@zergai/ztc 0.4.0-beta.1 → 0.5.0-beta.1

package/dist/agent/agent.js

@@ -1,38 +1,54 @@
 // Standard library
-import { randomUUID } from 'node:crypto';
-import { existsSync, readFileSync } from 'fs';
-import { extname } from 'path';
+import { createHash, randomUUID } from 'node:crypto';
+import { isDeepStrictEqual } from 'node:util';
+import { existsSync, readFileSync, realpathSync } from 'fs';
+import { extname, resolve } from 'path';
+import { formatTaskHandoffContext, parseTaskHandoffProjection } from '../session_handoff_contract.js';
 import { createBackendForProvider } from './backends/index.js';
 import { mergeTokenUsage } from './backends/token_usage.js';
+import { createUsageSnapshot, mergeUsageSnapshots, parseUsageSnapshot, recordUsageReceipt } from '../usage_snapshot.js';
 import { isTransportCodeError, isTransportMessageError } from './backends/transport_errors.js';
+import { retryAfterDelayMs } from './backends/http_error.js';
 import { inferDefaultProvider, getDefaultApiKeyForProvider, getDefaultModelForProvider } from '../config/defaults.js';
-import { resolveApiRetrySettings } from '../config/api_retry.js';
+import { apiRetryDelayMs, resolveApiRetrySettings } from '../config/api_retry.js';
 import { resolveExecutionSettings } from '../config/execution.js';
 import { createRecoveryGuard } from './runtime/recovery.js';
 import { listCommandJobs, interruptCommandJobs } from './runtime/command_jobs.js';
-import { describeExecutionContext } from './runtime/execution_context.js';
+import { awaitManagedCommandProgress, formatManagedCommandObservations } from './runtime/command_wait.js';
+import { describeExecutionContext, DELETION_EVIDENCE_GUIDANCE } from './runtime/execution_context.js';
 import { scheduleToolBatch, commandStillRunning } from './runtime/tool_scheduler.js';
 import { AllowAllPolicy } from './runtime/policy.js';
 import { NoopTracer } from './runtime/tracing.js';
+import { createDiagnosticSnapshot, mergeDiagnosticSnapshots, parseDiagnosticSnapshot, recordDiagnosticEvent as appendDiagnosticEvent } from '../diagnostics/session_export.js';
+import { getVersion } from '../utils/version.js';
 import { defaultTools as baseDefaultTools } from './tools/registry.js';
 import { toolSearchTool } from './tools/tool_search.js';
 import { recallToolResponseTool } from './tools/recall_tool_response.js';
 import { adaptationRunTool } from './tools/adaptation.js';
 import { getRequestToolDefinitions } from './tools/deferred.js';
 import { getLatestTodos } from './tools/todo.js';
-import { ToolResponseStore, describeOffloadPlaceholderFormat } from './tool_response_store.js';
-import { RequestEncoder } from './request_encoder.js';
+import { ToolResponseStore, ToolResponseIntegrityError, describeOffloadPlaceholderFormat } from './tool_response_store.js';
+import { formatEvidenceContext } from './runtime/evidence.js';
+import { captureNativeReport, NativeObservationLimitError } from './runtime/provider_native_evidence.js';
+import { projectCurrentVerification } from './runtime/source_verification.js';
+import { sessionEvidenceTool } from './tools/session_evidence.js';
+import { MEASUREMENT_EVIDENCE_GUIDANCE } from './measurement_guidance.js';
+import { RequestEncoder, STABLE_RESULT_LIMIT, nativeHistoryContextId } from './request_encoder.js';
 import { parseImageToolResult } from './tool_result_parsing.js';
 import { createRepeatGuard, pinnedTaskSystem } from './loop_policy.js';
 import { extractSourcePath } from './tool_compression.js';
 import { executeToolWithRuntime } from './runtime/tool_runtime.js';
+import { createToolProgressAccumulator } from './runtime/tool_progress.js';
+import { ToolCapability } from './runtime/capabilities.js';
 import { buildUserSubprocessEnv } from '../utils/subprocess_env.js';
 import { resolvePromptPrefixId } from '../utils/compaction.js';
 import { INCOMPLETE_MODEL_RESPONSE_CODE, incompleteModelResponseMessage, isIncompleteModelResponse, } from './completion_state.js';
+import { remoteDeletionReport, NO_VERIFIED_DELETION_REPORT } from './runtime/remote_deletion_receipts.js';
 const defaultTools = [
     ...baseDefaultTools,
     toolSearchTool,
     recallToolResponseTool,
+    sessionEvidenceTool,
     adaptationRunTool,
 ];
 function getTool(name, tools) {
@@ -160,6 +176,8 @@ export class Agent {
     backend;
     policy;
     tracer;
+    diagnostics = createDiagnosticSnapshot();
+    usageSnapshot = createUsageSnapshot();
     streamChunkSize = 32;
     /**
      * True when the last callAPI() consumed the backend's generateStream and
@@ -173,13 +191,134 @@ export class Agent {
     /** Auto-continues spent since the last tool run; reset per turn and per tool. */
     _consecutiveAutoContinues = 0;
     _subprocessEnv;
+    commandPolicy;
     toolEffectObserver;
+    onLocalFileChange;
+    toolCheckpoint;
+    toolCheckpointTail = Promise.resolve();
+    toolCheckpointFailure = null;
+    failedToolCheckpoint = null;
+    nativeEvidencePending = Promise.resolve();
+    nativeEvidenceFailure = null;
+    nativeEvidenceCaptureDepth = 0;
+    // Invocation identity is independent of command text: a fresh call ID is a
+    // new operation, while a recorded ID must never reach dispatch a second time.
+    recordedToolCalls = new Map();
+    remoteResourceSession;
     #conversationBinding;
     // Per-instance offload store + tool-discovery set. Owning these at the Agent
     // level (rather than as module singletons) means subagents get isolated
     // copies — their tool_search discoveries and tool-result writes never leak
     // into the parent's request schemas or tool_responses/ directory.
-    toolResponseStore = new ToolResponseStore();
+    toolResponseStore;
+    evidenceUnsubscribe;
+    getEvidenceSnapshot() {
+        return this.toolResponseStore.evidence.getSnapshot();
+    }
+    getDiagnosticSessionId() { return this.config.sessionId; }
+    getUsageSessionId() { return this.config.sessionId; }
+    getUsageSnapshot() { return structuredClone(this.usageSnapshot); }
+    restoreUsageSnapshot(snapshot) {
+        const admitted = parseUsageSnapshot(snapshot);
+        if (admitted === null)
+            throw new TypeError('Invalid usage snapshot');
+        this.usageSnapshot = mergeUsageSnapshots(admitted, this.usageSnapshot);
+    }
+    retainUsageReceipt(receipt) {
+        this.usageSnapshot = recordUsageReceipt(this.usageSnapshot, receipt);
+        this.emit({ type: 'request_usage', receipt: structuredClone(receipt) });
+    }
+    getDiagnosticSnapshot() { return structuredClone(this.diagnostics); }
+    restoreDiagnosticSnapshot(snapshot) {
+        const admitted = parseDiagnosticSnapshot(snapshot);
+        if (admitted === null)
+            throw new TypeError('Invalid diagnostic snapshot');
+        // Retain both the restored history and this newly constructed runtime epoch.
+        this.diagnostics = mergeDiagnosticSnapshots(admitted, this.diagnostics);
+    }
+    recordDiagnosticEvent(kind, data) {
+        this.diagnostics = appendDiagnosticEvent(this.diagnostics, { id: `diagnostic_${randomUUID()}`,
+            kind, origin: kind === 'provider_response' ? 'provider' : 'host', storedRole: null,
+            timestamp: new Date().toISOString(), data });
+    }
+    /** Persist only factual API metadata, never prompts, credentials, or raw response bodies. */
+    captureDiagnosticTrace(event) {
+        const data = event.data;
+        if (!data)
+            return;
+        if (event.type === 'api_request') {
+            const tools = Array.isArray(data.tools) ? data.tools.flatMap(tool => typeof tool === 'object' && tool !== null && 'name' in tool && typeof tool.name === 'string' ? [tool.name] : []) : [];
+            this.recordDiagnosticEvent('runtime', { phase: 'provider_request',
+                turnId: typeof data.turnId === 'string' ? data.turnId : null,
+                model: typeof data.model === 'string' ? data.model : null,
+                maxTokens: typeof data.maxTokens === 'number' ? data.maxTokens : null, tools });
+        }
+        else if (event.type === 'api_response') {
+            const usage = {};
+            if (typeof data.usage === 'object' && data.usage !== null) {
+                for (const [key, value] of Object.entries(data.usage)) {
+                    if (['inputTokens', 'outputTokens', 'totalTokens', 'cachedInputTokens', 'cacheWriteInputTokens', 'reasoningTokens', 'contextWindow'].includes(key)
+                        && typeof value === 'number' && Number.isFinite(value))
+                        usage[key] = value;
+                    if (key === 'estimated' && typeof value === 'boolean')
+                        usage[key] = value;
+                }
+            }
+            this.recordDiagnosticEvent('provider_response', {
+                turnId: typeof data.turnId === 'string' ? data.turnId : null,
+                model: typeof data.model === 'string' ? data.model : null,
+                provider: this.config.runtimeFacts.provider ?? null,
+                providerStopReason: typeof data.stopReason === 'string' ? data.stopReason : null,
+                stopReasonSource: 'backend_response',
+                usage: data.usage === undefined ? null : usage,
+            });
+        }
+    }
+    toolTraceData(call) {
+        const source = this.getEvidenceSnapshot().records.find(record => record.kind === 'observation' && record.source.toolCallId === call.id);
+        return { tool: call.name, toolCallId: call.id, args: structuredClone(call.args), status: call.status,
+            startedAt: call.startedAt?.toISOString() ?? null, completedAt: call.completedAt?.toISOString() ?? null,
+            ...(source?.kind === 'observation' ? { resultReference: { observationId: source.id,
+                    sha256: source.resultSha256, bytes: source.resultBytes, partial: source.partial,
+                    availability: source.availability }, job: source.source.job ?? null } : {}) };
+    }
+    /** Fresh applicability is a projection; original process/source observations remain immutable. */
+    async refreshVerificationCoverage() {
+        const latest = new Map();
+        for (const record of this.getEvidenceSnapshot().records) {
+            if (record.source.verification) {
+                latest.delete(record.source.verification.receipt_id);
+                latest.set(record.source.verification.receipt_id, record.source.verification);
+            }
+        }
+        if (!latest.size)
+            return;
+        const receipts = [...latest.values()].reverse();
+        const selected = [...receipts.filter(receipt => receipt.process_outcome === 'running'),
+            ...receipts.filter(receipt => receipt.process_outcome !== 'running').slice(0, 8)];
+        const coverage = [];
+        for (const receipt of selected) {
+            let admitted = !this.remoteResourceSession && receipt.source.origin === 'local';
+            if (admitted) {
+                try {
+                    admitted = realpathSync(this._cwd) === receipt.source.cwd;
+                }
+                catch {
+                    admitted = false;
+                }
+            }
+            if (admitted)
+                admitted = receipt.source.files.every(file => this.policy.evaluateTool({ name: 'read_file',
+                    args: { path: resolve(receipt.source.cwd, file.path) }, capabilities: [ToolCapability.FILE_READ] }).allowed);
+            coverage.push(admitted ? await projectCurrentVerification(receipt) : {
+                receipt_id: receipt.receipt_id, checked_at: new Date().toISOString(), source_id: null, applicability: 'unknown',
+                reason: 'The current host, working directory or file policy does not admit a fresh check of this source.',
+            });
+        }
+        const retained = new Set(this.getEvidenceSnapshot().records.flatMap(record => record.source.verification
+            ? [record.source.verification.receipt_id] : []));
+        this.toolResponseStore.evidence.setVerificationCoverage(coverage.filter(row => retained.has(row.receipt_id)));
+    }
     discoveredTools = new Set();
     // Host-injected agent-domain tools that ship every request regardless of the
     // deferred-tool registry. Unlike discoveredTools (session-scoped, cleared on
@@ -192,6 +331,7 @@ export class Agent {
     _hasCustomSystemPrompt;
     _authenticationManagedByBackend;
     constructor(config = {}) {
+        this.toolResponseStore = config.toolResponseStore ?? new ToolResponseStore();
         const ambientDiscovery = config.ambientDiscovery ?? true;
         const defaultProvider = ambientDiscovery ? inferDefaultProvider() : 'anthropic';
         const defaultModel = getDefaultModelForProvider(defaultProvider);
@@ -204,6 +344,7 @@ export class Agent {
             apiKey,
             apiEndpoint: config.apiEndpoint,
         });
+        const tools = config.tools ?? (ambientDiscovery ? defaultTools : []);
         this.config = {
             model: config.model || defaultModel,
             apiKey,
@@ -218,8 +359,8 @@ export class Agent {
             runtimeFacts: config.runtimeFacts ?? {},
             apiRetry: resolveApiRetrySettings({ apiRetry: config.apiRetry }),
             llmRequestTimeoutMs: resolveLlmRequestTimeoutMs(config.llmRequestTimeoutMs, config.apiRetry?.requestTimeoutMs),
-            tools: config.tools || (ambientDiscovery ? defaultTools : []),
-            systemPrompt: config.systemPrompt || this.getDefaultSystemPrompt(),
+            tools,
+            systemPrompt: config.systemPrompt || this.getDefaultSystemPrompt(tools),
             backend,
             ambientDiscovery,
             policy: config.policy || new AllowAllPolicy(),
@@ -233,7 +374,11 @@ export class Agent {
         this._subprocessEnv = config.subprocessEnv === undefined
             ? undefined
             : buildUserSubprocessEnv(config.subprocessEnv);
+        this.commandPolicy = config.commandPolicy === undefined ? undefined : structuredClone(config.commandPolicy);
         this.toolEffectObserver = config.toolEffectObserver;
+        this.onLocalFileChange = config.onLocalFileChange;
+        this.toolCheckpoint = config.toolCheckpoint;
+        this.remoteResourceSession = config.remoteResourceSession;
         this.#conversationBinding = config.conversationBinding;
         // Host-injected agent-domain tools always ship their schema (they're the
         // agent's primary surface, not a corpus to search). Kept separate from
@@ -242,8 +387,16 @@ export class Agent {
             this.alwaysLoadedToolNames.add(name);
         }
         this.backend = this.config.backend;
+        if (this.backend.getModelCapabilities?.(this.config.model)?.tools === false) {
+            this.config.tools = [];
+            this.config.autoContinue = false;
+        }
         this.policy = this.config.policy;
-        this.tracer = this.config.tracer;
+        const suppliedTracer = this.config.tracer;
+        this.tracer = { event: event => {
+                this.captureDiagnosticTrace(event);
+                suppliedTracer.event(event);
+            } };
         this._cwd = this.config.cwd;
         this._autoContinue = this.config.autoContinue;
         this.hooks = config.hooks;
@@ -255,9 +408,25 @@ export class Agent {
         this._codexEffort = config.codexEffort;
         this._codexFastMode = config.codexFastMode ?? false;
         this._hasCustomSystemPrompt = typeof config.systemPrompt === 'string' && config.systemPrompt.trim().length > 0;
+        this.evidenceUnsubscribe = this.toolResponseStore.evidence.onChange(() => {
+            if (this.nativeEvidenceCaptureDepth > 0)
+                return;
+            this.emit({ type: 'evidence', sessionId: this.config.sessionId, snapshot: this.getEvidenceSnapshot() });
+        });
+        const version = getVersion();
+        this.recordDiagnosticEvent('runtime', { phase: 'agent_constructed',
+            version: version === '0.0.0' ? null : version,
+            provider: this.config.runtimeFacts.provider ?? null, model: this.config.model,
+            mode: this.config.runtimeFacts.mode ?? null, mux: this.config.runtimeFacts.mux ?? null,
+            configuredTools: this.getConfiguredToolNames(),
+            runtimeCredentialsAvailable: this.config.runtimeCredentialsAvailable,
+            backendAuthenticationConfigured: this._authenticationManagedByBackend,
+            llmRequestTimeoutMs: this.config.llmRequestTimeoutMs,
+            execution: { ...this.config.execution },
+        });
     }
     setAutoContinue(enabled) {
-        this._autoContinue = enabled;
+        this._autoContinue = enabled && this.backend.getModelCapabilities?.(this.config.model)?.tools !== false;
     }
     /** Override the agent's system prompt (e.g., for simulation persona injection). */
     setSystemPrompt(prompt) {
@@ -271,7 +440,7 @@ export class Agent {
     refreshSystemPrompt() {
         if (this._hasCustomSystemPrompt)
             return;
-        this.config.systemPrompt = this.getDefaultSystemPrompt();
+        this.config.systemPrompt = this.getDefaultSystemPrompt(this.config.tools);
     }
     getAutoContinue() {
         return this._autoContinue;
@@ -319,12 +488,12 @@ export class Agent {
     getConfiguredToolNames() {
         return this.config.tools.map((tool) => tool.definition.name);
     }
-    getDefaultSystemPrompt() {
+    getDefaultSystemPrompt(tools) {
         const offloadEnabled = this.toolResponseStore.getConfig().offloadEnabled;
         const offloadSection = offloadEnabled
             ? `\nTool results older than a handful of turns or larger than ~2k tokens appear as offload placeholders (e.g. \`${describeOffloadPlaceholderFormat()}\`). Full content is stored on disk per-session; call \`recall_tool_response\` with the \`tool_use_id\` to retrieve it.
