@vellumai/assistant 0.8.10 → 0.8.11-staging.1

package/src/daemon/conversation-error.ts

@@ -2,6 +2,11 @@ import type {
   ConversationErrorCode,
   ConversationErrorEvent,
 } from "../api/events/conversation-error.js";
+import {
+  ORDERING_ERROR_PATTERNS,
+  WEB_SEARCH_ORDERING_PATTERNS,
+} from "../plugins/defaults/history-repair/terminal.js";
+import { isImageDimensionsTooLargeError } from "../plugins/defaults/image-recovery/detect.js";
 import { ConnectionResolutionError } from "../providers/connection-resolution.js";
 import { getProviderRoutingSource } from "../providers/registry.js";
 import { isAbortReason } from "../util/abort-reasons.js";
@@ -118,21 +123,6 @@ const PROVIDER_API_PATTERNS = [
   /gateway timeout/i,
 ];
 
-// Provider ordering error patterns (tool_use/tool_result mismatches)
-const ORDERING_ERROR_PATTERNS = [
-  /tool_result.*not immediately after.*tool_use/i,
-  /tool_use.*must have.*tool_result/i,
-  /tool_use_id.*without.*tool_result/i,
-  /tool_result.*tool_use_id.*not found/i,
-  /messages.*invalid.*order/i,
-];
-
-// Web-search-specific ordering error patterns
-const WEB_SEARCH_ORDERING_PATTERNS = [
-  /web_search.*tool_use.*without/i,
-  /web_search.*tool_result/i,
-];
-
 // Stale/invalid opaque `encrypted_content` token in replayed web-search results.
 // Anthropic's tokens have bounded validity; the daemon replaces historical
 // `web_search_tool_result` blocks with text summaries to avoid this, but this
@@ -149,18 +139,6 @@ const STREAMING_ERROR_PATTERNS = [
   /stream has ended.*this shouldn't happen/i,
 ];
 
-// User-initiated cancellation patterns — these should NOT produce conversation_error
-// Image-input validation patterns — Anthropic 400s with one of these messages
-// when an image block violates a hard limit. The first matches the per-side
-// pixel cap ("image dimensions exceed max allowed size"); the second matches the
-// base64 payload cap ("image exceeds 5 MB maximum: 7465044 bytes > 5242880
-// bytes"). Distinct classification matters because retrying with the same
-// oversized image is futile — the recovery path must strip or downscale it.
-const IMAGE_DIMENSIONS_TOO_LARGE_PATTERNS = [
-  /image dimensions? exceeds? max allowed size/i,
-  /image exceeds \d+\s*MB maximum/i,
-];
-
 const VISION_NOT_SUPPORTED_PATTERNS = [
   /no endpoints found that support image input/i,
   /does not support image/i,
@@ -457,7 +435,7 @@ function classifyCore(
         // from "no key configured" (banner: "API key required").
         return invalidApiKeyClassification(attribution);
       }
-      if (isImageDimensionsTooLarge(message)) {
+      if (isImageDimensionsTooLargeError(message)) {
         return {
           code: "IMAGE_TOO_LARGE",
           userMessage:
@@ -499,11 +477,6 @@ export function isContextTooLarge(message: string): boolean {
   return CONTEXT_TOO_LARGE_PATTERNS.some((p) => p.test(message));
 }
 
-/** Check whether an error message indicates an image-input dimension failure. */
-function isImageDimensionsTooLarge(message: string): boolean {
-  return IMAGE_DIMENSIONS_TOO_LARGE_PATTERNS.some((p) => p.test(message));
-}
-
 function isVisionNotSupported(message: string): boolean {
   return VISION_NOT_SUPPORTED_PATTERNS.some((p) => p.test(message));
 }

package/src/daemon/conversation-lifecycle.ts

@@ -244,7 +244,7 @@ export function disposeConversation(ctx: DisposeContext): void {
   ctx.workspaceTopLevelContext = null;
   // The compaction module owns the per-conversation ContextWindowManager, so
   // teardown releases it directly. Moving this behind a compaction-plugin hook
-  // would let the module own disposal end-to-end, but the per-turn `stop` hook 
+  // would let the module own disposal end-to-end, but the per-turn `stop` hook
   // would first require relocating the manager's only
   // cross-turn state — `nonPersistedPrefixCount` — off the manager so a
   // per-turn dispose/rebuild stays correct.

