@vellumai/assistant 0.8.9-staging.2 → 0.8.9-staging.3

package/src/prompts/templates/BOOTSTRAP-ACTIVATION-RAIL.md

@@ -22,7 +22,7 @@ _If the user declines the port (`port_declined`)._ Don't re-pitch and don't ask
 
 On `port_declined`, render exactly ONE small structured intake surface before moving to Propose — a `ui_show` `choice` surface (`display: "inline"`, single-select) whose options are a short background list (Founder / Engineer / Creative / Operator / Investor / Student / Other), so the no-port branch still hands Propose a structured signal. (A `form` with one short field, or a `choice` phrased as a single top-of-mind question, is an acceptable substitute — pick one; the background `choice` is the default.) This is the deliberate structured-intake exception to the "don't enumerate options / the recommendation IS the click" guidance — scoped to the no-port branch only, where there's no paste to infer from, so a small menu is the cheapest way to get traction. The port (paste) branch is unchanged: it never renders this surface.
 
-**Propose.** Don't organize what they already told you — infer what they didn't. Name the unstated thing sitting in their context and say *why* you think it: point at the specific surface that made you say it. "You didn't say this, but —". Then recommend, and lean one way; the recommendation IS the click, not a neutral menu of equally-weighted options.
+**Propose.** Don't organize what they already told you — infer what they didn't. Name the unstated thing sitting in their context and say _why_ you think it: point at the specific surface that made you say it. "You didn't say this, but —". Then recommend, and lean one way; the recommendation IS the click, not a neutral menu of equally-weighted options.
 
 "Unstated" is inference, not invention. Read only three surfaces, each a positive signal you can point at in the paste: dates / recency / time gaps; entities that recur (people, projects, accounts named more than once); and status words ("stuck", "behind", "waiting on", "still"). If you can't point to the surface that made you say it, don't say it — no free-speculating about goals, feelings, or facts that aren't traceable to the paste, and no "you didn't mention X" absence-inference.
 
@@ -71,7 +71,7 @@ These are enforcement rules, not advice.
 
 **Long turns show progress.** Any post-submit / post-skill-load turn must render a `task_progress` card within ~5s, or fall back to streaming text. Bind "long turn" → "task_progress emitted": a long-running turn that produces neither a progress card nor streaming text didn't satisfy this move.
 
-**Action Trust-Guarantee.** Sibling to the OAuth Trust-Guarantee. Before a bulk write / delete / destructive op, render a `ui_show` preview — a table surface showing total count, breakdown, sample rows, and the categories to confirm. The user commits or refines on that surface; only then do you execute. Single-item actions use the natural draft instead. Threshold for the preview gate: bulk *and* low recoverability. One of the two alone doesn't trip it.
+**Action Trust-Guarantee.** Sibling to the OAuth Trust-Guarantee. Before a bulk write / delete / destructive op, render a `ui_show` preview — a table surface showing total count, breakdown, sample rows, and the categories to confirm. The user commits or refines on that surface; only then do you execute. Single-item actions use the natural draft instead. Threshold for the preview gate: bulk _and_ low recoverability. One of the two alone doesn't trip it.
 
 **Start Small.** On first execution of any skill, prefer the smallest meaningful result over the most complete result. Show, then offer to expand.
 
@@ -83,6 +83,41 @@ Identity writes (IDENTITY.md, SOUL.md), user-profile writes, journal entries: al
 
 The base BOOTSTRAP task_preferences fallback is not on this rail. Your opener is the Port pitch.
 
