comisai 1.0.42 → 1.0.44

package/node_modules/@comis/agent/dist/executor/pi-executor/pi-executor.js

@@ -32,8 +32,10 @@
  *
  * @module
  */
+import * as os from "node:os";
+import { attachTrajectoryToEventBus, createTrajectoryRecorder, attachCacheTraceToEventBus, createCacheTrace, } from "@comis/observability";
 import { createAgentSession, DefaultResourceLoader, } from "@earendil-works/pi-coding-agent";
-import { formatSessionKey, tryGetContext, ContextEngineConfigSchema, } from "@comis/core";
+import { formatSessionKey, safePath, tryGetContext, } from "@comis/core";
 import { suppressError } from "@comis/shared";
 import { createToolRetryBreaker } from "../../safety/tool-retry-breaker.js";
 import { createMessageSendLimiter } from "../../safety/message-send-limiter.js";
@@ -49,14 +51,18 @@ import { setupContextEngine } from "../executor-context-engine-setup.js";
 import { runPrompt } from "../prompt-runner/index.js";
 import { wrapToolResultWithGuide } from "../jit-guide-injector.js";
 import { postExecution } from "../executor-post-execution.js";
+import { resolveReplyLanguage } from "../resolve-reply-language.js";
 import { assembleTools } from "../executor-tool-assembly.js";
-import { getDeliveredGuides, setDeliveredGuides, setBreakpointIndex, clearSessionCacheWarm, setEvictionCooldown, decrementEvictionCooldown as decrementEvictionCooldownForSession, recordCacheSavings, getCacheSavings, clearSessionCacheSavings, setSessionStateClock, } from "../executor-session-state.js";
+import { getDeliveredGuides, setDeliveredGuides, setBreakpointIndex, clearSessionCacheWarm, setEvictionCooldown, decrementEvictionCooldown as decrementEvictionCooldownForSession, recordCacheSavings, getCacheSavings, clearSessionCacheSavings, setSessionStateClock, getWindowReconcileLogged, setWindowReconcileLogged, } from "../executor-session-state.js";
 import { normalizeModelCompat } from "../../provider/model-compat.js";
 import { normalizeModelId } from "../../provider/model-id-normalize.js";
+import { resolveModelProfile } from "../model-profile.js";
+import { observedModelId } from "../observed-model-id.js";
+import { resolveEffectiveContextWindow } from "../../model/effective-context-window.js";
+import { DEFAULT_EFFECTIVE_CAP_BY_CLASS } from "../../context-engine/budget-capacity-cap.js";
 import { isAnthropicFamily, isGoogleFamily, resolveProviderCapabilities } from "../../provider/capabilities.js";
 import { detectOnboardingState } from "../../workspace/onboarding-detector.js";
-import { installDagIngestionHook, validateRoleAttribution } from "../../context-engine/index.js";
-import { CHARS_PER_TOKEN_RATIO } from "../../context-engine/constants.js";
+import { validateRoleAttribution } from "../../context-engine/index.js";
 import { getElapsedSinceLastResponse } from "../ttl-guard.js";
 import { clearSessionBlockStability } from "../block-stability-tracker.js";
 import { wrapToolForAutoBackground } from "../../background/index.js";
@@ -65,11 +71,17 @@ import { OPERATION_TIMEOUT_DEFAULTS } from "../../model/operation-model-defaults
 import { randomUUID } from "node:crypto";
 // Closure-extracted helpers (state-first)
 import { installCompactionTrigger } from "./compaction-trigger.js";
+import { createDeltaResetComposer } from "./delta-reset.js";
+import { resolveTrajectoryConfinedBase } from "./trajectory-confinement.js";
 import { bootstrapSession, decodeExecutionOverrides } from "./session-bootstrap.js";
 import { runSafetyGates } from "./safety-gate.js";
+import { maybeRunBootstrapSweep } from "./maybe-run-bootstrap-sweep.js";
 import { applyPromptRunOutcome, handleEnvelopeException } from "./message-envelope.js";
 import { finalizeLockResult } from "./executor-error-mapping.js";
 import { createBeforeToolCallGuard } from "./before-tool-call-guard.js";
+import { createTurnLoopDetector } from "../turn-loop-detector.js";
+import { buildPromptingSnapshot } from "./pi-executor-prompting.js";
+import { computeOutputHeadroom } from "../../context-engine/output-headroom.js";
 /** Number of turns to restrict breakpoints after server eviction. */
 const EVICTION_COOLDOWN_TURNS = 2;
 // ---------------------------------------------------------------------------
@@ -117,7 +129,7 @@ export function createPiExecutor(config, deps) {
         async execute(msg, sessionKey, tools, onDelta, agentId, _directives, _prevTimestamp, overrides) {
             // 1. Bootstrap: OAuth pre-resolve + ExecutionResult init + SEP plan ref
             //    (closure-extracted)
-            const { executionStartMs, result, sepEnabled, executionPlanRef } = await bootstrapSession({}, deps, { config, sessionKey, overrides });