package/src/daemon/conversation-runtime-assembly.ts

@@ -10,9 +10,14 @@ import { join } from "node:path";
 
 import { type ChannelId, parseInterfaceId } from "../channels/types.js";
 import { isAssistantFeatureFlagEnabled } from "../config/assistant-feature-flags.js";
+import { resolveCallSiteConfig } from "../config/llm-resolver.js";
 import { getConfig } from "../config/loader.js";
-import type { LLMCallSite } from "../config/schemas/llm.js";
-import { stripUserTextBlocksByPrefix } from "../context/strip-injections.js";
+import type { LLMCallSite, LLMConfig } from "../config/schemas/llm.js";
+import {
+  NOW_SCRATCHPAD_STRIP_PREFIXES,
+  stripSpotlightInjections,
+  stripUserTextBlocksByPrefix,
+} from "../context/strip-injections.js";
 import { getDocumentsForConversation } from "../documents/document-store.js";
 import {
   getApp,
@@ -28,8 +33,9 @@ import { isBackgroundConversationType } from "../memory/conversation-types.js";
 import {
   countMemoryPrefixBlocks,
   extractMemoryPrefixBlocks,
-  stripAllMemoryInjections,
+  getLiveGraphMemory,
 } from "../memory/graph/conversation-graph-memory.js";
+import { unwrapMemoryBlock, wrapMemoryBlock } from "../memory/memory-marker.js";
 import {
   readSlackMetadata,
   readSlackMetadataFromMessageMetadata,
@@ -44,7 +50,10 @@ import {
 } from "../messaging/providers/slack/render-transcript.js";
 import { createContextSummaryMessage } from "../plugins/defaults/compaction/window-manager.js";
 import { getInjectorChain } from "../plugins/defaults/memory-retrieval/injector-chain.js";
-import { MEMORY_V3_BLOCK_ID } from "../plugins/defaults/memory-v3-shadow/types.js";
+import {
+  MEMORY_V3_BLOCK_ID,
+  MEMORY_V3_COMMIT_META_KEY,
+} from "../plugins/defaults/memory-v3-shadow/types.js";
 import type {
   InjectionBlock,
   InjectionPlacement,
@@ -210,6 +219,43 @@ export function resolveTurnInboundActorContext(
   return resolved.trustClass === "guardian" ? null : resolved;
 }
 
+/**
+ * Render the `model_profile:` turn-context label for a turn from its resolved
+ * inference profile key, for the unified `<turn_context>` block.
+ *
+ * Returns `null` when there is no key to announce (the caller gates this to the
+ * turns where the active profile changed since the one last delivered to the
+ * model). Otherwise the human-readable label comes from the profile's
+ * configured `label` (falling back to the key) and the model id from the
+ * call-site resolution keyed on that profile, yielding `Label (model)` — or
+ * just `Label` when no model resolves. Derives purely from the passed key,
+ * call site, and config, so callers thread the key (plain turn data) rather
+ * than the rendered string and self-resolve the call site from the live
+ * conversation.
+ *
+ * `selectionSeed` is the conversation id, threaded so that a key naming a `mix`
+ * profile expands to the same arm the turn's provider calls run on (which seed
+ * expansion with the same id). Without it the announced model would be a fresh
+ * random arm that can disagree with the model actually serving the turn.
+ */
+export function resolveTurnModelProfileLabel(
+  modelProfileKey: string | null,
+  callSite: LLMCallSite,
+  llm: LLMConfig,
+  selectionSeed?: string,
+): string | null {
+  if (modelProfileKey == null) {
+    return null;
+  }
+  const profileEntry = llm.profiles?.[modelProfileKey];
+  const resolved = resolveCallSiteConfig(callSite, llm, {
+    overrideProfile: modelProfileKey,
+    selectionSeed,
+  });
+  const label = profileEntry?.label ?? modelProfileKey;
+  return resolved.model ? `${label} (${resolved.model})` : label;
+}
+
 /** Derive channel capabilities from source channel + interface identifiers. */
 export function resolveChannelCapabilities(
   sourceChannel?: string | null,
@@ -631,12 +677,7 @@ function injectVoiceCallControlContext(
 