 
-Recall is one-shot per session: each \`tool_use_id\` should be recalled at most once. After you recall it, the original tool_result above will show the full content again as long as the inline budget permits. If you call recall again on an id that was already recalled, you will receive a no-op acknowledgement — read the original tool_result block instead. If a placeholder is followed by \`First lines:\` / \`Last lines:\` previews, you can often answer from those without recalling.\n`
+Recall returns bounded source bytes with \`cursor\`, \`nextCursor\`, and \`complete\`; repeat at \`nextCursor\` until the needed source is available. An acknowledgement is used only for a small result whose exact full bytes are already visible. Large original results may remain historical previews, so read the returned recall content. If a placeholder is followed by \`First lines:\` / \`Last lines:\` previews, you can often answer from those without recalling.\n`
             : '';
         return `You are ZTC (Zerg Terminal Client), an AI assistant that helps users interact with the Zerg continual AI system and manage local development tasks.
 
@@ -348,9 +517,9 @@ ${offloadSection}
 INVESTIGATION STRATEGY — before making tool calls to explore or debug, follow this sequence:
 1. State your hypothesis: what do you think is happening and why? Which files or functions are involved?
 2. Plan your reads: identify the specific locations you need to check. Prefer one larger read (100–200 lines) over many small 20-line windows — fewer tool calls, more context per call.
-3. Read, then extract: after reading a file, state the key findings in your response text before moving on. Your own text persists in context even when tool results age out — treat your written analysis as your working memory.
+3. Read, then extract: distinguish captured observations from your interpretation. Use session_evidence to discover source IDs and record hypotheses/conclusions; corrections require supporting evidence and an explicit supersedes link. Assistant prose never replaces a tool outcome or grants user authorization. Recall the original source when a summary conflicts with it; missing evidence remains unknown.
 4. Verify before acting: trace the full chain (caller → function → side effects → re-render) in one pass before proposing a fix. Jumping between scattered reads wastes rounds.
-5. Never re-read a file section you already read in this session unless the file was modified since. If you need data from a prior read, check your earlier analysis first.`;
+5. Never re-read a file section you already read in this session unless the file was modified since. If you need data from a prior read, check your earlier analysis first.\n\n${DELETION_EVIDENCE_GUIDANCE}${tools.some(tool => tool.definition.name === 'measurement_report') ? `\n\n${MEASUREMENT_EVIDENCE_GUIDANCE}` : ''}`;
     }
     // Event handling
     on(handler) {
@@ -362,6 +531,28 @@ INVESTIGATION STRATEGY — before making tool calls to explore or debug, follow
             handler(event);
         }
     }
+    toolOutputObserver(toolCall, signal) {
+        const progress = createToolProgressAccumulator(toolCall.startedAt.getTime(), snapshot => {
+            if (signal?.aborted || toolCall.status !== 'running')
+                return;
+            const event = { type: 'tool_progress', toolCallId: toolCall.id, tool: toolCall.name, progress: snapshot };
+            // A failed display subscriber must neither fail the admitted tool nor
+            // prevent another subscriber from observing its informational output.
+            for (const handler of this.eventHandlers) {
+                try {
+                    handler(event);
+                }
+                catch { /* informational observer only */ }
+            }
+        });
+        return {
+            onOutput: (stream, chunk) => {
+                if (!signal?.aborted && toolCall.status === 'running')
+                    progress.onOutput(stream, chunk);
+            },
+            close: progress.close,
+        };
+    }
     nextToolEventId() {
         this.toolEventSequence += 1;
         return `tool_${this.toolEventSequence}`;
@@ -381,6 +572,7 @@ INVESTIGATION STRATEGY — before making tool calls to explore or debug, follow
     // confusing reversal). We subtract this from the emitted context so the bar
     // tracks durable context and only moves backward on a real reset/compaction.
     _currentTransientOverageTokens = 0;
+    _nativeContextId;
     formatMessages(messages) {
         // Pre-pass: collect every tool_use_id appearing in tool_result messages,
         // and remember the LAST batch (treated as current turn). Running the
@@ -409,17 +601,26 @@ INVESTIGATION STRATEGY — before making tool calls to explore or debug, follow
         this._currentRequestToolIds = currentTurnToolIds;
         if (allToolIds.length > 0) {
             const activeModel = this.config.model || 'default';
-            const budget = this.toolResponseStore.effectiveBudget(activeModel);
+            const budget = this.toolResponseStore.effectiveBudget(activeModel, this.backend.getModelCapabilities?.(activeModel) ? this.backend.getModelCapabilities(activeModel)?.context_window ?? null : undefined);
             this._selectorVerdict = this.toolResponseStore.selectInlineSet(allToolIds, currentTurnToolIds, budget);
         }
         else {
             this._selectorVerdict = null;
+            this.toolResponseStore.selectInlineSet([], new Set(), 0);
         }
         // The role filter, per-message content encoding, and same-role merge live in
         // RequestEncoder (provider-neutral, shared shape). The selector verdict +
         // current-turn ids computed above are injected; the transient-overage count
         // comes back as an explicit return instead of a hidden field mutation.
-        const { messages: encoded, transientOverageTokens } = new RequestEncoder(this._encodeDeps()).encode(messages);
+        // Preserve opaque provider context through saved history without placing it
+        // in the display-only reasoningContent field. Copies are wire-only.
+        const wireMessages = messages.map(message => {
+            const providerReasoning = message.metadata?.providerReasoning;
+            return message.role === 'assistant' && typeof providerReasoning === 'string'
+                ? { ...message, metadata: { ...message.metadata, reasoningContent: providerReasoning } }
+                : message;
+        });
+        const { messages: encoded, transientOverageTokens } = new RequestEncoder(this._encodeDeps()).encode(wireMessages);
         this._currentTransientOverageTokens = transientOverageTokens;
         return encoded;
     }
@@ -428,6 +629,9 @@ INVESTIGATION STRATEGY — before making tool calls to explore or debug, follow
     // buildContentBlocks pipeline entry point below.
     _encodeDeps() {
         return {
+            preserveNativeHistory: this.backend.preservesNativeHistory,
+            model: this.config.model,
+            nativeContextId: this._nativeContextId,
             selectorVerdict: this._selectorVerdict,
             currentTurnToolIds: this._currentRequestToolIds,
             renderForContext: (id) => this.toolResponseStore.renderForContext(id),
@@ -635,7 +839,7 @@ INVESTIGATION STRATEGY — before making tool calls to explore or debug, follow
             }
             const missingBeforeStrip = activeToolCalls.filter(tc => !resultIds.has(tc.id));
             const hasStoredResults = missingBeforeStrip.some(tc => Boolean(tc.error) || (tc.result !== undefined && tc.result !== null));
-            const stripIds = new Set(hasRoleToolEvidence && !hasStoredResults
+            const stripIds = new Set(hasRoleToolEvidence && !hasStoredResults && msg.metadata?.toolCheckpoint !== true
                 ? missingBeforeStrip.map(tc => tc.id)
                 : []);
             const keptToolCalls = activeToolCalls.filter(tc => !stripIds.has(tc.id));
@@ -671,7 +875,7 @@ INVESTIGATION STRATEGY — before making tool calls to explore or debug, follow
                     content = tc.result;
                 }
                 else {
-                    content = 'Error: Tool execution was interrupted. Please retry.';
+                    content = 'Tool outcome unknown: the original result was not durably observed. Inspect this exact call and its existing receipts/current state before deciding whether to retry. Do not automatically repeat the original command; local interruption does not prove that an external operation stopped.';
                 }
                 if (content.length > SYNTH_RESULT_CAP) {
                     content = content.slice(0, SYNTH_RESULT_CAP) + `\n[truncated — ${content.length} chars total]`;
@@ -695,6 +899,14 @@ INVESTIGATION STRATEGY — before making tool calls to explore or debug, follow
         return repaired;
     }
     buildRequest(messages, availableTools = this.config.tools) {
+        this.captureUserInstructions(messages);
+        const evidence = formatEvidenceContext(this.getEvidenceSnapshot());
+        const evidenceTurn = [...messages].reverse().find(message => message.role === 'user');
+        // Stamp each source turn once. Render the host index next to that turn
+        // without changing its text, the system prefix or prior request records.
+        if (evidence && evidenceTurn && typeof evidenceTurn.metadata?.evidenceContext !== 'string') {
+            evidenceTurn.metadata = { ...evidenceTurn.metadata, evidenceContext: evidence };
+        }
         // Repair any orphaned tool_use blocks before building request
         if (this.config.pinTaskHeader) {
             const facts = describeExecutionContext({ ...this.getExecutionContext(), tools: availableTools.map(tool => tool.definition.name) });
@@ -705,22 +917,70 @@ INVESTIGATION STRATEGY — before making tool calls to explore or debug, follow
                     latestUser.metadata = { ...latestUser.metadata, executionContext: facts };
             }
         }
+        const currentCoverage = this.getEvidenceSnapshot().verificationCoverage;
+        if (currentCoverage?.length && evidenceTurn) {
+            const rows = [];
+            let remaining = 12 * 1024 - 512;
+            for (const projection of currentCoverage) {
+                const row = JSON.stringify(projection);
+                const size = Buffer.byteLength(row) + 1;
+                if (size > remaining)
+                    continue;
+                rows.push(row);
+                remaining -= size;
+            }
+            evidenceTurn.metadata = { ...evidenceTurn.metadata,
+                verificationContext: '[Current source applicability — host observations]\n' + rows.join('\n')
+                    + `\n${currentCoverage.length - rows.length} additional applicability checks omitted. Checks are scoped and as-of checked_at. Historical process outcomes and declared purposes do not qualify edited source; matching endpoints do not prove immutable inputs. Qualification remains unverified.`,
+            };
+        }
         const repairedMessages = this.repairConversationHistory(messages);
         // Facts are attached to the user/tool-result turn that observed them. Keep
         // earlier snapshots immutable so provider threads can reuse their prefix.
