@visual-z/xeno 0.8.2 → 0.8.3

package/src/core/work-state.ts

@@ -50,6 +50,10 @@ export function scopedWorkId(namespace: string, requested: string, items: readon
     ? requested : `${namespace}:${requested}`;
 }
 
+function unknownWork(id: string): string {
+  return `unknown work_id ${id}; create it with a next note (kind=next) first`;
+}
+
 export function workChangeError(items: readonly WorkItem[], event: LogEvent): string | null {
   if (!("work_id" in event) || event.work_id === undefined) return null;
   const item = items.find(item => item.id === event.work_id);
@@ -57,9 +61,10 @@ export function workChangeError(items: readonly WorkItem[], event: LogEvent): st
     const error = dependencyError(items, event.work_id, event.depends_on);
     if (error) return error;
   }
-  if (event.t === "work_dependencies" && !item) return `unknown work_id ${event.work_id}`;
+  // Every unknown-id rejection names the way to make the id exist, or the model retries the same call.
+  if (event.t === "work_dependencies" && !item) return unknownWork(event.work_id);
   if (event.t === "work_owner") {
-    if (!item) return `unknown work_id ${event.work_id}`;
+    if (!item) return unknownWork(event.work_id);
     if (event.operation === "release") return item.owner === event.owner ? null : "only the recorded owner can release work";
     const ready = workReadiness(items, item.id, event.owner);
     return ready.ready ? null : `work ${item.id} is ${ready.reason}; cannot claim it`;

package/src/core/working-set.ts

@@ -7,9 +7,17 @@ import { estimateTokens } from "./tokens.ts";
 import { RECOVERY_SECTIONS, recoverySources, type RecoveryNodes, type RecoveryRanges, type RecoveryReference } from "./recovery-sources.ts";
 import { recoveryInstructions } from "./prompt-policy.ts";
 
+/**
+ * The cut format new sessions record. Live cuts, cold replay and interrupted-cut
+ * repair all select through `carriedHandoff`, so this is only the default for
+ * cuts not yet written; a recorded version is never reinterpreted.
+ */
+export const CURRENT_WORKING_SET_VERSION = 3;
+
 export type WorkingSet = {
-  version: 1 | 2; source: NodeRef;
-  work: (Pick<WorkItem, "id" | "what" | "status" | "next_action" | "reason" | "depends_on" | "owner"> & { readiness?: WorkReadiness })[];
+  version: 1 | 2 | 3; source: NodeRef;
+  /** v3 omits `what`, `next_action` and `reason` when the carried `state.work_items` holds the same item. */
+  work: (Pick<WorkItem, "id" | "status" | "next_action" | "reason" | "depends_on" | "owner"> & { what?: string; readiness?: WorkReadiness })[];
   references: ({ node?: number; event: string; kind: string; work?: string } & Partial<Omit<RecoveryReference, "node" | "event" | "kind" | "work">>)[];
   omitted: { work: number; references: number };
   recovery_sections?: RecoveryRanges;
@@ -50,20 +58,40 @@ export function workingSet(full: Handoff, budget: number): WorkingSet | null {
 