+## Telemetry: tag your `ui_show` surfaces
+
+The activation funnel is measured passively — there is no separate tool to call.
+When you render the `ui_show` surface for a rail move that IS a funnel moment,
+add the optional `activation_moment` parameter to that same `ui_show` call. It's
+a tag on a surface you're already showing, not extra work.
+
+Most moments record when the user COMMITS the tagged surface (clicks an action /
+submits / selects). The one exception is `first_wow_executed`, which records the
+moment the surface RENDERS — because the wow has already happened by the time you
+show its result, and a result card is often display-only with nothing to commit.
+
+Which surface to tag with which moment:
+
+- `moment_1` — the no-port intake `choice` surface, OR the Port-summary card
+  (background + top-of-mind captured, or the user explicitly skipped). Records on
+  commit (when the intake resolves).
+- `moment_2` — the Propose offer surface (the `ui_show` offer card/choice where
+  the user picks an outcome). Records on commit.
+- `moment_3` — the task-selection surface (the specific thing you're about to
+  run is chosen). Records on commit.
+- `first_wow_executed` — the Run result surface (e.g. `work_result` / the result
+  the user sees after the wow ran against real data). Records on RENDER — you do
+  not need the user to click anything; just tag the result surface.
+- `first_wow_interacted` — the user's first engagement AFTER the wow. Tag the
+  surface they act on (a result-card action button, or the follow-through
+  `choice` you render next). Records on commit. Don't put this on the same
+  surface as `first_wow_executed` — one tag per surface, and that surface already
+  records "executed" on render.
+
+A surface carries at most one `activation_moment`. The milestone no-ops outside
+an activation session, and a missing or mistimed tag is non-fatal — but accurate,
+move-bound tags are what make the funnel meaningful. Omit `activation_moment` on
+every non-funnel surface.
+
 ## Wrap
 
 <!-- Open question: the default wrap tone below is opinionated (brisk, dataset-first). Whether that's the right note to end the activation rail on is a conscious call we haven't made yet — flag, don't silently change. -->

package/src/providers/openai/__tests__/vision-not-supported.test.ts

@@ -0,0 +1,75 @@
+import { describe, expect, test } from "bun:test";
+
+import OpenAI from "openai";
+
+import { detectVisionNotSupported } from "../chat-completions-provider.js";
+
+function buildApiError(
+  status: number,
+  body: unknown,
+): InstanceType<typeof OpenAI.APIError> {
+  return new OpenAI.APIError(
+    status,
+    body as Record<string, unknown>,
+    undefined,
+    new Headers(),
+  );
+}
+
+describe("detectVisionNotSupported", () => {
+  test("detects OpenRouter 'No endpoints found that support image input'", () => {
+    const err = buildApiError(404, {
+      error: {
+        message: "No endpoints found that support image input",
+        code: 404,
+      },
+    });
+    expect(detectVisionNotSupported(err)).toBe(true);
+  });
+
+  test("detects 'does not support image' phrasing", () => {
+    const err = buildApiError(400, {
+      error: {
+        message: "This model does not support image input",
+      },
+    });
+    expect(detectVisionNotSupported(err)).toBe(true);
+  });
+
+  test("detects 'image input is not supported'", () => {
+    const err = buildApiError(400, {
+      error: {
+        message: "image input is not supported for this model",
+      },
+    });
+    expect(detectVisionNotSupported(err)).toBe(true);
+  });
+
+  test("detects 'vision is not supported'", () => {
+    const err = buildApiError(400, {
+      error: {
+        message: "Vision is not supported by this model",
+      },
+    });
+    expect(detectVisionNotSupported(err)).toBe(true);
+  });
+
+  test("returns false for unrelated errors", () => {
+    const err = buildApiError(429, {
+      error: {
+        message: "Rate limit exceeded",
+      },
+    });
+    expect(detectVisionNotSupported(err)).toBe(false);
+  });
+
+  test("returns false for context overflow", () => {
+    const err = buildApiError(400, {
+      error: {
+        code: "context_length_exceeded",
+        message: "This model's maximum context length is 128000 tokens",
+      },
+    });
+    expect(detectVisionNotSupported(err)).toBe(false);
+  });
+});

package/src/providers/openai/chat-completions-provider.ts

@@ -101,6 +101,22 @@ export function extractApiErrorDetail(
  *  OpenRouter's `error.metadata.raw` strings, which are typically <1KB. */
 const MAX_API_ERROR_DETAIL_CHARS = 2000;
 
+const VISION_NOT_SUPPORTED_PATTERNS = [
+  /no endpoints found that support image input/i,
+  /does not support image/i,
+  /image input is not supported/i,
+  /this model does not support vision/i,
+  /vision is not supported/i,
+  /multi-?modal.*not.*support/i,
+];
+
+export function detectVisionNotSupported(
+  error: InstanceType<typeof OpenAI.APIError>,
+): boolean {
+  const haystack = `${error.message} ${JSON.stringify((error as { error?: unknown }).error ?? "")}`;
+  return VISION_NOT_SUPPORTED_PATTERNS.some((re) => re.test(haystack));
+}
+
 /**
  * Fallback `content` for an assistant turn that has neither visible text nor
  * tool calls (e.g. a reasoning-only turn truncated at the output-token limit).
@@ -649,6 +665,15 @@ export class OpenAIChatCompletionsProvider implements Provider {
             cause: error,
           });
         }
+        if (detectVisionNotSupported(error)) {
+          const model = modelOverride ?? this.model;
+          throw new ProviderError(
+            `This model (${model}) doesn't support image input. Remove the image or switch to a vision-capable model.`,
+            this.name,
+            error.status,
+            abortReason ? { abortReason } : undefined,
+          );
+        }
         const retryAfterMs = extractRetryAfterMs(error.headers);
         const errorOptions: {
           retryAfterMs?: number;

