chainlesschain 0.162.188 → 0.162.193

package/src/repl/agent-repl.js

@@ -22,6 +22,8 @@ import chalk from "chalk";
 import fs from "fs";
 import os from "os";
 import path from "path";
+import { randomUUID } from "node:crypto";
+import { isPromise, isProxy } from "node:util/types";
 import { logger } from "../lib/logger.js";
 import { getPlanModeManager, PlanState } from "../lib/plan-mode.js";
 import { createVimState, feedNormalKey } from "../lib/repl-vim.js";
@@ -45,15 +47,35 @@ import {
   startSession as jsonlStartSession,
   appendUserMessage,
   appendAssistantMessage,
-  appendCompactEvent,
+  appendCompactEventIfMessagesMatch,
   appendTokenUsage,
   appendToolCallCompact,
   appendLlmRetryCompact,
   appendEvent,
-  rebuildMessages,
+  appendAuthorityEvent,
+  isUnsafeSessionId,
   sessionExists,
+  forkSession,
 } from "../harness/jsonl-session-store.js";
 import { classifyStreamRetryReason } from "../lib/stream-retry.js";
+import {
+  createSessionMcpLedgerSink,
+  formatMcpLedgerRecoveryNotice,
+  loadMcpLedgerRecovery,
+} from "../lib/mcp-call-ledger-store.js";
+import { createMcpHostRecoveryRuntime } from "../lib/mcp-host-recovery-runtime.js";
+import {
+  isVerifiedSessionHostSnapshot,
+  readSessionHostResumeState,
+} from "../lib/session-host-snapshot.js";
+import {
+  preserveDurableSystemMessageProvenance,
+  projectCanonicalResumeMessages,
+} from "../lib/session-message-provenance.js";
+import {
+  MCP_RECOVERY_INVALID_CODE,
+  classifyMcpRecoveryAdmission,
+} from "../lib/mcp-ledger-recovery-admission.js";
 import { CLISkillLoader } from "../lib/skill-loader.js";
 import { storeMemory, consolidateMemory } from "../lib/hierarchical-memory.js";
 import { CLIContextEngineering } from "../lib/cli-context-engineering.js";
@@ -87,10 +109,11 @@ import {
 import { HookEvents } from "../lib/hook-manager.js";
 import { IterationBudget } from "../lib/iteration-budget.js";
 import { resolveAgentMcp } from "../runtime/mcp-config.js";
-import { collapseConsecutiveMessagesInPlace } from "../runtime/message-roles.js";
+import { mergeConsecutiveMessages } from "../runtime/message-roles.js";
 import {
   AGENT_TOOLS,
   buildSystemPrompt,
+  chatWithTools,
   executeTool as coreExecuteTool,
   agentLoop as coreAgentLoop,
   formatToolArgs,
@@ -111,8 +134,15 @@ import { resolveSlashMacro } from "./slash-macro.js";
 import { expandMcpPrompt, renderMcpSurface } from "./mcp-prompt.js";
 import { newCostStore, addUsage } from "./session-cost.js";
 import { extractPluginUsageAttribution } from "../lib/plugin-usage-attribution.js";
+import { formatManagedCheckpointEvent } from "../lib/managed-checkpoint-render.js";
 import { parseThinkCommand, parseEffortCommand } from "./think-command.js";
-import { parseBtwCommand, buildAsideBlock, applyAside } from "./btw-command.js";
+import {
+  parseBtwCommand,
+  parseNoteNextCommand,
+  runBtwQuestion,
+  buildAsideBlock,
+  applyAside,
+} from "./btw-command.js";
 import { shouldStreamLive } from "./stream-decision.js";
 import { emptyTurnNotice } from "./empty-turn-notice.js";
 import {
@@ -295,11 +325,11 @@ export async function agentLoop(messages, options) {
   // IN PLACE: `coreAgentLoop` mutates this same array (appending assistant/tool
   // turns), and the REPL reuses it across turns, so folding a copy would leave
   // the degenerate `[user, user]` pair in the persistent history and re-break
-  // the next turn. Safe in place because the gated turn is still tool-free (a
-  // resumed transcript holds only user/assistant/system) and the helper never
-  // folds `tool` turns regardless.
+  // the next turn. The tail helper validates the complete raw transcript first
+  // and folds only an exact plain `{role, content}` pair, so recovery authority
+  // can never disappear during this live one-shot normalization.
   if (options.mergeRoles) {
-    collapseConsecutiveMessagesInPlace(messages);
+    collapseValidatedPlainReplTailInPlace(messages);
   }
   const usageEvents = [];
   // Visible cross-vendor fallback notice: a silent switch from the configured
@@ -340,7 +370,14 @@ export async function agentLoop(messages, options) {
         /* advisory — never break the turn */
       }
     }
-    if (event.type === "checkpoint") {
+    const managedCheckpointLine = formatManagedCheckpointEvent(event);
+    if (managedCheckpointLine) {
+      const render =
+        event.type === "managed-checkpoint-error" || event.coverage === "none"
+          ? chalk.yellow
+          : chalk.gray;
+      process.stdout.write(render(`${managedCheckpointLine}\n`));
+    } else if (event.type === "checkpoint") {
       // Remember which file snapshot lines up with the live conversation so
       // `/rewind <n>` can restore code + conversation together (Claude-Code
       // parity). atMessageCount = messages.length at snapshot time; see
@@ -471,20 +508,1562 @@ export async function agentLoop(messages, options) {
       return { content: event.content, usageEvents, thinking: event.thinking };
     }
   }
-  return { content: "", usageEvents };
+  return { content: "", usageEvents };
+}
+
+const REPL_MCP_RECOVERY_CANDIDATES = new WeakSet();
+const REPL_JSONL_RESUME_CANDIDATES = new WeakSet();
+const REPL_JSONL_RESUME_ABSENCE_CANDIDATES = new WeakSet();
+const REPL_NATIVE_PROMISE = Promise;
+const REPL_NATIVE_PROMISE_PROTOTYPE = Promise.prototype;
+const REPL_NATIVE_PROMISE_THEN = Promise.prototype.then;
+const REPL_NATIVE_PROMISE_CONSTRUCTOR_DESCRIPTOR = Object.freeze({
+  ...Object.getOwnPropertyDescriptor(Promise.prototype, "constructor"),
+});
+const REPL_NATIVE_PROMISE_SPECIES_DESCRIPTOR = Object.freeze({
+  ...Object.getOwnPropertyDescriptor(Promise, Symbol.species),
+});
+const REPL_SAFE_PROMISE_CONSTRUCTOR = Object.freeze(
+  Object.defineProperty(Object.create(null), Symbol.species, {
+    configurable: false,
+    enumerable: false,
+    writable: false,
+    value: null,
+  }),
+);
+const REPL_NATIVE_PROMISE_REJECTION_HANDLER = () => {};
+const REPL_PAYLOAD_DIGEST = /^sha256:[0-9a-f]{64}$/;
+const REPL_AUTHORITY_HASH = /^[0-9a-f]{64}$/;
+const REPL_RESUME_SESSION_ID_MAX_BYTES = 128;
+const REPL_RESUME_SESSION_ID_PATTERN = /^[A-Za-z0-9][A-Za-z0-9._@-]*$/;
+const REPL_WINDOWS_DEVICE_NAME =
+  /^(?:con|prn|aux|nul|com[1-9]|lpt[1-9])(?:\.|$)/i;
+const REPL_RESUME_ROLES = new Set(["system", "user", "assistant", "tool"]);
+const REPL_MCP_EFFECTS = new Set(["read", "unknown", "write", "destructive"]);
+const REPL_REPLAY_DENY_FIELDS = new Set([
+  "ledgerId",
+  "serverName",
+  "toolName",
+  "inputBytes",
+  "replayDigest",
+]);
+const REPL_MCP_REMEDIATIONS = new Set([
+  "inspect_transcript",
+  "adjudicate_started_calls",
+  "exact_replay_denied",
+]);
+
+function invalidReplRecovery(message, code = MCP_RECOVERY_INVALID_CODE) {
+  const error = new TypeError(message);
+  error.code = code;
+  return error;
+}
+
+function validateReplResumeSessionId(sessionId) {
+  if (
+    isUnsafeSessionId(sessionId) ||
+    Buffer.byteLength(sessionId, "utf8") > REPL_RESUME_SESSION_ID_MAX_BYTES ||
+    !REPL_RESUME_SESSION_ID_PATTERN.test(sessionId) ||
+    REPL_WINDOWS_DEVICE_NAME.test(sessionId) ||
+    sessionId.endsWith(".") ||
+    sessionId.normalize("NFC") !== sessionId
+  ) {
+    throw invalidReplRecovery(
+      "REPL resume session id is invalid",
+      "CC_REPL_SESSION_ID_INVALID",
+    );
+  }
+  return sessionId;
+}
+
+function brandedFrozenCandidate(brand, value) {
+  const candidate = Object.freeze(value);
+  brand.add(candidate);
+  return candidate;
+}
+
+function safeRecoveryErrorValue(error, key, fallback) {
+  try {
+    if (error && !isProxy(error)) {
+      const descriptor = Object.getOwnPropertyDescriptor(error, key);
+      if (descriptor && "value" in descriptor) return descriptor.value;
+    }
+  } catch {
+    // Malformed errors are diagnostic input, never recovery authority.
+  }
+  return fallback;
+}
+
+function replMcpRecoveryError(error, fallbackCode) {
+  const message = safeRecoveryErrorValue(
+    error,
+    "message",
+    "REPL session recovery failed",
+  );
+  let cause = new Error("REPL session recovery failed");
+  try {
+    if (!isProxy(error) && error instanceof Error) cause = error;
+  } catch {
+    // Keep the inert fallback cause for hostile diagnostic objects.
+  }
+  const wrapped = new Error(
+    typeof message === "string" && message
+      ? message
+      : "REPL session recovery failed",
+    { cause },
+  );
+  const code = safeRecoveryErrorValue(error, "code", fallbackCode);
+  wrapped.code = typeof code === "string" && code ? code : fallbackCode;
+  return wrapped;
+}
+
+function samePropertyDescriptor(actual, expected) {
+  if (!actual || !expected) return actual === expected;
+  if (
+    actual.configurable !== expected.configurable ||
+    actual.enumerable !== expected.enumerable
+  ) {
+    return false;
+  }
+  if ("value" in expected) {
+    return (
+      "value" in actual &&
+      actual.value === expected.value &&
+      actual.writable === expected.writable
+    );
+  }
+  return (
+    !("value" in actual) &&
+    actual.get === expected.get &&
+    actual.set === expected.set
+  );
+}
+
+function unconsumableNativePromise(subject) {
+  return invalidReplRecovery(
+    `${subject} is a native Promise with an unsafe non-configurable constructor; ` +
+      "its producer must observe the rejection",
+    "CC_REPL_NATIVE_PROMISE_UNCONSUMABLE",
+  );
+}
+
+function consumeNativeReplPromise(value, subject) {
+  const prototype = Object.getPrototypeOf(value);
+  if (isProxy(prototype)) throw unconsumableNativePromise(subject);
+
+  const constructorDescriptor = Object.getOwnPropertyDescriptor(
+    value,
+    "constructor",
+  );
+  const intrinsicSpeciesIntact = samePropertyDescriptor(
+    Object.getOwnPropertyDescriptor(REPL_NATIVE_PROMISE, Symbol.species),
+    REPL_NATIVE_PROMISE_SPECIES_DESCRIPTOR,
+  );
+  const inheritedIntrinsicConstructor =
+    !constructorDescriptor &&
+    prototype === REPL_NATIVE_PROMISE_PROTOTYPE &&
+    samePropertyDescriptor(
+      Object.getOwnPropertyDescriptor(
+        REPL_NATIVE_PROMISE_PROTOTYPE,
+        "constructor",
+      ),
+      REPL_NATIVE_PROMISE_CONSTRUCTOR_DESCRIPTOR,
+    ) &&
+    intrinsicSpeciesIntact;
+  const ownIntrinsicConstructor =
+    constructorDescriptor &&
+    "value" in constructorDescriptor &&
+    (constructorDescriptor.value === undefined ||
+      (constructorDescriptor.value === REPL_NATIVE_PROMISE &&
+        intrinsicSpeciesIntact));
+
+  if (inheritedIntrinsicConstructor || ownIntrinsicConstructor) {
+    Reflect.apply(REPL_NATIVE_PROMISE_THEN, value, [
+      undefined,
+      REPL_NATIVE_PROMISE_REJECTION_HANDLER,
+    ]);
+    return;
+  }
+
+  const canShadow = constructorDescriptor
+    ? constructorDescriptor.configurable === true
+    : Object.isExtensible(value);
+  if (!canShadow) {
+    // Promise.prototype.then necessarily performs SpeciesConstructor, which
+    // would execute this hostile constructor/accessor. ECMAScript exposes no
+    // separate hook-free operation that marks a rejection handled. Fail closed
+    // without pretending the Promise was consumed; the producer must have
+    // attached its own rejection observer before returning this invalid value.
+    throw unconsumableNativePromise(subject);
+  }
+
+  Object.defineProperty(value, "constructor", {
+    configurable: true,
+    enumerable: constructorDescriptor?.enumerable ?? false,
+    writable: false,
+    value: REPL_SAFE_PROMISE_CONSTRUCTOR,
+  });
+  try {
+    Reflect.apply(REPL_NATIVE_PROMISE_THEN, value, [
+      undefined,
+      REPL_NATIVE_PROMISE_REJECTION_HANDLER,
+    ]);
+  } finally {
+    if (constructorDescriptor) {
+      Object.defineProperty(value, "constructor", constructorDescriptor);
+    } else {
+      Reflect.deleteProperty(value, "constructor");
+    }
+  }
+}
+
+function synchronousReplRecoveryValue(value, subject) {
+  if (
+    value === null ||
+    value === undefined ||
+    (typeof value !== "object" && typeof value !== "function")
+  ) {
+    return value;
+  }
+  if (isProxy(value)) {
+    throw invalidReplRecovery(`${subject} must not be a Proxy`);
+  }
+
+  // Consume a genuine Promise before inspecting any user-controlled `then`
+  // descriptor. A Promise can shadow `then` with an accessor or data property;
+  // reading that descriptor first would leave an already-rejected Promise
+  // unobserved even though the recovery boundary correctly rejected it.
+  if (isPromise(value)) {
+    consumeNativeReplPromise(value, subject);
+    throw invalidReplRecovery(`${subject} must be returned synchronously`);
+  }
+
+  let prototype = value;
+  while (prototype) {
+    // An ordinary object can hide a Proxy in its prototype chain. Check every
+    // level before reflection so no getOwnPropertyDescriptor/getPrototypeOf
+    // trap is executed while rejecting untrusted recovery evidence.
+    if (isProxy(prototype)) {
+      throw invalidReplRecovery(`${subject} must not inherit from a Proxy`);
+    }
+    const thenDescriptor = Object.getOwnPropertyDescriptor(prototype, "then");
+    if (thenDescriptor) {
+      if (!("value" in thenDescriptor)) {
+        throw invalidReplRecovery(`${subject}.then must not be an accessor`);
+      }
+      if (typeof thenDescriptor.value === "function") {
+        // Never invoke an arbitrary user-supplied thenable capability.
+        throw invalidReplRecovery(`${subject} must be returned synchronously`);
+      }
+      break;
+    }
+    prototype = Object.getPrototypeOf(prototype);
+  }
+  return value;
+}
+
+function plainDataDescriptors(value, subject) {
+  synchronousReplRecoveryValue(value, subject);
+  if (!value || typeof value !== "object" || Array.isArray(value)) {
+    throw invalidReplRecovery(`${subject} must be a plain data object`);
+  }
+  const prototype = Object.getPrototypeOf(value);
+  if (prototype !== Object.prototype && prototype !== null) {
+    throw invalidReplRecovery(`${subject} must have a plain prototype`);
+  }
+  const descriptors = Object.getOwnPropertyDescriptors(value);
+  for (const key of Reflect.ownKeys(descriptors)) {
+    if (typeof key === "symbol" || !("value" in descriptors[key])) {
+      throw invalidReplRecovery(`${subject} contains an accessor or symbol`);
+    }
+  }
+  return descriptors;
+}
+
+function dataDescriptorValue(
+  descriptors,
+  key,
+  subject,
+  { required = true, fallback = null } = {},
+) {
+  const descriptor = descriptors[key];
+  if (!descriptor) {
+    if (!required) return fallback;
+    throw invalidReplRecovery(`${subject}.${key} is missing`);
+  }
+  if (!("value" in descriptor)) {
+    throw invalidReplRecovery(`${subject}.${key} must be a data property`);
+  }
+  return descriptor.value;
+}
+
+function snapshotDataArray(value, subject, mapper) {
+  synchronousReplRecoveryValue(value, subject);
+  if (!Array.isArray(value) || isProxy(value)) {
+    throw invalidReplRecovery(`${subject} must be a non-Proxy array`);
+  }
+  const descriptors = Object.getOwnPropertyDescriptors(value);
+  for (const key of Reflect.ownKeys(descriptors)) {
+    if (typeof key === "symbol" || !("value" in descriptors[key])) {
+      throw invalidReplRecovery(`${subject} contains an accessor or symbol`);
+    }
+  }
+  const length = descriptors.length?.value;
+  if (!Number.isSafeInteger(length) || length < 0) {
+    throw invalidReplRecovery(`${subject}.length is invalid`);
+  }
+  const snapshots = [];
+  for (let index = 0; index < length; index += 1) {
+    const descriptor = descriptors[String(index)];
+    if (!descriptor || !("value" in descriptor)) {
+      throw invalidReplRecovery(`${subject}[${index}] is not plain data`);
+    }
+    snapshots.push(mapper(descriptor.value, index));
+  }
+  return Object.freeze(snapshots);
+}
+
+function requiredRecoveryString(value, subject, { nullable = false } = {}) {
+  if (value === null && nullable) return null;
+  if (typeof value !== "string" || (!nullable && !value)) {
+    throw invalidReplRecovery(`${subject} must be a string`);
+  }
+  return value;
+}
+
+function snapshotReplMcpRecord(record, index) {
+  const subject = `MCP recovery unsettled[${index}]`;
+  const descriptors = plainDataDescriptors(record, subject);
+  const effectContract = dataDescriptorValue(
+    descriptors,
+    "effectContract",
+    subject,
+  );
+  const effectDescriptors = plainDataDescriptors(
+    effectContract,
+    `${subject}.effectContract`,
+  );
+  const effect = requiredRecoveryString(
+    dataDescriptorValue(
+      effectDescriptors,
+      "effect",
+      `${subject}.effectContract`,
+    ),
+    `${subject}.effectContract.effect`,
+  );
+  if (!REPL_MCP_EFFECTS.has(effect)) {
+    throw invalidReplRecovery(`${subject}.effectContract.effect is invalid`);
+  }
+  return Object.freeze({
+    ledgerId: requiredRecoveryString(
+      dataDescriptorValue(descriptors, "ledgerId", subject),
+      `${subject}.ledgerId`,
+    ),
+    serverName: requiredRecoveryString(
+      dataDescriptorValue(descriptors, "serverName", subject),
+      `${subject}.serverName`,
+    ),
+    toolName: requiredRecoveryString(
+      dataDescriptorValue(descriptors, "toolName", subject),
+      `${subject}.toolName`,
+    ),
+    effectContract: Object.freeze({ effect }),
+  });
+}
+
+function snapshotReplMcpIncident(incident, index) {
+  const subject = `MCP recovery incidents[${index}]`;
+  const descriptors = plainDataDescriptors(incident, subject);
+  return Object.freeze({
+    code: requiredRecoveryString(
+      dataDescriptorValue(descriptors, "code", subject),
+      `${subject}.code`,
+    ),
+    ledgerId: requiredRecoveryString(
+      dataDescriptorValue(descriptors, "ledgerId", subject, {
+        required: false,
+        fallback: null,
+      }),
+      `${subject}.ledgerId`,
+      { nullable: true },
+    ),
+  });
+}
+
+function snapshotReplReplayDeny(entry, index) {
+  const subject = `MCP recovery replayDenied[${index}]`;
+  const descriptors = plainDataDescriptors(entry, subject);
+  const fields = Object.keys(descriptors);
+  if (
+    fields.length !== REPL_REPLAY_DENY_FIELDS.size ||
+    fields.some((field) => !REPL_REPLAY_DENY_FIELDS.has(field))
+  ) {
+    throw invalidReplRecovery(`${subject} has an invalid exact schema`);
+  }
+  const snapshot = Object.freeze({
+    ledgerId: requiredRecoveryString(
+      dataDescriptorValue(descriptors, "ledgerId", subject),
+      `${subject}.ledgerId`,
+    ),
+    serverName: requiredRecoveryString(
+      dataDescriptorValue(descriptors, "serverName", subject),
+      `${subject}.serverName`,
+    ),
+    toolName: requiredRecoveryString(
+      dataDescriptorValue(descriptors, "toolName", subject),
+      `${subject}.toolName`,
+    ),
+    inputBytes: dataDescriptorValue(descriptors, "inputBytes", subject),
+    replayDigest: requiredRecoveryString(
+      dataDescriptorValue(descriptors, "replayDigest", subject),
+      `${subject}.replayDigest`,
+    ),
+  });
+  if (
+    !Number.isInteger(snapshot.inputBytes) ||
+    snapshot.inputBytes < 0 ||
+    !REPL_PAYLOAD_DIGEST.test(snapshot.replayDigest)
+  ) {
+    throw invalidReplRecovery(`${subject} has an invalid exact identity`);
+  }
+  return snapshot;
+}
+
+function strictReplMcpRecoverySnapshot(recovery, sessionId) {
+  const descriptors = plainDataDescriptors(recovery, "MCP recovery");
+  const recoverySessionId = requiredRecoveryString(
+    dataDescriptorValue(descriptors, "sessionId", "MCP recovery"),
+    "MCP recovery.sessionId",
+  );
+  if (recoverySessionId !== sessionId) {
+    throw invalidReplRecovery("MCP recovery session does not match the target");
+  }
+  if (dataDescriptorValue(descriptors, "verified", "MCP recovery") !== true) {
+    throw invalidReplRecovery("MCP recovery was not verified");
+  }
+  const unsettled = snapshotDataArray(
+    dataDescriptorValue(descriptors, "unsettled", "MCP recovery"),
+    "MCP recovery.unsettled",
+    snapshotReplMcpRecord,
+  );
+  const incidents = snapshotDataArray(
+    dataDescriptorValue(descriptors, "incidents", "MCP recovery"),
+    "MCP recovery.incidents",
+    snapshotReplMcpIncident,
+  );
+  // Exact-replay denies are authority, not presentation samples. Preserve and
+  // freeze every entry: truncation would silently re-enable a denied call.
+  const replayDenied = snapshotDataArray(
+    dataDescriptorValue(descriptors, "replayDenied", "MCP recovery"),
+    "MCP recovery.replayDenied",
+    snapshotReplReplayDeny,
+  );
+  const headHash = requiredRecoveryString(
+    dataDescriptorValue(descriptors, "headHash", "MCP recovery"),
+    "MCP recovery.headHash",
+    { nullable: true },
+  );
+  const recoveryDigest = requiredRecoveryString(
+    dataDescriptorValue(descriptors, "recoveryDigest", "MCP recovery"),
+    "MCP recovery.recoveryDigest",
+  );
+  const remediation = requiredRecoveryString(
+    dataDescriptorValue(descriptors, "remediation", "MCP recovery"),
+    "MCP recovery.remediation",
+    { nullable: true },
+  );
+  if (
+    (headHash !== null && !REPL_AUTHORITY_HASH.test(headHash)) ||
+    !REPL_PAYLOAD_DIGEST.test(recoveryDigest) ||
+    (remediation !== null && !REPL_MCP_REMEDIATIONS.has(remediation))
+  ) {
+    throw invalidReplRecovery("MCP recovery authority metadata is invalid");
+  }
+  const expectedRemediation =
+    incidents.length > 0
+      ? "inspect_transcript"
+      : unsettled.length > 0
+        ? "adjudicate_started_calls"
+        : replayDenied.length > 0
+          ? "exact_replay_denied"
+          : null;
+  if (remediation !== expectedRemediation) {
+    throw invalidReplRecovery("MCP recovery remediation is inconsistent");
+  }
+
+  const snapshot = Object.freeze({
+    sessionId: recoverySessionId,
+    verified: true,
+    unsettled,
+    incidents,
+    replayDenied,
+    headHash,
+    recoveryDigest,
+    remediation,
+  });
+  const admission = classifyMcpRecoveryAdmission(snapshot);
+  if (admission.reasonCode) {
+    throw invalidReplRecovery(
+      "MCP recovery projection is malformed",
+      admission.reasonCode,
+    );
+  }
+  return snapshot;
+}
+
+function dependencyDataFunction(dependencies, key, fallback) {
+  if (dependencies == null) return fallback;
+  if (typeof dependencies !== "object" || isProxy(dependencies)) {
+    throw invalidReplRecovery("REPL recovery dependencies are invalid");
+  }
+  const descriptor = Object.getOwnPropertyDescriptor(dependencies, key);
+  if (!descriptor) return fallback;
+  if (!("value" in descriptor) || typeof descriptor.value !== "function") {