 /** R9: a new projection version keeps the original v1 ordering byte-stable. */
 export function recoveryWorkingSet(full: Handoff, nodes: RecoveryNodes, budget: number, tools?: readonly string[]): WorkingSet | null {
+  return sourceView(full, nodes, { version: 2, users: true,
+    fits: view => estimateTokens.count([], emitYaml(view)) <= budget,
+    recovery: tools === undefined ? "Read original user messages before continuing: history(node=source.node,recovery=users,offset=0). Other pages: failures, environment, next_actions; event=ID reads one original. Abandoned messages are cancelled; annotations are not user instructions. Observations are historical: recheck resource, host and current permissions before acting. history(work_id=ID) recovers work." : recoveryInstructions(tools) });
+}
+
+/**
+ * v3 shares v2's source ordering. Two things differ, both decided by the caller
+ * that owns the whole carried handoff: `fits` measures the view inside that
+ * handoff rather than standalone, and `users: false` leaves user sources out
+ * because the carried `user_turns` already hold every one verbatim.
+ */
+export function recoveryWorkingSetV3(full: Handoff, nodes: RecoveryNodes, options: {
+  users: boolean; recovery: string; fits: (view: WorkingSet) => boolean;
+}): WorkingSet | null {
+  return sourceView(full, nodes, { version: 3, ...options });
+}
+
+function sourceView(full: Handoff, nodes: RecoveryNodes, options: {
+  version: 2 | 3; users: boolean; recovery: string; fits: (view: WorkingSet) => boolean;
+}): WorkingSet | null {
   const legacy = workingSet(full, Infinity);
   if (!legacy) return null;
   const sources = recoverySources(nodes);
-  const view: WorkingSet = { version: 2, source: legacy.source, work: [], references: [],
+  const view: WorkingSet = { version: options.version, source: legacy.source, work: [], references: [],
     omitted: { work: legacy.work.length, references: legacy.references.length + RECOVERY_SECTIONS.reduce((sum, section) => sum + sources[section].length, 0) },
     recovery_sections: Object.fromEntries(RECOVERY_SECTIONS.map(section => [section, { total: sources[section].length, omitted: sources[section].length }])) as RecoveryRanges,
-    recovery: tools === undefined ? "Read original user messages before continuing: history(node=source.node,recovery=users,offset=0). Other pages: failures, environment, next_actions; event=ID reads one original. Abandoned messages are cancelled; annotations are not user instructions. Observations are historical: recheck resource, host and current permissions before acting. history(work_id=ID) recovers work." : recoveryInstructions(tools) };
-  const fits = () => estimateTokens.count([], emitYaml(view)) <= budget;
+    recovery: options.recovery };
+  const fits = () => options.fits(view);
   if (!fits()) return null;
   const queues = RECOVERY_SECTIONS.map(section => ({ section, items: [...sources[section]], at: 0 }));
   // The latest and first live user messages anchor correction and initial scope;
   // remaining user sources are newest first. Cancelled turns stay pageable.
   const live = sources.users.filter(ref => !ref.abandoned), first = live.at(-1);
-  queues[0]!.items = [...live.slice(0, 1), ...(first && first !== live[0] ? [first] : []),
+  queues[0]!.items = !options.users ? [] : [...live.slice(0, 1), ...(first && first !== live[0] ? [first] : []),
     ...live.slice(1, -1), ...sources.users.filter(ref => ref.abandoned)];
   const takeReference = (reference: WorkingSet["references"][number], section?: keyof RecoveryRanges) => {
     view.references.push(reference); view.omitted.references--;

package/src/runtime/connection-reuse.ts

@@ -0,0 +1,40 @@
+/**
+ * Whether a provider may keep reusing pooled connections.
+ *
+ * A socket that a proxy, NAT or server dropped while it sat in the pool fails
+ * the next request the same way -- Horizyn 2026-10-12 lost the first request
+ * after "continue" to it. Claude Code answers by turning keep-alive off for
+ * the rest of the process once a connection dies; this does the same per
+ * provider instance, so tests sharing a process cannot leak state into each
+ * other and a fresh session starts from the cheap path again
+ * (feat-fresh-connection-after-drop).
+ *
+ * Bun honours `keepalive: false` by opening a new socket per request
+ * (measured on 1.3.10: three default fetches share one socket, three with
+ * keepalive:false open three). The cost is a TLS handshake per request,
+ * negligible next to a model call. Google, Vertex and Bedrock go through
+ * pi-ai's native HTTP with no fetch hook, so this cannot reach them.
+ */
+import { connectionFailure } from "./retry.ts";
+
+export class ConnectionReuse {
+  private fresh = false;
+
+  /**
+   * Called with every failed attempt, retried or final. Only a connection
+   * that existed and died counts: one that never opened left nothing stale
+   * in the pool.
+   */
+  note(error: unknown): void {
+    if (connectionFailure(error) === "stale") this.fresh = true;
+  }
+
+  init(init: RequestInit | undefined): RequestInit | undefined {
+    return this.fresh ? { ...init, keepalive: false } : init;
+  }
+
+  /** A fetch that opens fresh connections once one has died. */
+  wrap(fetchImpl: typeof fetch): typeof fetch {
+    return Object.assign((input: RequestInfo | URL, init?: RequestInit) => fetchImpl(input, this.init(init)), { preconnect: fetchImpl.preconnect });
+  }
+}