package/src/runtime/routes/__tests__/stt-routes.test.ts

@@ -1,3 +1,8 @@
+import { randomUUID } from "node:crypto";
+import { writeFileSync } from "node:fs";
+import { unlink, writeFile } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
 import { afterEach, beforeEach, describe, expect, mock, test } from "bun:test";
 
 // ---------------------------------------------------------------------------
@@ -26,6 +31,35 @@ mock.module("../../../providers/speech-to-text/resolve.js", () => ({
   },
 }));
 
+// -- Spawn mock (ffmpeg/ffprobe) for the file-transcription path ------------
+
+type SpawnResult = { exitCode: number; stdout: string; stderr: string };
+let spawnOverride: ((args: string[]) => SpawnResult) | null = null;
+
+/**
+ * Default spawn behavior: ffmpeg writes the requested output file so the
+ * downstream readFile succeeds, ffprobe reports a short duration.
+ */
+function defaultSpawn(args: string[]): SpawnResult {
+  if (args[0] === "ffmpeg") {
+    const outputPath = args[args.length - 1];
+    writeFileSync(outputPath, Buffer.from("fake-wav-bytes"));
+    return { exitCode: 0, stdout: "", stderr: "" };
+  }
+  if (args[0] === "ffprobe") {
+    return { exitCode: 0, stdout: "1.0", stderr: "" };
+  }
+  return { exitCode: 0, stdout: "", stderr: "" };
+}
+
+mock.module("../../../util/spawn.js", () => ({
+  FFMPEG_TRANSCODE_TIMEOUT_MS: 60_000,
+  FFPROBE_TIMEOUT_MS: 10_000,
+  STT_REQUEST_TIMEOUT_MS: 300_000,
+  spawnWithTimeout: async (args: string[]) =>
+    (spawnOverride ?? defaultSpawn)(args),
+}));
+
 // ---------------------------------------------------------------------------
 // Import under test — after mocks
 // ---------------------------------------------------------------------------
@@ -86,6 +120,7 @@ const fakeTranscriber: BatchTranscriber = {
 beforeEach(() => {
   mockTranscriber = fakeTranscriber;
   mockResolveError = null;
+  spawnOverride = null;
 });
 
 afterEach(() => {
@@ -366,4 +401,81 @@ describe("stt-routes", () => {
       "BAD_GATEWAY",
     );
   });
+
+  // -- File transcription: provider error categorization --------------------
+
+  async function withTempAudioFile(
+    run: (filePath: string) => Promise<void>,
+  ): Promise<void> {
+    const filePath = join(tmpdir(), `vellum-stt-test-${randomUUID()}.wav`);
+    await writeFile(filePath, Buffer.from("fake-audio"));
+    try {
+      await run(filePath);
+    } finally {
+      await unlink(filePath).catch(() => {});
+    }
+  }
+
+  test("transcribe-file maps provider auth failures (403) to 401", async () => {
+    // Reproduces JARVIS-994: a raw Gemini 403 denial must surface as an
+    // actionable 401, not a generic 502, and must not be treated as a
+    // daemon-level error.
+    mockTranscriber = {
+      providerId: "google-gemini",
+      boundaryId: "daemon-batch",
+      transcribe: async () => {
+        throw new Error(
+          'Google Gemini API error (403): {"error":{"code":403,"message":"Your project has been denied access. Please contact support.","status":"PERMISSION_DENIED"}}',
+        );
+      },
+    };
+
+    await withTempAudioFile(async (filePath) => {
+      const { handler } = getRoute("stt/transcribe-file");
+      const err = await expectRouteError(
+        () => handler(makeArgs({ filePath })),
+        401,
+        "UNAUTHORIZED",
+      );
+      expect(err.message).toContain("credentials");
+    });
+  });
+
+  test("transcribe-file maps generic provider failures to 502", async () => {
+    mockTranscriber = {
+      providerId: "openai-whisper",
+      boundaryId: "daemon-batch",
+      transcribe: async () => {
+        throw new Error("upstream kaboom");
+      },
+    };
+
+    await withTempAudioFile(async (filePath) => {
+      const { handler } = getRoute("stt/transcribe-file");
+      await expectRouteError(
+        () => handler(makeArgs({ filePath })),
+        502,
+        "BAD_GATEWAY",
+      );
+    });
+  });
+
+  test("transcribe-file maps ffmpeg failures to 502 even when stderr contains a status-like number", async () => {
+    // Guards against ffmpeg stderr (or a user-supplied path) deciding the HTTP
+    // category: a conversion failure whose message contains "403" must stay a
+    // 502 conversion error, not become a misleading 401 auth error.
+    spawnOverride = (args) =>
+      args[0] === "ffmpeg"
+        ? { exitCode: 1, stdout: "", stderr: "Error opening /tmp/403/clip.wav" }
+        : { exitCode: 0, stdout: "1.0", stderr: "" };
+
+    await withTempAudioFile(async (filePath) => {
+      const { handler } = getRoute("stt/transcribe-file");
+      await expectRouteError(
+        () => handler(makeArgs({ filePath })),
+        502,
+        "BAD_GATEWAY",
+      );
+    });
+  });
 });

