, queryModel, bridgeConfig, () => wasAborted, account, router, attemptFailure)
+		.then(async ({ capturedSessionId, failure }) => {
+			debug(`provider: consumeQuery completed, stopReason=${abortCtx.turnOutput?.stopReason}, failure=${failure?.kind ?? "none"}, aborted=${wasAborted}`);
 			if (streamIdleTimedOut) {
-				abortCtx.deferredUserMessages = [];
-				debug("provider: stream idle timeout already surfaced; skipping normal completion");
+				dropDeferredUserMessages("stream-idle-timeout-completion");
+				debug(`provider: stream idle timeout ${retryRequested ? "queued account rotation" : "already surfaced"}; skipping normal completion`);
 				return;
 			}
 
 			// --- Abort detection in normal completion path ---
 			if (wasAborted || options?.signal?.aborted) {
-				if (sharedSession) setSharedSession({ ...sharedSession, needsRebuild: true, forceRotate: true });
-				ctx().deferredUserMessages = [];
+				markRebuildForThisQuery({ forceRotate: true });
+				dropDeferredUserMessages("abort-completion");
 				debug(`provider: abort detected, marked sharedSession needsRebuild + forceRotate`);
-				if (ctx().turnOutput) {
-					ctx().turnOutput.stopReason = "aborted";
-					ctx().turnOutput.errorMessage = "Operation aborted";
+				surfaceFailure({ message: "Operation aborted" }, true);
+				return;
+			}
+
+			// --- Failure held by consumeQuery ---
+			if (failure) {
+				if (requestRotation(failure)) return;
+				// Not replayable (legacy, post-output, unclassified, or attempts
+				// exhausted): surface an explicit error — unless the usage-limit path
+				// already did — and persist the session record: the child session
+				// advanced through this query, so dropping it would force a full
+				// rebuild next turn. But NEVER run the deferred-replay loop from
+				// here — surfacing ended the Pi stream, so a continuation query's
+				// output would be invisible while its tool side effects still
+				// execute. Deferred user input is dropped LOUDLY, and when steers
+				// were dropped the record is marked needsRebuild: the cursor already
+				// advanced over them on the promise of replay, so a plain REUSE next
+				// turn would silently lose them forever (#967).
+				if (!abortCtx.handledTerminalError) surfaceFailure(failure);
+				const droppedSteers = dropDeferredUserMessages("terminal-failure");
+				const activeSession = getSharedSession();
+				const failedSessionId = capturedSessionId ?? activeSession?.sessionId;
+				if (failedSessionId) {
+					const cursor = Math.max(context.messages.length, abortCtx.latestCursor, activeSession?.cursor ?? 0);
+					debug(`provider: terminal failure, persisting session=${failedSessionId.slice(0, 8)}, cursor=${cursor}, account=${account?.label ?? "legacy"}, droppedSteers=${droppedSteers.length}`);
+					persistSession({ sessionId: failedSessionId, cursor, cwd, ...accountScope, ...(droppedSteers.length > 0 ? { needsRebuild: true } : {}) });
 				}
-				ctx().currentPiStream?.push({ type: "error", reason: "aborted", error: ctx().turnOutput! });
-				ctx().currentPiStream?.end();
-				ctx().currentPiStream = null;
 				return;
 			}
 
 			// --- Capture session ID ---
-			const sessionId = capturedSessionId ?? sharedSession?.sessionId;
+			const activeSession = getSharedSession();
+			const sessionId = capturedSessionId ?? activeSession?.sessionId;
 			if (sessionId) {
-				const cursor = Math.max(context.messages.length, ctx().latestCursor, sharedSession?.cursor ?? 0);
-				debug(`provider: query done, session=${sessionId.slice(0, 8)}, cursor=${cursor}`);
-				setSharedSession({ sessionId, cursor, cwd });
+				const cursor = Math.max(context.messages.length, abortCtx.latestCursor, activeSession?.cursor ?? 0);
+				debug(`provider: query done, session=${sessionId.slice(0, 8)}, cursor=${cursor}, account=${account?.label ?? "legacy"}`);
+				// Fresh record on purpose: a transient mid-turn needsRebuild/forceRotate
+				// must not survive a completed query and force a rebuild next turn.
+				persistSession({ sessionId, cursor, cwd, ...accountScope });
 			}
+			// The failure branch above returned, so reaching here means success.
+			if (account && router) safeRouterCall("recordSuccess", () => router.recordSuccess(account.profileId, options?.sessionId));
 