+    throw invalidReplRecovery(`REPL recovery dependency ${key} is invalid`);
+  }
+  return descriptor.value;
+}
+
+function replMcpRecoveryFailureNotice(error, subject = "MCP call ledger") {
+  return (
+    `MCP recovery notice — the durable ${subject} could not be verified. ` +
+    "Do not execute or retry MCP tools until the session transcript has " +
+    `been inspected (${error?.code || "CC_MCP_LEDGER_EVENT_READ_FAILED"}).`
+  );
+}
+
+function failClosedReplMcpRecoveryCandidate(
+  sessionId,
+  error,
+  fallbackCode = "CC_MCP_LEDGER_EVENT_READ_FAILED",
+  subject = "MCP call ledger",
+) {
+  const recoveryError = replMcpRecoveryError(error, fallbackCode);
+  return brandedFrozenCandidate(REPL_MCP_RECOVERY_CANDIDATES, {
+    sessionId,
+    recovery: null,
+    recoveryError,
+    notice: replMcpRecoveryFailureNotice(recoveryError, subject),
+  });
+}
+
+/**
+ * Read one target session's verified MCP recovery projection without mutating
+ * the active REPL. Callers commit the returned candidate only after the rest
+ * of a session switch (notably message rebuild) has succeeded.
+ */
+export function readReplMcpRecoveryCandidate(sessionId, dependencies = {}) {
+  try {
+    const loadRecovery = dependencyDataFunction(
+      dependencies,
+      "loadMcpLedgerRecovery",
+      loadMcpLedgerRecovery,
+    );
+    const formatNotice = dependencyDataFunction(
+      dependencies,
+      "formatMcpLedgerRecoveryNotice",
+      formatMcpLedgerRecoveryNotice,
+    );
+    return createReplMcpRecoveryCandidate(
+      sessionId,
+      synchronousReplRecoveryValue(
+        loadRecovery(sessionId),
+        "MCP recovery loader result",
+      ),
+      formatNotice,
+    );
+  } catch (error) {
+    return failClosedReplMcpRecoveryCandidate(sessionId, error);
+  }
+}
+
+function createReplMcpRecoveryCandidate(
+  sessionId,
+  recoveryValue,
+  formatNotice = formatMcpLedgerRecoveryNotice,
+) {
+  try {
+    const recovery = strictReplMcpRecoverySnapshot(recoveryValue, sessionId);
+    let notice = synchronousReplRecoveryValue(
+      formatNotice(recovery),
+      "MCP recovery formatter result",
+    );
+    if (notice !== null && typeof notice !== "string") {
+      throw invalidReplRecovery(
+        "MCP recovery formatter must return a string or null",
+      );
+    }
+    if (
+      !notice &&
+      (recovery.unsettled.length > 0 ||
+        recovery.incidents.length > 0 ||
+        recovery.replayDenied.length > 0)
+    ) {
+      notice =
+        "MCP recovery notice — interrupted MCP calls, ledger incidents, " +
+        "or exact replay denies require explicit inspection before replay.";
+    }
+    return brandedFrozenCandidate(REPL_MCP_RECOVERY_CANDIDATES, {
+      sessionId,
+      recovery,
+      recoveryError: null,
+      notice: notice || null,
+    });
+  } catch (error) {
+    return failClosedReplMcpRecoveryCandidate(sessionId, error);
+  }
+}
+
+function snapshotReplMessageValue(value, subject, ancestors = new WeakSet()) {
+  if (
+    value === null ||
+    value === undefined ||
+    typeof value === "string" ||
+    typeof value === "boolean" ||
+    (typeof value === "number" && Number.isFinite(value))
+  ) {
+    return value;
+  }
+  if (!value || typeof value !== "object" || isProxy(value)) {
+    throw invalidReplRecovery(
+      `${subject} contains a non-serializable value`,
+      "CC_REPL_SESSION_REBUILD_FAILED",
+    );
+  }
+  if (ancestors.has(value)) {
+    throw invalidReplRecovery(
+      `${subject} contains a cycle`,
+      "CC_REPL_SESSION_REBUILD_FAILED",
+    );
+  }
+  ancestors.add(value);
+  try {
+    if (Array.isArray(value)) {
+      return snapshotDataArray(value, subject, (item, index) =>
+        snapshotReplMessageValue(item, `${subject}[${index}]`, ancestors),
+      );
+    }
+    const descriptors = plainDataDescriptors(value, subject);
+    const snapshot = {};
+    for (const key of Object.keys(descriptors)) {
+      snapshot[key] = snapshotReplMessageValue(
+        descriptors[key].value,
+        `${subject}.${key}`,
+        ancestors,
+      );
+    }
+    return Object.freeze(snapshot);
+  } finally {
+    ancestors.delete(value);
+  }
+}
+
+function snapshotReplMessages(messages) {
+  try {
+    return snapshotDataArray(
+      messages,
+      "REPL session rebuild",
+      (message, index) => {
+        const snapshot = snapshotReplMessageValue(
+          message,
+          `REPL session rebuild[${index}]`,
+        );
+        if (
+          !snapshot ||
+          Array.isArray(snapshot) ||
+          typeof snapshot.role !== "string"
+        ) {
+          throw invalidReplRecovery(
+            `REPL session rebuild[${index}] is not a message`,
+            "CC_REPL_SESSION_REBUILD_FAILED",
+          );
+        }
+        return preserveDurableSystemMessageProvenance(message, snapshot);
+      },
+    );
+  } catch (cause) {
+    const error = invalidReplRecovery(
+      safeRecoveryErrorValue(cause, "message", "REPL session rebuild failed"),
+      "CC_REPL_SESSION_REBUILD_FAILED",
+    );
+    error.cause = cause;
+    throw error;
+  }
+}
+
+function canonicalPersistentReplMessages(messages) {
+  return snapshotReplMessages(
+    projectCanonicalResumeMessages(snapshotReplMessages(messages), {
+      strict: true,
+    }),
+  );
+}
+
+/**
+ * Track the exact replay projection this REPL has persisted. Compact writes
+ * compare it with the store's verified active messages under one lock, so a
+ * second host's unseen turn can never be hidden by a local auto/session-end
+ * checkpoint.
+ */
+export function createReplCompactPersistence(
+  initialMessages = [],
+  dependencies = {},
+) {
+  const appendCompact = dependencyDataFunction(
+    dependencies,
+    "appendCompactEventIfMessagesMatch",
+    appendCompactEventIfMessagesMatch,
+  );
+  let persistedMessages = canonicalPersistentReplMessages(initialMessages);
+  const replace = (messages) => {
+    persistedMessages = canonicalPersistentReplMessages(messages);
+    return persistedMessages;
+  };
+  return Object.freeze({
+    record(message) {
+      const projected = canonicalPersistentReplMessages([message]);
+      if (projected.length !== 1) {
+        throw new TypeError("Persisted REPL message is not canonical");
+      }
+      persistedMessages = Object.freeze([...persistedMessages, projected[0]]);
+      return projected[0];
+    },
+    replace,
+    persist(sessionId, payload) {
+      const canonicalMessages = canonicalPersistentReplMessages(
+        payload?.messages || [],
+      );
+      const canonicalPayload = { ...payload, messages: canonicalMessages };
+      const result = appendCompact(
+        sessionId,
+        canonicalPayload,
+        persistedMessages,
+      );
+      replace(canonicalMessages);
+      return result;
+    },
+    snapshot() {
+      return snapshotReplMessages(persistedMessages);
+    },
+  });
+}
+
+function validateRawReplReplayMessages(rebuiltMessages) {
+  for (let index = 0; index < rebuiltMessages.length; index += 1) {
+    const message = rebuiltMessages[index];
+    if (!REPL_RESUME_ROLES.has(message.role)) {
+      throw invalidReplRecovery(
+        `REPL session message[${index}] has an unsupported role`,
+        "CC_REPL_SESSION_ROLE_INVALID",
+      );
+    }
+
+    const hasToolCalls = Object.prototype.hasOwnProperty.call(
+      message,
+      "tool_calls",
+    );
+    const hasToolCallId = Object.prototype.hasOwnProperty.call(
+      message,
+      "tool_call_id",
+    );
+    if (message.role !== "assistant" && hasToolCalls) {
+      throw invalidReplRecovery(
+        `REPL session message[${index}] carries tool calls on the wrong role`,
+        "CC_REPL_SESSION_TOOL_PAIR_INVALID",
+      );
+    }
+    if (message.role !== "tool" && hasToolCallId) {
+      throw invalidReplRecovery(
+        `REPL session message[${index}] carries a tool result id on the wrong role`,
+        "CC_REPL_SESSION_TOOL_PAIR_INVALID",
+      );
+    }
+
+    if (message.role === "tool") {
+      if (
+        !hasToolCallId ||
+        typeof message.tool_call_id !== "string" ||
+        message.tool_call_id.length === 0
+      ) {
+        throw invalidReplRecovery(
+          `REPL session tool result[${index}] has an invalid call id`,
+          "CC_REPL_SESSION_TOOL_PAIR_INVALID",
+        );
+      }
+      continue;
+    }
+
+    if (message.role !== "assistant" || !hasToolCalls) continue;
+    if (!Array.isArray(message.tool_calls)) {
+      throw invalidReplRecovery(
+        `REPL session assistant message[${index}] has invalid tool calls`,
+        "CC_REPL_SESSION_TOOL_PAIR_INVALID",
+      );
+    }
+    const batchToolCallIds = new Set();
+    for (const toolCall of message.tool_calls) {
+      const toolCallId =
+        toolCall && typeof toolCall === "object" && !Array.isArray(toolCall)
+          ? toolCall.id
+          : null;
+      if (
+        typeof toolCallId !== "string" ||
+        toolCallId.length === 0 ||
+        batchToolCallIds.has(toolCallId)
+      ) {
+        throw invalidReplRecovery(
+          `REPL session assistant message[${index}] has ambiguous tool call ids`,
+          "CC_REPL_SESSION_TOOL_PAIR_INVALID",
+        );
+      }
+      batchToolCallIds.add(toolCallId);
+    }
+  }
+}
+
+function isPlainReplMergeMessage(message) {
+  if (message.role !== "user" && message.role !== "assistant") return false;
+  const keys = Object.keys(message);
+  return (
+    Object.prototype.hasOwnProperty.call(message, "content") &&
+    keys.every((key) => key === "role" || key === "content")
+  );
+}
+
+function mergePlainReplRoleRuns(rebuiltMessages) {
+  const mergedMessages = [];
+  for (const message of rebuiltMessages) {
+    const previous = mergedMessages.at(-1);
+    if (
+      previous &&
+      previous.role === message.role &&
+      isPlainReplMergeMessage(previous) &&
+      isPlainReplMergeMessage(message)
+    ) {
+      // The shared role helper is safe only after raw authority validation and
+      // only for exact {role, content} records. This prevents a later record's
+      // tool/identity authority from disappearing behind object spread.
+      mergedMessages[mergedMessages.length - 1] = mergeConsecutiveMessages([
+        previous,
+        message,
+      ])[0];
+    } else {
+      mergedMessages.push(message);
+    }
+  }
+  return snapshotReplMessages(mergedMessages);
+}
+
+function collapseValidatedPlainReplTailInPlace(messages) {
+  const rawSnapshot = snapshotReplMessages(messages);
+  validateRawReplReplayMessages(rawSnapshot);
+  const previous = rawSnapshot.at(-2);
+  const current = rawSnapshot.at(-1);
+  if (
+    !previous ||
+    previous.role !== current?.role ||
+    !isPlainReplMergeMessage(previous) ||
+    !isPlainReplMergeMessage(current)
+  ) {
+    return false;
+  }
+  const merged = mergeConsecutiveMessages([previous, current]);
+  if (merged.length !== 1) return false;
+  messages.splice(messages.length - 2, 2, merged[0]);
+  return true;
+}
+
+function normalizeReplReplayMessages(rebuiltMessages) {
+  // Validate the immutable raw snapshot before any normalization. In
+  // particular, never let a same-role merge hide malformed tool authority.
+  validateRawReplReplayMessages(rebuiltMessages);
+
+  // Stable-partition verified canonical systems ahead of conversation. Their
+  // relative order is preserved exactly, without inspecting content. This
+  // keeps a trailing migration/fork marker from separating a dangling user
+  // turn from the next live user turn after providers extract system prompts.
+  const canonicalSystemMessages = snapshotReplMessages(
+    rebuiltMessages.filter((message) => message.role === "system"),
+  );
+  const conversationMessages = mergePlainReplRoleRuns(
+    rebuiltMessages.filter((message) => message.role !== "system"),
+  );
+  let phase = "expect-initial-conversation-message";
+  let pendingToolCallIds = null;
+
+  for (let index = 0; index < conversationMessages.length; index += 1) {
+    const message = conversationMessages[index];
+    const hasToolCalls = Object.prototype.hasOwnProperty.call(
+      message,
+      "tool_calls",
+    );
+
+    if (message.role === "tool") {
+      const toolCallId = message.tool_call_id;
+      if (phase !== "expect-tools" || !pendingToolCallIds?.delete(toolCallId)) {
+        throw invalidReplRecovery(
+          `REPL session tool result[${index}] has no matching pending call`,
+          "CC_REPL_SESSION_TOOL_PAIR_INVALID",
+        );
+      }
+      if (pendingToolCallIds.size === 0) {
+        pendingToolCallIds = null;
+        phase = "expect-assistant-after-tools";
+      }
+      continue;
+    }
+
+    if (message.role === "user") {
+      if (
+        phase !== "expect-user" &&
+        phase !== "expect-initial-conversation-message"
+      ) {
+        throw invalidReplRecovery(
+          `REPL session user message[${index}] breaks role alternation`,
+          "CC_REPL_SESSION_ROLE_ALTERNATION_INVALID",
+        );
+      }
+      phase = "expect-assistant";
+      continue;
+    }
+
+    if (
+      phase !== "expect-assistant" &&
+      phase !== "expect-assistant-after-tools" &&
+      phase !== "expect-initial-conversation-message"
+    ) {
+      throw invalidReplRecovery(
+        `REPL session assistant message[${index}] breaks role alternation`,
+        "CC_REPL_SESSION_ROLE_ALTERNATION_INVALID",
+      );
+    }
+
+    const toolCalls = hasToolCalls ? message.tool_calls : [];
+    if (toolCalls.length === 0) {
+      phase = "expect-user";
+      continue;
+    }
+
+    // IDs are unique only within this pending assistant batch. A later, fully
+    // settled fallback round may legitimately reuse a deterministic ID such as
+    // call_<toolName>.
+    pendingToolCallIds = new Set(toolCalls.map((toolCall) => toolCall.id));
+    phase = "expect-tools";
+  }
+
+  if (phase === "expect-tools" || phase === "expect-assistant-after-tools") {
+    throw invalidReplRecovery(
+      "REPL session ends with an incomplete tool call/result exchange",
+      "CC_REPL_SESSION_TOOL_PAIR_INVALID",
+    );
+  }
+  return Object.freeze({
+    canonicalSystemMessages,
+    conversationMessages,
+    replayMessages: Object.freeze([
+      ...canonicalSystemMessages,
+      ...conversationMessages,
+    ]),
+  });
+}
+
+function failedReplJsonlResumeCandidate(sessionId, error, sessionSnapshot) {
+  const observedCode = safeRecoveryErrorValue(
+    error,
+    "code",
+    "CC_SESSION_HOST_SNAPSHOT_UNVERIFIED",
+  );
+  const resumeError = replMcpRecoveryError(
+    error,
+    typeof observedCode === "string" && observedCode
+      ? observedCode
+      : "CC_SESSION_HOST_SNAPSHOT_UNVERIFIED",
+  );
+  return brandedFrozenCandidate(REPL_JSONL_RESUME_CANDIDATES, {
+    ok: false,
+    sessionId,
+    rebuiltMessages: null,
+    replayMessages: null,
+    canonicalSystemMessages: null,
+    conversationMessages: null,
+    sessionSnapshot: sessionSnapshot || null,
+    mcp: failClosedReplMcpRecoveryCandidate(
+      sessionId,
+      resumeError,
+      resumeError.code,
+      "session transcript",
+    ),
+    error: resumeError,
+  });
+}
+
+function absentReplJsonlResumeCandidate(sessionId) {
+  const error = new Error(`Session not found: ${sessionId}`);
+  error.code = "CC_REPL_SESSION_NOT_FOUND";
+  const candidate = failedReplJsonlResumeCandidate(sessionId, error, null);
+  REPL_JSONL_RESUME_ABSENCE_CANDIDATES.add(candidate);
+  return candidate;
+}
+
+/**
+ * Prepare a JSONL resume transaction from exactly one fully verified sample.
+ * Messages, the public snapshot, and MCP recovery authority are derived by the
+ * shared reader from that same event array. A present-but-invalid transcript is
+ * an inert structured refusal and cannot be committed into the active REPL.
+ */
+export function prepareReplJsonlResumeCandidate(sessionId, dependencies = {}) {
+  let sessionSnapshot = null;
+  try {
+    validateReplResumeSessionId(sessionId);
+    const readResumeState = dependencyDataFunction(
+      dependencies,
+      "readSessionHostResumeState",
+      readSessionHostResumeState,
+    );
+    const formatNotice = dependencyDataFunction(
+      dependencies,
+      "formatMcpLedgerRecoveryNotice",
+      formatMcpLedgerRecoveryNotice,
+    );
+    const state = synchronousReplRecoveryValue(
+      readResumeState(sessionId),
+      "REPL session host resume state",
+    );
+    if (state === null) return absentReplJsonlResumeCandidate(sessionId);
+    const stateDescriptors = plainDataDescriptors(
+      state,
+      "REPL session host resume state",
+    );
+    sessionSnapshot = snapshotReplMessageValue(
+      dataDescriptorValue(
+        stateDescriptors,
+        "snapshot",
+        "REPL session host resume state",
+      ),
+      "REPL session host snapshot",
+    );
+    if (
+      !isVerifiedSessionHostSnapshot(sessionSnapshot) ||
+      sessionSnapshot.sessionId !== sessionId
+    ) {
+      const error = new Error(
+        "Canonical JSONL session is not fully verified; resume was refused",
+      );
+      error.code = "CC_SESSION_HOST_SNAPSHOT_UNVERIFIED";
+      throw error;
+    }
+    const rawRebuiltMessages = snapshotReplMessages(
+      dataDescriptorValue(
+        stateDescriptors,
+        "messages",
+        "REPL session host resume state",
+      ),
+    );
+    // The injected host seam may supply plain persisted fields. Only the
+    // runtime-only provenance already established by the verified store is
+    // canonical; unmarked host prompts and forged wire tags are removed before
+    // REPL normalization or any side effect.
+    const rebuiltMessages = snapshotReplMessages(
+      projectCanonicalResumeMessages(rawRebuiltMessages),
+    );
+    const normalizedReplay = normalizeReplReplayMessages(rebuiltMessages);
+    const mcp = createReplMcpRecoveryCandidate(
+      sessionId,
+      dataDescriptorValue(
+        stateDescriptors,
+        "recovery",
+        "REPL session host resume state",
+      ),
+      formatNotice,
+    );
+    if (
+      mcp.recoveryError ||
+      mcp.recovery.headHash !== sessionSnapshot.head.hash ||
+      mcp.recovery.recoveryDigest !==
+        sessionSnapshot.recoveryAuthority.recoveryDigest
+    ) {
+      const error = new Error(
+        "Canonical JSONL messages and MCP recovery authority do not share one head",
+      );
+      error.code = "CC_REPL_SESSION_AUTHORITY_MISMATCH";
+      throw error;
+    }
+    return brandedFrozenCandidate(REPL_JSONL_RESUME_CANDIDATES, {
+      ok: true,
+      sessionId,
+      rebuiltMessages,
+      replayMessages: normalizedReplay.replayMessages,
+      canonicalSystemMessages: normalizedReplay.canonicalSystemMessages,
+      conversationMessages: normalizedReplay.conversationMessages,
+      sessionSnapshot,
+      mcp,
+      error: null,
+    });
+  } catch (error) {
+    return failedReplJsonlResumeCandidate(sessionId, error, sessionSnapshot);
+  }
+}
+
+/**
+ * Resolve startup storage only after a requested canonical JSONL session has
+ * been sampled and verified. A present canonical session is authoritative;
+ * feature/config reads are reserved for new sessions or the legacy DB
+ * fallback when no JSONL transcript exists.
+ */
+export function prepareReplStartupResume(sessionId, dependencies = {}) {
+  if (sessionId !== null && sessionId !== undefined) {
+    const candidate = prepareReplJsonlResumeCandidate(sessionId, dependencies);
+    if (candidate.ok) {
+      return Object.freeze({ useJsonl: true, candidate });
+    }
+    if (!REPL_JSONL_RESUME_ABSENCE_CANDIDATES.has(candidate)) {
+      return Object.freeze({ useJsonl: true, candidate });
+    }
+  }
+
+  const readFeature = dependencyDataFunction(dependencies, "feature", feature);
+  return Object.freeze({
+    useJsonl: Boolean(readFeature("JSONL_SESSION")),
+    candidate: null,
+  });
+}
+
+function assertReplStartupAdmission(value) {
+  synchronousReplRecoveryValue(value, "REPL startup admission");
+  const descriptors = plainDataDescriptors(value, "REPL startup admission");
+  const useJsonl = dataDescriptorValue(
+    descriptors,
+    "useJsonl",
+    "REPL startup admission",
+  );
+  const candidate = dataDescriptorValue(
+    descriptors,
+    "candidate",
+    "REPL startup admission",
+  );
+  if (
+    typeof useJsonl !== "boolean" ||
+    !Object.isFrozen(value) ||
+    (candidate !== null &&
+      (!REPL_JSONL_RESUME_CANDIDATES.has(candidate) ||
+        !Object.isFrozen(candidate))) ||
+    (candidate !== null && useJsonl !== true)
+  ) {
+    throw invalidReplRecovery(
+      "REPL startup admission capability is invalid",
+      "CC_REPL_STARTUP_ADMISSION_INVALID",
+    );
+  }
+  return value;
+}
+
+function refuseReplStartupResume(options, candidate) {
+  const observedCode = safeRecoveryErrorValue(
+    candidate?.error,
+    "code",
+    "CC_SESSION_HOST_SNAPSHOT_UNVERIFIED",
+  );
+  const refusal = Object.freeze({
+    started: false,
+    exitCode: 1,
+    code:
+      typeof observedCode === "string" && observedCode
+        ? observedCode
+        : "CC_SESSION_HOST_SNAPSHOT_UNVERIFIED",
+    sessionId: options.sessionId,
+    sessionSnapshot: candidate?.sessionSnapshot || null,
+  });
+  logger.error(
+    JSON.stringify({
+      type: "session.resume.refused",
+      ...refusal,
+    }),
+  );
+  process.exitCode = 1;
+  return refusal;
+}
+
+function commitPreparedReplResume(prepared, commit, rollback) {
+  if (!prepared || typeof commit !== "function") return false;
+  try {
+    commit(prepared);
+    return true;
+  } catch (commitError) {
+    if (typeof rollback === "function") {
+      try {
+        rollback(prepared, commitError);
+      } catch (rollbackError) {
+        const error = new AggregateError(
+          [commitError, rollbackError],
+          "REPL session resume and rollback both failed",
+        );
+        error.code = "CC_REPL_SESSION_RESUME_ROLLBACK_FAILED";
+        throw error;
+      }
+    }
+    throw commitError;
+  }
+}
+
+/** Commit a fully prepared JSONL switch; forged/failed candidates are inert. */
+export function commitPreparedReplJsonlResume(candidate, commit, rollback) {
+  if (
+    !candidate ||
+    !REPL_JSONL_RESUME_CANDIDATES.has(candidate) ||
+    !candidate.ok
+  ) {
+    return false;
+  }
+  return commitPreparedReplResume(candidate, commit, rollback);
+}
+
+/** Commit the already parsed and snapshotted legacy-DB resume state. */
+export function commitPreparedReplDbResume(preparedState, commit, rollback) {
+  return commitPreparedReplResume(preparedState, commit, rollback);
 }
 