-        const contextMessages = this.config.pinTaskHeader ? repairedMessages.flatMap(message => {
-            const facts = message.metadata?.executionContext;
-            return typeof facts === 'string' ? [message, {
-                    id: `${message.id}_execution`, role: 'user', content: facts, timestamp: message.timestamp,
-                    metadata: { synthetic: true },
-                }] : [message];
-        }) : repairedMessages;
+        const contextMessages = repairedMessages.flatMap(message => {
+            const facts = this.config.pinTaskHeader ? message.metadata?.executionContext : undefined;
+            const observations = message.metadata?.evidenceContext;
+            const applicability = message.metadata?.verificationContext;
+            return [message, ...(typeof facts === 'string' ? [{
+                        id: `${message.id}_execution`, role: 'user', content: facts, timestamp: message.timestamp,
+                        metadata: { synthetic: true, hostContext: true },
+                    }] : []), ...(typeof observations === 'string' ? [{
+                        id: `${message.id}_evidence`, role: 'user', content: observations, timestamp: message.timestamp,
+                        metadata: { synthetic: true, hostContext: true },
+                    }] : []), ...(typeof applicability === 'string' ? [{
+                        id: `${message.id}_verification`, role: 'user', content: applicability, timestamp: message.timestamp,
+                        metadata: { synthetic: true, hostContext: true },
+                    }] : [])];
+        });
+        if (this.config.pinTaskHeader && this.taskHandoff) {
+            const snapshot = this.taskHandoff.snapshot;
+            // Saved user/tool text retains conversation priority, alongside the other
+            // host observations, without changing a hosted thread's base instructions.
+            let currentUserIndex = contextMessages.length - 1;
+            for (; currentUserIndex >= 0; currentUserIndex--) {
+                const message = contextMessages[currentUserIndex];
+                if (message.role === 'user' && !message.metadata?.synthetic && !message.metadata?.hostContext
+                    && !message.metadata?.toolResult && !message.metadata?.compactionSummary)
+                    break;
+            }
+            // Historical context belongs before the current instruction. Never split
+            // an assistant/tool-result pair or replace the request tail with history.
+            contextMessages.splice(currentUserIndex < 0 ? 0 : currentUserIndex, 0, {
+                id: `handoff_${snapshot.source.sessionId}_${snapshot.revision}`,
+                role: 'user', content: formatTaskHandoffContext(snapshot),
+                timestamp: new Date(snapshot.source.capturedAt),
+                metadata: { synthetic: true, hostContext: true, preserveUserBoundary: true }
+            });
+        }
+        const system = this.systemWithTaskHeader(messages);
+        const tools = getRequestToolDefinitions(availableTools, this.discoveredTools, this.config.deferToolSchemas !== false, this.alwaysLoadedToolNames);
+        this._nativeContextId = this.backend.preservesNativeHistory ? nativeHistoryContextId(system, tools) : undefined;
         return {
             model: this.config.model,
             maxTokens: this.config.maxTokens,
-            system: this.systemWithTaskHeader(messages),
+            system,
             messages: this.formatMessages(contextMessages),
-            tools: getRequestToolDefinitions(availableTools, this.discoveredTools, this.config.deferToolSchemas !== false, this.alwaysLoadedToolNames),
+            tools,
             // A container pin identifies a cached prompt prefix, so the transport has to
             // know when this conversation is no longer sending the prefix its container
             // was warmed for. That is compaction, and only this layer can see it.
@@ -779,12 +1039,16 @@ INVESTIGATION STRATEGY — before making tool calls to explore or debug, follow
      * visible text, so an empty or whitespace-only response emits no stream
      * events (EPO-622), matching emitStreamText.
      */
-    async streamAndAssemble(request, signal, onAnswerOutput) {
+    async streamAndAssemble(request, signal, onAnswerOutput, onUsage) {
         let text = '';
         let reasoning = '';
         const toolUses = [];
+        const nativeContent = [];
         let usage;
+        let reportedUsage;
+        let costUsd;
         let stopReason = 'end_turn';
+        let stopDetails;
         let streamOpen = false;
         // Text that arrived but is still whitespace only. Providers open a turn
         // this way — DeepSeek streams "\n\n" before its tool calls — and each delta
@@ -802,14 +1066,22 @@ INVESTIGATION STRATEGY — before making tool calls to explore or debug, follow
                 switch (ev.type) {
                     case 'heartbeat':
                         break;
+                    case 'content_block':
+                        nativeContent.push(ev.block);
+                        break;
                     case 'reasoning_delta':
                         if (ev.text) {
                             reasoning += ev.text;
-                            this.emit({ type: 'reasoning_delta', content: ev.text });
+                            if (!this.remoteResourceSession)
+                                this.emit({ type: 'reasoning_delta', content: ev.text });
                         }
                         break;
                     case 'text_delta':
                         if (ev.text) {
+                            if (this.remoteResourceSession) {
+                                text += ev.text;
+                                break;
+                            }
                             if (streamOpen) {
                                 text += ev.text;
                                 onAnswerOutput();
@@ -849,11 +1121,31 @@ INVESTIGATION STRATEGY — before making tool calls to explore or debug, follow
                     }
                     case 'tool_use_end':
                         break;
-                    case 'usage':
+                    case 'usage': {
                         usage = ev.usage;
+                        // Usage snapshots are cumulative for this request. Report increments
+                        // as they arrive so cancellation cannot discard already billed work.
+                        onUsage?.({
+                            ...usage,
+                            inputTokens: Math.max(0, usage.inputTokens - (reportedUsage?.inputTokens ?? 0)),
+                            outputTokens: Math.max(0, usage.outputTokens - (reportedUsage?.outputTokens ?? 0)),
+                            totalTokens: Math.max(0, usage.totalTokens - (reportedUsage?.totalTokens ?? 0)),
+                        });
+                        reportedUsage = {
+                            ...usage,
+                            inputTokens: Math.max(usage.inputTokens, reportedUsage?.inputTokens ?? 0),
+                            outputTokens: Math.max(usage.outputTokens, reportedUsage?.outputTokens ?? 0),
+                            totalTokens: Math.max(usage.totalTokens, reportedUsage?.totalTokens ?? 0),
+                        };
+                        break;
+                    }
+                    case 'cost':
+                        if (Number.isFinite(ev.costUsd) && ev.costUsd >= 0)
+                            costUsd = ev.costUsd;
                         break;
                     case 'done':
                         stopReason = ev.stopReason;
+                        stopDetails = ev.stopDetails;
                         break;
                 }
             }
@@ -879,7 +1171,9 @@ INVESTIGATION STRATEGY — before making tool calls to explore or debug, follow
             }
             content.push({ type: 'tool_use', id: tu.id, name: tu.name, input });
         }
-        return { content, stopReason, reasoning: reasoning || undefined, usage };
+        return { content: nativeContent.length > 0 ? nativeContent : content, stopReason,
+            ...(stopDetails ? { stopDetails } : {}), reasoning: reasoning || undefined, usage,
+            ...(costUsd === undefined ? {} : { costUsd }) };
     }
     emitReasoningText(text) {
         if (!text || !text.trim()) {
@@ -894,7 +1188,28 @@ INVESTIGATION STRATEGY — before making tool calls to explore or debug, follow
      * Server). The action has already run, so a command emits tool_start
      * immediately followed by tool_end.
      */
-    emitObservation(observation) {
+    async emitObservation(observation, nativeTurnId, canPublish) {
+        // Provider observations have no host-managed operation receipt.
+        if (this.remoteResourceSession)
+            return;
+        if (observation.kind !== 'reasoning') {
+            const captured = captureNativeReport(observation, { provider: this.config.runtimeFacts.provider ?? 'unknown-provider', turnId: nativeTurnId });
+            if (!captured)
+                return;
+            this.nativeEvidenceCaptureDepth++;
+            try {
+                this.toolResponseStore.put(captured.handle, `provider_${observation.kind}`, captured.content, captured.partial, { source: captured.source, isError: captured.isError });
+                await this.toolResponseStore.flush();
+            }
+            finally {
+                this.nativeEvidenceCaptureDepth--;
+            }
+            this.emit({ type: 'evidence', sessionId: this.config.sessionId, snapshot: this.getEvidenceSnapshot() });
+        }
+        // Retain admitted original source facts even when persistence finishes
+        // after cancellation; visible progress belongs to its producing request.
+        if (!canPublish())
+            return;
         switch (observation.kind) {
             case 'reasoning':
                 this.emitReasoningText(observation.text);
@@ -944,6 +1259,17 @@ INVESTIGATION STRATEGY — before making tool calls to explore or debug, follow
      * genuinely multi-task long-lived agents is deferred (plan A10).
      */
     _taskHeader = null;
+    taskHandoff = null;
+    /** Only a host-selected checkpoint may supply historical task context. */
+    setTaskHandoff(projection) {
+        const admitted = projection === null ? null : parseTaskHandoffProjection(projection);
+        if (projection !== null && !admitted)
+            throw new TypeError('Invalid task handoff projection');
+        if (admitted && this.config.sessionId && admitted.snapshot.source.sessionId !== this.config.sessionId) {
+            throw new TypeError('Task handoff belongs to a different selected session');
+        }
+        this.taskHandoff = admitted;
+    }
     /**
      * Drop the explicitly pinned task for the next conversation. Wired into the /clear-only path (clearTransientState), never into
      * /compact — the pin must survive compaction (that is the whole point of R7).
@@ -971,6 +1297,10 @@ INVESTIGATION STRATEGY — before making tool calls to explore or debug, follow
     /** Append the pinned task header (R7) to the static system prompt. */
     getExecutionContext() {
         return {
+            permissions: this.config.runtimeFacts.permissions,
+            ...(this.remoteResourceSession ? { remoteResourceGuard: {
+                    ownerId: this.remoteResourceSession.ownerId, resources: this.remoteResourceSession.resources.map(resource => resource.id),
+                } } : {}),
             mode: this.config.runtimeFacts.mode ?? 'normal', cwd: this._cwd,
             tools: this.getConfiguredToolNames(), mux: this.config.runtimeFacts.mux ?? false,
             configScope: this.config.runtimeFacts.configScope ?? 'host configuration',
@@ -985,26 +1315,114 @@ INVESTIGATION STRATEGY — before making tool calls to explore or debug, follow
             return this.config.systemPrompt;
         return pinnedTaskSystem(this.config.systemPrompt, this._taskHeader);
     }
-    /**
-     * Execute one terminal turn. A host binding makes the remote conversation the
-     * authoritative history and mirrors the accepted user/assistant pair around
-     * the same core loop used by unhosted ZTC.
-     */
-    async run(messages, signal, takeSteering) {
+    async persistToolCheckpoint(phase, toolCallId, messages, handler = this.toolCheckpoint) {
+        if (this.toolCheckpointFailure)
+            throw this.toolCheckpointFailure;
+        if (!handler) {
+            if (phase === 'terminal')
+                await this.toolResponseStore.flush();
+            return;
+        }
+        // Capture at enqueue time: a later sibling completion or a host retaining
+        // this payload cannot rewrite the arguments admitted for this invocation.
+        const checkpoint = { sessionId: this.config.sessionId || 'ztc-session', phase,
+            toolCallId, messages: structuredClone(messages) };
+        const pending = this.toolCheckpointTail.then(async () => {
+            if (this.toolCheckpointFailure)
+                throw this.toolCheckpointFailure;
+            try {
+                if (phase === 'terminal')
+                    await this.toolResponseStore.flush();
+                await handler(structuredClone(checkpoint));
+            }
+            catch (error) {
+                this.failedToolCheckpoint = { checkpoint, handler };
+                this.toolCheckpointFailure = this.checkpointPersistenceError(checkpoint, error);
+                throw this.toolCheckpointFailure;
+            }
+        });
+        this.toolCheckpointTail = pending.catch(() => { });
+        await pending;
+    }
+    checkpointPersistenceError(checkpoint, error) {
+        return new AgentError(`Unable to persist ${checkpoint.phase === 'terminal' ? 'terminal outcome' : 'call intent'} checkpoint for ${checkpoint.toolCallId}: ${error instanceof Error ? error.message : String(error)}. Stop this turn and inspect the original checkpoint and existing receipts before deciding whether to repeat any work.`, 'TOOL_CHECKPOINT_FAILED');
+    }
+    /** Retry persistence only, before a new public invocation can admit effects. */
+    async recoverToolCheckpoint() {
+        await this.toolCheckpointTail;
+        if (!this.toolCheckpointFailure)
+            return;
+        const failed = this.failedToolCheckpoint;
+        if (!failed)
+            throw this.toolCheckpointFailure;
+        const pending = this.toolCheckpointTail.then(async () => {
+            // Another entrant can have repaired this exact record while we queued.
+            if (this.failedToolCheckpoint !== failed)
+                return;
+            try {
+                if (failed.checkpoint.phase === 'terminal')
+                    await this.toolResponseStore.flush();
+                await failed.handler(structuredClone(failed.checkpoint));
+                this.failedToolCheckpoint = null;
+                this.toolCheckpointFailure = null;
+            }
+            catch (error) {
+                this.toolCheckpointFailure = this.checkpointPersistenceError(failed.checkpoint, error);
+                throw this.toolCheckpointFailure;
+            }
+        });
+        this.toolCheckpointTail = pending.catch(() => { });
+        await pending;
+    }
+    /** Execute a host-bound or standalone turn through the same core loop. */
+    async run(messages, signal, takeSteering, toolCheckpoint = this.toolCheckpoint, steeringAdmission, onUsage) {
+        const diagnosticTurn = { id: `turn_${randomUUID()}`, iterations: 0 };
+        let result;
+        let failure;
         const onInterrupt = () => { if (this.config.execution.interruptBackgroundJobs)
             void interruptCommandJobs(this.config.sessionId); };
         signal?.addEventListener('abort', onInterrupt, { once: true });
         try {
-            return await this.runBound(messages, signal, takeSteering);
+            await this.recoverToolCheckpoint();
+            await this.nativeEvidencePending;
+            if (this.nativeEvidenceFailure)
+                throw this.nativeEvidenceFailure;
+            result = await this.runBound(messages, signal, takeSteering, toolCheckpoint, steeringAdmission, diagnosticTurn, onUsage);
+            return result;
+        }
+        catch (error) {
+            failure = error;
+            throw error;
         }
         finally {
             signal?.removeEventListener('abort', onInterrupt);
+            try {
+                await this.nativeEvidencePending;
+                if (this.nativeEvidenceFailure)
+                    throw this.nativeEvidenceFailure;
+                await this.toolResponseStore.flush();
+            }
+            catch (error) {
+                failure = error;
+                throw error;
+            }
+            finally {
+                const errorCode = failure instanceof AgentError ? failure.code ?? null : null;
+                const reason = failure !== undefined
+                    ? signal?.aborted || errorCode === 'CANCELLED' ? 'cancelled' : 'error'
+                    : result?.stopReason ?? 'error';
+                const data = { reason, errorCode, iterations: diagnosticTurn.iterations };
+                // This outcome belongs to the invocation, even after a UI cancels its
+                // event subscription or a hosted driver fails before the model loop.