 			// --- Replay deferred user messages as continuation queries ---
 			// Only for outermost queries — reentrant (subagent) queries leave
 			// deferred messages for the parent to handle after it finishes.
 			try {
-				while (ctx().deferredUserMessages.length > 0 && !isReentrant && !wasAborted) {
-					const steerPrompt = ctx().deferredUserMessages.shift()!;
-					debug(`provider: replaying deferred user message: ${steerPrompt.slice(0, 60)}`);
-					ctx().resetTurnState(model);
-					ctx().resetToolTracking();
-
-					const resumeId = sharedSession?.sessionId;
+				while (abortCtx.deferredUserMessages.length > 0 && !isReentrant && !wasAborted) {
+					const steer = abortCtx.deferredUserMessages.shift()!;
+					const steerPreview = (steer.text || "[image-only]").slice(0, 60);
+					debug(`provider: replaying deferred user message: ${steerPreview}`);
+					abortCtx.resetTurnState(queryModel);
+					abortCtx.resetToolTracking();
+
+					// A foreign one-shot has no claim on the shared record: its steers
+					// continue ITS OWN child session, never --resume the parent's.
+					const resumeId = foreignContext ? capturedSessionId : getSharedSession()?.sessionId;
 					if (!resumeId) {
 						debug(`WARNING: no session to resume for deferred message, dropping`);
+						// No record survives here (no session id), so the next turn
+						// rebuilds from Pi history anyway — but the drop is still diagnosed.
+						dropDeferredUserMessages("continuation-no-resume-id", steer);
 						break;
 					}
 
 					const contOptions = { ...queryOptions, resume: resumeId, ...makeCliDebugOptions("continuation") };
-					const contQuery = query({ prompt: steerPrompt, options: contOptions });
-					ctx().activeQuery = contQuery;
+					// Runs carrying image blocks replay as blocks (wrapPromptStream) so
+					// the images survive; text-only runs stay plain strings (vstack#993).
+					const contQuery = sdkQueryFactory({ prompt: steer.blocks ? wrapPromptStream(steer.blocks) : steer.text, options: contOptions });
+					abortCtx.activeQuery = contQuery;
 
-					debug(`provider: continuation query, model=${model.id}, resume=${resumeId.slice(0, 8)}, prompt=${steerPrompt.slice(0, 60)}`);
+					debug(`provider: continuation query, model=${queryModel.id}, resume=${resumeId.slice(0, 8)}, account=${account?.label ?? "legacy"}, prompt=${steerPreview}`);
 
 					try {
-						const { capturedSessionId: contSid } = await consumeQuery(contQuery, customToolNameToPi, model, cwd, bridgeConfig, () => wasAborted);
-						const sid = contSid ?? sharedSession?.sessionId;
+						const continuation = await consumeQuery(contQuery, abortCtx, customToolNameToPi, queryModel, bridgeConfig, () => wasAborted, account, router);
+						if (continuation.failure) {
+							// Continuations never rotate: the original prompt already
+							// committed on this account.
+							recordAttemptFailure(continuation.failure);
+							if (!abortCtx.handledTerminalError) surfaceFailure(continuation.failure);
+							// The shifted steer may never have reached the child, and any
+							// remaining ones certainly did not — the record must rebuild so
+							// they re-import from Pi history (#967).
+							if (dropDeferredUserMessages("continuation-failure", steer).length > 0) {
+								markRebuildForThisQuery();
+							}
+							break;
+						}
+						const activeSession = getSharedSession();
+						const sid = continuation.capturedSessionId ?? activeSession?.sessionId;
 						if (sid) {
-							setSharedSession({ sessionId: sid, cursor: sharedSession?.cursor ?? 0, cwd });
+							persistSession({ sessionId: sid, cursor: activeSession?.cursor ?? 0, cwd, ...accountScope });
 						}
 					} catch (contError) {
 						debug(`provider: continuation query error:`, contError);
+						const continuationFailure: ClaudeAttemptFailure = {
+							kind: classifyClaudeFailure(contError),
+							message: contError instanceof Error ? contError.message : String(contError),
+						};
+						recordAttemptFailure(continuationFailure);
+						if (!abortCtx.handledTerminalError) surfaceFailure(continuationFailure);
+						// Same #967 posture as the failure branch above.
+						if (dropDeferredUserMessages("continuation-error", steer).length > 0) {
+							markRebuildForThisQuery();
+						}
 						break;
 					} finally {
 						contQuery.close();
@@ -1018,158 +1280,100 @@ function streamClaudeAgentSdk(model: Model<any>, context: Context, options?: Sim
 				}
 			} finally {
 				// Guarantees restoration even if contQuery() throws synchronously
-				ctx().activeQuery = sdkQuery;
+				abortCtx.activeQuery = sdkQuery;
 			}
 