package/src/runtime/routes/acp-routes.test.ts

@@ -2,9 +2,9 @@
  * Tests for the ACP route handlers.
  *
  * Suites:
- *  - POST /v1/acp/spawn: resolver failure paths (acp_disabled,
- *    unknown_agent) and the body-shape guard. The binary_not_found /
- *    auto-install surface is covered in `__tests__/acp-routes.test.ts`.
+ *  - POST /v1/acp/spawn: resolver failure paths (unknown_agent) and the
+ *    body-shape guard. The binary_not_found / auto-install surface is
+ *    covered in `__tests__/acp-routes.test.ts`.
  *  - POST /v1/acp/spawn (env injection) — CLAUDE_CODE_OAUTH_TOKEN is read
  *    from the credential broker (policy-gated + audited) and merged into
  *    `agentConfig.env` ONLY for the `claude` agent.
@@ -200,21 +200,6 @@ beforeEach(() => {
 // ---------------------------------------------------------------------------
 
 describe("POST /v1/acp/spawn", () => {
-  test("throws BadRequestError when ACP is disabled", async () => {
-    config.setConfig({ enabled: false });
-
-    const handler = getSpawnHandler();
-    await expect(
-      handler({
-        body: {
-          agent: "claude",
-          task: "do a thing",
-          conversationId: "conv-1",
-        },
-      }),
-    ).rejects.toThrow("acp.enabled");
-  });
-
   test("throws BadRequestError with merged available list when agent id is unknown", async () => {
     config.setConfig({
       agents: {
@@ -235,8 +220,6 @@ describe("POST /v1/acp/spawn", () => {
   });
 
   test("body-shape guard short-circuits before the resolver runs", async () => {
-    config.setConfig({ enabled: false });
-
     const handler = getSpawnHandler();
     await expect(handler({ body: { agent: "claude" } })).rejects.toThrow(
       "agent, task, and conversationId are required",

package/src/runtime/routes/conversation-routes.ts

@@ -1741,6 +1741,7 @@ export async function handleSendMessage(
         ...(body.automated === true ? { automated: true } : {}),
       },
       isInteractive,
+      sourceActorPrincipalId,
       transport,
       clientMessageId,
     });
@@ -1842,6 +1843,7 @@ export async function handleSendMessage(
     userMessageInterface: sourceInterface,
     assistantMessageInterface: sourceInterface,
   });
+  conversation.currentTurnSourceActorPrincipalId = sourceActorPrincipalId;
 
   await conversation.ensureActorScopedHistory();
 

package/src/runtime/routes/playground/__tests__/force-compact.test.ts

@@ -18,8 +18,8 @@ mock.module("../helpers.js", () => ({
   addPlaygroundMessage: async () => ({ id: "msg-test" }),
 }));
 