+                this.recordDiagnosticEvent('turn_end', { ...data, turnId: diagnosticTurn.id });
+                this.tracer.event({ type: 'turn_end', timestamp: new Date(), data });
+            }
         }
     }
-    async runBound(messages, signal, takeSteering) {
+    async runBound(messages, signal, takeSteering, toolCheckpoint = this.toolCheckpoint, steeringAdmission, diagnosticTurn, onUsage) {
         const binding = this.#conversationBinding;
         if (!binding)
-            return this.runCore(messages, signal, takeSteering);
+            return this.runCore(messages, signal, takeSteering, toolCheckpoint, steeringAdmission, diagnosticTurn, onUsage);
         const userMessage = [...messages].reverse().find((message) => message.role === 'user'
             && !message.metadata?.synthetic
             && !message.metadata?.toolResult);
@@ -1036,14 +1454,15 @@ INVESTIGATION STRATEGY — before making tool calls to explore or debug, follow
             // The host driver publishes only the initial user and final assistant
             // for this turn. Leave busy input pending for a new hosted turn so the
             // authoritative conversation cannot silently omit it.
-            const result = await this.runCore(workingMessages, signal);
+            const result = await this.runCore(workingMessages, signal, undefined, toolCheckpoint, undefined, diagnosticTurn, onUsage);
             const assistantMessage = {
                 id: `host_assistant_${randomUUID()}`,
                 role: 'assistant',
                 content: result.content,
+                ...(result.nativeContent ? { nativeContent: result.nativeContent, nativeModel: result.nativeModel, nativeContextId: result.nativeContextId } : {}),
                 timestamp: new Date(),
                 ...(result.toolCalls.length > 0 ? { toolCalls: result.toolCalls } : {}),
-                ...(result.reasoning ? { metadata: { reasoningContent: result.reasoning } } : {}),
+                metadata: { ...(this.config.runtimeFacts.mode === 'plan' ? { planMode: true } : {}), ...(result.reasoning ? { reasoningContent: result.reasoning } : {}) },
             };
             const receipt = await binding.driver.publish({
                 turn,
@@ -1082,10 +1501,18 @@ INVESTIGATION STRATEGY — before making tool calls to explore or debug, follow
         }
     }
     // Main execution loop shared by hosted and standalone turns.
-    async runCore(messages, signal, takeSteering) {
+    async runCore(messages, signal, takeSteering, toolCheckpoint = this.toolCheckpoint, steeringAdmission, diagnosticTurn, onUsage) {
         if (!this.hasApiKey()) {
             throw new AgentError('No API key configured. Use /config key <key> to set one.', 'NO_API_KEY');
         }
+        for (const message of messages) {
+            if (message.role !== 'assistant')
+                continue;
+            for (const call of message.toolCalls ?? []) {
+                if (!this.recordedToolCalls.has(call.id))
+                    this.recordedToolCalls.set(call.id, structuredClone(call));
+            }
+        }
         const allToolCalls = [];
         const turnMessages = [];
         let iterations = 0;
@@ -1098,6 +1525,7 @@ INVESTIGATION STRATEGY — before making tool calls to explore or debug, follow
         // "as-is, including any reasoning_content"; without this the trace survives
         // only inside one run() and every later user turn sends a stripped history.
         let finalReasoning;
+        let finalNativeContent;
         let lastToolTurnText = '';
         let totalUsage = null;
         let runError = null;
@@ -1118,11 +1546,14 @@ INVESTIGATION STRATEGY — before making tool calls to explore or debug, follow
                     throw new AgentError('Cancelled', 'CANCELLED');
                 }
                 iterations++;
+                if (diagnosticTurn)
+                    diagnosticTurn.iterations = iterations;
                 this.emit({ type: 'thinking_start' });
                 try {
                     // Call the API
                     const availability = await Promise.all(this.config.tools.map(tool => tool.isAvailable?.({ cwd: this._cwd }) ?? true));
                     const availableTools = this.config.tools.filter((_tool, index) => availability[index]);
+                    await this.refreshVerificationCoverage();
                     const request = this.buildRequest(messages, availableTools);
                     request.signal = signal;
                     request.onMetrics = metrics => {
@@ -1131,9 +1562,55 @@ INVESTIGATION STRATEGY — before making tool calls to explore or debug, follow
                     };
                     // Providers that run their own tool loop (Codex App Server) report each
                     // command/reasoning/file action here so it shows in the mirror/TUI.
-                    request.onObservation = (observation) => this.emitObservation(observation);
-                    this.tracer.event({ type: 'api_request', timestamp: new Date(), data: { model: request.model, maxTokens: request.maxTokens, system: request.system, messages: request.messages, tools: request.tools } });
-                    const response = await this.callAPI(request, signal);
+                    const nativeTurnId = `native_request_${randomUUID()}`;
+                    const captureNativeObservation = (observation, attemptCanPublish) => {
+                        const capture = this.emitObservation(observation, nativeTurnId, attemptCanPublish);
+                        this.nativeEvidencePending = Promise.all([this.nativeEvidencePending, capture]).then(() => { }).catch(error => {
+                            this.nativeEvidenceFailure ??= new AgentError(`Unable to retain native provider report: ${error instanceof Error ? error.message : String(error)}. Inspect existing reports before repeating work.`, 'NATIVE_EVIDENCE_FAILED');
+                        });
+                        return capture;
+                    };
+                    this.tracer.event({ type: 'api_request', timestamp: new Date(), data: { turnId: diagnosticTurn?.id ?? null,
+                            model: request.model, maxTokens: request.maxTokens, system: request.system, messages: request.messages, tools: request.tools } });
+                    // One identity covers this logical call, including its internal transport retries.
+                    // Selected account pointers are not evidence of which account served the request.
+                    const identity = { id: `usage_${randomUUID()}`, sessionId: this.config.sessionId,
+                        projectHash: createHash('sha256').update(this._cwd).digest('hex').slice(0, 12),
+                        provider: this.config.runtimeFacts.provider ?? null, model: request.model, accountId: null };
+                    const retainReturnedAccounting = (response) => {
+                        const rawContent = response.content;
+                        const accountingResponse = { ...response, content: Array.isArray(rawContent) ? rawContent
+                                : typeof rawContent === 'string' && rawContent ? [{ type: 'text', text: rawContent }] : [] };
+                        const usage = response.usage ?? this.estimateUsage(request, accountingResponse);
+                        this.retainUsageReceipt({ ...identity, observedAt: new Date().toISOString(),
+                            source: usage.estimated === true ? 'estimated' : 'reported', usage,
+                            costUsd: typeof response.costUsd === 'number' && Number.isFinite(response.costUsd) && response.costUsd >= 0
+                                ? response.costUsd : null });
+                        return usage;
+                    };
+                    const requestUsage = onUsage?.forRequest?.() ?? onUsage;
+                    let response;
+                    let returnedResponse;
+                    try {
+                        response = await this.callAPI(request, captureNativeObservation, signal, { messages, turnMessages, toolCalls: allToolCalls, handler: toolCheckpoint }, observed => { returnedResponse = observed; }, requestUsage);
+                    }
+                    catch (error) {
+                        // A success metrics observer may cancel synchronously just before the
+                        // completed response promise wins the race. Its returned facts remain known.
+                        if (returnedResponse)
+                            retainReturnedAccounting(returnedResponse);
+                        else
+                            this.retainUsageReceipt({ ...identity, observedAt: new Date().toISOString(),
+                                source: 'unavailable', usage: null, costUsd: null });
+                        throw error;
+                    }
+                    // Retain returned accounting before a later cancellation/checkpoint guard can discard the answer.
+                    const usage = retainReturnedAccounting(response);
+                    await this.nativeEvidencePending;
+                    if (this.nativeEvidenceFailure)
+                        throw this.nativeEvidenceFailure;
+                    if (this.toolCheckpointFailure)
+                        throw this.toolCheckpointFailure;
                     if (signal?.aborted) {
                         throw new AgentError('Cancelled', 'CANCELLED');
                     }
@@ -1144,16 +1621,19 @@ INVESTIGATION STRATEGY — before making tool calls to explore or debug, follow
                             ? [{ type: 'text', text: raw }]
                             : [];
                     }
-                    response.content = normalizeRepeatedResponseContent(response.content);
-                    this.tracer.event({ type: 'api_response', timestamp: new Date(), data: { stopReason: response.stopReason, content: response.content, usage: response.usage } });
+                    if (!this.backend.preservesNativeHistory)
+                        response.content = normalizeRepeatedResponseContent(response.content);
+                    this.tracer.event({ type: 'api_response', timestamp: new Date(), data: { turnId: diagnosticTurn?.id ?? null,
+                            model: request.model, stopReason: response.stopReason, stopReasonSource: 'backend_response', content: response.content, usage: response.usage } });
                     // Forward ZRouter prompt echo if present (superuser-authorized by the server)
                     if (response.promptEcho) {
                         this.tracer.event({ type: 'prompt_echo', timestamp: new Date(), data: response.promptEcho });
                     }
                     // Skip when the response was streamed live (reasoning_delta already emitted).
-                    if (!this._lastResponseStreamed)
+                    if (!this.remoteResourceSession && !this._lastResponseStreamed)
                         this.emitReasoningText(response.reasoning);
-                    const usage = response.usage ?? this.estimateUsage(request, response);
+                    if (!response.usage)
+                        requestUsage?.(usage);
                     totalUsage = mergeTokenUsage(totalUsage, usage);
                     // Durable context = real input_tokens minus the current-turn tool-result
                     // bytes that get stubbed next turn. Without this the bar spikes on a big
@@ -1173,12 +1653,59 @@ INVESTIGATION STRATEGY — before making tool calls to explore or debug, follow
                     if (isIncompleteModelResponse(response.stopReason)) {
                         throw new AgentError(incompleteModelResponseMessage(response.stopReason, request.maxTokens, response.usage?.outputTokens), INCOMPLETE_MODEL_RESPONSE_CODE);
                     }
+                    if (response.stopReason === 'refusal') {
+                        throw new AgentError('The model declined this request.', 'MODEL_REFUSAL');
+                    }
                     // Check for tool use
-                    const toolUseBlocks = response.content.filter(this.isToolUseBlock);
+                    const requestedToolBlocks = response.content.filter(this.isToolUseBlock);
+                    const requestedIds = new Set();
+                    for (const block of requestedToolBlocks) {
+                        if (requestedIds.has(block.id)) {
+                            throw new AgentError(`Provider response contains duplicate tool invocation ID ${block.id}; no call in this batch was executed.`, 'DUPLICATE_TOOL_CALL_ID');
+                        }
+                        requestedIds.add(block.id);
+                    }
+                    // Provider IDs identify calls within this response, not operations for
+                    // the lifetime of the Agent. Opaque IDs outside the store's bounded
+                    // filename alphabet and reused IDs need a fresh canonical identity for
+                    // transcript pairing, receipts and immutable stored result bytes.
+                    // Explicit host executeHarnessToolCall retries retain their own replay
+                    // contract; provider response reuse must never replay those outcomes.
+                    const occupiedIds = new Set([...this.recordedToolCalls.keys(), ...requestedIds]);
+                    const toolUseBlocks = [];
+                    for (const block of requestedToolBlocks) {
+                        if (/^[A-Za-z0-9_-]{1,256}$/.test(block.id)
+                            && !this.recordedToolCalls.has(block.id) && !await this.hasStoredToolIdentity(block.id)) {
+                            toolUseBlocks.push(block);
+                            continue;
+                        }
+                        let id;
+                        let identityAttempts = 0;
+                        do {
+                            if (++identityAttempts > 16) {
+                                throw new AgentError('Unable to allocate a fresh tool invocation identity. Inspect retained source availability before retrying.', 'TOOL_CALL_IDENTITY_UNAVAILABLE');
+                            }
+                            id = `tool_${randomUUID()}`;
+                        } while (occupiedIds.has(id) || await this.hasStoredToolIdentity(id));
+                        occupiedIds.add(id);
+                        toolUseBlocks.push({ ...block, id });
+                    }
+                    if (this.backend.preservesNativeHistory && toolUseBlocks.length > 0) {
+                        // Native replay keeps opaque signed blocks unchanged. Its tool-use
+                        // IDs still need to pair with the canonical identities admitted above.