-			finalizeCurrentStream(ctx().turnOutput?.stopReason);
+			finalizeCurrentStream(abortCtx.turnOutput?.stopReason, abortCtx);
 		})
 		.catch((error) => {
-			debug(`provider: query error, model=${model.id}, aborted=${Boolean(options?.signal?.aborted)}, error=`, error);
-			const suppressDuplicateError = ctx().handledTerminalError || streamIdleTimedOut;
-			const openedExtraUsage = !suppressDuplicateError && isExtraUsageRequiredMessage(error) && launchExtraUsageHelperIfAllowed(cwd, bridgeConfig, "query error");
-			if ((wasAborted || options?.signal?.aborted) && sharedSession) {
-				setSharedSession({ ...sharedSession, needsRebuild: true, forceRotate: true });
-			} else {
-				setSharedSession(null);
+			debug(`provider: query error, model=${queryModel.id}, aborted=${Boolean(options?.signal?.aborted)}, error=`, error);
+			const suppressDuplicateError = abortCtx.handledTerminalError || (streamIdleTimedOut && !retryRequested);
+			if (wasAborted || options?.signal?.aborted) {
+				markRebuildForThisQuery({ forceRotate: true });
 			}
-			ctx().deferredUserMessages = [];
-			if (suppressDuplicateError) {
-				debug("provider: suppressing duplicate query error after terminal error was already emitted");
-				return;
+			// #967: a record kept past this error with steers behind its cursor
+			// must rebuild so they re-import from Pi history. (The non-abort
+			// surface path below replaces the record with null, which rebuilds too.)
+			if (dropDeferredUserMessages("query-error").length > 0) {
+				markRebuildForThisQuery();
 			}
-			if (ctx().turnOutput) {
-				ctx().turnOutput.stopReason = options?.signal?.aborted ? "aborted" : "error";
-				ctx().turnOutput.errorMessage = `${error instanceof Error ? error.message : String(error)}${openedExtraUsage ? "\n\nOpened Claude Code /extra-usage helper. Complete billing/admin flow in the browser, then retry the prompt." : ""}`;
+			if (suppressDuplicateError || retryRequested) {
+				debug("provider: suppressing duplicate query error after terminal handling");
+				return;
 			}
-			ctx().currentPiStream?.push({ type: "error", reason: (ctx().turnOutput?.stopReason ?? "error") as "aborted" | "error", error: ctx().turnOutput! });
-			ctx().currentPiStream?.end();
-			ctx().currentPiStream = null;
+			// Prefer the failure metadata consumeQuery held before the throw: a
+			// rejected rate_limit_event followed by the iterator throwing was
+			// re-classified here WITHOUT its rateLimitInfo, so recordAttemptFailure
+			// recorded a second failure on top of the recordRateLimit the event
+			// already taught the router — a double-counted cooldown.
+			const failure: ClaudeAttemptFailure = attemptFailure.failure?.rateLimitInfo
+				? attemptFailure.failure
+				: {
+					kind: classifyClaudeFailure(error),
+					message: error instanceof Error ? error.message : String(error),
+				};
+			if (requestRotation(failure)) return;
+			if (!wasAborted && !options?.signal?.aborted) persistSession(null);
+			surfaceFailure(failure, Boolean(options?.signal?.aborted));
 		})
 		.finally(() => {
 			streamIdleWatchdog?.dispose();
 			activeStreamIdleWatchdogs.delete(abortCtx);
 			if (options?.signal) options.signal.removeEventListener("abort", onAbort);
-			if (ctx().activeQuery === sdkQuery) {