package/src/runtime/exec-sessions.ts

@@ -46,6 +46,19 @@ export function yieldWait(value: unknown): { ms: number; note: string } {
   const ms = Math.min(MAX_YIELD_MS, Math.max(MIN_YIELD_MS, requested));
   return { ms, note: ms === requested ? "" : ` · yield_time_ms ${requested} clamped to ${ms}` };
 }
+/**
+ * Bounds on one owned empty wait's window, copied from Codex's empty
+ * `write_stdin` (MIN_EMPTY_YIELD_TIME_MS, DEFAULT_MAX_BACKGROUND_TERMINAL_TIMEOUT_MS),
+ * not measured. The floor is what stops a chatty process from waking the
+ * model every line: below it, a 100 ms request brings the per-line wakeups back.
+ */
+export const MIN_EMPTY_YIELD_MS = 5_000;
+export const MAX_EMPTY_YIELD_MS = 300_000;
+export function emptyYieldWait(value: unknown): { ms: number; note: string } {
+  const requested = typeof value === "number" && Number.isFinite(value) ? value : DEFAULT_YIELD_MS;
+  const ms = Math.min(MAX_EMPTY_YIELD_MS, Math.max(MIN_EMPTY_YIELD_MS, requested));
+  return { ms, note: ms === requested ? "" : ` · yield_time_ms ${requested} clamped to ${ms}` };
+}
 /**
  * Concurrent sessions. An assumption, not a measurement: comfortably above a
  * server + watcher + REPL, low enough that a runaway loop of starts is refused
@@ -61,6 +74,12 @@ export const CLOSED_RECEIPT_AGE_MS = 10 * 60_000;
 type TakenOutput = {
   stored: ArchivedObservation; receipt: ProcessReceipt; wallMs: number;
   exit: number | null; stopped?: "timeout" | "cancelled";
+  /**
+   * Input that arrived after the process exited and was not written:
+   * "control" for interrupt/EOF, whose intent the exit already satisfied;
+   * "refused" for real input, which the caller must report as not sent.
+   */
+  unsent?: "control" | "refused";
 };
 type ClosedSession = { owner?: string; id: number; endedAt: number; receipt: ProcessReceipt };
 
@@ -79,7 +98,6 @@ interface Session {
   spoolPath: string;
   queue: Promise<unknown>;
   operations: Promise<unknown>;
-  outputListeners: Set<() => void>;
   final?: TakenOutput;
   captureError?: string;
   written: number;
@@ -151,7 +169,6 @@ function append(session: Session, chunk: Uint8Array): void {
       if (bytesWritten < 1) throw new Error("process output spool made no write progress");
       offset += bytesWritten; session.written += bytesWritten;
     }
-    for (const notify of session.outputListeners) notify();
   }).catch(error => {
     session.captureError = `process output capture failed: ${String(error)}`;
     stopSession(session, "cancelled");
@@ -177,7 +194,7 @@ export async function startSession(input: {
   const exited = new Promise<void>((resolve) => { resolveExit = resolve; });
   const session = {
     id: nextId++, ...(input.owner === undefined ? {} : { owner: input.owner }), command: input.command, cwd: input.cwd, tty: input.tty, source: input.source, started: performance.now(),
-    spool, spoolPath, queue: Promise.resolve(), operations: Promise.resolve(), outputListeners: new Set<() => void>(), written: 0, read: 0,
+    spool, spoolPath, queue: Promise.resolve(), operations: Promise.resolve(), written: 0, read: 0,
     exit: null, timeoutMs: input.timeoutMs, exited, drained: Promise.resolve(),
     ...(input.artifactObserver ? { artifactObserver: input.artifactObserver } : {}),
   } as Omit<Session, "pid" | "write" | "kill" | "timer"> as Session;
@@ -302,26 +319,42 @@ export interface ObservationWait {
   /** Steering releases this observation wait without cancelling the owned command. */
   wake?: AbortSignal;
   onWaiting?: (active: boolean) => void;
+  /** One window; output is delivered at a window's end, never as it arrives. */
+  windowMs: number;
 }
 