 /** Strip `<NOW.md>` blocks injected by the `now-md` default injector. */
 export function stripNowScratchpad(messages: Message[]): Message[] {
-  return stripUserTextBlocksByPrefix(messages, [
-    // Shared prefix catches both the current tag and any pre-line-limit
-    // variant that may linger in in-flight histories during a rolling deploy.
-    "<NOW.md Always keep this up to date",
-    "<now_scratchpad>", // backward-compat: strip legacy blocks from pre-rename history
-  ]);
+  return stripUserTextBlocksByPrefix(messages, NOW_SCRATCHPAD_STRIP_PREFIXES);
 }
 
 /**
@@ -1485,6 +1526,24 @@ export interface RuntimeInjectionBlocks {
   nowScratchpadBlock?: string;
   pkbContextBlock?: string;
   memoryV2StaticBlock?: string;
+  /**
+   * UNWRAPPED inner text of the memory-v3 frozen net-new card block the v3
+   * injector attached this turn, mirroring v2's unwrapped `memoryInjectedBlock`
+   * contract (rehydration re-wraps on use). Undefined when v3 attached no new
+   * cards (all-repeat turn, v3 off, or v3 failure). Persisted by the
+   * user-prompt-submit hook under `metadata.memoryV3InjectedBlock`
+   * (`MEMORY_V3_INJECTED_BLOCK_METADATA_KEY`).
+   */
+  memoryV3InjectedBlock?: string;
+  /**
+   * True when memory-v3 superseded v2 as this turn's `<memory>` source — the
+   * `memory-v3-live` flag is on AND the v3 injector produced a block (possibly
+   * empty-text on an all-repeat turn), i.e. exactly when assembly stripped
+   * v2's fresh tail block. The user-prompt-submit hook keys v2's
+   * `memoryInjectedBlock` metadata persist off this so a stripped v2 block is
+   * never rehydrated back into history on reload.
+   */
+  memoryV3Active?: boolean;
   /**
    * Composed output of every plugin-registered {@link Injector}, concatenated
    * in ascending `order`. Empty string when every injector opted out (returned
@@ -1637,6 +1696,63 @@ function applyInjectionBlock(
   }
 }
 