-				const cause = toolCallDrainCause({ wasAborted, signalAborted: options?.signal?.aborted, streamIdleTimedOut });
-				reportToolResultMismatch(ctx(), "query teardown", cwd, { forceRotate: cause !== "query-end" });
-				// Drain pending handlers for this query as errors naming the cause —
-				// their results are never coming.
-				const drained = drainPendingToolCalls(ctx(), cause);
-				if (drained > 0) debug(`provider: query teardown drained ${drained} waiting MCP handler(s) as errors (cause=${cause})`);
-				ctx().pendingResults.clear();
-
-				if (isReentrant) {
-					popContext();  // merges deferred messages and restores parent
-				} else {
-					ctx().activeQuery = null;
+			const cause = toolCallDrainCause({ wasAborted, signalAborted: options?.signal?.aborted, streamIdleTimedOut });
+			teardownQuery(abortCtx, sdkQuery, cause, cwd, isReentrant);
+			sdkQuery.close();
+		})
+		.then(async () => {
+			// --- Account retry re-entry ---
+			// Runs AFTER teardown so the failed attempt's query state is fully
+			// released. The recursive call re-enters the fresh-query path with the
+			// rotation state carrying the excluded profiles; its events forward
+			// into this attempt's still-unstarted Pi stream.
+			if (!retryRequested) return;
+			if (wasAborted || options?.signal?.aborted) {
+				// An abort landed AFTER rotation was queued: requestRotation already
+				// discarded the attempt buffer and nulled currentPiStream, and only
+				// the retry loop below would have ended the outer stream. Skipping
+				// the retry without terminating here left the consumer hanging on a
+				// stream that never ends.
+				debug("provider: abort after queued account retry — terminating stream without retrying");
+				if (abortCtx.turnOutput) {
+					abortCtx.turnOutput.stopReason = "aborted";
+					abortCtx.turnOutput.errorMessage = "Operation aborted";
 				}
+				stream.push({ type: "error", reason: "aborted", error: abortCtx.turnOutput! });
+				stream.end();
+				return;
 			}
-			sdkQuery.close();
-		});
+			debug(`provider: starting account retry after ${retryFailure?.kind ?? "failure"}; excluded=${[...rotationState.excludedProfileIds].join(",")}`);
+			const retryStream = streamClaudeAgentSdk(model, context, {
+				...(options ?? {}),
+				[ROTATION_STATE_KEY]: rotationState,
+			} as BridgeStreamOptions);
+			// End exactly once per outcome (VST-53). Ending in a `finally` ran on
+			// the throw path too, BEFORE the .catch below could push its error
+			// event — and EventStream.push is a silent no-op after end, so a failed
+			// rotation ended the turn with no error event at all. Success ends
+			// here; every throw ends in the .catch, after the error is pushed.
+			for await (const event of retryStream) stream.push(event);
+			stream.end();
+		})
+		.catch((error) => {
+			debug("provider: account retry pipeline failed:", error);
+			if (abortCtx.turnOutput) {
+				abortCtx.turnOutput.stopReason = "error";
+				abortCtx.turnOutput.errorMessage = error instanceof Error ? error.message : String(error);
+			}
+			stream.push({ type: "error", reason: "error", error: abortCtx.turnOutput! });
+			stream.end();
+		})
+		// After teardown and any retry pipeline: nothing else reads this lane.
+		.finally(releaseEphemeralLane);
 