-/** OMP's job owner pattern: no paid model turn merely to observe elapsed time. */
+/**
+ * OMP's job owner pattern: no paid model turn merely to observe elapsed time.
+ * Exit, timeout, cancellation and steering end the wait at once. Output does
+ * not: it is collected until the window ends, and a window with nothing new
+ * rolls into the next. Waking per byte made a process that prints a warning
+ * every few seconds cost one model request per line (session mv4wyiyg-lebu,
+ * fix-owned-wait-coalesce-output); Codex collects to the deadline the same way.
+ */
 async function waitForObservation(session: Session, signal: AbortSignal | undefined, wait: ObservationWait): Promise<void> {
   await session.queue;
-  let notify!: () => void;
-  const changed = new Promise<void>(resolve => { notify = resolve; });
-  session.outputListeners.add(notify);
-  signal?.addEventListener("abort", notify, { once: true });
-  wait.wake?.addEventListener("abort", notify, { once: true });
-  const pending = session.exit === null && session.read === session.written && !signal?.aborted && !wait.wake?.aborted;
+  let interrupt!: () => void;
+  const interrupted = new Promise<void>(resolve => { interrupt = resolve; });
+  signal?.addEventListener("abort", interrupt, { once: true });
+  wait.wake?.addEventListener("abort", interrupt, { once: true });
+  const ended = () => session.exit !== null || signal?.aborted === true || wait.wake?.aborted === true;
+  const pending = !ended();
+  let timer: ReturnType<typeof setTimeout> | undefined;
   try {
     if (pending) {
       wait.onWaiting?.(true);
-      await Promise.race([session.exited, changed]);
+      while (!ended()) {
+        const deadline = new Promise<void>(resolve => { timer = setTimeout(resolve, wait.windowMs); });
+        await Promise.race([session.exited, interrupted, deadline]);
+        clearTimeout(timer);
+        await session.queue;
+        if (session.written > session.read) break;
+      }
     }
   } finally {
-    session.outputListeners.delete(notify);
-    signal?.removeEventListener("abort", notify);
-    wait.wake?.removeEventListener("abort", notify);
+    clearTimeout(timer);
+    signal?.removeEventListener("abort", interrupt);
+    wait.wake?.removeEventListener("abort", interrupt);
     if (pending) wait.onWaiting?.(false);
   }
   if (signal?.aborted) stopSession(session, "cancelled");
@@ -371,6 +404,17 @@ async function takeOutput(session: Session, outputStore: string, previewBytes: n
   return taken;
 }
 
+/**
+ * Input made only of Ctrl-C / Ctrl-D. Sent to a process that has already
+ * exited, it asks for something the exit already did (stop, end of input), so
+ * it is answered as a poll rather than refused -- otherwise the exit and the
+ * unread tail wait for a second call the model may never make (ticket session
+ * mv4ugd29, write-stdin-exited card).
+ */
+export function isControlInput(chars: string): boolean {
+  return chars.length > 0 && /^[\u0003\u0004]+$/.test(chars);
+}
+
 /** One lease covers stdin, waiting, archival and cursor commit; cancellation can interrupt a queued wait. */
 export async function pollSession(session: Session, outputStore: string, previewBytes: number, yieldMs: number,
   chars = "", signal?: AbortSignal, wait?: ObservationWait): Promise<TakenOutput> {
@@ -378,16 +422,20 @@ export async function pollSession(session: Session, outputStore: string, preview
   if (signal?.aborted) cancel(); else signal?.addEventListener("abort", cancel, { once: true });
   const result = session.operations.then(async () => {
     if (session.final) {
-      if (chars.length > 0) throw new ToolFault("not_found", "process is closed; input was not sent", NOT_STARTED);
+      if (chars.length > 0 && !isControlInput(chars)) throw new ToolFault("not_found", "process is closed; input was not sent", NOT_STARTED);
       return { ...session.final, receipt: { ...session.final.receipt, replayed: true } };
     }
+    // An exit not yet reported is still delivered with any late input: the
+    // input is never written, but the exit and unread output are not withheld.
+    let unsent: TakenOutput["unsent"];
     if (chars.length > 0) {
-      if (session.exit !== null) throw new ToolFault("not_found", "process has exited; input was not sent; poll with empty chars", NOT_STARTED);
-      session.write(chars);
+      if (session.exit !== null) unsent = isControlInput(chars) ? "control" : "refused";
+      else session.write(chars);
     }
     if (chars.length === 0 && wait) await waitForObservation(session, signal, wait);
     else await waitSession(session, yieldMs, signal);
-    return takeOutput(session, outputStore, previewBytes);
+    const taken = await takeOutput(session, outputStore, previewBytes);
+    return unsent === undefined ? taken : { ...taken, unsent };
   });
   session.operations = result.catch(() => {});
   try { return await result; }