+/**
+ * Strip v2's freshly-prepended DYNAMIC memory prefix from the tail user
+ * message, preserving every other leading memory-prefix block. Exactly three
+ * shapes are v2's to remove:
+ *
+ *  - `v2WrappedBlock` — the wrapped (`wrapMemoryBlock`) form of the text the
+ *    graph-memory wiring prepended this turn, matched by full-block IDENTITY.
+ *    A prefix match cannot work here: v3's card-block instruction header is
+ *    deliberately byte-identical to v2's `INJECTION_HEADER`
+ *    (`memory/v2/injection.ts`), and v2's router block leads with that same
+ *    header whenever any summary section is present — the dominant case — so
+ *    the two layers' blocks are indistinguishable by any shared prefix.
+ *  - legacy `<memory __injected>` text blocks — only v2 ever produced them.
+ *  - memory-image groups (`<memory_image …>` opener text, the image block,
+ *    the `</memory_image>` closer) — only v2 injects images; v3 card blocks
+ *    are text-only.
+ *
+ * Everything else in the leading memory prefix survives:
+ *
+ *  - memory-v3's frozen card blocks: a same-turn re-entry assembly (overflow
+ *    convergence) sees the tail it assembled on first entry, whose leading
+ *    block may be this turn's just-frozen v3 cards (while this re-entry's
+ *    injector run produces an EMPTY block — the cards are already claimed by
+ *    the everInjected store). Their bytes never equal the v2 identity, so
+ *    they are kept without needing to be recognized as v3.
+ *  - the `<info>` static block: it counts toward the memory prefix for
+ *    splice positioning but is never prepended by `prepareMemory`, so the v2
+ *    suppression strip has no business removing it.
+ *
+ * `v2WrappedBlock === null` (nothing injected this turn, or no live graph
+ * handle) still strips the image groups and legacy blocks — both are
+ * unambiguously v2's — but leaves every `<memory>` text block in place.
+ */
+function stripTailV2DynamicMemoryPrefix(
+  messages: Message[],
+  v2WrappedBlock: string | null,
+): Message[] {
+  const last = messages[messages.length - 1];
+  if (!last || last.role !== "user") return messages;
+  const prefixCount = countMemoryPrefixBlocksOnContent(last.content);
+  if (prefixCount === 0) return messages;
+  const content = last.content.filter((block, i) => {
+    if (i >= prefixCount) return true;
+    // v2's memory-image groups: opener text, injected image, closer text.
+    if (block.type === "image") return false;
+    if (block.type !== "text") return true;
+    if (block.text.startsWith("<memory_image")) return false;
+    if (block.text === "</memory_image>") return false;
+    // v2's legacy dynamic wrapper.
+    if (block.text.startsWith("<memory __injected>\n")) return false;
+    // v2's current dynamic block — identity match only (see doc comment).
+    return v2WrappedBlock === null || block.text !== v2WrappedBlock;
+  });
+  if (content.length === last.content.length) return messages;
+  return [...messages.slice(0, -1), { ...last, content }];
+}
+
 /**
  * Per-turn options accepted by {@link applyRuntimeInjections}.
  *
@@ -1990,6 +2106,7 @@ export async function applyRuntimeInjections(
   let pkbContextCaptured: string | undefined;
   let pkbSystemReminderCaptured: string | undefined;
   let memoryV2StaticCaptured: string | undefined;
+  let memoryV3Captured: string | undefined;
   const initialTail = runMessages[runMessages.length - 1];
   const initialTailIsUser = !!initialTail && initialTail.role === "user";
   if (initialTailIsUser) {
@@ -2013,6 +2130,26 @@ export async function applyRuntimeInjections(
         case "memory-v2-static":
           memoryV2StaticCaptured = block.text;
           break;
+        case MEMORY_V3_BLOCK_ID: {
+          // The v3 frozen card block is persisted UNWRAPPED (the v2
+          // `memoryInjectedBlock` contract — rehydration re-wraps on use).
+          // An empty-text block (all-repeat turn) attaches no content, so
+          // nothing is captured for persistence either.
+          if (block.text.length > 0) {
+            memoryV3Captured = unwrapMemoryBlock(block.text);
+          }
+          // Attachment is guaranteed from here (user tail — the gate this
+          // capture loop runs under), so commit the injector's deferred
+          // everInjected-store write. On a non-user tail the block silently
+          // no-ops in `applyInjectionBlock`, and skipping the commit keeps
+          // the store from claiming cards that never attached (which would
+          // suppress them until compaction).
+          const commit = block.meta?.[MEMORY_V3_COMMIT_META_KEY];
+          if (typeof commit === "function") {
+            (commit as () => void)();
+          }
+          break;
+        }
       }
     }
   }
@@ -2029,15 +2166,32 @@ export async function applyRuntimeInjections(
       ? injectorChainPieces.join("\n\n")
       : undefined;
 
-  // ── Step 0: memory-v3-live v2 suppression ──
-  // When the `memory-v3-live` flag is on AND the v3 injector actually produced
-  // a block this turn, v3 is the sole `<memory>` source. v2's `prepareMemory`
-  // already prepended its own `<memory>` block to the tail user message (and
-  // historical turns may carry v2 blocks from earlier turns). Strip every user
-  // message's memory prefix here so:
-  //   1. The v3 `after-memory-prefix` block (Step 2) lands at the top of the
-  //      tail with no v2 prefix ahead of it — exactly one `<memory>` block.
-  //   2. History is byte-stable across turns for prompt caching.
+  // ── Step 0: memory-v3 ephemeral-spotlight strip + v2 tail suppression ──
+  //
+  // Spotlight strip (unconditional): the `<memory_spotlight>` block is
+  // ephemeral by contract — re-rendered at the current tail each turn — so any
+  // spotlight riding history from a previous turn is stale and is removed
+  // here. This is a SCOPED strip of only that block id: the frozen `<memory>`
+  // card blocks on historical messages are untouched (the cache contract).
+  // With the v3 flag off no spotlight blocks exist and this is a content
+  // no-op, keeping the v2 path bit-for-bit identical.
+  let runMessagesForAssembly = stripSpotlightInjections(runMessages);
+
+  // v2 suppression: when the `memory-v3-live` flag is on AND the v3 injector
+  // produced a block this turn (possibly empty-text on an all-repeat turn), v3
+  // owns the `<memory>` layer. v2's `prepareMemory` already prepended its own
+  // fresh `<memory>` block to the tail user message — strip the TAIL's v2
+  // dynamic prefix only, so the v3 `after-memory-prefix` block (Step 2) lands
+  // at the top of the tail with no v2 prefix ahead of it. Historical user
+  // messages keep their memory blocks byte-identical: frozen v3 card blocks
+  // from prior turns AND pre-cutover v2 blocks both ride the cached prefix
+  // (the old whole-layer `stripAllMemoryInjections` replace is gone). The
+  // strip discriminates v2's dynamic block by IDENTITY ({@link
+  // stripTailV2DynamicMemoryPrefix}): the live graph handle holds the exact
+  // text the wiring layer prepended this turn, so a re-entry tail's
+  // just-frozen v3 card block (and the `<info>` static block) survive even
+  // though v2 and v3 blocks share identical wrapper + header bytes — the v2
+  // prefix this strip exists to remove was already stripped on first entry.
   // Keyed off the v3 block being present (not the flag alone) so a v3 failure
   // (`produce()` → null) leaves v2's block intact — fallback rather than a
   // memory-less turn. Idempotent: re-injection sites that already stripped
@@ -2047,9 +2201,14 @@ export async function applyRuntimeInjections(
     getConfig(),
   );
   const v3ProducedBlock = afterMemory.some((b) => b.id === MEMORY_V3_BLOCK_ID);
-  let runMessagesForAssembly = runMessages;
-  if (suppressV2MemoryForV3 && v3ProducedBlock) {
-    runMessagesForAssembly = stripAllMemoryInjections(runMessages);
+  const memoryV3Active = suppressV2MemoryForV3 && v3ProducedBlock;
+  if (memoryV3Active) {
+    const v2DynamicText =
+      getLiveGraphMemory(conversationId)?.lastInjectedBlockText ?? null;
+    runMessagesForAssembly = stripTailV2DynamicMemoryPrefix(
+      runMessagesForAssembly,
+      v2DynamicText === null ? null : wrapMemoryBlock(v2DynamicText),
+    );
   }
 