+                        const canonicalIds = new Map(requestedToolBlocks.map((block, index) => [block.id, toolUseBlocks[index].id]));
+                        response.content = response.content.map(block => this.isToolUseBlock(block)
+                            ? { ...block, id: canonicalIds.get(block.id) } : block);
+                    }
                     if (toolUseBlocks.length === 0) {
+                        if (this.backend.preservesNativeHistory)
+                            finalNativeContent = response.content;
                         // No tools, extract text
                         const textBlocks = response.content.filter(this.isTextBlock);
-                        const iterationText = textBlocks.map(b => b.text).join('\n');
+                        const iterationText = this.remoteResourceSession
+                            ? allToolCalls.filter(call => call.name === 'remote_resource' && call.status === 'complete')
+                                .flatMap(call => remoteDeletionReport(call.result ?? '') ?? []).join('\n') || NO_VERIFIED_DELETION_REPORT
+                            : textBlocks.map(b => b.text).join('\n');
                         // Last non-empty text wins. An empty no-tool iteration (e.g. the
                         // follow-up turn after an auto-continue prompt) must NOT clobber text
                         // an earlier iteration already produced and streamed — otherwise run()
@@ -1187,16 +1714,49 @@ INVESTIGATION STRATEGY — before making tool calls to explore or debug, follow
                         // (ZTC-28). Mirrors the tool-branch lastToolTurnText guard below.
                         if (iterationText.trim()) {
                             finalContent = iterationText;
+                            finalReasoning = this.remoteResourceSession ? undefined : response.reasoning;
+                        }
+                        else if (!this.remoteResourceSession && response.reasoning?.trim()) {
+                            // Reasoning-only output is observable activity too. Keep it without
+                            // inventing text or losing earlier text on an empty follow-up.
                             finalReasoning = response.reasoning;
                         }
                         // Skip the buffered pacing when the text was already streamed live.
-                        if (!this._lastResponseStreamed)
+                        if (this.remoteResourceSession ? lastToolTurnText !== iterationText : !this._lastResponseStreamed)
                             await this.emitStreamText(iterationText, signal);
+                        // Deliver busy input before automatic continuation or ending this turn.
+                        // At the iteration cap leave the queue intact for the renderer's next turn.
+                        if (iterations < this.config.maxIterations) {
+                            const steering = takeSteering?.() ?? [];
+                            if (steering.length > 0) {
+                                if (iterationText.trim()) {
+                                    const answer = {
+                                        id: `assistant_${Date.now()}_${iterations}`, role: 'assistant', content: iterationText, timestamp: new Date(),
+                                        turn: requestUsage?.getTurn?.(),
+                                        metadata: { ...(this.config.runtimeFacts.mode === 'plan' ? { planMode: true } : {}), ...(response.reasoning ? { reasoningContent: response.reasoning } : {}) },
+                                    };
+                                    messages.push(answer);
+                                    turnMessages.push(answer);
+                                }
+                                messages.push(...steering);
+                                turnMessages.push(...steering);
+                                this.emit({ type: 'history_checkpoint', messages: [...turnMessages] });
+                                if (signal?.aborted)
+                                    throw new AgentError('Cancelled', 'CANCELLED');
+                                await steeringAdmission?.({ messages: [...turnMessages], sourceMessageIds: steering.map(message => message.id),
+                                    deliveryState: 'unknown', signal });
+                                if (signal?.aborted)
+                                    throw new AgentError('Cancelled', 'CANCELLED');
+                                finalContent = '';
+                                finalReasoning = undefined;
+                                continue;
+                            }
+                        }
                         // Check if we should auto-continue. Bounded: every continuation is a
                         // full-context request, so a model that keeps narrating an intention
                         // instead of calling a tool must not be able to spend maxIterations
                         // round trips on it. The budget is reset by any executed tool.
-                        if (this.shouldContinue(iterationText)
+                        if (!this.remoteResourceSession && this.shouldContinue(iterationText)
                             && this._consecutiveAutoContinues < this.config.maxConsecutiveAutoContinues) {
                             this._consecutiveAutoContinues++;
                             const acTodos = getLatestTodos();
@@ -1214,8 +1774,9 @@ INVESTIGATION STRATEGY — before making tool calls to explore or debug, follow
                                 id: `assistant_${Date.now()}`,
                                 role: 'assistant',
                                 content: iterationText,
+                                ...(this.backend.preservesNativeHistory ? { nativeContent: structuredClone(response.content), nativeModel: this.config.model, nativeContextId: this._nativeContextId } : {}),
                                 timestamp: new Date(),
-                                ...(response.reasoning ? { metadata: { reasoningContent: response.reasoning } } : {}),
+                                metadata: { ...(this.config.runtimeFacts.mode === 'plan' ? { planMode: true } : {}), ...(response.reasoning ? { reasoningContent: response.reasoning } : {}) },
                             });
                             // Add auto-continue prompt as user message
                             messages.push({
@@ -1229,42 +1790,92 @@ INVESTIGATION STRATEGY — before making tool calls to explore or debug, follow
                         stopReason = 'complete';
                         break;
                     }
-                    // Per-batch dedup for `recall_tool_response`: two recalls of the same
-                    // inner tool_use_id in one assistant turn share a single execute. The
-                    // outer toolBlock.id pairing is preserved for each block so the
-                    // tool_use ↔ tool_result API invariant holds.
+                    // Identical no-range recall proposals may share an execution. Explicit
+                    // ranges need their own bytes and validation, and even normalized source
+                    // IDs must preserve each invocation's original arguments and pairing.
                     const sharedRecallExec = new Map();
-                    const recordToolSuccess = (toolBlock, toolCall, content, effectiveArgs) => {
+                    const toolUseMessageId = `assistant_${randomUUID()}`;
+                    const batchCalls = toolUseBlocks.map(block => ({
+                        id: block.id, name: block.name, args: structuredClone(block.input), status: 'pending',
+                    }));
+                    for (const call of batchCalls)
+                        this.recordedToolCalls.set(call.id, call);
+                    const toolUseMessage = {
+                        id: toolUseMessageId, role: 'assistant',
+                        content: this.remoteResourceSession ? '[Using tools...]'
+                            : response.content.filter(this.isTextBlock).map(block => block.text).join('\n') || '[Using tools...]',
+                        ...(this.backend.preservesNativeHistory ? { nativeContent: structuredClone(response.content), nativeModel: this.config.model, nativeContextId: this._nativeContextId } : {}),
+                        timestamp: new Date(), toolCalls: batchCalls,
+                        metadata: { toolCheckpoint: true, ...(this.config.runtimeFacts.mode === 'plan' ? { planMode: true } : {}), ...(response.reasoning ? this.remoteResourceSession
+                                ? { providerReasoning: response.reasoning } : { reasoningContent: response.reasoning } : {}) },
+                    };
+                    messages.push(toolUseMessage);
+                    turnMessages.push(toolUseMessage);
+                    allToolCalls.push(...batchCalls);
+                    const toolResultMessage = {
+                        id: `tool_${randomUUID()}`, role: 'user', content: '[]', timestamp: new Date(),
+                        metadata: { toolResult: true, toolCheckpoint: true },
+                    };
+                    const completedResults = new Map();
+                    const retainToolResult = async (toolCall, rawContent, guardedContent, managedCommand, contentTruncated = false, verificationReceipt, verifierDecision, benchmarkComparisonDecision) => {
+                        const partial = Boolean(signal?.aborted || contentTruncated || managedCommand?.result.has_more || managedCommand?.result.output_truncated);
+                        const { rendered } = this.toolResponseStore.put(toolCall.id, toolCall.name, rawContent, partial, {
+                            args: toolCall.args,
+                            sourcePath: extractSourcePath(toolCall.name, toolCall.args), dedupable: toolCall.status === 'complete',
+                            isError: toolCall.status === 'error',
+                            source: { ...this.evidenceSource(toolCall.id, toolCall.name, toolCall.args, managedCommand, verificationReceipt, partial || toolCall.status === 'error' ? undefined : verifierDecision, partial || toolCall.status === 'error' ? undefined : benchmarkComparisonDecision), messageId: toolUseMessageId },
+                        });
+                        const annotation = guardedContent.slice(rawContent.length);
+                        completedResults.set(toolCall.id, { tool_use_id: toolCall.id, content: rendered,
+                            is_error: toolCall.status === 'error', ...(annotation ? { context_annotation: annotation } : {}) });
+                        toolResultMessage.content = JSON.stringify(batchCalls.flatMap(call => completedResults.has(call.id) ? [completedResults.get(call.id)] : []));
+                        if (!turnMessages.some(message => message.id === toolResultMessage.id)) {
+                            messages.push(toolResultMessage);
+                            turnMessages.push(toolResultMessage);
+                        }
+                        await this.refreshVerificationCoverage();
+                        await this.persistToolCheckpoint('terminal', toolCall.id, turnMessages, toolCheckpoint);
+                    };
+                    const recordToolSuccess = async (toolBlock, toolCall, content, effectiveArgs, managedCommand, contentTruncated = false, verificationReceipt, verifierDecision, benchmarkComparisonDecision) => {
                         toolCall.completedAt = new Date();
                         toolCall.args = effectiveArgs;
                         toolCall.status = 'complete';
                         toolCall.result = content;
+                        const guarded = applyRepeatGuard(toolBlock.name, toolBlock.input, content, managedCommand);
+                        await retainToolResult(toolCall, content, guarded, managedCommand, contentTruncated, verificationReceipt, verifierDecision, benchmarkComparisonDecision);
                         this.emit({ type: 'tool_end', tool: toolBlock.name, result: content, toolCallId: toolBlock.id });
                         this.tracer.event({
                             type: 'tool_end',
                             timestamp: new Date(),
-                            data: { tool: toolBlock.name },
+                            data: this.toolTraceData(toolCall),
                         });
-                        const guarded = applyRepeatGuard(toolBlock.name, toolBlock.input, content);
-                        return { toolCall, toolResult: { tool_use_id: toolBlock.id, content: guarded, is_error: false } };
+                        return { toolCall, managedCommand, contentTruncated, verificationReceipt, verifierDecision, benchmarkComparisonDecision, rawContent: content, toolResult: { tool_use_id: toolBlock.id, content: guarded, is_error: false } };
                     };
-                    const recordToolError = (toolBlock, toolCall, error, effectiveArgs) => {
+                    const recordToolError = async (toolBlock, toolCall, error, effectiveArgs, managedCommand, contentTruncated = false, verificationReceipt, verifierDecision, benchmarkComparisonDecision) => {
                         toolCall.completedAt = new Date();
                         if (effectiveArgs !== undefined)
                             toolCall.args = effectiveArgs;
                         toolCall.status = 'error';
                         toolCall.error = error;
+                        const guarded = applyRepeatGuard(toolBlock.name, toolBlock.input, `Error: ${error}`);
+                        await retainToolResult(toolCall, `Error: ${error}`, guarded, managedCommand, contentTruncated, verificationReceipt, verifierDecision, benchmarkComparisonDecision);
                         this.emit({ type: 'tool_error', tool: toolBlock.name, error, toolCallId: toolBlock.id });
                         this.tracer.event({
                             type: 'tool_error',
                             timestamp: new Date(),
-                            data: { tool: toolBlock.name, error },
+                            data: { ...this.toolTraceData(toolCall), error },
                         });
                         return {
                             toolCall,
+                            managedCommand,
+                            contentTruncated,
+                            verificationReceipt,
+                            verifierDecision,
+                            benchmarkComparisonDecision,
+                            rawContent: `Error: ${error}`,
                             toolResult: {
                                 tool_use_id: toolBlock.id,
-                                content: applyRepeatGuard(toolBlock.name, toolBlock.input, `Error: ${error}`),
+                                content: guarded,
                                 is_error: true,
                             },
                         };
@@ -1283,17 +1894,19 @@ INVESTIGATION STRATEGY — before making tool calls to explore or debug, follow
                     // current agent is rebuilt before any subsequent iteration.
                     const exclusiveTransitionId = toolUseBlocks.find((toolBlock) => toolBlock.name === 'plan_mode')?.id ?? null;
                     const combined = await scheduleToolBatch(toolUseBlocks, this.config.tools, this.config.execution, async (toolBlock, skipReason) => {
-                        const toolCall = {
-                            id: toolBlock.id,
-                            name: toolBlock.name,
-                            args: toolBlock.input,
-                            status: 'running',
-                            startedAt: new Date()
+                        if (this.toolCheckpointFailure)
+                            throw this.toolCheckpointFailure;
+                        const toolCall = batchCalls.find(call => call.id === toolBlock.id);
+                        toolCall.status = 'running';
+                        toolCall.startedAt = new Date();
+                        const beforeExecute = async (args) => {
+                            toolCall.args = structuredClone(args);
+                            await this.persistToolCheckpoint('before_execute', toolBlock.id, turnMessages, toolCheckpoint);
                         };
                         this.tracer.event({
                             type: 'tool_start',
                             timestamp: new Date(),
-                            data: { tool: toolBlock.name }
+                            data: { ...this.toolTraceData(toolCall), argsSource: 'provider_proposal' }
                         });
                         this.emit({ type: 'tool_start', tool: toolBlock.name, args: toolBlock.input, toolCallId: toolBlock.id });
                         if (skipReason)
@@ -1306,15 +1919,19 @@ INVESTIGATION STRATEGY — before making tool calls to explore or debug, follow
                         if (tool?.finalResponse && toolUseBlocks.length !== 1) {
                             return recordToolError(toolBlock, toolCall, 'finish_task must be the only tool call; observe other results before completing the task.');
                         }
-                        // Dispatch-layer short-circuit for recalls on already-pinned ids.
-                        // The selector marked the original tool_result inline this request;
-                        // the model doesn't need the content rehydrated again. Returning a
-                        // tiny ack (paired with the OUTER toolBlock.id) preserves the API
-                        // protocol invariant.
+                        // Selector intent does not prove visibility: the encoder may cap or
+                        // compress the result. Acknowledge only exact encoded source bytes
+                        // that also remain within the historical stability limit. Larger
+                        // current results become previews after this recall is appended.
+                        // A hook dispatcher still owns each invocation's admission and outcome.