package/src/runtime/history-tools.ts

@@ -2,7 +2,7 @@
 import { join } from "node:path";
 import { deriveHandoff } from "../core/derive.ts";
 import type { Handoff } from "../core/handoff.ts";
-import { HISTORY_SECTIONS, historyPage, type HistorySection } from "../core/history.ts";
+import { HISTORY_SECTIONS, historyPage, userTurnImages, type HistorySection } from "../core/history.ts";
 import { historyEntries, historyHits, historyIndex, queryHistory, type HistoryEntry } from "../core/history-query.ts";
 import { resourceKey } from "../core/evidence-links.ts";
 import { canonicalValue } from "../core/continuation.ts";
@@ -87,7 +87,12 @@ export async function runHistoryTool(logDir: string, currentNode: number, ctx: T
     if (typeof args["event"] === "string") {
       const found = indexed.byEvent.get(args["event"]);
       if (!found) throw new ToolFault("not_found", "event is not readable in the active ancestry", READ_ATTEMPTED);
-      return historyValue(ctx, found);
+      // A carried user turn names its images by digest only (D8). Reading the
+      // original turn reattaches them as a tool result, so their image tokens are
+      // paid once, when asked for, instead of in every later handoff.
+      const original = found.kind === "user" ? history.nodes.flatMap(part => part.events).find(event => event.id === found.event) : undefined;
+      const images = original?.t === "user" ? original.images ?? [] : [];
+      return { ...await historyValue(ctx, found), ...(images.length ? { images } : {}) };
     }
     if (typeof args["query"] === "string" || args["recent"] === true || typeof args["resource"] === "string" || typeof args["work_id"] === "string") {
       const query = typeof args["query"] === "string" ? args["query"] : "";
@@ -144,6 +149,11 @@ export async function runHistoryTool(logDir: string, currentNode: number, ctx: T
       if (part.node === node) break;
     }
     if (full === null) throw new ToolFault("not_found", "empty history", READ_ATTEMPTED);
+    // Pages match a v3 carried suffix: user turns name their images by digest (D8).
+    if (args["section"] === "user_turns") {
+      const at = history.nodes.findIndex(part => part.node === node);
+      full = { ...full, user_turns: userTurnImages(full.user_turns, history.nodes.slice(0, at + 1)) };
+    }
     const page = historyPage(full, args["section"] as HistorySection,
       typeof args["offset"] === "number" ? args["offset"] : 0,
       typeof args["limit"] === "number" ? Math.min(args["limit"], 100) : 20);

package/src/runtime/loop.ts

@@ -18,11 +18,12 @@
  * request.
  */
 
-import type { LogEvent, AssistantBlock, NodeRef, CutReason, ToolInvocationEvent } from "../core/events.ts";
+import type { LogEvent, AssistantBlock, NodeRef, CutReason, ToolInvocationEvent, FailureCause } from "../core/events.ts";
 import { userInputData, submissionImages, type UserInput, type ImageRef } from "../core/images.ts";
 import { hydrateImages } from "./images.ts";
 import type { Handoff } from "../core/handoff.ts";
 import { boundHandoff, DEFAULT_HANDOFF_TOKENS } from "../core/history.ts";
+import { CURRENT_WORKING_SET_VERSION } from "../core/working-set.ts";
 import { boundaryPreparation, continuationGuidance } from "../core/continuation.ts";
 import type { FrozenPrefix, Message, ProjectInput } from "../core/project.ts";
 import { projectContext, toolCallIdentityViolations } from "../core/project.ts";
@@ -76,7 +77,11 @@ import { skillTools, type Skill } from "../core/skills.ts";
 import type { WorkItem } from "../core/work-state.ts";
 import { parseAcceptanceContract, type AcceptanceContract, type AcceptanceCriterion, type AcceptanceState } from "../core/acceptance.ts";
 import { deadlineNotice } from "../core/deadline.ts";
-import { statusOf } from "./retry.ts";
+import { describeFailure, failureCause, statusOf } from "./retry.ts";
+import { XENO_VERSION } from "./version.ts";
+import { SECRET_GUIDANCE, SecretKeeper } from "./secrets.ts";
+import { secretEnvironmentValues } from "../core/secrets.ts";
+import { copyVault } from "../store/secrets.ts";
 import { assertNever } from "../core/exhaustive.ts";
 import { isLogEvent } from "../core/event-validation.ts";
 import {
@@ -177,6 +182,8 @@ export interface LoopEvent {
   /** branch_start: wall-clock milliseconds, for asserting the stagger. */
   at?: number;
   outcome?: ExecutionOutcome;
+  /** done: credential-free cause of a failed request, recorded on its outcome. */
+  failure?: FailureCause;
   /** Q23: task evidence is separate from the execution outcome; rebuilt from original receipts. */
   request?: RequestState;
   progress?: Extract<StreamDelta, { kind: "tool" | "retry" }> | { kind: "output"; text: string; name: string }
@@ -214,6 +221,11 @@ export const DEFAULT_BRANCH_LIMITS: BranchLimits = {
 };
 