-import type { ContextWindowResult } from "../../../../context/window-manager.js";
 import type { Conversation } from "../../../../daemon/conversation.js";
+import type { ContextWindowResult } from "../../../../plugins/defaults/compaction/window-manager.js";
 import type { Message } from "../../../../providers/types.js";
 import { RouteError } from "../../errors.js";
 import { ROUTES } from "../index.js";

package/src/runtime/routes/stt-routes.ts

@@ -17,6 +17,7 @@ import { listProviderEntries } from "../../providers/speech-to-text/provider-cat
 import { resolveBatchTranscriber } from "../../providers/speech-to-text/resolve.js";
 import { normalizeSttError } from "../../stt/daemon-batch-transcriber.js";
 import type { BatchTranscriber, SttErrorCategory } from "../../stt/types.js";
+import { SttError } from "../../stt/types.js";
 import { getLogger } from "../../util/logger.js";
 import {
   FFMPEG_TRANSCODE_TIMEOUT_MS,
@@ -141,6 +142,27 @@ async function toWav(inputPath: string, isVideo: boolean): Promise<string> {
   return wavPath;
 }
 
+/**
+ * Call the provider and tag any failure as an {@link SttError} so callers can
+ * distinguish provider failures (categorized HTTP statuses) from local
+ * preprocessing failures (ffmpeg/ffprobe), which stay on the bad-gateway path.
+ */
+async function transcribeChunk(
+  transcriber: BatchTranscriber,
+  audioBuffer: Buffer,
+): Promise<string> {
+  try {
+    const result = await transcriber.transcribe({
+      audio: audioBuffer,
+      mimeType: "audio/wav",
+      signal: AbortSignal.timeout(STT_REQUEST_TIMEOUT_MS),
+    });
+    return result.text;
+  } catch (err) {
+    throw normalizeSttError(err);
+  }
+}
+
 async function transcribeWithProvider(
   audioPath: string,
   transcriber: BatchTranscriber,
@@ -151,12 +173,7 @@ async function transcribeWithProvider(
   // If small enough, send directly
   if (fileSize <= STT_CHUNK_MAX_BYTES) {
     const audioBuffer = await readFile(audioPath);
-    const result = await transcriber.transcribe({
-      audio: audioBuffer,
-      mimeType: "audio/wav",
-      signal: AbortSignal.timeout(STT_REQUEST_TIMEOUT_MS),
-    });
-    return result.text;
+    return transcribeChunk(transcriber, audioBuffer);
   }
 
   // Split into chunks for large files
@@ -175,12 +192,8 @@ async function transcribeWithProvider(
         `  Transcribing chunk ${i + 1}/${chunks.length}...\n`,
       );
       const audioBuffer = await readFile(chunks[i]);
-      const result = await transcriber.transcribe({
-        audio: audioBuffer,
-        mimeType: "audio/wav",
-        signal: AbortSignal.timeout(STT_REQUEST_TIMEOUT_MS),
-      });
-      if (result.text) parts.push(result.text);
+      const text = await transcribeChunk(transcriber, audioBuffer);
+      if (text) parts.push(text);
     }
 
     return parts.join(" ");
@@ -363,6 +376,26 @@ async function handleTranscribeFile({ body }: RouteHandlerArgs) {
       durationSeconds,
     };
   } catch (err) {
+    // Only provider failures (tagged as SttError by transcribeChunk) are
+    // categorized into HTTP statuses. Local preprocessing failures (ffmpeg/
+    // ffprobe) stay on the bad-gateway path so their stderr never decides the
+    // category (e.g. a path under a dir named "403" must not become a 401).
+    if (err instanceof SttError) {
+      // Auth/rate-limit/timeout/invalid-audio are user-config or transient
+      // conditions, not daemon defects, so log them at warn to keep them out
+      // of error telemetry. Reserve error level (with the raw err for a Sentry
+      // stack) for genuine provider/unexpected failures.
+      if (err.category === "provider-error") {
+        log.error({ err, filePath }, "File transcription failed");
+      } else {
+        log.warn(
+          { category: err.category, message: err.message, filePath },
+          "File transcription failed",
+        );
+      }
+      throw STT_ERROR_MAP[err.category]();
+    }
+
     log.error({ err, filePath }, "File transcription failed");
     throw new BadGatewayError(
       err instanceof Error ? err.message : "Transcription failed",

package/src/runtime/routes/workspace-routes.ts

@@ -46,14 +46,24 @@ const workspaceTreeEntrySchema = z.object({
 
 type TreeEntry = z.infer<typeof workspaceTreeEntrySchema>;
 