                         const innerId = recallInnerIdOf(toolBlock);
-                        if (innerId !== null &&
+                        if (!this.hooks && innerId !== null &&
+                            toolBlock.input.cursor === undefined && toolBlock.input.max_bytes === undefined &&
                             this.toolResponseStore.willInlineNextRender(innerId) &&
-                            this.toolResponseStore.hasCached(innerId)) {
+                            this.toolResponseStore.hasCached(innerId) &&
+                            request.messages.some(message => typeof message.content !== 'string' && message.content.some(block => block.type === 'tool_result' && block.tool_use_id === innerId &&
+                                typeof block.content === 'string' && block.content.length <= STABLE_RESULT_LIMIT &&
+                                createHash('sha256').update(block.content).digest('hex') === this.toolResponseStore.getMeta(innerId)?.result_sha256))) {
                             const ack = JSON.stringify({
                                 ok: true,
                                 tool_use_id: innerId,
@@ -1323,124 +1940,133 @@ INVESTIGATION STRATEGY — before making tool calls to explore or debug, follow
                             });
                             return recordToolSuccess(toolBlock, toolCall, ack, toolBlock.input);
                         }
+                        const outputObserver = this.toolOutputObserver(toolCall, signal);
                         try {
-                            // Share the execute promise across duplicate recalls in this batch.
+                            // Hooks own per-invocation transformations, admission and outcomes.
+                            // Only a host without a hook dispatcher may share default recalls.
                             let result;
-                            if (innerId !== null) {
-                                const existing = sharedRecallExec.get(innerId);
+                            if (!this.hooks && innerId !== null && toolBlock.input.cursor === undefined && toolBlock.input.max_bytes === undefined) {
+                                const recallShareKey = JSON.stringify(toolBlock.input);
+                                const existing = sharedRecallExec.get(recallShareKey);
                                 if (existing !== undefined) {
                                     result = await existing;
                                 }
                                 else {
                                     const fresh = executeToolWithRuntime(toolBlock.name, toolBlock.input, {
                                         tools: this.config.tools,
+                                        remoteResourceSession: this.remoteResourceSession,
                                         context: {
                                             cwd: this._cwd,
                                             toolCallId: toolBlock.id,
+                                            onUsage: requestUsage,
                                             sessionId: this.config.sessionId,
+                                            managedCommandWaitSliceMs: 0,
                                             signal,
                                             toolResponseStore: this.toolResponseStore,
                                             discoveredTools: this.discoveredTools,
                                             availableTools: this.config.tools,
                                             subprocessEnv: this.copySubprocessEnv(),
+                                            commandPolicy: this.commandPolicy,
+                                            onOutput: outputObserver.onOutput,
                                         },
                                         policy: this.policy,
                                         hooks: this.hooks,
                                         approvalRequester: this.approvalRequester,
                                         onToolEffect: this.toolEffectObserver,
+                                        onLocalFileChange: this.onLocalFileChange,
+                                        beforeExecute,
                                         approvalRequiredCapabilities: this.approvalRequiredCapabilities,
                                         approvalContext: this.approvalContext,
                                     });
-                                    sharedRecallExec.set(innerId, fresh);
+                                    sharedRecallExec.set(recallShareKey, fresh);
                                     result = await fresh;
                                 }
                             }
                             else {
                                 result = await executeToolWithRuntime(toolBlock.name, toolBlock.input, {
                                     tools: this.config.tools,
+                                    remoteResourceSession: this.remoteResourceSession,
                                     context: {
                                         cwd: this._cwd,
                                         toolCallId: toolBlock.id,
+                                        onUsage: requestUsage,
                                         sessionId: this.config.sessionId,
+                                        managedCommandWaitSliceMs: 0,
                                         signal,
                                         toolResponseStore: this.toolResponseStore,
                                         discoveredTools: this.discoveredTools,
                                         availableTools: this.config.tools,
                                         subprocessEnv: this.copySubprocessEnv(),
+                                        commandPolicy: this.commandPolicy,
+                                        onOutput: outputObserver.onOutput,
                                     },
                                     policy: this.policy,
                                     hooks: this.hooks,
                                     approvalRequester: this.approvalRequester,
                                     onToolEffect: this.toolEffectObserver,
+                                    onLocalFileChange: this.onLocalFileChange,
+                                    beforeExecute,
                                     approvalRequiredCapabilities: this.approvalRequiredCapabilities,
                                     approvalContext: this.approvalContext,
                                 });
                             }
+                            outputObserver.close();
                             if (result.isError) {
-                                return recordToolError(toolBlock, toolCall, result.content, result.effectiveArgs);
+                                return recordToolError(toolBlock, toolCall, result.content, result.effectiveArgs, result.managedCommand, result.contentTruncated, result.verificationReceipt, result.verifierDecision, result.benchmarkComparisonDecision);
                             }
-                            return recordToolSuccess(toolBlock, toolCall, result.content, result.effectiveArgs);
+                            return recordToolSuccess(toolBlock, toolCall, result.content, result.effectiveArgs, result.managedCommand, result.contentTruncated, result.verificationReceipt, result.verifierDecision, result.benchmarkComparisonDecision);
                         }
                         catch (err) {
+                            outputObserver.close();
+                            if (this.toolCheckpointFailure)
+                                throw this.toolCheckpointFailure;
                             const error = err.message;
                             return recordToolError(toolBlock, toolCall, error);
                         }
-                    }, result => result.toolCall.status === 'error' || commandStillRunning(result.toolResult.content), signal, exclusiveTransitionId);
-                    allToolCalls.push(...combined.map(r => r.toolCall));
-                    const partial = Boolean(signal?.aborted);
-                    const toolResults = combined.map(r => {
-                        const { rendered } = this.toolResponseStore.put(r.toolResult.tool_use_id, r.toolCall.name, r.toolResult.content, partial, {
-                            sourcePath: extractSourcePath(r.toolCall.name, r.toolCall.args),
-                            dedupable: r.toolCall.status === 'complete',
-                            isError: r.toolResult.is_error,
-                        });
-                        return { tool_use_id: r.toolResult.tool_use_id, content: rendered, is_error: r.toolResult.is_error };
-                    });
+                        finally {
+                            outputObserver.close();
+                        }
+                    }, result => result.toolCall.status === 'error' || result.managedCommand?.result.status === 'running'
+                        || commandStillRunning(result.toolResult.content), signal, exclusiveTransitionId);
                     // Real work happened, so the turn has demonstrably not stalled on
                     // narration: give it a fresh continuation budget.
                     this._consecutiveAutoContinues = 0;
                     // Add assistant message with tool use
-                    const textContent = response.content
-                        .filter(this.isTextBlock)
-                        .map(b => b.text)
-                        .join('\n');
-                    const toolUseMessage = {
-                        id: `assistant_${Date.now()}`,
-                        role: 'assistant',
-                        content: textContent || '[Using tools...]',
-                        timestamp: new Date(),
-                        toolCalls: allToolCalls.slice(-toolUseBlocks.length),
-                        ...(response.reasoning ? { metadata: { reasoningContent: response.reasoning } } : {}),
-                    };
-                    messages.push(toolUseMessage);
-                    turnMessages.push(toolUseMessage);
-                    const toolResultMessage = {
-                        id: `tool_${Date.now()}`,
-                        role: 'user',
-                        content: JSON.stringify(toolResults),
-                        timestamp: new Date(),
-                        metadata: { toolResult: true },
-                    };
-                    messages.push(toolResultMessage);
-                    turnMessages.push(toolResultMessage);
+                    const textContent = this.remoteResourceSession
+                        ? combined.filter(result => result.toolCall.name === 'remote_resource' && result.toolCall.status === 'complete')
+                            .flatMap(result => remoteDeletionReport(result.toolResult.content) ?? []).join('\n')
+                        : response.content.filter(this.isTextBlock).map(b => b.text).join('\n');
+                    toolUseMessage.content = textContent || '[Using tools...]';
+                    toolUseMessage.turn = requestUsage?.getTurn?.();
                     this.emit({ type: 'history_checkpoint', messages: [...turnMessages] });
                     if (signal?.aborted)
                         throw new AgentError('Cancelled', 'CANCELLED');
                     // Stream any text content that came with tool calls (important for user feedback!)
                     if (textContent && textContent.trim() && !signal?.aborted) {
-                        if (!this._lastResponseStreamed)
+                        if (this.remoteResourceSession || !this._lastResponseStreamed)
                             await this.emitStreamText(textContent, signal);
                         // Last non-empty text wins — empty iterations preserve the prior value
                         // so maxIterations exhaustion still has something to return.
                         lastToolTurnText = textContent;
                     }
+                    // Recorded IDs were reconciled above; the scheduler receives only new
+                    // calls. Add one host notice after retaining every refused result pair.
+                    const batchLimit = resolveExecutionSettings(this.config.execution).maxCallsPerResponse;
+                    if (toolUseBlocks.length > batchLimit) {
+                        const recoveryMessage = { id: `batch_recovery_${randomUUID()}`, role: 'user',
+                            content: `[Tool batch recovery] The ${toolUseBlocks.length} new-call batch exceeds the limit of ${batchLimit} total calls (reads + effects) per response. None of this rejected batch executed. Submit smaller batches of at most ${batchLimit} calls in bounded rounds, and inspect prerequisite results before dependent effects. Retry only operations explicitly marked not_executed, using fresh invocation IDs for those proven unexecuted retries. Reuse retained completed results; inspect and reconcile running or unknown outcomes before considering another operation.`,
+                            metadata: { synthetic: true }, timestamp: new Date() };
+                        messages.push(recoveryMessage);
+                        turnMessages.push(recoveryMessage);
+                        this.emit({ type: 'history_checkpoint', messages: [...turnMessages] });
+                    }
                     const recoveryAction = recovery(combined.map(result => ({ name: result.toolCall.name,
-                        content: result.toolResult.content, isError: result.toolResult.is_error })));
+                        content: result.toolResult.content, isError: result.toolResult.is_error, managedCommand: result.managedCommand })));
                     if (recoveryAction === 'stop')
                         throw new AgentError('Automatic recovery budget exhausted after repeated tool failures. Inspect the retained results and current capabilities before retrying.', 'RECOVERY_EXHAUSTED');
                     if (recoveryAction === 'recover') {
                         const recoveryMessage = { id: `recovery_${randomUUID()}`, role: 'user',
-                            content: '[Recovery] Repeated failures share the same cause. Stop that sequence. Inspect current capabilities and active jobs, then make one changed recovery attempt. Use file/stdin tools for scripts and raw Ctrl+C for stuck shell input, then read the pane in the same response or immediately afterward. A silent running-job poll allows one further inspection before stopping; do not repeat empty polls. Continue authorized work; use ask_user only for a concrete missing prerequisite. Do not repeat an acknowledgement as proof of success.',
+                            content: '[Recovery] Repeated failures share the same cause. Stop that sequence. Inspect current capabilities and active jobs, then make one changed recovery attempt. Use file/stdin tools for scripts and raw Ctrl+C for stuck shell input, then read the pane in the same response or immediately afterward. Healthy managed job waiting preserves this failure budget; silence is not a reason to relaunch or abandon the owned job. Continue authorized work; use ask_user only for a concrete missing prerequisite. Do not repeat an acknowledgement as proof of success.',
                             metadata: { synthetic: true }, timestamp: new Date() };
                         messages.push(recoveryMessage);
                         turnMessages.push(recoveryMessage);
@@ -1469,7 +2095,7 @@ INVESTIGATION STRATEGY — before making tool calls to explore or debug, follow
                     const hasSuccessfulInteractiveTool = toolUseBlocks.some(tb => {
                         if (!Agent.TURN_ENDING_TOOLS.has(tb.name))
                             return false;
-                        const result = toolResults.find(r => r.tool_use_id === tb.id);
+                        const result = completedResults.get(tb.id);
                         return result ? !result.content.startsWith('Error:') : false;
                     });
                     if (hasSuccessfulInteractiveTool) {
@@ -1480,10 +2106,53 @@ INVESTIGATION STRATEGY — before making tool calls to explore or debug, follow
                     // and before the next inference. Keep terminal tools and exhausted turns
                     // on the normal next-turn path because no model request remains here.
                     if (iterations < this.config.maxIterations) {
-                        const steering = takeSteering?.() ?? [];
+                        const observations = combined.flatMap(result => result.managedCommand && !result.toolResult.is_error
+                            ? [{ ...result.managedCommand, toolCallId: result.toolCall.id }] : []);
+                        const consumedSteering = [];
+                        let waited;
+                        try {
+                            waited = observations.length === combined.length
+                                ? await awaitManagedCommandProgress(observations, { signal, deadlineAt: Date.now() + 60_000,
+                                    takeSteering: takeSteering ? () => {
+                                        const next = takeSteering();
+                                        consumedSteering.push(...next);
+                                        return next;
+                                    } : undefined, emit: event => this.emit(event) })
+                                : { waited: false, observations: [], steering: [] };
+                        }
+                        catch (error) {
+                            // A failed receipt refresh must not discard Enter messages already drained.