 /**
- * Start the agentic REPL
+ * Own the exact mutable state switched by the interactive `/session resume`
+ * command. Both JSONL and legacy-DB paths use this controller, which also gives
+ * tests a behavioral seam for failures at each real apply stage.
  */
-export async function startAgentRepl(options = {}) {
-  const trustedWorkspaceRoot = process.cwd();
-  return runWithHostHooksV2Workspace(trustedWorkspaceRoot, () =>
-    startAgentReplInWorkspace(options),
+export function createReplResumeStateController(bindings) {
+  const snapshots = new WeakSet();
+  const hostSystemMessagePrefixes = new WeakSet();
+  let registeredHostSystemMessages = null;
+  const replaceArray = (target, values) => {
+    target.length = 0;
+    for (const value of values) target.push(value);
+  };
+  const invalidHostPrefix = (message) =>
+    invalidReplRecovery(message, "CC_REPL_HOST_SYSTEM_PREFIX_INVALID");
+  const assertHostSystemMessages = (candidate) => {
+    if (
+      !candidate ||
+      !hostSystemMessagePrefixes.has(candidate) ||
+      !Array.isArray(candidate) ||
+      !Object.isFrozen(candidate) ||
+      candidate.length === 0 ||
+      candidate.some(
+        (message) =>
+          !message || message.role !== "system" || !Object.isFrozen(message),
+      )
+    ) {
+      throw invalidHostPrefix("REPL host system prefix capability is invalid");
+    }
+    return candidate;
+  };
+  const createHostSystemMessages = (sourceMessages) => {
+    const snapshot = snapshotReplMessages(sourceMessages);
+    const leadingSystems = [];
+    for (const message of snapshot) {
+      if (message.role !== "system") break;
+      leadingSystems.push(message);
+    }
+    if (leadingSystems.length === 0) {
+      throw invalidHostPrefix("REPL host system prefix is empty");
+    }
+    const capability = Object.freeze(leadingSystems);
+    hostSystemMessagePrefixes.add(capability);
+    return capability;
+  };
+  const registerHostSystemMessages = () => {
+    if (registeredHostSystemMessages !== null) {
+      throw invalidHostPrefix("REPL host system prefix is already registered");
+    }
+    registeredHostSystemMessages = createHostSystemMessages(bindings.messages);
+    return registeredHostSystemMessages;
+  };
+  const refreshHostSystemMessages = () => {
+    const registered = assertHostSystemMessages(registeredHostSystemMessages);
+    const currentBase = snapshotReplMessages([bindings.messages[0]])[0];
+    if (currentBase.role !== "system") {
+      throw invalidHostPrefix("REPL current host base system is invalid");
+    }
+    const capability = Object.freeze([currentBase, ...registered.slice(1)]);
+    hostSystemMessagePrefixes.add(capability);
+    registeredHostSystemMessages = capability;
+    return capability;
+  };
+  const materializeHostSystemMessages = (candidate) =>
+    assertHostSystemMessages(candidate).map((message) => ({ ...message }));
+
+  const capture = () => {
+    const hostSystemMessages = assertHostSystemMessages(
+      registeredHostSystemMessages,
+    );
+    const mcpRuntime = bindings.runtimeManager.current;
+    if (!mcpRuntime) {
+      const error = new Error("Active MCP recovery runtime is unavailable");
+      error.code = "CC_REPL_MCP_RUNTIME_UNAVAILABLE";
+      throw error;
+    }
+    const snapshot = Object.freeze({
+      sessionId: bindings.sessionId,
+      messages: Object.freeze(bindings.messages.slice()),
+      recovery: bindings.recovery,
+      recoveryError: bindings.recoveryError,
+      sanitizeRolesNextTurn: bindings.sanitizeRolesNextTurn,
+      turnBindingProducer: bindings.turnBindingProducer,
+      turnBindingCriticalError: bindings.turnBindingCriticalError,
+      checkpointMarks: Object.freeze(bindings.checkpointMarks.slice()),
+      clearedConversation: bindings.clearedConversation,
+      hostSystemMessages,
+      mcpRuntime,
+    });
+    snapshots.add(snapshot);
+    return snapshot;
+  };
+
+  const restore = (snapshot) => {
+    if (!snapshot || !snapshots.has(snapshot)) {
+      throw new TypeError("REPL resume snapshot is invalid");
+    }
+    bindings.sessionId = snapshot.sessionId;
+    replaceArray(bindings.messages, snapshot.messages);
+    bindings.recovery = snapshot.recovery;
+    bindings.recoveryError = snapshot.recoveryError;
+    bindings.sanitizeRolesNextTurn = snapshot.sanitizeRolesNextTurn;
+    bindings.turnBindingProducer = snapshot.turnBindingProducer;
+    bindings.turnBindingCriticalError = snapshot.turnBindingCriticalError;
+    replaceArray(bindings.checkpointMarks, snapshot.checkpointMarks);
+    bindings.clearedConversation = snapshot.clearedConversation;
+    registeredHostSystemMessages = assertHostSystemMessages(
+      snapshot.hostSystemMessages,
+    );
+    if (bindings.runtimeManager.current !== snapshot.mcpRuntime) {
+      bindings.runtimeManager.commit(snapshot.mcpRuntime);
+    }
+  };
+
+  const apply = (preparedState) => {
+    const hostSystemMessages = assertHostSystemMessages(
+      preparedState.hostSystemMessages,
+    );
+    const activeHostSystemMessages =
+      materializeHostSystemMessages(hostSystemMessages);
+    const canonicalSystemMessages = snapshotReplMessages(
+      preparedState.canonicalSystemMessages,
+    );
+    const conversationMessages = snapshotReplMessages(
+      preparedState.conversationMessages,
+    );
+    if (
+      canonicalSystemMessages.some((message) => message.role !== "system") ||
+      conversationMessages.some((message) => message.role === "system")
+    ) {
+      throw invalidHostPrefix(
+        "REPL prepared resume message partition is invalid",
+      );
+    }
+    bindings.sessionId = preparedState.sessionId;
+    replaceArray(bindings.messages, activeHostSystemMessages);
+    registeredHostSystemMessages = hostSystemMessages;
+    for (const message of canonicalSystemMessages) {
+      bindings.messages.push(message);
+    }
+    bindings.applyMcpRecoveryCommit(bindings.messages, preparedState.mcpCommit);
+    for (const message of conversationMessages) {
+      bindings.messages.push(message);
+    }
+    bindings.sanitizeRolesNextTurn = preparedState.sanitizeRolesNextTurn;
+    bindings.turnBindingProducer = null;
+    bindings.turnBindingCriticalError = null;
+    bindings.checkpointMarks.length = 0;
+    bindings.clearedConversation = null;
+    bindings.runtimeManager.commit(preparedState.mcpRuntime);
+    bindings.logMcpRecoveryCommit(preparedState.mcpCommit);
+    bindings.logger.info(preparedState.logMessage);
+  };
+
+  return Object.freeze({
+    capture,
+    restore,
+    apply,
+    registerHostSystemMessages,
+    refreshHostSystemMessages,
+  });
+}
+
+/**
+ * Own the single recovery runtime for the active REPL session/client pair.
+ * Session switches are prepared without mutating the active runtime, then
+ * committed only after the transcript switch succeeds.
+ */
+export function createReplMcpHostRuntimeManager(dependencies = {}) {
+  const createRuntime =
+    dependencies.createMcpHostRecoveryRuntime || createMcpHostRecoveryRuntime;
+  const createLedgerSink =
+    dependencies.createSessionMcpLedgerSink || createSessionMcpLedgerSink;
+  const appendLedgerEvent =
+    dependencies.appendAuthorityEvent || appendAuthorityEvent;
+  const candidates = new WeakSet();
+  let current = null;
+
+  const prepare = ({
+    adhocMcp = null,
+    bundleMcpClient = null,
+    sessionId = null,
+    persistent = false,
+    recovery = null,
+    recoveryError = null,
+    verifiedRecovery = false,
+  } = {}) => {
+    const bundle = adhocMcp?.mcpClient
+      ? adhocMcp
+      : bundleMcpClient
+        ? { mcpClient: bundleMcpClient }
+        : null;
+    const rawClient = bundle?.mcpClient || null;
+    const persistLedger = Boolean(persistent && sessionId);
+
+    if (
+      !verifiedRecovery &&
+      current &&
+      current.rawClient === rawClient &&
+      current.sessionId === sessionId &&
+      current.persistent === persistLedger &&
+      current.recovery === recovery &&
+      current.recoveryError === recoveryError
+    ) {
+      return current;
+    }
+
+    const sink = persistLedger
+      ? createLedgerSink(sessionId, { appendEvent: appendLedgerEvent })
+      : null;
+    const sharedController =
+      !verifiedRecovery && current?.sessionId === sessionId
+        ? current.runtime.controller
+        : null;
+    const runtime = createRuntime({
+      bundle,
+      rawClient,
+      sessionId,
+      sink,
+      recovery,
+      recoveryError,
+      ...(sharedController ? { controller: sharedController } : {}),
+    });
+    const candidate = Object.freeze({
+      runtime,
+      rawClient,
+      hostMcp: bundle
+        ? Object.freeze({
+            ...bundle,
+            mcpClient: runtime.client,
+          })
+        : null,
+      sessionId,
+      persistent: persistLedger,
+      recovery,
+      recoveryError,
+      verifiedRecovery: Boolean(verifiedRecovery),
+    });
+    candidates.add(candidate);
+    return candidate;
+  };
+
+  const commit = (candidate) => {
+    if (!candidate || !candidates.has(candidate)) {
+      throw new TypeError("MCP host runtime candidate is invalid");
+    }
+    current = candidate;
+    return current;
+  };
+
+  return Object.freeze({
+    prepare,
+    commit,
+    activate(options) {
+      return commit(prepare(options));
+    },
+    get current() {
+      return current;
+    },
+  });
+}
+
+/**
+ * Execute the startup boundary with explicit host-owned dependencies. Exported
+ * for behavior tests; callers cannot obtain the private workspace starter, and
+ * the public startAgentRepl() below always supplies the real fixed bindings.
+ */
+export async function runReplStartupBoundary(options, startupDependencies) {
+  const prepareStartup = dependencyDataFunction(
+    startupDependencies,
+    "prepareReplStartupResume",
+    null,
+  );
+  if (typeof prepareStartup !== "function") {
+    throw invalidReplRecovery(
+      "REPL startup admission dependency is missing",
+      "CC_REPL_STARTUP_DEPENDENCY_INVALID",
+    );
+  }
+  const startupAdmission = assertReplStartupAdmission(
+    synchronousReplRecoveryValue(
+      prepareStartup(options.sessionId),
+      "REPL startup admission",
+    ),
+  );
+  const startupCandidate = startupAdmission.candidate;
+  if (startupCandidate && !startupCandidate.ok) {
+    const refuseStartup = dependencyDataFunction(
+      startupDependencies,
+      "refuseReplStartupResume",
+      null,
+    );
+    if (typeof refuseStartup !== "function") {
+      throw invalidReplRecovery(
+        "REPL startup refusal dependency is missing",
+        "CC_REPL_STARTUP_DEPENDENCY_INVALID",
+      );
+    }
+    return refuseStartup(options, startupCandidate);
+  }
+
+  // Only a frozen, branded admission capability may cross into workspace,
+  // pipe, config, plugin, hook, MCP, model, or tool initialization.
+  const readCwd = dependencyDataFunction(startupDependencies, "cwd", null);
+  const enterWorkspace = dependencyDataFunction(
+    startupDependencies,
+    "runWithHostHooksV2Workspace",
+    null,
+  );
+  const startWorkspace = dependencyDataFunction(
+    startupDependencies,
+    "startAgentReplInWorkspace",
+    null,
+  );
+  if (
+    typeof readCwd !== "function" ||
+    typeof enterWorkspace !== "function" ||
+    typeof startWorkspace !== "function"
+  ) {
+    throw invalidReplRecovery(
+      "REPL host startup dependency is missing",
+      "CC_REPL_STARTUP_DEPENDENCY_INVALID",
+    );
+  }
+  const trustedWorkspaceRoot = readCwd();
+  return enterWorkspace(trustedWorkspaceRoot, () =>
+    startWorkspace(options, startupAdmission),
   );
 }
 