 export interface SessionConfig {
+  /**
+   * Where secret-named environment values are read from (S.9). Defaults to
+   * process.env; a test supplies its own so it never depends on the machine.
+   */
+  secretEnvironment?: Readonly<Record<string, string | undefined>>;
   /** Runtime-only output contract, explicitly selected by the current caller. */
   validateOutput?: (text: string) => { ok: boolean; error?: string };
   /** Persist a selector, never persisted profile code or authorization (D6/D13). */
@@ -381,6 +393,12 @@ export class Session {
   private stall: StallState | null = null;
   private recovery: RecoveryState | null = null;
   private processWake = new AbortController();
+  /**
+   * The exception the last provider request ended with, compared by identity
+   * in send()'s catch. Wrapping the error instead would break every check that
+   * reads it (FailedResponseError, statusOf, context overflow).
+   */
+  private providerFailure: { error: unknown; retries: number } | undefined;
   private pendingAdoption: number | null = null;
   /** A worktree enter/exit moves the root only once its tool round is paired, like adoption. */
   private pendingRoot: string | null = null;
@@ -397,6 +415,8 @@ export class Session {
   readonly clock: Clock;
   state: SessionState;
   private readonly allocation: { next: number };
+  /** S.9: the vault behind placeholders. A branch is handed its parent's, like `allocation`. */
+  private secrets: SecretKeeper;
 
   constructor(config: SessionConfig, provider: Provider, clock: Clock = systemClock(), allocation = { next: 1 }) {
     if (config.acceptanceContract) parseAcceptanceContract(config.acceptanceContract);
@@ -406,6 +426,7 @@ export class Session {
     schedulingWindow([], 0, config.maxParallelTools ?? 3);
     validateRequestBudget(config.maxTurns, config.stallLimit ?? DEFAULT_STALL_LIMIT);
     this.allocation = allocation;
+    this.secrets = new SecretKeeper(config.logDir, secretEnvironmentValues(config.secretEnvironment ?? process.env));
     this.config = { ...config, ...(config.acceptanceContract ? { acceptanceContract: parseAcceptanceContract(config.acceptanceContract) } : {}), tools: { ...config.tools, execOwner: this.execOwner, historyCache: new HistoryCache(),
       processWait: { wake: () => this.processWake.signal } } };
     // A child or restored Session must never inherit another live invocation scope.
@@ -419,6 +440,8 @@ export class Session {
     // Branch capability sets are owned by branchTools; a parent's optional catalog is not a grant.
     if ((config.branchDepth ?? 0) > 0) delete this.config.tools.deferredTools;
     this.config.tools.outputStore ??= join(config.logDir, "artifacts");
+    // Read at call time, so a branch that is handed its parent's keeper expands the parent's values.
+    this.config.tools.expandSecrets = input => this.secrets.expand(input);
     this.config.tools.historyEvents = async () => {
       const history = await readNodeHistory(this.config.logDir, this.state.node, undefined, "context");
       if (!history.ok) throw Error(history.error);
@@ -498,6 +521,7 @@ export class Session {
   async start(): Promise<void> {
     this.resetDerivedToolState();
     const dir = this.config.logDir;
+    await this.secrets.load();
     const model = this.provider.config.spec.id;
     const existing = await listNodes(dir);
     const recordedCursor = await readCursor(dir);
@@ -607,6 +631,7 @@ export class Session {
    */
   async fork(destLogDir: string, untilEvent?: string, position: "at" | "before" = "at"): Promise<void> {
     await copyAncestryTo(this.config.logDir, destLogDir, this.clock.now(), untilEvent, position);
+    await copyVault(this.config.logDir, destLogDir);
     if (untilEvent !== undefined) {
       const cursor = await readCursor(destLogDir);
       if (!cursor) throw new Error("missing fork cursor");
@@ -749,8 +774,18 @@ export class Session {
    * must see that a person changed models, not that the node filled up.
    * boundary.ts already produces this reason when checkpointRequested is
    * set; switchModel is the other caller that wants it.
+   *
+   * An empty projection is the exception (fix-switch-model-empty-segment).
+   * With no events there is no old model's block to keep away from the new
+   * one, and the frozen prefix does not change here, so the cursor alone
+   * records the switch. Cutting anyway sealed an empty segment and opened
+   * the next from an empty handoff, which the model read as earlier work to
+   * resume. The check is the projection, not the node file: an inherit-basis
+   * node can be empty on disk while still projecting ancestor thinking.
+   *
+   * Returns whether a segment was cut, so the caller can say so truthfully.
    */
-  async switchModel(next: Provider): Promise<void> {
+  async switchModel(next: Provider): Promise<boolean> {
     if (this.running || this.isHalfRound()) {
       throw new Error(
         "cannot switch models mid-turn: a tool_use is still unpaired. " +
@@ -758,9 +793,12 @@ export class Session {
       );
     }
 