-// Total number of filesystem entries we're willing to traverse when computing
-// recursive directory sizes for a single tree listing. The budget is shared
-// across every directory in the response so a giant `repos/` checkout cannot
-// starve the request — once exhausted, remaining directories report `size:
-// null` (caller renders an unknown-size placeholder). 50k is generous for
-// typical workspaces (sounds, db, logs) while bailing fast on multi-repo
-// trees.
-const DIR_SIZE_TOTAL_ENTRY_BUDGET = 50_000;
+// Recursive directory sizing walks the filesystem synchronously, so it is
+// bounded by two caps that work together:
+//
+// - `DIR_SIZE_PER_DIR_ENTRY_BUDGET` caps a single directory. No one giant
+//   subtree (e.g. a `node_modules/` or `repos/` checkout) can consume the whole
+//   listing's budget and starve its siblings; only the oversized directory
+//   itself reports `size: null` (the caller renders an unknown-size
+//   placeholder) while every other folder still shows an accurate size.
+// - `DIR_SIZE_TOTAL_ENTRY_BUDGET` caps the listing as a whole, so a workspace
+//   with many large sibling directories still can't block the daemon event loop
+//   for an unbounded amount of time. Once it is exhausted, the remaining
+//   directories report `size: null`.
+//
+// Each directory is allotted `min(per-dir cap, remaining listing budget)`
+// entries, and whatever it actually consumes is deducted from the listing
+// budget.
+const DIR_SIZE_PER_DIR_ENTRY_BUDGET = 250_000;
+const DIR_SIZE_TOTAL_ENTRY_BUDGET = 1_000_000;
 
 interface DirSizeBudget {
   remaining: number;
@@ -61,13 +71,13 @@ interface DirSizeBudget {
 
 /**
  * Recursively sum the byte size of every regular file under `absPath`,
- * sharing a single entry budget across all directories in the same listing.
+ * traversing up to `budget.remaining` filesystem entries.
  *
  * Returns:
  * - the total size in bytes when the entire subtree was traversed within
  *   budget
- * - `null` if the shared budget was exhausted before completion (the caller
- *   surfaces that as an unknown size in the UI)
+ * - `null` if the budget was exhausted before completion (the caller surfaces
+ *   that as an unknown size in the UI)
  *
  * Symlinks are not followed. We rely on `withFileTypes` so we never `stat`
  * directories purely to discover their type.
@@ -108,6 +118,27 @@ function computeDirSize(absPath: string, budget: DirSizeBudget): number | null {
   return total;
 }
 
+/**
+ * Compute a directory's recursive size while drawing from a shared listing
+ * budget. The directory is allotted at most `DIR_SIZE_PER_DIR_ENTRY_BUDGET`
+ * entries — and never more than the listing has left — and whatever it consumes
+ * is deducted from `listingBudget` so the next sibling sees the reduced
+ * remainder. Returns `null` (unknown size) when the allotment is exhausted.
+ */
+function computeDirSizeWithinListing(
+  absPath: string,
+  listingBudget: DirSizeBudget,
+): number | null {
+  const allotment = Math.min(
+    DIR_SIZE_PER_DIR_ENTRY_BUDGET,
+    listingBudget.remaining,
+  );
+  const dirBudget: DirSizeBudget = { remaining: allotment };
+  const size = computeDirSize(absPath, dirBudget);
+  listingBudget.remaining -= allotment - dirBudget.remaining;
+  return size;
+}
+
 const SOUNDS_WORKSPACE_PATH = "data/sounds";
 
 function normaliseWorkspacePathForSync(path: string): string {
@@ -153,9 +184,11 @@ function handleWorkspaceTree({ queryParams }: RouteHandlerArgs) {
     const dirents = readdirSync(resolved, { withFileTypes: true });
     const workspaceDir = getWorkspaceDir();
 
-    // Shared budget across every directory in this listing. When opted out,
-    // we never construct one, so directories report `size: null` as before.
-    const dirSizeBudget: DirSizeBudget | undefined = includeDirSizes
+    // Listing-wide budget, only constructed when sizes are requested. Each
+    // directory draws a per-directory allotment from it so one oversized
+    // subtree can't starve its siblings, while the shared remainder still caps
+    // total synchronous traversal for the whole listing.
+    const listingBudget: DirSizeBudget | undefined = includeDirSizes
       ? { remaining: DIR_SIZE_TOTAL_ENTRY_BUDGET }
       : undefined;
 