 	return stream;
 }
 
-function commandCwd(ctx: unknown): string {
-	const value = (ctx as { cwd?: unknown })?.cwd;
-	return typeof value === "string" && value.length > 0 ? value : process.cwd();
-}
-
-async function tryOpenExtensionManagerSettings(ctx: { ui: ExtensionUIContext }): Promise<boolean> {
-	const host = globalThis as unknown as Record<PropertyKey, unknown>;
-	const openQuickSettings = host[Symbol.for("vstack.pi.extension-manager.open-quick-settings")];
-	if (typeof openQuickSettings !== "function") return false;
-	try {
-		await (openQuickSettings as (ctx: unknown, hint?: string) => Promise<void>)(ctx, "@vanillagreen/pi-claude-bridge");
-		return true;
-	} catch {
-		return false;
-	}
-}
-
-function showBridgeStatus(ctx: { ui: ExtensionUIContext; cwd?: string }): void {
-	const config = loadConfig(commandCwd(ctx));
-	ctx.ui.notify([
-		`Claude bridge: ${config.enabled === false ? "disabled" : "enabled"}`,
-		`Extra usage auto-helper: ${extraUsageAllowed(config) ? "on" : "off"} (settings)`,
-		`Use /claude-bridge:extra to run Claude Code /extra-usage now.`,
-	].join("\n"), "info");
-}
-
-// Read a credential file, treating any read error as "absent" — a missing or
-// unreadable candidate must fall through to the next one, not abort resolution.
-function readCredentialFile(path: string): string | undefined {
-	try {
-		return nodeReadFileSync(path, "utf8");
-	} catch {
-		return undefined;
-	}
-}
-
-// Deterministic connector enumeration for the host app (vstack#838). Reports the
-// failure reason rather than an empty list, so "no connectors" and "could not
-// check" stay distinguishable.
-async function reportConnectorInventory(ctx: { ui: ExtensionUIContext }): Promise<void> {
-	const credentials = resolveClaudeOAuth(readCredentialFile);
-	if (!credentials) {
-		ctx.ui.notify("Claude bridge: no Claude OAuth credentials found — cannot enumerate connectors.", "error");
-		return;
-	}
-	const inventory = await listAccountConnectors({ credentials });
-	if (!inventory.ok) {
-		ctx.ui.notify(`Claude bridge: connector enumeration failed — ${inventory.reason}`, "error");
-		return;
-	}
-	if (inventory.connectors.length === 0) {
-		ctx.ui.notify("Claude bridge: this account has no connectors installed.", "info");
-		return;
-	}
-	const names = inventory.connectors.map((c) => c.name).join(", ");
-	ctx.ui.notify(`Claude bridge: ${inventory.connectors.length} connector(s) installed — ${names}`, "info");
-}
-
-function registerBridgeCommands(pi: ExtensionAPI): void {
-	const guard = pi as unknown as Record<PropertyKey, unknown>;
-	if (guard[COMMANDS_REGISTERED_KEY]) return;
-	guard[COMMANDS_REGISTERED_KEY] = true;
-
-	const runExtraUsage = async (ctx: { ui: ExtensionUIContext; cwd?: string }) => {
-		const cwd = commandCwd(ctx);
-		if (extraUsageHelperInFlight) {
-			ctx.ui.notify("Claude extra usage helper already running.", "info");
-			await extraUsageHelperInFlight.catch(() => undefined);
-			return;
-		}
-		try {
-			ctx.ui.notify("Claude extra usage helper starting…", "info");
-			extraUsageHelperInFlight = runExtraUsageHelper(cwd)
-				.finally(() => { extraUsageHelperInFlight = null; });
-			const message = await extraUsageHelperInFlight;
-			ctx.ui.notify(`Claude extra usage helper: ${message}`, "info");
-		} catch (error) {
-			const message = error instanceof Error ? error.message : String(error);
-			ctx.ui.notify(`Claude extra usage helper failed: ${message}`, "error");
-		}
-	};
-
-	pi.registerCommand("claude-bridge", {
-		description: "Open Claude bridge settings/status",
-		handler: async (args: string, ctx) => {
-			if (args.trim()) ctx.ui.notify("Unknown /claude-bridge argument. Use /claude-bridge:extra to run Claude Code /extra-usage.", "warning");
-			if (await tryOpenExtensionManagerSettings(ctx)) return;
-			showBridgeStatus(ctx);
-		},
-	});
-	pi.registerCommand("claude-bridge:extra", {
-		description: "Run Claude Code /extra-usage through claude-bridge",
-		handler: async (_args: string, ctx) => runExtraUsage(ctx),
-	});
-	pi.registerCommand("claude-bridge:connectors", {
-		description: "List the Claude account's installed claude.ai connectors",
-		handler: async (_args: string, ctx) => reportConnectorInventory(ctx),
-	});
-}
-
 // --- Extension registration ---
 
 export default function (pi: ExtensionAPI) {
@@ -1179,22 +1383,35 @@ export default function (pi: ExtensionAPI) {
 
 	const config = loadConfig(process.cwd());
 	debug("loadConfig:", JSON.stringify(config));
+	// Registered before the disabled early return: a bridge switched off by
+	// claude-bridge.json is exactly when the settings editor has to show where
+	// that value came from.
+	registerExternalConfigResolver();
 	registerBridgeCommands(pi);
 	if (config.enabled === false) {
 		debug("provider: disabled by configuration");
 		return;
 	}
+	// Publish the reciprocal account-host service (a local /usage probe) for the
+	// companion account manager. Primary instance only — a subagent reload must
+	// not swap the owner from under an in-flight probe.
+	if (claimPrimaryInstance()) {
+		const host = globalThis as Record<symbol, any>;
+		host[CLAUDE_BRIDGE_ACCOUNT_HOST_SYMBOL] = BRIDGE_ACCOUNT_HOST;
+	}
 