+                            if (consumedSteering.length) {
+                                messages.push(...consumedSteering);
+                                turnMessages.push(...consumedSteering);
+                                this.emit({ type: 'history_checkpoint', messages: [...turnMessages] });
+                            }
+                            throw error;
+                        }
+                        if (waited.waited) {
+                            const observation = { id: `command_observation_${randomUUID()}`, role: 'user',
+                                content: formatManagedCommandObservations(waited.observations), timestamp: new Date(),
+                                metadata: { synthetic: true, hostContext: true, managedCommandObservation: true } };
+                            for (const [index, item] of waited.observations.entries()) {
+                                this.toolResponseStore.put(`${observation.id}_${index}`, 'read_command', JSON.stringify(item.result), item.result.has_more || Boolean(item.result.output_truncated), {
+                                    source: { ...this.evidenceSource(item.toolCallId, 'read_command', {}, item), originToolCallId: item.toolCallId },
+                                    isError: item.result.status !== 'running' && item.result.status !== 'completed',
+                                });
+                            }
+                            messages.push(observation);
+                            turnMessages.push(observation);
+                            this.emit({ type: 'history_checkpoint', messages: [...turnMessages] });
+                        }
+                        const steering = [...waited.steering, ...(takeSteering?.() ?? [])];
                         if (steering.length > 0) {
                             messages.push(...steering);
                             turnMessages.push(...steering);
+                            this.emit({ type: 'history_checkpoint', messages: [...turnMessages] });
+                            if (signal?.aborted)
+                                throw new AgentError('Cancelled', 'CANCELLED');
+                            await steeringAdmission?.({ messages: [...turnMessages], sourceMessageIds: steering.map(message => message.id), signal });
+                            if (signal?.aborted)
+                                throw new AgentError('Cancelled', 'CANCELLED');
                         }
                     }
                 }
@@ -1534,11 +2203,12 @@ INVESTIGATION STRATEGY — before making tool calls to explore or debug, follow
             }
         }
         return {
-            content: finalContent || lastToolTurnText,
+            content: finalContent || lastToolTurnText || (this.remoteResourceSession ? NO_VERIFIED_DELETION_REPORT : ''),
             toolCalls: allToolCalls,
             usage: totalUsage || undefined,
             stopReason,
             ...(finalReasoning ? { reasoning: finalReasoning } : {}),
+            ...(finalNativeContent ? { nativeContent: finalNativeContent, nativeModel: this.config.model, nativeContextId: this._nativeContextId } : {}),
             turnMessages,
         };
     }
@@ -1551,6 +2221,7 @@ INVESTIGATION STRATEGY — before making tool calls to explore or debug, follow
      * implements it, so this is a no-op for every other provider.
      */
     dispose() {
+        this.evidenceUnsubscribe();
         this.backend.close?.();
     }
     /**
@@ -1560,7 +2231,50 @@ INVESTIGATION STRATEGY — before making tool calls to explore or debug, follow
      * approval requester, tool-response store, and mirror-visible tool events.
      */
     async executeHarnessToolCall(name, args, options = {}) {
+        await this.recoverToolCheckpoint();
+        return this.executeHarnessToolCallWithCheckpoint(name, args, options);
+    }
+    recordedToolCall(id, name, args) {
+        const recorded = this.recordedToolCalls.get(id);
+        if (recorded && (recorded.name !== name || !isDeepStrictEqual(recorded.args, args))) {
+            throw new AgentError(`Tool invocation identity conflict for ${id}: the recorded tool or arguments differ. Inspect the original call; it was not executed again.`, 'TOOL_CALL_IDENTITY_CONFLICT');
+        }
+        return recorded;
+    }
+    async hasStoredToolIdentity(id) {
+        if (this.toolResponseStore.getMeta(id))
+            return true;
+        try {
+            // Compaction can remove the call row while its immutable source remains.
+            // Lazy lookup also reserves unavailable or unindexed retained sources.
+            return await this.toolResponseStore.get(id) !== null;
+        }
+        catch (error) {
+            if (error instanceof ToolResponseIntegrityError)
+                return true;
+            throw error;
+        }
+    }
+    async executeHarnessToolCallWithCheckpoint(name, args, options, context) {
+        if (this.toolCheckpointFailure)
+            throw this.toolCheckpointFailure;
         options.onActivity?.();
+        const toolCallId = options.callId ?? `tool_${randomUUID()}`;
+        const recorded = this.recordedToolCall(toolCallId, name, args);
+        if (recorded) {
+            if (recorded.error !== undefined)
+                return { success: false, output: `Error: ${recorded.error}` };
+            if (recorded.result !== undefined) {
+                const image = parseImageToolResult(recorded.result);
+                return { success: true, output: image
+                        ? { text: image.description ?? '', images: [{ mediaType: image.mediaType, data: image.data }] }
+                        : recorded.result };
+            }
+            return { success: false, output: `Tool outcome unknown for recorded invocation ${toolCallId}. Inspect the original call and reconcile its existing receipts/current state; it was not executed again.` };
+        }
+        if (await this.hasStoredToolIdentity(toolCallId)) {
+            return { success: false, output: `Tool outcome unknown for retained invocation ${toolCallId}: its original argument record is unavailable. Inspect its retained source and reconcile existing receipts/current state; it was not executed again.` };
+        }
         const tool = this.config.tools.find(candidate => candidate.definition.name === name);
         if (!tool) {
             return {
@@ -1568,59 +2282,156 @@ INVESTIGATION STRATEGY — before making tool calls to explore or debug, follow
                 output: `Error: unknown tool '${name}' is not registered for this agent.`,
             };
         }
-        const toolCallId = options.callId ?? this.nextToolEventId();
+        // Direct calls have an isolated canonical segment. Provider callbacks hold
+        // the arrays and handler belonging to their original turn, even if their
+        // underlying IO settles after cancellation and a newer turn has started.
+        const owner = context ?? { messages: [], turnMessages: [], toolCalls: [], handler: this.toolCheckpoint };
+        const toolCall = { id: toolCallId, name, args: structuredClone(args),
+            status: 'running', startedAt: new Date() };
+        this.recordedToolCalls.set(toolCallId, toolCall);
+        const toolUseMessage = {
+            id: `assistant_${randomUUID()}`, role: 'assistant', content: '[Using tools...]',
+            timestamp: new Date(), toolCalls: [toolCall], metadata: { toolCheckpoint: true },
+        };
+        const toolResultMessage = {
+            id: `tool_${randomUUID()}`, role: 'user', content: '[]', timestamp: new Date(),
+            metadata: { toolResult: true, toolCheckpoint: true },
+        };
+        owner.messages.push(toolUseMessage);
+        owner.turnMessages.push(toolUseMessage);
+        owner.toolCalls.push(toolCall);
         this.emit({ type: 'tool_start', tool: name, args, toolCallId });
-        this.tracer.event({ type: 'tool_start', timestamp: new Date(), data: { tool: name } });
+        this.tracer.event({ type: 'tool_start', timestamp: new Date(), data: this.toolTraceData(toolCall) });
+        const outputObserver = this.toolOutputObserver(toolCall, options.signal);
+        let result;
         try {
-            const result = await executeToolWithRuntime(name, args, {
+            result = await executeToolWithRuntime(name, args, {
                 tools: this.config.tools,
+                remoteResourceSession: this.remoteResourceSession,
                 context: {
                     cwd: this._cwd,
                     toolCallId,
                     sessionId: this.config.sessionId,
                     signal: options.signal,
+                    onUsage: options.onUsage,
                     toolResponseStore: this.toolResponseStore,
                     discoveredTools: this.discoveredTools,
                     availableTools: this.config.tools,
                     subprocessEnv: this.copySubprocessEnv(),
+                    commandPolicy: this.commandPolicy,
+                    onOutput: outputObserver.onOutput,
                 },
                 policy: this.policy,
                 hooks: this.hooks,
                 approvalRequester: this.approvalRequester,
                 onToolEffect: this.toolEffectObserver,
+                onLocalFileChange: this.onLocalFileChange,
+                beforeExecute: async (effectiveArgs) => {
+                    toolCall.args = structuredClone(effectiveArgs);
+                    await this.persistToolCheckpoint('before_execute', toolCallId, owner.turnMessages, owner.handler);
+                },
                 approvalRequiredCapabilities: this.approvalRequiredCapabilities,
                 approvalContext: this.approvalContext,
             });
-            options.onActivity?.();
-            if (result.isError) {
-                this.emit({ type: 'tool_error', tool: name, error: result.content, toolCallId });
-                this.tracer.event({ type: 'tool_error', timestamp: new Date(), data: { tool: name, error: result.content } });
-                return { success: false, output: `Error: ${result.content}` };
-            }
-            this.emit({ type: 'tool_end', tool: name, result: result.content, toolCallId });
-            this.tracer.event({ type: 'tool_end', timestamp: new Date(), data: { tool: name } });
-            const image = parseImageToolResult(result.content);
-            if (image) {
-                return {
-                    success: true,
-                    output: {
-                        text: image.description ?? '',
-                        images: [{ mediaType: image.mediaType, data: image.data }],
-                    },
-                };
-            }
-            return { success: true, output: result.content };
         }
         catch (error) {
-            const message = error instanceof Error ? error.message : String(error);
-            this.emit({ type: 'tool_error', tool: name, error: message, toolCallId });
-            this.tracer.event({ type: 'tool_error', timestamp: new Date(), data: { tool: name, error: message } });
-            return { success: false, output: `Error: ${message}` };
+            if (this.toolCheckpointFailure)
+                throw this.toolCheckpointFailure;
+            result = { content: error instanceof Error ? error.message : String(error),
+                isError: true, effectiveArgs: toolCall.args };
+        }
+        finally {
+            outputObserver.close();
+        }
+        toolCall.args = structuredClone(result.effectiveArgs);
+        toolCall.completedAt = new Date();
+        toolCall.status = result.isError ? 'error' : 'complete';
+        if (result.isError)
+            toolCall.error = result.content;
+        else
+            toolCall.result = result.content;
+        const partial = Boolean(options.signal?.aborted || result.contentTruncated || result.managedCommand?.result.has_more || result.managedCommand?.result.output_truncated);
+        const { rendered } = this.toolResponseStore.put(toolCallId, name, result.content, partial, {
+            args: result.effectiveArgs,
+            sourcePath: extractSourcePath(name, result.effectiveArgs), isError: result.isError,
+            source: { ...this.evidenceSource(toolCallId, name, result.effectiveArgs, result.managedCommand, result.verificationReceipt, partial || result.isError ? undefined : result.verifierDecision, partial || result.isError ? undefined : result.benchmarkComparisonDecision),
+                messageId: toolUseMessage.id },
+        });
+        toolResultMessage.content = JSON.stringify([{ tool_use_id: toolCallId, content: rendered, is_error: result.isError }]);
+        owner.messages.push(toolResultMessage);
+        owner.turnMessages.push(toolResultMessage);
+        await this.refreshVerificationCoverage();
+        await this.persistToolCheckpoint('terminal', toolCallId, owner.turnMessages, owner.handler);
+        if (context)
+            this.emit({ type: 'history_checkpoint', messages: [...owner.turnMessages] });
+        options.onActivity?.();
+        if (result.isError) {
+            this.emit({ type: 'tool_error', tool: name, error: result.content, toolCallId });
+            this.tracer.event({ type: 'tool_error', timestamp: new Date(), data: { ...this.toolTraceData(toolCall), error: result.content } });
+            return { success: false, output: `Error: ${result.content}` };
+        }
+        this.emit({ type: 'tool_end', tool: name, result: result.content, toolCallId });
+        this.tracer.event({ type: 'tool_end', timestamp: new Date(), data: this.toolTraceData(toolCall) });
+        const image = parseImageToolResult(result.content);
+        if (image) {
+            return {
+                success: true,
+                output: {
+                    text: image.description ?? '',
+                    images: [{ mediaType: image.mediaType, data: image.data }],
+                },
+            };
+        }
+        return { success: true, output: result.content };
+    }
+    captureUserInstructions(messages) {
+        const known = new Set(this.getEvidenceSnapshot().records.map(record => record.id));
+        for (const message of messages) {
+            if (message.role !== 'user' || message.metadata?.synthetic || message.metadata?.toolResult
+                || message.metadata?.compactionSummary || message.metadata?.managedCommandObservation)
+                continue;
+            const id = `instruction_${message.id}`;
+            if (known.has(id))
+                continue;
+            // Legacy tool-result arrays may lack the metadata marker. They remain
+            // quoted tool data, never a source of user permission.
+            try {
+                const parsed = JSON.parse(message.content);
+                if (Array.isArray(parsed) && parsed.some(item => item && typeof item === 'object' && 'tool_use_id' in item))
+                    continue;
+            }
+            catch { /* ordinary user text */ }
+            this.toolResponseStore.evidence.recordUserInstruction({ id, text: message.content,
+                textSha256: createHash('sha256').update(message.content).digest('hex'), originalTextBytes: Buffer.byteLength(message.content),
+                recordedAt: message.timestamp instanceof Date ? message.timestamp.toISOString() : new Date().toISOString(),
+                source: { origin: 'user', messageId: message.id } });
+            known.add(id);
+        }
+    }
+    evidenceSource(toolCallId, toolName, args, managed, verificationReceipt, verifierDecision, benchmarkComparisonDecision) {
+        const path = extractSourcePath(toolName, args);
+        const verification = verificationReceipt ?? managed?.result.verification;
+        const source = { origin: managed || verification || benchmarkComparisonDecision ? 'host_receipt' : 'host_tool', toolCallId, toolName,
+            cwd: managed?.result.cwd ?? this._cwd, ...(path ? { path } : {}) };
+        if (verification)
+            source.verification = structuredClone(verification);
+        if (verifierDecision)
+            source.verifier = structuredClone(verifierDecision);
+        if (benchmarkComparisonDecision)
+            source.benchmarkComparison = structuredClone(benchmarkComparisonDecision);
+        if (managed) {
+            const result = managed.result;
+            source.job = { sessionId: managed.sessionId, jobId: result.job_id, status: result.status,
+                exitCode: result.exit_code ?? null, startedAt: result.started_at, endedAt: result.ended_at,
+                cursor: result.cursor, hasMore: result.has_more, outputTruncated: Boolean(result.output_truncated),
+                ...(result.checked === undefined ? {} : { checked: structuredClone(result.checked) }) };
+            source.artifact = { path: result.log_path };
         }
+        return source;
     }
     // API call with retry logic for transient errors
-    async callAPI(request, signal) {
-        const { maxAttempts, baseDelayMs: baseDelay } = this.config.apiRetry;
+    async callAPI(request, onProviderObservation, signal, checkpointContext, onReturnedResponse, onUsage) {
+        const { maxAttempts, recoveryWindowMs } = this.config.apiRetry;
         const timeoutMs = this.config.llmRequestTimeoutMs;
         if (this.backend.handlesTransportRetries?.(request) === true) {
             request = { ...request, transportTurnId: request.transportTurnId ?? randomUUID() };
@@ -1638,11 +2449,23 @@ INVESTIGATION STRATEGY — before making tool calls to explore or debug, follow
         // model like deepseek can regenerate the turn instead of killing the run.