   let result = runMessagesForAssembly;
@@ -2214,6 +2373,8 @@ export async function applyRuntimeInjections(
       nowScratchpadBlock: nowScratchpadCaptured,
       pkbContextBlock: pkbContextCaptured,
       memoryV2StaticBlock: memoryV2StaticCaptured,
+      memoryV3InjectedBlock: memoryV3Captured,
+      memoryV3Active,
       injectorChainBlock,
     },
   };

package/src/daemon/conversation-skill-tools.ts

@@ -16,9 +16,12 @@ import { getConfig } from "../config/loader.js";
 import { skillFlagKey } from "../config/skill-state.js";
 import type { SkillSummary, SkillToolManifest } from "../config/skills.js";
 import { loadSkillCatalog } from "../config/skills.js";
+import { recordSkillLoadedEvent } from "../memory/skill-loaded-events-store.js";
 import type { Message, ToolDefinition } from "../providers/types.js";
 import type { ActiveSkillEntry } from "../skills/active-skill-tools.js";
 import { deriveActiveSkills } from "../skills/active-skill-tools.js";
+import { getCachedCatalogSync } from "../skills/catalog-cache.js";
+import { readInstallMeta } from "../skills/install-meta.js";
 import { parseToolManifestFile } from "../skills/tool-manifest.js";
 import { computeSkillVersionHash } from "../skills/version-hash.js";
 import {
@@ -28,10 +31,34 @@ import {
   unregisterSkillTools,
 } from "../tools/registry.js";
 import { createSkillToolsFromManifest } from "../tools/skills/skill-tool-factory.js";
+import type { UsageAttributionSnapshot } from "../usage/attribution.js";
+import { toAttributionColumns } from "../usage/attribution.js";
 import { getLogger } from "../util/logger.js";
 
 const log = getLogger("conversation-skill-tools");
 