 	// Reset shared (Claude) conversation state on pi session lifecycle events.
 	// Registration tokens are managed separately by applyProviderRegistration
 	// (load / session_start / pre-spawn) and releaseProviderTokens (shutdown), so
 	// a mid-session credential flip is handled while token ownership is intact.
 	const clearSession = (event: string) => {
-		debug(`${event}: clearing session ${sharedSession?.sessionId?.slice(0, 8) ?? "none"}`);
+		const activeSession = getSharedSession();
+		debug(`${event}: clearing session ${activeSession?.sessionId?.slice(0, 8) ?? "none"}`);
 		setSharedSession(null);
 	};
 
-	pi.on("session_start", (event, ctx) => {
+	pi.on("session_start", (event, ctx) => runInRequestLane(ctx.sessionManager.getSessionId(), () => {
+		recordStartedLane(ctx.sessionManager, ctx.sessionManager.getSessionId());
 		recordProjectTrust(ctx);
 		setPiUI(ctx.ui);
 		if (event.reason === "new" || event.reason === "resume" || event.reason === "fork") {
@@ -1208,15 +1425,21 @@ export default function (pi: ExtensionAPI) {
 		// Live availability flip: re-evaluate credential presence every
 		// session_start so login/logout since load is reflected without /reload.
 		applyProviderRegistration(`session_start:${event.reason}`);
+	}));
+	pi.on("session_shutdown", (_event, ctx) => {
+		const sessionId = takeStartedLane(ctx.sessionManager) ?? ctx.sessionManager.getSessionId();
+		runInRequestLane(sessionId, () => {
+			cancelScheduledSessionPersistence(ctx.sessionManager);
+			clearSession("session_shutdown");
+			releaseProviderTokens("session_shutdown");
+		});
+		deleteSharedSessionLane(sessionId);
+		deleteQueryLane(sessionId);
 	});
-	pi.on("session_shutdown", () => {
-		clearSession("session_shutdown");
-		releaseProviderTokens("session_shutdown");
-	});
-	pi.on("message_end", (event, ctx) => {
+	pi.on("message_end", (event, ctx) => runInRequestLane(ctx.sessionManager.getSessionId(), () => {
 		const message = (event as { message?: AssistantMessage }).message;
 		if (message?.role === "assistant" && message.provider === PROVIDER_ID) schedulePersistSharedSession(ctx);
-	});
+	}));
 
 	// pi /compact and session-tree navigation (rewind / fork-at-point /
 	// branch switch) both mutate pi's messages array out from under the
@@ -1226,23 +1449,25 @@ export default function (pi: ExtensionAPI) {
 	// triggers CC's autocompact-thrashing guard (issue #8). Force the next
 	// call down the REBUILD path so CC sees the current history.
 	const markRebuild = (event: string) => {
+		const activeSession = getSharedSession();
 		if (ctx().activeQuery) {
-			reportToolResultMismatch(ctx(), event, sharedSession?.cwd ?? process.cwd());
+			reportToolResultMismatch(ctx(), event, activeSession?.cwd ?? process.cwd());
 		}
-		if (sharedSession) {
-			debug(`${event}: marking needsRebuild on session ${sharedSession.sessionId.slice(0, 8)}`);
-			setSharedSession({ ...sharedSession, needsRebuild: true });
+		if (activeSession) {
+			debug(`${event}: marking needsRebuild on session ${activeSession.sessionId.slice(0, 8)}`);
+			markSessionForRebuild();
 		}
 	};
-	pi.on("session_compact", () => markRebuild("session_compact"));
-	pi.on("session_tree", () => markRebuild("session_tree"));
+	pi.on("session_compact", (_event, ctx) => runInRequestLane(ctx.sessionManager.getSessionId(), () => markRebuild("session_compact")));
+	pi.on("session_tree", (_event, ctx) => runInRequestLane(ctx.sessionManager.getSessionId(), () => markRebuild("session_tree")));
 
 	// --- Provider ---
 	//
-	// Register the provider ONLY when real Claude credentials are present, so
-	// claude-bridge models are never advertised as available/selectable when a
-	// request would fail at spawn time (pi's ModelRegistry.hasConfiguredAuth()
-	// treats the dummy apiKey as "configured", so the gate must live here).
+	// Native registration (pi >=0.81): register unconditionally; the provider's
+	// own auth check/resolve report whether Claude credentials exist, so pi
+	// hides claude-bridge models while no account is connected and shows them
+	// when one appears. session_start and pre-spawn re-upsert the provider to
+	// force pi's availability recompute at those boundaries.
 	//
 	// applyProviderRegistration also claims the primary-instance token (first
 	// load wins) and enforces the multi-instance guard: a non-primary subagent