-    await this.performCut("model_checkpoint", next.config.spec.id, undefined, next.config.spec.provider, next.config.effort);
+    const cut = this.state.events.length > 0;
+    if (cut) await this.performCut("model_checkpoint", next.config.spec.id, undefined, next.config.spec.provider, next.config.effort);
+    else this.state.anchor = null;
     this.provider = next;
     await this.saveCursor();
+    return cut;
   }
 
   /** D6: changing the frozen prefix is an explicit checkpoint, never in-place prompt surgery. */
@@ -890,6 +928,7 @@ export class Session {
       updated_at: this.clock.now(),
       workspace: this.config.tools.root,
       context_ref: contextRef ?? await this.persistContext(),
+      xeno_version: XENO_VERSION,
     });
   }
 
@@ -902,6 +941,10 @@ export class Session {
     // D8: runtime callers may retain mutable results. The in-memory projection
     // must own the same JSON value that was appended, independent of later edits.
     event = JSON.parse(JSON.stringify(event)) as LogEvent;
+    // S.9: credentials become placeholders before anything is written, so no
+    // projection, handoff, export or history page can carry the value.
+    const redacted = await this.secrets.redact(event, this.lastAssistantText());
+    event = redacted.event;
     const saved = this.recordTail.then(async () => {
       await appendEvent(this.config.logDir, this.state.node, event);
       this.state.events.push(event);
@@ -913,6 +956,9 @@ export class Session {
     });
     this.recordTail = saved.catch(() => {});
     await saved;
+    if (redacted.added > 0 && !this.state.events.some(item => item.t === "guidance" && item.reason === "secret")) {
+      await this.record({ t: "guidance", id: this.clock.nextId(), at: this.clock.now(), reason: "secret", text: SECRET_GUIDANCE, sources: [event.id] });
+    }
     if (event.t === "tool_result" && event.ok && event.effect?.kind === "read") {
       const path = resolve(this.config.tools.root, event.effect.path);
       const skill = this.config.skills?.find(item => item.filePath === path);
@@ -925,6 +971,19 @@ export class Session {
     }
   }
 
+  /** The text the user is answering, for recognising a solicited credential. */
+  private lastAssistantText(): string | undefined {
+    for (let i = this.state.events.length - 1; i >= 0; i--) {
+      const event = this.state.events[i]!;
+      if (event.t === "user") return undefined;
+      if (event.t === "assistant") {
+        const text = event.blocks.flatMap(block => block.type === "text" ? [block.text] : []).join("\n");
+        if (text.trim()) return text;
+      }
+    }
+    return undefined;
+  }
+
   private allowedNames(): string[] {
     return this.config.frozen.tools.flatMap(tool => tool !== null && typeof tool === "object" && "name" in tool && typeof tool.name === "string" &&
       (this.config.tools.allow === undefined || this.config.tools.allow.includes(tool.name)) ? [tool.name] : []);
@@ -1000,7 +1059,7 @@ export class Session {
 
   private async boundCarried(full: Handoff, tools = this.adviceNames()): Promise<Handoff> {
     return carriedHandoff(this.config.logDir, this.state.node, full, { handoff_tokens: DEFAULT_HANDOFF_TOKENS,
-      ...(this.config.workingSet ? { working_set_version: 2 as const } : {}), guidance_tools: tools });
+      ...(this.config.workingSet ? { working_set_version: CURRENT_WORKING_SET_VERSION } : {}), guidance_tools: tools });
   }
 