         const useStream = process.env.ZTC_NO_STREAM !== '1' && !this.backend.streamsSyntheticallyFor?.(request);
         let answerOutputEmitted = false;
-        for (let attempt = 1; attempt <= maxAttempts; attempt++) {
+        let effectObserved = false;
+        let recoveryStartedAt;
+        let lastReason = 'Server temporarily unavailable';
+        const canRegenerate = () => this.backend.allowsRequestRetryAfterFailure?.(request) !== false;
+        const returned = (response) => { onReturnedResponse?.(response); return response; };
+        for (let attempt = 1;; attempt++) {
             if (signal?.aborted) {
                 throw new AgentError('Cancelled', 'CANCELLED');
             }
+            if (recoveryStartedAt !== undefined && recoveryWindowMs !== null
+                && Date.now() - recoveryStartedAt >= recoveryWindowMs) {
+                throw new AgentError(lastReason, 'API_ERROR');
+            }
+            if (attempt > 1)
+                this.emit({ type: 'thinking_start' });
             const attemptController = new AbortController();
+            let providerAttemptActive = true;
             let timedOut = false;
             let removeAbortListener;
             // Inactivity guard, not a total-duration cap: harness-owning backends
@@ -1659,30 +2482,47 @@ INVESTIGATION STRATEGY — before making tool calls to explore or debug, follow
                 // this to tell a user cancel (skip failover) from a hung account (rotate).
                 userSignal: signal,
                 timeoutMs,
-                onActivity: () => touchActivity(),
+                onActivity: () => {
+                    if (providerAttemptActive && !signal?.aborted && !attemptController.signal.aborted)
+                        touchActivity();
+                },
                 // A backend reconnect is a sign of life too: the Router is still holding
                 // the turn, so the inactivity guard must not fire during the backoff.
                 onTransportRetry: (info) => {
+                    if (!providerAttemptActive || signal?.aborted || attemptController.signal.aborted)
+                        return;
                     touchActivity();
                     this.emit({
                         type: 'api_retry',
                         attempt: info.attempt,
                         maxAttempts: info.maxAttempts,
                         delay: info.delayMs,
-                        reason: 'Connection to the LLM endpoint dropped',
+                        reason: info.rateLimited ? 'Rate limit exceeded' : 'Connection to the LLM endpoint dropped',
+                        ...(info.rateLimited ? { rateLimited: true } : {}),
                     });
                 },
                 onObservation: (observation) => {
-                    touchActivity();
-                    request.onObservation?.(observation);
+                    if (providerAttemptActive && !signal?.aborted && !attemptController.signal.aborted) {
+                        touchActivity();
+                        if (observation.kind !== 'reasoning')
+                            effectObserved = true;
+                    }
+                    // Original reports remain evidence after retirement; liveness and
+                    // visible progress must stay with the request that produced them.
+                    return onProviderObservation(observation, () => providerAttemptActive && !signal?.aborted && !attemptController.signal.aborted);
                 },
                 onToolCall: async (name, args) => {
+                    if (!providerAttemptActive || signal?.aborted || attemptController.signal.aborted) {
+                        throw new AgentError('Provider request retired or cancelled; no new tool call was admitted.', 'CANCELLED');
+                    }
+                    effectObserved = true;
                     // A tool stops when the caller cancels or this provider attempt times
                     // out, whichever comes first.
-                    const result = await this.executeHarnessToolCall(name, args, {
+                    const result = await this.executeHarnessToolCallWithCheckpoint(name, args, {
                         signal: signal ? AbortSignal.any([signal, attemptController.signal]) : attemptController.signal,
                         onActivity: touchActivity,
-                    });
+                        onUsage,
+                    }, checkpointContext);
                     return result.output;
                 },
             };
@@ -1717,34 +2557,52 @@ INVESTIGATION STRATEGY — before making tool calls to explore or debug, follow
                     this._lastResponseStreamed = true;
                     try {
                         return await Promise.race([
-                            this.streamAndAssemble(guardedRequest, signal, () => { answerOutputEmitted = true; }),
+                            this.streamAndAssemble(guardedRequest, signal, () => { answerOutputEmitted = true; }, onUsage).then(returned),
                             guardPromise,
                         ]);
                     }
                     catch (streamErr) {
+                        if (this.toolCheckpointFailure)
+                            throw this.toolCheckpointFailure;
                         // If streaming failed before emitting anything (and not because of
                         // cancel/timeout), fall back to the buffered generate() for this
                         // attempt — never regress a turn just because generateStream can't
                         // serve this request.
                         if (this.backend.allowsBufferedFallbackAfterStreamFailure?.(guardedRequest) === false
-                            || answerOutputEmitted || timedOut || signal?.aborted
+                            || !canRegenerate() || effectObserved || answerOutputEmitted || timedOut || signal?.aborted
                             || (streamErr instanceof AgentError && streamErr.code === 'CANCELLED')) {
                             throw streamErr;
                         }
                         this._lastResponseStreamed = false;
                         return await Promise.race([
-                            this.backend.generate(guardedRequest),
+                            this.backend.generate(guardedRequest).then(response => {
+                                if (response.usage)
+                                    onUsage?.(response.usage);
+                                return returned(response);
+                            }),
                             guardPromise,
                         ]);
                     }
                 }
                 this._lastResponseStreamed = false;
                 return await Promise.race([
-                    this.backend.generate(guardedRequest),
+                    this.backend.generate(guardedRequest).then(response => {
+                        if (response.usage)
+                            onUsage?.(response.usage);
+                        return returned(response);
+                    }),
                     guardPromise,
                 ]);
             }
             catch (err) {
+                onUsage?.({ inputTokens: 0, outputTokens: 0, totalTokens: 0, estimated: true, unreported: true });
+                providerAttemptActive = false;
+                if (this.toolCheckpointFailure)
+                    throw this.toolCheckpointFailure;
+                if (err instanceof NativeObservationLimitError) {
+                    this.nativeEvidenceFailure ??= new AgentError(err.message, 'NATIVE_OBSERVATION_LIMIT');
+                    throw this.nativeEvidenceFailure;
+                }
                 if (err instanceof AgentError && err.code === 'CANCELLED') {
                     throw err;
                 }
@@ -1759,7 +2617,7 @@ INVESTIGATION STRATEGY — before making tool calls to explore or debug, follow
                 // — re-streaming would duplicate that text in the UI. Fail the turn
                 // instead. (Connect-time failures, and failures during the reasoning
                 // phase only, still retry.)
-                if (useStream && answerOutputEmitted) {
+                if (effectObserved || !canRegenerate() || useStream && answerOutputEmitted) {
                     throw new AgentError(this.parseAPIError(error).reason, 'API_ERROR');
                 }
                 const { retryable, reason, kind } = this.parseAPIError(error);
@@ -1770,20 +2628,37 @@ INVESTIGATION STRATEGY — before making tool calls to explore or debug, follow
                 // attempt resumes the same Router-buffered turn instead of appending a
                 // duplicate. Only a failure AFTER answer text is unrecoverable, and the
                 // answerOutputEmitted guard above already handled that case.
-                if (!retryable || attempt === maxAttempts) {
+                if (!retryable || maxAttempts === 1 || attempt >= maxAttempts && recoveryWindowMs === 0) {
                     if (kind === 'context_overflow') {
                         throw new ContextOverflowError(reason, request, error.message);
                     }
                     throw new AgentError(reason, 'API_ERROR');
                 }
-                // Calculate delay with exponential backoff
-                const delay = baseDelay * Math.pow(2, attempt - 1);
+                lastReason = reason;
+                const recovering = attempt >= maxAttempts;
+                if (recovering)
+                    recoveryStartedAt ??= Date.now();
+                const elapsedMs = recoveryStartedAt === undefined ? 0 : Math.max(0, Date.now() - recoveryStartedAt);
+                if (recovering && recoveryWindowMs !== null && elapsedMs >= recoveryWindowMs) {
+                    throw new AgentError(reason, 'API_ERROR');
+                }
+                // Keep the exact pending inference alive. Never resubmit the user turn
+                // or revisit already checkpointed tool results to recover an endpoint.
+                let delay = Math.max(apiRetryDelayMs(attempt, this.config.apiRetry), retryAfterDelayMs(error));
+                if (recovering) {
+                    delay = Math.max(1, delay);
+                    if (recoveryWindowMs !== null)
+                        delay = Math.min(delay, recoveryWindowMs - elapsedMs);
+                }
                 this.emit({
                     type: 'api_retry',
                     attempt,
                     maxAttempts,
                     delay,
-                    reason
+                    reason,
+                    phase: recovering ? 'recovery' : 'retry',
+                    elapsedMs,
+                    ...(kind === 'rate_limit' ? { rateLimited: true } : {}),
                 });
                 removeAbortListener?.();
                 removeAbortListener = undefined;
@@ -1791,15 +2666,16 @@ INVESTIGATION STRATEGY — before making tool calls to explore or debug, follow
                 await waitForRetryDelay(delay, signal);
             }
             finally {
+                providerAttemptActive = false;
                 removeAbortListener?.();
             }
         }
-        // Should never reach here, but TypeScript needs it
-        throw new AgentError('Unexpected retry loop exit', 'API_ERROR');
     }
     // Parse API error to determine if retryable and extract user-friendly message
     parseAPIError(error) {
-        const message = error.message;
+        // A provider may embed an oversized/malformed diagnostic in an Error.
+        // Keep all parsing bounded even for transports with their own error type.
+        const message = error.message.slice(0, 64 * 1024);
         // Check for status codes in error message
         const statusMatch = message.match(/API error \((\d+)\)/);
         const statusCode = statusMatch ? parseInt(statusMatch[1], 10) : 0;
@@ -1811,9 +2687,12 @@ INVESTIGATION STRATEGY — before making tool calls to explore or debug, follow
         let errorMessage = '';
         let admissionMessage = '';
         try {
-            const jsonMatch = message.match(/:\s*(\{[\s\S]*\})\s*$/);
-            if (jsonMatch) {
-                const parsed = JSON.parse(jsonMatch[1]);
+            // Provider envelopes start with an object after the diagnostic prefix.
+            // Index searches avoid a greedy regex restarting at every forged colon.
+            const objectStart = message.indexOf('{');
+            const objectEnd = message.lastIndexOf('}');
+            if (objectStart >= 0 && objectEnd >= objectStart) {
+                const parsed = JSON.parse(message.slice(objectStart, objectEnd + 1));
                 const errorPayload = parsed.error;
                 if (typeof errorPayload === 'string') {
                     errorMessage = errorPayload;
@@ -1848,6 +2727,11 @@ INVESTIGATION STRATEGY — before making tool calls to explore or debug, follow
         catch {
             // Not valid JSON, use raw message
         }
+        if (statusCode === 410 && message.startsWith('ZRouter API error (')
+            && ['stream_producer_lost', 'stream_producer_failed', 'stream_resume_expired'].includes(errorCode)) {
+            return { retryable: false, reason: 'The Router stream was interrupted and cannot be resumed. '
+                    + 'Send a message to continue from the existing conversation.' };
+        }
         // Detected before the generic 400 bucket so the host can dump the request.
         if (errorCode === 'context_length_exceeded' || isContextOverflowMessage(`${errorMessage} ${message}`)) {
             return { retryable: false, reason: 'Context window exceeded', kind: 'context_overflow' };
@@ -1857,10 +2741,15 @@ INVESTIGATION STRATEGY — before making tool calls to explore or debug, follow
             return { retryable: true, reason: 'API is overloaded' };
         }
         if (statusCode === 429 || errorType === 'rate_limit_error' || errorType === 'RESOURCE_EXHAUSTED') {
-            return { retryable: true, reason: 'Rate limit exceeded' };
+            return { retryable: true, reason: 'Rate limit exceeded', kind: 'rate_limit' };
         }
-        if (statusCode === 503 || statusCode === 502 || statusCode === 500 || errorType === 'UNAVAILABLE' || errorType === 'INTERNAL') {
-            return { retryable: true, reason: 'Server temporarily unavailable' };
+        if (statusCode === 504 || statusCode === 503 || statusCode === 502 || statusCode === 500 || errorType === 'UNAVAILABLE' || errorType === 'INTERNAL') {
+            // Only Router admission guidance is public. Provider diagnostics stay
+            // private; a bounded response-header ID supplies support correlation.
+            const requestId = /(?:fly-request-id|x-request-id)=([A-Za-z0-9._:-]{1,128})(?:[ \]]|$)/.exec(message)?.[1];
+            const detail = [admissionMessage.trim().replace(/\s+/g, ' '), requestId && `request_id: ${requestId}`].filter(Boolean).join('; ');
+            const cause = detail ? `: ${detail.length > 160 ? `${detail.slice(0, 159)}…` : detail}` : '';
+            return { retryable: true, reason: `Upstream server error (${statusCode || 'no status'})${cause}` };
         }
         // Non-retryable errors with clean messages
         if (statusCode === 401 || errorType === 'authentication_error' || errorType === 'UNAUTHENTICATED') {
@@ -1876,7 +2765,7 @@ INVESTIGATION STRATEGY — before making tool calls to explore or debug, follow
         // unsubscribed user hits on the default route, so say what to do. Only the
         // Router's H3 envelope may supply its public wording; any other 402 body
         // stays private behind the canonical message.
-        if (statusCode === 402) {
+        if (statusCode === 402 || errorCode === 'billing_required') {
             const guidance = 'Subscribe in Zerg Router (Dashboard → Billing), or choose another model with /model.';
             return {
                 retryable: false,