-async function startAgentReplInWorkspace(options = {}) {
+/** Start the agentic REPL with non-overridable production bindings. */
+export async function startAgentRepl(options = {}) {
+  return runReplStartupBoundary(options, {
+    prepareReplStartupResume,
+    refuseReplStartupResume,
+    cwd: () => process.cwd(),
+    runWithHostHooksV2Workspace,
+    startAgentReplInWorkspace,
+  });
+}
+
+async function startAgentReplInWorkspace(options = {}, startupAdmission) {
   // EPIPE guard: if the REPL's stdout is piped and the consumer closes (e.g.
   // `cc agent | head`), the async stream `error` would otherwise crash the
   // process. Route a broken pipe into the REPL's own graceful shutdown (the
@@ -506,6 +2085,7 @@ async function startAgentReplInWorkspace(options = {}) {
     }
     process.exit(0);
   });
+  const { useJsonl, candidate: _startupJsonlResume } = startupAdmission;
   let model = options.model || "qwen2.5:7b";
   let provider = options.provider || "ollama";
   // Extended thinking (Anthropic; opt-in via --think/--ultrathink). Carried from
@@ -515,12 +2095,15 @@ async function startAgentReplInWorkspace(options = {}) {
   // (--thinking-budget) is the companion legacy-model budget_tokens override.
   let thinking = options.thinking || null;
   const thinkingBudget = options.thinkingBudget || null;
-  // `/btw` one-shot asides: queued notes that ride ONLY the next turn (sent to
-  // the model, then stripped so they never persist or carry forward).
-  // `_btwRestore` holds the user message + its pre-aside content so we can undo
-  // the injection after the turn (or as a backstop at the next submit on throw).
+  // `/note-next` one-shot guidance rides ONLY the next main turn, then is
+  // stripped so it never persists or carries forward. `/btw` itself is an
+  // immediate independent side question handled below.
   let pendingBtw = [];
   let _btwRestore = null;
+  // Provider-neutral, tool-free Advisor/Critic. Initialized lazily after the
+  // durable session and resumed transcript are available; null means the
+  // optional surface could not be initialized. Default is off via config.
+  let _advisorRuntime = null;
   // Current permission mode (strict|trusted|autopilot|auto), mirrored here so
   // Shift+Tab can cycle it and `/permissions <tier>` can set it. Kept in sync
   // with _approvalGate.setSessionPolicy below. "auto" rides the trusted gate
@@ -588,6 +2171,13 @@ async function startAgentReplInWorkspace(options = {}) {
   // Snapshot the work tree before each mutating tool (git engine) so the user
   // can `cc checkpoint restore` to just before any tool call.
   const autoCheckpoint = options.autoCheckpoint === true;
+  const managedCheckpoint = options.managedCheckpoint === true;
+  const managedCheckpointStateDir = options.managedCheckpointStateDir || null;
+  const managedCheckpointExclusions = Array.isArray(
+    options.managedCheckpointExclusions,
+  )
+    ? options.managedCheckpointExclusions
+    : [];
 