@@ -176,7 +209,9 @@ function handleWorkspaceTree({ queryParams }: RouteHandlerArgs) {
       const relativePath = fullPath.slice(workspaceDir.length + 1);
 
       const dirSize =
-        isDir && dirSizeBudget ? computeDirSize(fullPath, dirSizeBudget) : null;
+        isDir && listingBudget
+          ? computeDirSizeWithinListing(fullPath, listingBudget)
+          : null;
 
       entries.push({
         name: entry.name,

package/src/telemetry/__tests__/activation-funnel.test.ts

@@ -0,0 +1,95 @@
+import { describe, expect, test } from "bun:test";
+
+import {
+  ACTIVATION_MOMENT_PARAMS,
+  ACTIVATION_STEPS,
+  activationStepIndex,
+  activationStepNameForMomentParam,
+  buildActivationDaemonEventId,
+  isActivationMomentParam,
+  isActivationStepName,
+} from "../activation-funnel.js";
+
+const ALL_STEP_NAMES = Object.values(ACTIVATION_STEPS).map((s) => s.stepName);
+
+describe("activation funnel vocabulary", () => {
+  test("step indices are 1-5 and unique", () => {
+    const indices = Object.values(ACTIVATION_STEPS).map((s) => s.stepIndex);
+    expect([...indices].sort((a, b) => a - b)).toEqual([1, 2, 3, 4, 5]);
+    expect(new Set(indices).size).toBe(indices.length);
+  });
+
+  test("activationStepIndex resolves index from name", () => {
+    for (const { stepName, stepIndex } of Object.values(ACTIVATION_STEPS)) {
+      expect(activationStepIndex(stepName)).toBe(stepIndex);
+    }
+  });
+
+  test("isActivationStepName accepts all five step names", () => {
+    expect(ALL_STEP_NAMES).toHaveLength(5);
+    for (const stepName of ALL_STEP_NAMES) {
+      expect(isActivationStepName(stepName)).toBe(true);
+    }
+  });
+
+  test("isActivationStepName rejects unknown names", () => {
+    expect(isActivationStepName("bogus")).toBe(false);
+  });
+
+  test("buildActivationDaemonEventId is deterministic", () => {
+    expect(
+      buildActivationDaemonEventId("conv-abc", "activation_moment_1_complete"),
+    ).toBe("activation_v1_2026_06:conv-abc:activation_moment_1_complete");
+  });
+});
+
+describe("activation moment param (model-facing tag)", () => {
+  test("ACTIVATION_MOMENT_PARAMS lists the five tokens in step order", () => {
+    expect(ACTIVATION_MOMENT_PARAMS).toEqual([
+      "moment_1",
+      "moment_2",
+      "moment_3",
+      "first_wow_executed",
+      "first_wow_interacted",
+    ]);
+  });
+
+  test("isActivationMomentParam accepts all five tokens", () => {
+    for (const param of ACTIVATION_MOMENT_PARAMS) {
+      expect(isActivationMomentParam(param)).toBe(true);
+    }
+  });
+
+  test("isActivationMomentParam rejects unknown tokens (incl. wire step names)", () => {
+    expect(isActivationMomentParam("bogus")).toBe(false);
+    // The wire step name is NOT a valid model-facing token.
+    expect(isActivationMomentParam("activation_moment_1_complete")).toBe(false);
+    expect(isActivationMomentParam("moment_4")).toBe(false);
+  });
+
+  test("activationStepNameForMomentParam maps each token to its step name", () => {
+    expect(activationStepNameForMomentParam("moment_1")).toBe(
+      ACTIVATION_STEPS.moment1.stepName,
+    );
+    expect(activationStepNameForMomentParam("moment_2")).toBe(
+      ACTIVATION_STEPS.moment2.stepName,
+    );
+    expect(activationStepNameForMomentParam("moment_3")).toBe(
+      ACTIVATION_STEPS.moment3.stepName,
+    );
+    expect(activationStepNameForMomentParam("first_wow_executed")).toBe(
+      ACTIVATION_STEPS.firstWowExecuted.stepName,
+    );
+    expect(activationStepNameForMomentParam("first_wow_interacted")).toBe(
+      ACTIVATION_STEPS.firstWowInteracted.stepName,
+    );
+  });
+
+  test("every moment param maps to a valid wire step name", () => {
+    for (const param of ACTIVATION_MOMENT_PARAMS) {
+      expect(
+        isActivationStepName(activationStepNameForMomentParam(param)),
+      ).toBe(true);
+    }
+  });
+});