+/**
+ * Sentinel "version hash" stored in the previously-active map for skills that
+ * are active without a loadable TOOLS.json (instruction-only skills — the
+ * common case for catalog installs — or skills whose manifest failed to
+ * parse). These entries registered no tools, so teardown paths must skip
+ * `unregisterSkillTools` for them to avoid decrementing refcounts held by
+ * other conversations.
+ */
+const NO_TOOLS_VERSION = "__no_tools__";
+
+/**
+ * Whether a tracked version-hash entry corresponds to tools that were actually
+ * registered. Absent entries and the no-tools sentinel registered nothing, so
+ * every teardown path must consult this before calling `unregisterSkillTools`
+ * — the registry refcounts, and a spurious unregister would decrement counts
+ * held by other conversations. This helper is the single owner of the
+ * sentinel check; do not compare against `NO_TOOLS_VERSION` elsewhere.
+ */
+function hasRegisteredTools(trackedHash: string | undefined): boolean {
+  return trackedHash !== undefined && trackedHash !== NO_TOOLS_VERSION;
+}
+
 // ---------------------------------------------------------------------------
 // Public types
 // ---------------------------------------------------------------------------
@@ -74,7 +101,8 @@ export interface ProjectSkillToolsOptions {
   preactivatedSkillIds?: string[];
   /**
    * Conversation-scoped tracking map of previously active skill IDs to their
-   * version hashes. Each conversation should own its own map to prevent
+   * version hashes (or the no-tools sentinel for active skills without a
+   * loadable manifest). Each conversation should own its own map to prevent
    * cross-conversation state bleed when the daemon serves multiple concurrent
    * conversations. When a skill's hash changes between turns, its tools are
    * unregistered and re-registered with the updated definitions.
@@ -86,6 +114,11 @@ export interface ProjectSkillToolsOptions {
    * reads across agent turns.
    */
   cache?: SkillProjectionCache;
+  /** Telemetry context for skill_loaded events; absent disables recording. */
+  telemetry?: {
+    conversationId: string;
+    attribution: UsageAttributionSnapshot | null;
+  };
 }
 
 // ---------------------------------------------------------------------------
@@ -116,6 +149,50 @@ function loadManifestForSkill(skill: SkillSummary): SkillToolManifest | null {
   }
 }
 
+/**
+ * Whether a skill is Vellum-produced for `skill_loaded` telemetry purposes:
+ * bundled skills always are; managed skills only when their install metadata
+ * records a `vellum` origin (legacy version.json installs are inferred as
+ * vellum by `readInstallMeta`). All other sources (workspace, extra, plugin)
+ * never emit.
+ */
+function isVellumProducedSkill(skill: SkillSummary): boolean {
+  if (skill.source === "bundled") return true;
+  if (skill.source === "managed") {
+    return readInstallMeta(skill.directoryPath)?.origin === "vellum";
+  }
+  return false;
+}
+
+/**
+ * Record a `skill_loaded` telemetry event for a newly-activated Vellum-produced
+ * skill. Metadata only — never skill output or conversation content.
+ * `skill_updated_at` comes from the cached merged catalog (sync accessor —
+ * this runs on the hot tool-projection path). Failures are swallowed at
+ * debug level: recording must never break tool projection.
+ */
+function recordSkillLoadedTelemetry(
+  skill: SkillSummary,
+  telemetry: ProjectSkillToolsOptions["telemetry"],
+): void {
+  if (!telemetry) return;
+  try {
+    if (!isVellumProducedSkill(skill)) return;
+    const catalogEntry = getCachedCatalogSync().find((s) => s.id === skill.id);
+    recordSkillLoadedEvent({
+      conversationId: telemetry.conversationId,
+      skillName: skill.id,
+      skillUpdatedAt: catalogEntry?.updatedAt,
+      ...toAttributionColumns(telemetry.attribution),
+    });
+  } catch (err) {
+    log.debug(
+      { err, skillId: skill.id },
+      "Failed to record skill_loaded telemetry event (non-fatal)",
+    );
+  }
+}
+
 // ---------------------------------------------------------------------------
 // Cache helpers
 // ---------------------------------------------------------------------------
@@ -268,8 +345,11 @@ export function projectSkillTools(
     }
   }
 
-  // Unregister tools for skills that are no longer active
+  // Unregister tools for skills that are no longer active. Skills tracked
+  // with the no-tools sentinel never registered anything — skip them so we
+  // don't decrement refcounts held by other conversations.
   for (const id of removedIds) {
+    if (!hasRegisteredTools(prevActive.get(id))) continue;
     log.info({ skillId: id }, "Unregistering tools for deactivated skill");
     unregisterSkillTools(id);
   }
@@ -294,8 +374,36 @@ export function projectSkillTools(
       continue;
     }
 