   // --fallback-model: walk an ordered backup-model chain when a turn's LLM
   // call fails (transient error or model-not-found). Built once; passed into
@@ -616,7 +2206,10 @@ async function startAgentReplInWorkspace(options = {}) {
   // Bootstrap runtime (best-effort, DB not required)
   let db = null;
   let contextEngine = null;
-  let sessionId = null;
+  let sessionId = _startupJsonlResume?.sessionId || null;
+  const _replCompactPersistence = createReplCompactPersistence(
+    _startupJsonlResume?.ok ? _startupJsonlResume.rebuiltMessages : [],
+  );
 
   try {
     const ctx = await bootstrap({ verbose: false });
@@ -627,7 +2220,30 @@ async function startAgentReplInWorkspace(options = {}) {
 
   // Initialize prompt compressor (adaptive to model's context window)
   if (feature("PROMPT_COMPRESSOR")) {
-    _compressor = new PromptCompressor({ model, provider });
+    _compressor = new PromptCompressor({
+      model,
+      provider,
+      llmQuery: async (prompt) => {
+        const response = await chatWithTools(
+          [{ role: "user", content: prompt }],
+          {
+            provider,
+            model,
+            baseUrl,
+            apiKey,
+            enabledToolNames: [],
+            extraToolDefinitions: [],
+            maxOutputTokens: 2048,
+          },
+        );
+        return {
+          summary: response?.message?.content || "",
+          usage: response?.usage || null,
+          provider,
+          model,
+        };
+      },
+    });
   }
   const _autoPinOpt = resolveAutoPinOption({ config: _autoPinCfgValue });
   // Compaction options shared by /compact + auto-compact. Adds the
@@ -893,16 +2509,18 @@ async function startAgentReplInWorkspace(options = {}) {
   // PostToolUse). The interactive _permissionConfirm above doubles as the
   // confirmer for a hook `ask` decision.
   try {
-    const { loadHooks, projectHookTrustNotice } =
+    const { loadHooks, projectHookTrustNotice, attachAuthorityErrors } =
       await import("../lib/settings-hooks.cjs");
     const loaded = loadHooks({ cwd: process.cwd() });
     // Fold in installed plugins' hooks/hooks.json (Phase 3.3c).
     const { mergePluginHooks } = await import("../lib/plugin-runtime/hooks.js");
-    const effectiveHooks = mergePluginHooks(loaded.hooks, {
-      cwd: process.cwd(),
-    });
+    const effectiveHooks = mergePluginHooks(
+      attachAuthorityErrors(loaded.hooks, loaded.authorityErrors),
+      { cwd: process.cwd() },
+    );
     _settingsHooks =
-      effectiveHooks && Object.keys(effectiveHooks).length > 0
+      Object.keys(effectiveHooks).length > 0 ||
+      effectiveHooks._authorityErrors.length > 0
         ? effectiveHooks
         : null;
     // First-run trust notice for an untrusted/cloned repo's shell-running
@@ -914,7 +2532,16 @@ async function startAgentReplInWorkspace(options = {}) {
       /* trust notice is best-effort */
     }
   } catch (_err) {
-    _settingsHooks = null;
+    _settingsHooks = {};
+    Object.defineProperty(_settingsHooks, "_authorityErrors", {
+      value: Object.freeze([
+        Object.freeze({
+          sourceFile: null,
+          code: _err?.code || "CC_HOOK_AUTHORITY_LOAD_FAILED",
+        }),
+      ]),
+      enumerable: false,
+    });
   }
 