   async acceptanceState(): Promise<AcceptanceState | undefined> {
@@ -1256,6 +1315,7 @@ export class Session {
           if (item.value.outcome && item.value.outcome.reason !== "model_end") await this.record({
             t: "outcome", id: this.clock.nextId(), at: this.clock.now(),
             reason: item.value.reason ?? item.value.outcome.reason, outcome: item.value.outcome,
+            ...(item.value.failure ? { failure: item.value.failure } : {}),
           });
           const request = await this.requestState();
           if (request) item.value.request = request;
@@ -1270,9 +1330,14 @@ export class Session {
         yield { kind: "done", reason: "stopped: request ended without a terminal outcome", outcome, ...(request ? { request } : {}) };
       }
     } catch (error) {
-      // Raw provider exceptions can contain credentials; persist only the execution fact.
+      // Raw exceptions can contain credentials; persist the category, never the message.
+      // Only the provider request's own exception is a provider error: this catch
+      // also sees failures in history reads and in the harness itself.
+      const provider = this.providerFailure?.error === error ? this.providerFailure : undefined;
+      const failure = failureCause(error, provider);
       await this.record({ t: "outcome", id: this.clock.nextId(), at: this.clock.now(),
-        reason: "request failed before completion; no complete response was committed", outcome: executionOutcome("provider_error") });
+        reason: `request failed before completion (${describeFailure(failure)}); no complete response was committed`,
+        outcome: executionOutcome(provider ? "provider_error" : "execution_error"), failure });
       throw error;
     } finally {
       // Closing a consumer is not a user cancellation. Preserve the existing
@@ -1404,7 +1469,9 @@ export class Session {
           }
           if (phase === "finalize") {
             yield { kind: "discard" };
-            yield { kind: "done", reason: await report("final response failed; no additional request was made", turn + 1), outcome: executionOutcome("provider_error") };
+            const failure = failureCause(error, this.providerFailure?.error === error ? this.providerFailure : { retries: 0 });
+            yield { kind: "done", reason: await report(`final response failed (${describeFailure(failure)}); no additional request was made`, turn + 1),
+              outcome: executionOutcome("provider_error"), failure };
             return;
           }
           if (!(error instanceof Error) || !isContextOverflow(error.message, statusOf(error))) throw error;
@@ -1737,8 +1804,9 @@ export class Session {
   ): AsyncGenerator<LoopEvent, Turn> {
     const hydrated = await hydrateImages(messages, this.config.blobDir ?? join(this.config.logDir, "blobs"),
       this.provider.config.spec.input?.includes("image") ?? false);
-    return yield* withProgress<Turn, LoopEvent>(emit => this.provider.send(
-      this.config.frozen, hydrated, this.state.node, signal, (delta: StreamDelta): void => {
+    let retries = 0;
+    this.providerFailure = undefined;
+    const progress = (emit: (event: LoopEvent) => void) => (delta: StreamDelta): void => {
       switch (delta.kind) {
         case "text":
           emit({ kind: "text_delta", text: delta.text });
@@ -1749,13 +1817,25 @@ export class Session {
         case "discard":
           emit({ kind: "discard" });
           break;
-        case "tool": case "retry":
+        case "retry":
+          retries = Math.max(retries, delta.attempt);
+          emit({ kind: "progress", progress: delta });
+          break;
+        case "tool":
           emit({ kind: "progress", progress: delta });
           break;
         default:
           return assertNever(delta, "onDelta");
       }
-    }, options));
+    };
+    try {
+      return yield* withProgress<Turn, LoopEvent>(emit => this.provider.send(
+        this.config.frozen, hydrated, this.state.node, signal, progress(emit), options));
+    } catch (error) {
+      // The outcome needs to know this exception came from the request, and after how many retries.
+      this.providerFailure = { error, retries };
+      throw error;
+    }
   }
 
   /**
@@ -1829,7 +1909,10 @@ export class Session {
       let context: ToolContext = { ...this.config.tools, ...(this.readOnlyRequest ? { workflowMode: "plan" as const, planHint: READ_ONLY_HINT } : {}),
         imageStore: this.config.blobDir ?? join(this.config.logDir, "blobs"),
         advice: this.allowedNames(),
-        imageAutoResize: this.config.imageOptions?.autoResize ?? true, ...(signal ? { signal } : {}) };
+        imageAutoResize: this.config.imageOptions?.autoResize ?? true, ...(signal ? { signal } : {}),
+        // feat-approval-events: the broker has already recorded this call's
+        // invocation, and its result comes after execution, so the order is fixed.
+        onApproval: approval => this.record({ t: "approval", id: this.clock.nextId(), at: this.clock.now(), ...approval }) };
       if (native) context = nativeCommandContext(context);
       const decoder = new TextDecoder();
       context.onOutput = chunk => emit({ kind: "progress", progress: { kind: "output", name: call.name, text: decoder.decode(chunk, { stream: true }) } });
@@ -2092,6 +2175,7 @@ export class Session {
     );
     branch.state.node = node;
     branch.state.nextNode = this.state.nextNode;
+    branch.secrets = this.secrets;
     if (skill) await branch.recordSkill(skill, "fork", skillOrigin);
     this.children.set(node, branch);
     yield { kind: "branch_start", node, reason: purpose, at: Date.now() };
@@ -2881,7 +2965,7 @@ export class Session {
         next_thinking: nextThinking,
         ...(nextContextRef === undefined ? {} : { next_context_ref: nextContextRef }),
         handoff_tokens: DEFAULT_HANDOFF_TOKENS,
-        ...(this.config.workingSet ? { working_set_version: 2 as const } : {}),
+        ...(this.config.workingSet ? { working_set_version: CURRENT_WORKING_SET_VERSION } : {}),
         guidance_tools: guidanceTools,
         ...(retainedFrom === undefined ? {} : { retained_from: retainedFrom }),
       });