+    // A skill that newly became active counts as one `skill_loaded`, whether
+    // or not it ships a TOOLS.json — instruction-only skills (the common case
+    // for catalog installs) must be counted too. The event is recorded only
+    // once the skill lands in `successfulEntries`, so a failed registration
+    // is retried (and counted) on a later turn instead of emitting one row
+    // per failing turn. The once-per-activation guard (`prevActive`) is
+    // in-memory per-conversation state: after conversation disposal or a
+    // daemon restart, re-projection re-emits skill_loaded for already-active
+    // skills. That is intentional — a re-load after restart is a load.
+    // Downstream consumers that need activation-level uniqueness dedup on
+    // (conversation_id, skill_name).
+    const prevHash = prevActive.get(skillId);
+
     const manifest = loadManifestForSkill(skill);
     if (!manifest) {
+      // No loadable manifest — nothing to register, but keep tracking the
+      // activation so it isn't re-recorded every turn. If tools were
+      // registered on a previous turn (manifest removed or corrupted since),
+      // tear them down like the transiently-failed path would.
+      if (hasRegisteredTools(prevHash)) {
+        log.info(
+          { skillId },
+          "Unregistering tools for skill whose manifest is no longer loadable",
+        );
+        unregisterSkillTools(skillId);
+      }
+      successfulEntries.set(skillId, NO_TOOLS_VERSION);
+      if (prevHash === undefined) {
+        recordSkillLoadedTelemetry(skill, options?.telemetry);
+      }
       continue;
     }
 
@@ -321,10 +429,23 @@ export function projectSkillTools(
 
     if (tools.length > 0) {
       let accepted = tools;
-      const prevHash = prevActive.get(skillId);
-      if (prevHash === undefined) {
-        // Newly active skill — register for the first time
-        accepted = registerSkillTools(skillId, tools);
+      if (!hasRegisteredTools(prevHash)) {
+        // Newly active skill, or a previously manifest-less activation whose
+        // TOOLS.json has since appeared — register for the first time. There
+        // is nothing to unregister in the sentinel case: no tools were ever
+        // registered for it.
+        try {
+          accepted = registerSkillTools(skillId, tools);
+        } catch (err) {
+          log.error({ err, skillId }, "Failed to register skill tools");
+          // Not added to successfulEntries — registration (and the
+          // skill_loaded record below) is retried next turn.
+          continue;
+        }
+        // A first successful registration counts as the load; a manifest-less
+        // activation gaining a TOOLS.json re-registers, which — like a
+        // version-hash change — counts as a new load.
+        recordSkillLoadedTelemetry(skill, options?.telemetry);
       } else if (prevHash !== currentHash) {
         // Hash changed — unregister stale tools, then re-register with new definitions
         log.info(
@@ -343,6 +464,8 @@ export function projectSkillTools(
           // Don't add to successfulEntries — will be cleaned up as transiently-failed
           continue;
         }
+        // A version change that re-registers counts as a new skill load.
+        recordSkillLoadedTelemetry(skill, options?.telemetry);
       } else {
         // Hash unchanged — filter to only tools that are actually registered
         // for this skill. Some tools may have been skipped during initial
@@ -372,7 +495,9 @@ export function projectSkillTools(
     if (
       activeIds.has(id) &&
       !successfulEntries.has(id) &&
-      !alreadyUnregistered.has(id)
+      !alreadyUnregistered.has(id) &&
+      // Sentinel entries registered no tools — nothing to unregister.
+      hasRegisteredTools(prevActive.get(id))
     ) {
       log.info(
         { skillId: id },
@@ -403,7 +528,11 @@ export function resetSkillToolProjection(
   trackedIds?: Map<string, string>,
 ): void {
   if (trackedIds) {
-    for (const id of trackedIds.keys()) {
+    for (const [id, hash] of trackedIds) {
+      // Sentinel entries (active skills without a manifest) registered no
+      // tools — skip them so we don't decrement refcounts held by other
+      // conversations.
+      if (!hasRegisteredTools(hash)) continue;
       unregisterSkillTools(id);
     }
     trackedIds.clear();

package/src/daemon/conversation-slash.ts

@@ -458,17 +458,3 @@ export async function resolveSlash(
 
   return { kind: "passthrough", content };
 }
-
-// ── Provider Ordering Error Detection ────────────────────────────────
-
-const ORDERING_ERROR_PATTERNS = [
-  /tool_result.*not immediately after.*tool_use/i,
-  /tool_use.*must have.*tool_result/i,
-  /tool_use_id.*without.*tool_result/i,
-  /tool_result.*tool_use_id.*not found/i,
-  /messages.*invalid.*order/i,
-];
-
-export function isProviderOrderingError(message: string): boolean {
-  return ORDERING_ERROR_PATTERNS.some((pattern) => pattern.test(message));
-}