   // Start installed plugins' background monitors (Phase 3.3i). Trust-gated
@@ -972,19 +2599,10 @@ async function startAgentReplInWorkspace(options = {}) {
     _pluginSettingsRestore = null;
   }
 
-  // Resume existing session or create new one
-  const useJsonl = feature("JSONL_SESSION");
-
-  if (useJsonl && options.sessionId) {
-    // JSONL resume: check if session file exists
-    try {
-      if (sessionExists(options.sessionId)) {
-        sessionId = options.sessionId;
-      }
-    } catch (_err) {
-      // Non-critical
-    }
-  } else if (db && options.sessionId) {
+  // Resume existing session or create new one. JSONL resumes were admitted
+  // before bootstrap/config/plugin/hook initialization and use that exact
+  // verified sample below; do not re-read the transcript here.
+  if (!useJsonl && db && options.sessionId) {
     try {
       const existing = getSession(db, options.sessionId);
       if (existing && existing.messages) {
@@ -1144,6 +2762,56 @@ async function startAgentReplInWorkspace(options = {}) {
   let _replBaseSystem = _buildReplBaseSystem();
   let _activeOutputStyle = null; // { name, body }
   const messages = [{ role: "system", content: _replBaseSystem }];
+  let _mcpLedgerRecovery = null;
+  let _mcpLedgerRecoveryError = null;
+  const _prepareJsonlResumeCandidate = (targetSessionId) =>
+    prepareReplJsonlResumeCandidate(targetSessionId);
+  const _prepareMcpRecoveryCommit = (candidate) => {
+    const authorized =
+      candidate && REPL_MCP_RECOVERY_CANDIDATES.has(candidate)
+        ? candidate
+        : failClosedReplMcpRecoveryCandidate(
+            sessionId,
+            invalidReplRecovery(
+              "MCP recovery candidate capability is invalid",
+              "CC_REPL_MCP_RECOVERY_CANDIDATE_INVALID",
+            ),
+            "CC_REPL_MCP_RECOVERY_CANDIDATE_INVALID",
+          );
+    const recovery = authorized.recovery;
+    const recoveryError = authorized.recoveryError;
+    const noticeMessage = authorized.notice
+      ? Object.freeze({ role: "system", content: authorized.notice })
+      : null;
+    const warning = recoveryError
+      ? "⚠ MCP ledger recovery failed closed; inspect the transcript before using MCP tools."
+      : authorized.notice
+        ? `⚠ ${recovery.unsettled.length} interrupted MCP call(s), ${recovery.incidents.length} ledger incident(s), and ${recovery.replayDenied.length} exact replay deny/denies require inspection before replay.`
+        : null;
+    return Object.freeze({
+      recovery,
+      recoveryError,
+      noticeMessage,
+      warning,
+    });
+  };
+  const _applyMcpRecoveryCommit = (targetMessages, preparedCommit) => {
+    _mcpLedgerRecovery = preparedCommit.recovery;
+    _mcpLedgerRecoveryError = preparedCommit.recoveryError;
+    if (preparedCommit.noticeMessage) {
+      targetMessages.push(preparedCommit.noticeMessage);
+    }
+    return Boolean(preparedCommit.noticeMessage);
+  };
+  const _logMcpRecoveryCommit = (preparedCommit) => {
+    if (preparedCommit.warning) logger.warn(preparedCommit.warning);
+  };
+  const _commitMcpRecoveryCandidate = (targetMessages, candidate) => {
+    const preparedCommit = _prepareMcpRecoveryCommit(candidate);
+    const addedNotice = _applyMcpRecoveryCommit(targetMessages, preparedCommit);
+    _logMcpRecoveryCommit(preparedCommit);
+    return addedNotice;
+  };
   // Resume-degenerate role sanitation (Claude Code 2.1.187 parity): a one-shot
   // flag armed when a resumed transcript ends with a bare `user` turn (the prior
   // run produced no assistant response). Consumed by the first model call so the
@@ -1420,6 +3088,89 @@ async function startAgentReplInWorkspace(options = {}) {
   }
   _persistReplContextSources();
 
+  const _mcpHostRuntimeManager = createReplMcpHostRuntimeManager();
+  const _mcpRuntimeInputs = ({
+    targetSessionId = sessionId,
+    recovery = _mcpLedgerRecovery,
+    recoveryError = _mcpLedgerRecoveryError,
+  } = {}) => ({
+    adhocMcp: _adhocMcp,
+    bundleMcpClient: _bundleMcpClient,
+    sessionId: targetSessionId,
+    persistent: useJsonl && Boolean(targetSessionId),
+    recovery,
+    recoveryError,
+  });
+  const _activateMcpHostRuntime = () =>
+    _mcpHostRuntimeManager.activate(_mcpRuntimeInputs());
+  const _prepareMcpHostRuntime = (targetSessionId, mcpCandidate = {}) =>
+    _mcpHostRuntimeManager.prepare({
+      ..._mcpRuntimeInputs({
+        targetSessionId,
+        recovery: mcpCandidate.recovery ?? null,
+        recoveryError: mcpCandidate.recoveryError ?? null,
+      }),
+      verifiedRecovery: true,
+    });
+  const _getReplHostMcp = () => _activateMcpHostRuntime().hostMcp;
+  const _resumeStateController = createReplResumeStateController({
+    get sessionId() {
+      return sessionId;
+    },
+    set sessionId(value) {
+      sessionId = value;
+    },
+    messages,
+    get recovery() {
+      return _mcpLedgerRecovery;
+    },
+    set recovery(value) {
+      _mcpLedgerRecovery = value;
+    },
+    get recoveryError() {
+      return _mcpLedgerRecoveryError;
+    },
+    set recoveryError(value) {
+      _mcpLedgerRecoveryError = value;
+    },
+    get sanitizeRolesNextTurn() {
+      return _sanitizeRolesNextTurn;
+    },
+    set sanitizeRolesNextTurn(value) {
+      _sanitizeRolesNextTurn = value;
+    },
+    get turnBindingProducer() {
+      return _turnBindingProducer;
+    },
+    set turnBindingProducer(value) {
+      _turnBindingProducer = value;
+    },
+    get turnBindingCriticalError() {
+      return _turnBindingCriticalError;
+    },
+    set turnBindingCriticalError(value) {
+      _turnBindingCriticalError = value;
+    },
+    checkpointMarks: _checkpointMarks,
+    get clearedConversation() {
+      return _clearedConversation;
+    },
+    set clearedConversation(value) {
+      _clearedConversation = value;
+    },
+    runtimeManager: _mcpHostRuntimeManager,
+    applyMcpRecoveryCommit: _applyMcpRecoveryCommit,
+    logMcpRecoveryCommit: _logMcpRecoveryCommit,
+    logger,
+  });
+  const _captureResumeState = _resumeStateController.capture;
+  const _restoreResumeState = _resumeStateController.restore;
+  const _applyPreparedResumeState = _resumeStateController.apply;
+  const _registerHostSystemMessages =
+    _resumeStateController.registerHostSystemMessages;
+  const _refreshHostSystemMessages =
+    _resumeStateController.refreshHostSystemMessages;
+
   // Seed connected MCP servers with the startup workspace roots when the session
   // began with extra `--add-dir` roots — otherwise `roots/list` would only ever
   // return the cwd until the first mid-session /add-dir. No-op (byte-unchanged)
@@ -1500,35 +3251,37 @@ async function startAgentReplInWorkspace(options = {}) {
     }
   }
 
+  // Seal the complete host-owned leading system prefix exactly once, after
+  // startup hooks, bundle context, and optional memory injection, but before
+  // any canonical/legacy replay is appended. Later live switches refresh only
+  // entry 0 from the active base prompt; they never re-scan old session systems.
+  _registerHostSystemMessages();
+
+  let _startupResumeCommitted = false;
   // Load resumed session messages
   if (options.sessionId && sessionId) {
     try {
       if (useJsonl) {
-        // Interactive tamper warning: a broken hash chain means the transcript
-        // was edited outside the store — resume proceeds (the user is present)
-        // but the restored context is flagged untrusted.
-        try {
-          const { verifySession } =
-            await import("../harness/jsonl-session-store.js");
-          const trust = verifySession(sessionId);
-          if (trust.status === "tampered") {
-            logger.warn(
-              `⚠ Transcript integrity check FAILED (${trust.reason}) — restored context is untrusted. Run 'cc session verify ${sessionId}'.`,
-            );
-          }
-        } catch (_err) {
-          // verification is best-effort in the interactive path
+        const prepared = _startupJsonlResume;
+        if (!prepared?.ok) {
+          const error = new Error(
+            "Startup JSONL resume lost its verified admission capability",
+          );
+          error.code = "CC_REPL_SESSION_RESUME_NOT_PREPARED";
+          throw error;
         }
-        const rebuilt = rebuildMessages(sessionId);
-        if (rebuilt.length > 0) {
-          messages.push(...rebuilt.filter((m) => m.role !== "system"));
+        messages.push(...prepared.canonicalSystemMessages);
+        _commitMcpRecoveryCandidate(messages, prepared.mcp);
+        if (prepared.replayMessages.length > 0) {
+          messages.push(...prepared.conversationMessages);
           // Arm the resume role-merge if the prior run left a dangling user turn.
           _sanitizeRolesNextTurn =
-            messages[messages.length - 1]?.role === "user";
+            prepared.conversationMessages.at(-1)?.role === "user";
           logger.info(
-            `Resumed JSONL session ${sessionId} (${rebuilt.length} messages)`,
+            `Resumed JSONL session ${sessionId} (${prepared.rebuiltMessages.length} messages)`,
           );
         }
+        _startupResumeCommitted = true;
       } else if (db) {
         const existing = getSession(db, sessionId);
         if (existing && existing.messages) {
@@ -1542,15 +3295,26 @@ async function startAgentReplInWorkspace(options = {}) {
           logger.info(
             `Resumed session ${sessionId} (${parsed.length} messages)`,
           );
+          _startupResumeCommitted = true;
         }
       }
-    } catch (_err) {
-      // Non-critical
+    } catch (error) {
+      if (useJsonl) {
+        _commitMcpRecoveryCandidate(
+          messages,
+          failClosedReplMcpRecoveryCandidate(
+            sessionId,
+            error,
+            "CC_REPL_SESSION_REBUILD_FAILED",
+            "session transcript",
+          ),
+        );
+      }
     }
     // settings.json SessionResume hooks: a persisted transcript was just
     // replayed into this interactive session (distinct from SessionStart).
     // Observe-only, best-effort — never blocks entering the REPL.
-    if (_settingsHooks && messages.some((m) => m.role !== "system")) {
+    if (_settingsHooks && _startupResumeCommitted) {
       try {
         const { runObserveHooks } =
           await import("../lib/settings-hook-events.js");
@@ -1582,6 +3346,50 @@ async function startAgentReplInWorkspace(options = {}) {
     }
   }
 
+  // Create the active session-scoped runtime only after startup recovery has
+  // been loaded. Subsequent turns reuse this controller and ledger so a
+  // settlement-failure latch cannot be cleared by starting another turn.
+  _activateMcpHostRuntime();
+
+  // Advisor is independent from the main agent loop: it gets a redacted
+  // transcript snapshot and ZERO tools. Compact call/outcome metadata shares
+  // the session hash chain, while advice text itself is never persisted.
+  try {
+    const { createConfiguredAdvisorRuntime } =
+      await import("../lib/advisor-runtime.js");
+    const advisorOverrides = {};
+    if (options.advisorEnabled !== undefined) {
+      advisorOverrides.enabled = options.advisorEnabled === true;
+    }
+    _advisorRuntime = await createConfiguredAdvisorRuntime({
+      cwd: process.cwd(),
+      settingsFile: options.settingsFile || null,
+      managedSettingsFile: options.managedSettingsFile || null,
+      mainProvider: provider,
+      mainModel: model,
+      baseUrl,
+      apiKey,
+      overrides: advisorOverrides,
+      onEvent: (event) => {
+        if (!useJsonl || !sessionId) return;
+        try {
+          appendEvent(sessionId, event.type, event.data);
+        } catch {
+          // Advisor observability is best-effort and cannot fail a main turn.
+        }
+      },
+    });
+    // A resumed transcript may contain old tool results. Mark them observed so
+    // the first new turn cannot trigger an Advisor call for historical work.
+    _advisorRuntime.primeMessages(messages);
+  } catch (error) {
+    if (error?.code === "CC_MANAGED_SETTINGS_INVALID") throw error;
+    _advisorRuntime = null;
+    if (options.advisorEnabled === true) {
+      logger.warn(`Advisor unavailable: ${error.message}`);
+    }
+  }
+
   // Vim mode (Claude-Code `/vim` parity): opt-in modal line editing. `_vim`
   // holds the NORMAL-mode engine state while normal mode is active (readline's
   // own key handling is suspended then); it is null in INSERT mode (readline
@@ -1751,6 +3559,7 @@ async function startAgentReplInWorkspace(options = {}) {
       : [
           "/add-dir",
           "/agents",
+          "/advisor",
           "/auto",
           "/btw",
           "/cd",
@@ -1776,6 +3585,7 @@ async function startAgentReplInWorkspace(options = {}) {
           "/memory",
           "/microcompact",
           "/model",
+          "/note-next",
           "/output-style",
           "/permissions",
           "/plan",
@@ -1821,12 +3631,13 @@ async function startAgentReplInWorkspace(options = {}) {
       }
     },
     getIdeOpenFiles: async () => {
-      const exec = _adhocMcp?.externalToolExecutors?.mcp__ide__getOpenEditors;
-      if (!exec || exec.kind !== "mcp" || !_adhocMcp?.mcpClient?.callTool) {
+      const hostMcp = _getReplHostMcp();
+      const exec = hostMcp?.externalToolExecutors?.mcp__ide__getOpenEditors;
+      if (!exec || exec.kind !== "mcp" || !hostMcp?.mcpClient?.callTool) {
         return [];
       }
       const { parseToolResultJson } = await import("../lib/ide-context.js");
-      const res = await _adhocMcp.mcpClient.callTool(
+      const res = await hostMcp.mcpClient.callTool(
         exec.serverName,
         exec.toolName,
         {},
@@ -2231,9 +4042,61 @@ async function startAgentReplInWorkspace(options = {}) {
 
   // Steering (Claude-Code parity): typing while a turn is running QUEUES the
   // line instead of racing a second concurrent turn; the queue drains FIFO
-  // when the current turn finishes.
+  // when the current turn finishes. `/btw` is the deliberate exception: its
+  // tool-free snapshot call may run concurrently without mutating main state.
   let _processingLine = false;
   const _pendingLines = [];
+
+  const runBtwSideQuestion = async (btw, { concurrent = false } = {}) => {
+    if (!btw || btw.error) {
+      const message = btw?.error || "usage: /btw [--fork] <question>";
+      if (concurrent) process.stderr.write(`\n${message}\n`);
+      else logger.info(message);
+      return { ok: false, error: message };
+    }
+    try {
+      const chatFn = createChatFn({ provider, model, baseUrl, apiKey });
+      const { answer } = await runBtwQuestion({
+        messages,
+        question: btw.text,
+        chatFn,
+        model,
+      });
+      let forkedId = null;
+      let forkNotice = "";
+      if (btw.fork) {
+        if (useJsonl && sessionId && sessionExists(sessionId)) {
+          forkedId = forkSession(sessionId, {
+            requestId: `btw-${randomUUID()}`,
+          });
+          if (forkedId) {
+            appendUserMessage(forkedId, btw.text);
+            appendAssistantMessage(forkedId, answer);
+            forkNotice = `\nForked side thread: ${forkedId}`;
+          }
+        }
+        if (!forkedId) {
+          forkNotice =
+            "\nSide answer was not persisted: the parent has no durable JSONL session.";
+        }
+      }
+      const block =
+        `┌─ btw${btw.fork ? " --fork" : ""}\n` +
+        `${answer || "(empty response)"}\n` +
+        `└─ ephemeral · no tools · parent history unchanged${forkNotice}`;
+      // A concurrent answer must not corrupt the main streamed stdout payload.
+      // stderr also keeps headless/JSON consumers isolated from the overlay.
+      if (concurrent) process.stderr.write(`\n${block}\n`);
+      else logger.log(`\n${block}\n`);
+      return { ok: true, answer, forkedId };
+    } catch (error) {
+      const message = `/btw failed: ${error.message}`;
+      if (concurrent) process.stderr.write(`\n${message}\n`);
+      else logger.error(message);
+      return { ok: false, error: message };
+    }
+  };
+
   // Multiline input (Claude-Code parity): a physical line ending in a
   // continuation backslash keeps the prompt open; `_mlBuffer` accumulates the
   // pieces and the whole block submits when a line does not continue.
@@ -2368,7 +4231,13 @@ async function startAgentReplInWorkspace(options = {}) {
         `  ${chalk.cyan("/effort")}     Reasoning effort (/effort low|medium|high|xhigh; Anthropic)`,
       );
       logger.log(
-        `  ${chalk.cyan("/btw")}        Queue a one-off aside for your next message (not saved to history)`,
+        `  ${chalk.cyan("/btw")}        Ask an immediate tool-free side question (/btw [--fork] <question>)`,
+      );
+      logger.log(
+        `  ${chalk.cyan("/advisor")}    Independent tool-free critic (/advisor on|off|once [focus]|status)`,
+      );
+      logger.log(
+        `  ${chalk.cyan("/note-next")}  Apply ephemeral guidance to the next main turn`,
       );
       logger.log(`  ${chalk.cyan("/clear")}      Clear conversation`);
       logger.log(
@@ -2907,22 +4776,52 @@ async function startAgentReplInWorkspace(options = {}) {
       }
     }
 
-    // `/btw <note>` — queue a one-shot aside (Claude-Code parity). It rides the
-    // NEXT message to the model, then is stripped so it never bloats history.
+    // `/btw` is an immediate, tool-free side question over a snapshot of the
+    // current context. It never mutates or persists into the parent history.
     {
       const btw = parseBtwCommand(trimmed);
       if (btw) {
-        if (btw.error) {
-          logger.info(btw.error);
-          prompt();
-          return;
+        await runBtwSideQuestion(btw);
+        prompt();
+        return;
+      }
+    }
+
+    // `/advisor`: session-local enable/disable, one forced review, or status.
+    // One-shot advice is queued as an ephemeral prepareCall suffix, requiring
+    // the main agent to validate it locally on its next model/tool turn.
+    {
+      const { parseAdvisorCommand, executeAdvisorCommand } =
+        await import("./advisor-command.js");
+      const advisorCommand = parseAdvisorCommand(trimmed);
+      if (advisorCommand) {
+        const result = await executeAdvisorCommand(advisorCommand, {
+          runtime: _advisorRuntime,
+          messages,
+          signal: _turnAbort?.signal || null,
+        });
+        if (result?.output) logger.log(result.output);
+        if (result?.guidance) {
+          _advisorRuntime?.queueGuidance(result.guidance);
+        }
+        prompt();
+        return;
+      }
+    }
+
+    // Preserve the previous next-turn guidance behavior under an honest name.
+    {
+      const note = parseNoteNextCommand(trimmed);
+      if (note) {
+        if (note.error) logger.info(note.error);
+        else {
+          pendingBtw.push(note.text);
+          logger.info(
+            chalk.gray(
+              `Next-turn note queued (${pendingBtw.length}); it will not be saved to history.`,
+            ),
+          );
         }
-        pendingBtw.push(btw.text);
-        logger.info(
-          chalk.gray(
-            `Aside noted (${pendingBtw.length}) — rides your next message only, not saved to history.`,
-          ),
-        );
         prompt();
         return;
       }
@@ -3665,6 +5564,11 @@ async function startAgentReplInWorkspace(options = {}) {
         logger.info(
           `Compacted: ${stats.originalMessages} → ${stats.compressedMessages} messages, saved ${stats.saved} tokens (${stats.strategy})`,
         );
+        if (stats.degraded === true) {
+          logger.warn(
+            `Semantic compaction degraded to ${stats.summaryMode}: ${stats.degradedReason}`,
+          );
+        }
       } else if (contextEngine && messages.length > 5) {
         const compacted = contextEngine.smartCompact(messages);
         messages.length = 0;
@@ -3732,39 +5636,40 @@ async function startAgentReplInWorkspace(options = {}) {
       if (sessionArg.startsWith("resume ")) {
         const resumeId = sessionArg.slice(7).trim();
         try {
-          if (useJsonl && sessionExists(resumeId)) {
-            try {
-              const { verifySession } =
-                await import("../harness/jsonl-session-store.js");
-              const trust = verifySession(resumeId);
-              if (trust.status === "tampered") {
-                logger.warn(
-                  `⚠ Transcript integrity check FAILED (${trust.reason}) — restored context is untrusted. Run 'cc session verify ${resumeId}'.`,
-                );
-              }
-            } catch (_err) {
-              // verification is best-effort in the interactive path
-            }
-            const rebuilt = rebuildMessages(resumeId);
-            messages.length = 1; // keep system prompt
-            messages.push(...rebuilt.filter((m) => m.role !== "system"));
-            _sanitizeRolesNextTurn =
-              messages[messages.length - 1]?.role === "user";
-            sessionId = resumeId;
-            // The producer owns one immutable session id. Recreate it lazily
-            // on the next turn so bindings from the resumed conversation can
-            // never be appended to the previously active session.
-            _turnBindingProducer = null;
-            _turnBindingCriticalError = null;
-            // The prior session's checkpoint marks (turn-index → checkpoint id)
-            // no longer map to this swapped-in history; keeping them would make
-            // a later /rewind restore files from the WRONG session's snapshot.
-            // Same reset /clear does on a context swap.
-            _checkpointMarks.length = 0;
-            _clearedConversation = null; // stash belongs to the swapped-out session
-            logger.info(
-              `Resumed JSONL session ${sessionId} (${rebuilt.length} messages)`,
+          if (useJsonl) {
+            const prepared = _prepareJsonlResumeCandidate(resumeId);
+            if (!prepared.ok) throw prepared.error;
+            const preparedMcpRuntime = _prepareMcpHostRuntime(
+              prepared.sessionId,
+              prepared.mcp,
             );
+            const preparedMcpCommit = _prepareMcpRecoveryCommit(prepared.mcp);
+            const hostSystemMessages = _refreshHostSystemMessages();
+            const previousState = _captureResumeState();
+            const preparedState = Object.freeze({
+              sessionId: prepared.sessionId,
+              hostSystemMessages,
+              canonicalSystemMessages: prepared.canonicalSystemMessages,
+              conversationMessages: prepared.conversationMessages,
+              mcpCommit: preparedMcpCommit,
+              mcpRuntime: preparedMcpRuntime,
+              sanitizeRolesNextTurn:
+                prepared.conversationMessages.at(-1)?.role === "user",
+              logMessage: `Resumed JSONL session ${prepared.sessionId} (${prepared.rebuiltMessages.length} messages)`,
+            });
+            const committed = commitPreparedReplJsonlResume(
+              prepared,
+              () => _applyPreparedResumeState(preparedState),
+              () => _restoreResumeState(previousState),
+            );
+            if (!committed) {
+              const error = new Error(
+                "Prepared JSONL session resume was not committed",
+              );
+              error.code = "CC_REPL_SESSION_RESUME_NOT_COMMITTED";
+              throw error;
+            }
+            _replCompactPersistence.replace(prepared.rebuiltMessages);
           } else if (db) {
             const existing = getSession(db, resumeId);
             if (existing && existing.messages) {
@@ -3772,18 +5677,35 @@ async function startAgentReplInWorkspace(options = {}) {
                 typeof existing.messages === "string"
                   ? JSON.parse(existing.messages)
                   : existing.messages;
-              messages.length = 1; // keep system prompt
-              messages.push(...parsed.filter((m) => m.role !== "system"));
-              _sanitizeRolesNextTurn =
-                messages[messages.length - 1]?.role === "user";
-              sessionId = existing.id;
-              _turnBindingProducer = null;
-              _turnBindingCriticalError = null;
-              // Drop the prior session's checkpoint marks (see JSONL branch).
-              _checkpointMarks.length = 0;
-              _clearedConversation = null; // stash belongs to the swapped-out session
-              logger.info(
-                `Resumed session ${sessionId} (${parsed.length} messages)`,
+              const rebuiltMessages = snapshotReplMessages(parsed);
+              const replayMessages = Object.freeze(
+                rebuiltMessages.filter((message) => message.role !== "system"),
+              );
+              const preparedMcpRuntime = _prepareMcpHostRuntime(existing.id, {
+                recovery: null,
+                recoveryError: null,
+              });
+              const hostSystemMessages = _refreshHostSystemMessages();
+              const previousState = _captureResumeState();
+              const preparedState = Object.freeze({
+                sessionId: existing.id,
+                hostSystemMessages,
+                canonicalSystemMessages: Object.freeze([]),
+                conversationMessages: replayMessages,
+                mcpCommit: Object.freeze({
+                  recovery: null,
+                  recoveryError: null,
+                  noticeMessage: null,
+                  warning: null,
+                }),
+                mcpRuntime: preparedMcpRuntime,
+                sanitizeRolesNextTurn: replayMessages.at(-1)?.role === "user",
+                logMessage: `Resumed session ${existing.id} (${rebuiltMessages.length} messages)`,
+              });
+              commitPreparedReplDbResume(
+                preparedState,
+                () => _applyPreparedResumeState(preparedState),
+                () => _restoreResumeState(previousState),
               );
             } else {
               logger.info(`Session not found: ${resumeId}`);
@@ -3792,7 +5714,14 @@ async function startAgentReplInWorkspace(options = {}) {
             logger.info("No session store available");
           }
         } catch (err) {
-          logger.error(`Resume failed: ${err.message}`);
+          logger.error(
+            JSON.stringify({
+              type: "session.resume.refused",
+              code: err?.code || "CC_REPL_SESSION_RESUME_FAILED",
+              sessionId: resumeId,
+              message: err?.message || "Session resume failed",
+            }),
+          );
         }
       } else {
         logger.info(`Session ID: ${sessionId || "none"}`);
@@ -3841,15 +5770,30 @@ async function startAgentReplInWorkspace(options = {}) {
 
         // Re-merge plugin hooks onto the user's settings hooks (live session).
         try {
-          const { loadHooks } = await import("../lib/settings-hooks.cjs");
+          const { loadHooks, attachAuthorityErrors } =
+            await import("../lib/settings-hooks.cjs");
           const { mergePluginHooks } =
             await import("../lib/plugin-runtime/hooks.js");
-          const base = loadHooks({ cwd }).hooks;
-          const merged = mergePluginHooks(base, { cwd });
+          const loaded = loadHooks({ cwd });
+          const merged = mergePluginHooks(
+            attachAuthorityErrors(loaded.hooks, loaded.authorityErrors),
+            { cwd },
+          );
           _settingsHooks =
-            merged && Object.keys(merged).length > 0 ? merged : null;
-        } catch {
-          /* hooks re-merge is best-effort */
+            Object.keys(merged).length > 0 || merged._authorityErrors.length > 0
+              ? merged
+              : null;
+        } catch (error) {
+          _settingsHooks = {};
+          Object.defineProperty(_settingsHooks, "_authorityErrors", {
+            value: Object.freeze([
+              Object.freeze({
+                sourceFile: null,
+                code: error?.code || "CC_HOOK_AUTHORITY_LOAD_FAILED",
+              }),
+            ]),
+            enumerable: false,
+          });
         }
 
         // settings.json ConfigChange hooks (Claude-Code parity): the live
@@ -4497,6 +6441,31 @@ async function startAgentReplInWorkspace(options = {}) {
             "Plan has no items yet. Let the AI analyze the task first.",
           );
         } else {
+          // Review this immutable plan version before approval. Advisor output
+          // cannot block or approve the plan and grants no extra authority; its
+          // local-verification checklist is queued for the next main turn.
+          if (_advisorRuntime?.status().enabled) {
+            try {
+              const result = await _advisorRuntime.reviewPlan(
+                {
+                  id: planManager.currentPlan.id,
+                  title: planManager.currentPlan.title,
+                  description: planManager.currentPlan.description,
+                  summary: planManager.generatePlanSummary(),
+                },
+                { messages, signal: _turnAbort?.signal || null },
+              );
+              if (result.ok) {
+                const { renderAdvisorAdvice } =
+                  await import("./advisor-command.js");
+                logger.log(renderAdvisorAdvice(result));
+              } else if (result.effect !== "disabled") {
+                logger.warn(result.error);
+              }
+            } catch (error) {
+              logger.warn(`Advisor plan review skipped: ${error.message}`);
+            }
+          }
           planManager.approvePlan();
           logger.success(
             `Plan approved! ${planManager.currentPlan.items.length} items ready for execution.`,
@@ -4673,7 +6642,7 @@ async function startAgentReplInWorkspace(options = {}) {
 
     // `/mcp` — overview of connected MCP servers' resources + prompts.
     if (trimmed === "/mcp" || trimmed.startsWith("/mcp ")) {
-      const mcpClient = _adhocMcp?.mcpClient || _bundleMcpClient;
+      const mcpClient = _getReplHostMcp()?.mcpClient;
       logger.log(renderMcpSurface(mcpClient));
       prompt();
       return;
@@ -4700,7 +6669,12 @@ async function startAgentReplInWorkspace(options = {}) {
         } else if (cmd.action === "help") {
           logger.log(renderConfigHelp());
         } else if (cmd.action === "get") {
-          logger.log(renderConfigGet(cmd.key, cm.getConfigValue(cmd.key)));
+          logger.log(
+            renderConfigGet(
+              cmd.key,
+              cm.getConfigValue(cmd.key, { resolveSecrets: false }),
+            ),
+          );
         } else if (cmd.action === "set") {
           cm.setConfigValue(cmd.key, cmd.value);
           logger.log(
@@ -5112,7 +7086,7 @@ async function startAgentReplInWorkspace(options = {}) {
       try {
         const expanded = await expandMcpPrompt(
           promptText,
-          _adhocMcp?.mcpClient || _bundleMcpClient,
+          _getReplHostMcp()?.mcpClient,
         );
         if (expanded != null) {
           promptText = expanded;
@@ -5185,7 +7159,7 @@ async function startAgentReplInWorkspace(options = {}) {
     }
 
     // Backstop: if the previous turn's agentLoop threw before the success-path
-    // restore ran, undo its /btw aside now so it never leaks into this turn's
+    // restore ran, undo its /note-next guidance so it never leaks into this turn's
     // history/model call. (Normal turns clear _btwRestore right after agentLoop.)
     if (_btwRestore) {
       _btwRestore.msg.content = _btwRestore.content;
@@ -5335,11 +7309,12 @@ async function startAgentReplInWorkspace(options = {}) {
     try {
       const { buildIdePromptContext, expandIdeMentions } =
         await import("../lib/ide-context.js");
-      const ideCtx = await buildIdePromptContext(_adhocMcp);
+      const hostMcp = _getReplHostMcp();
+      const ideCtx = await buildIdePromptContext(hostMcp);
       if (ideCtx) userContent += `\n\n${ideCtx}`;
       // Explicit @selection / @diagnostics mentions (Claude-Code parity);
       // scan the user's original prompt, append the expansion ephemerally.
-      const mentioned = await expandIdeMentions(effectivePrompt, _adhocMcp);
+      const mentioned = await expandIdeMentions(effectivePrompt, hostMcp);
       for (const w of mentioned.warnings) {
         logger.info(chalk.yellow(`[@ide] ${w}`));
       }
@@ -5389,7 +7364,7 @@ async function startAgentReplInWorkspace(options = {}) {
       return;
     }
 
-    // Add user message (keep the object ref so a /btw aside can be injected for
+    // Add user message (keep the object ref so /note-next can be injected for
     // this turn's model call and then stripped before persistence).
     const _userMsg = { role: "user", content: _userMessageContent };
     messages.push(_userMsg);
@@ -5529,6 +7504,28 @@ async function startAgentReplInWorkspace(options = {}) {
         /* goal binding is best-effort — fall back to defaultPrepareCall */
       }
       _turnAbort = new AbortController();
+      if (_advisorRuntime) {
+        _advisorRuntime.beginTurn(
+          `${sessionId || "ephemeral"}:${_turnCount + 1}`,
+        );
+        prepareCall = _advisorRuntime.createPrepareCall({
+          messages,
+          basePrepareCall: prepareCall,
+          subject: promptText,
+          signal: _turnAbort.signal,
+          onAdvice: async (result) => {
+            if (!result.ok) {
+              if (result.effect !== "disabled") {
+                process.stderr.write(`  Advisor: ${result.error}\n`);
+              }
+              return;
+            }
+            const { renderAdvisorAdvice } =
+              await import("./advisor-command.js");
+            process.stderr.write(`\n${renderAdvisorAdvice(result)}\n`);
+          },
+        });
+      }
       // Live streaming hooks: write the answer token-by-token, and stream the
       // reasoning dimmed before it. Skipped (left undefined) in replay mode.
       let _liveStreamed = false;
@@ -5553,7 +7550,7 @@ async function startAgentReplInWorkspace(options = {}) {
           }
         : {};
       if (_streamLive) process.stdout.write("\n");
-      // Inject any queued /btw asides into THIS turn's user message just before
+      // Inject queued /note-next guidance into THIS turn just before
       // the model call. We remember the pre-aside content so it's restored right
       // after agentLoop returns — the aside steers this answer but is never
       // persisted (saveMessages/JSONL) or carried into later turns. Consumed on
@@ -5565,7 +7562,7 @@ async function startAgentReplInWorkspace(options = {}) {
           _btwRestore = { msg: _userMsg, content: _userMsg.content };
           _userMsg.content = applyAside(_userMsg.content, block);
           logger.verbose(
-            `[btw] applied ${pendingBtw.length} aside(s) to this turn`,
+            `[note-next] applied ${pendingBtw.length} note(s) to this turn`,
           );
         }
         pendingBtw = [];
@@ -5582,6 +7579,8 @@ async function startAgentReplInWorkspace(options = {}) {
           await import("../lib/async-hook-supervisor.js");
         _asyncHookSupervisor = new AsyncHookSupervisor({ persistStats: true });
       }
+      const activeMcpRuntime = _activateMcpHostRuntime();
+      const activeRawMcpClient = activeMcpRuntime.rawClient || undefined;
       const {
         content: response,
         usageEvents,
@@ -5653,6 +7652,9 @@ async function startAgentReplInWorkspace(options = {}) {
         sandbox: _sandbox,
         autoCheckpoint,
         checkpointSession: sessionId,
+        managedCheckpoint,
+        managedCheckpointStateDir,
+        managedCheckpointExclusions,
         checkpointMarks: _checkpointMarks,
         // Explicit turn-binding producer (null unless a JSONL session): the
         // wrapper folds every loop event into the live table.
@@ -5683,16 +7685,21 @@ async function startAgentReplInWorkspace(options = {}) {
         interactiveApproval: true,
         // MCP: --mcp-config (ad-hoc) wins; bundle MCP is the fallback. The 3
         // tool channels expose --mcp-config servers' tools to the LLM directly.
-        mcpClient: _adhocMcp?.mcpClient || _bundleMcpClient || undefined,
+        mcpClient: activeRawMcpClient,
+        mcpHostClient: activeMcpRuntime.runtime.client,
         extraToolDefinitions: _adhocMcp?.extraToolDefinitions,
         externalToolExecutors: _adhocMcp?.externalToolExecutors,
         externalToolDescriptors: _adhocMcp?.externalToolDescriptors,
+        // The recovery controller is required even when this legacy/ephemeral
+        // session has no durable sink. Otherwise an outcome-unknown call could
+        // be retried in the same process after agent-core creates a plain ledger.
+        mcpCallLedger: activeMcpRuntime.runtime.ledger,
         chatFn: _fallbackChatFn,
       });
       _persistReplContextSources();
       _turnAbort = null;
 
-      // Strip the one-shot /btw aside now the model has seen it — so it is never
+      // Strip one-shot /note-next guidance now the model has seen it so it is never
       // persisted (DB saveMessages below) or carried into the next turn.
       if (_btwRestore) {
         _btwRestore.msg.content = _btwRestore.content;
@@ -5867,8 +7874,16 @@ async function startAgentReplInWorkspace(options = {}) {
           if (useJsonl) {
             // Append incremental events (user + assistant)
             appendUserMessage(sessionId, effectivePrompt);
+            _replCompactPersistence.record({
+              role: "user",
+              content: effectivePrompt,
+            });
             if (effectiveResponse) {
               appendAssistantMessage(sessionId, effectiveResponse);
+              _replCompactPersistence.record({
+                role: "assistant",
+                content: effectiveResponse,
+              });
             }
           } else if (db) {
             saveMessages(db, sessionId, messages);
@@ -5903,16 +7918,21 @@ async function startAgentReplInWorkspace(options = {}) {
             logger.verbose(
               `Auto-compacted: ${stats.strategy} (saved ${stats.saved} tokens)`,
             );
+            if (stats.degraded === true) {
+              logger.warn(
+                `Auto-compaction degraded to ${stats.summaryMode}: ${stats.degradedReason}`,
+              );
+            }
             // Write compact checkpoint to JSONL for crash recovery
             if (useJsonl && sessionId) {
-              appendCompactEvent(sessionId, {
+              _replCompactPersistence.persist(sessionId, {
                 ...stats,
                 messages: compacted,
               });
             }
           }
         } catch (_e) {
-          // Non-critical — continue with uncompacted messages
+          logger.warn(`Auto-compaction failed: ${_e.message}`);
         }
       }
 
@@ -5993,6 +8013,15 @@ async function startAgentReplInWorkspace(options = {}) {
 
   rl.on("line", async (input) => {
     if (_processingLine) {
+      const concurrentBtw = _slashCommandsDisabled
+        ? null
+        : parseBtwCommand(input.trim());
+      if (concurrentBtw) {
+        // Intentionally do not await: the main turn keeps streaming while this
+        // independent, tool-free snapshot call runs alongside it.
+        void runBtwSideQuestion(concurrentBtw, { concurrent: true });
+        return;
+      }
       if (input.trim()) {
         _pendingLines.push(input);
         logger.log(
@@ -6057,7 +8086,7 @@ async function startAgentReplInWorkspace(options = {}) {
         if (useJsonl) {
           _persistReplContextSources();
           // JSONL: write final compact snapshot for fast rebuild
-          appendCompactEvent(sessionId, {
+          _replCompactPersistence.persist(sessionId, {
             strategy: "session-end",
             messages,
           });
@@ -6065,7 +8094,7 @@ async function startAgentReplInWorkspace(options = {}) {
           saveMessages(db, sessionId, messages);
         }
       } catch (_e) {
-        // Non-critical
+        logger.warn(`Session-end compact not persisted: ${_e.message}`);
       }
     }
     // Auto-summarize session into permanent memory