+            const { executionStartMs, result, sepEnabled, executionPlanRef } = await bootstrapSession({}, deps, { config, sessionKey, overrides, executionPlanHolder: deps.executionPlanHolder });
             // 2. Pre-lock safety gates: input validation, provider health, circuit
             //    breaker, fault injector (closure-extracted)
             const safetyOutcome = runSafetyGates({ result }, deps, { msg, sessionKey, agentId, provider: config.provider });
@@ -138,10 +150,24 @@ export function createPiExecutor(config, deps) {
             });
             const activeStepCounter = executionOverrides?.stepCounter ?? deps.stepCounter;
             activeStepCounter.reset();
-            deps.budgetGuard.resetExecution();
+            // BUDGET-01: a per-spawn tokenBudget becomes THIS execution's effective
+            // per-execution cap (min(config.perExecution, cap)); undefined ⇒ no cap
+            // override, byte-identical to the no-budget path.
+            // CR-01: resetExecution returns an EXECUTION-LOCAL window owning this run's
+            // per-execution total + cap. Thread it (not the shared per-agent guard)
+            // into the before-tool-call guard and the event bridge so two concurrent
+            // same-agent executions never clobber each other's per-execution budget.
+            const budgetWindow = deps.budgetGuard.resetExecution(executionOverrides?.tokenBudget);
             // 4. Resolve model using ModelRegistry
             //    Apply per-node model override from ExecutionOverrides and normalize shortcuts before registry lookup
             const normalizedPrimary = normalizeModelId(config.provider, config.model);
+            // WR-02: track the provider key (config providers.entries space) the
+            // EXECUTING model resolves to — the agent's primary by default, the
+            // override provider when a per-execution model override resolves below.
+            // The served-window gate compares against THIS key rather than
+            // resolvedModel.provider because the registry's alias fallback can
+            // rename a custom provider entry to its built-in pi name.
+            let resolvedProviderKey = config.provider;
             let resolvedModel = deps.modelRegistry.find(config.provider, normalizedPrimary.modelId);
             if (!resolvedModel && deps.providerAliases) {
                 const builtInName = deps.providerAliases.get(config.provider);
@@ -175,6 +201,7 @@ export function createPiExecutor(config, deps) {
                     }
                     if (overrideResolved) {
                         resolvedModel = overrideResolved;
+                        resolvedProviderKey = overrideProvider; // WR-02: the execution now runs on the override's provider
                         deps.logger.info({ defaultModel: config.model, overrideModel: executionOverrides.model }, "Model override applied from execution overrides");
                     }
                     else {
@@ -193,11 +220,125 @@ export function createPiExecutor(config, deps) {
             if (alsCtx && resolvedModel) {
                 alsCtx.resolvedModel = `${resolvedModel.provider}:${resolvedModel.id}`;
             }
-            // Derive compat config via normalizeModelCompat (xAI auto-detection).
+            // R4 (132-03): populate the turn's agentId onto the LIVE RequestContext so
+            // the in-session ctx_* tools scope LCD reads by THIS agent per-call (WR-02).
+            // The agentId arrives as a positional execute() arg (not in the context set
+            // at the channel/RPC boundary); mirror the resolvedModel mutation above. The
+            // tools read `tryGetContext().agentId` — a wiring-time closure would be
+            // unsafe when one wiring serves multiple agents (the exact WR-02 threat).
+            if (alsCtx && agentId) {
+                alsCtx.agentId = agentId;
+            }
+            // GEN-03 (181-04): tag the resolved reply language on ALS for the sub-agent leg
+            // (DET-02 config+inbound order; set only when non-en so the en path is untouched, I1).
+            if (alsCtx) {
+                const lang = resolveReplyLanguage({ inboundText: msg.text ?? "", configLanguage: config.language });
+                if (lang !== "en")
+                    alsCtx.resolvedLanguage = lang;
+            }
+            // Derive compat config via normalizeModelCompat (xAI + GBNF auto-detection;
+            // providerType/comisCompat resolved per-execution because model overrides
+            // can switch providers — GBNF-01).
             const modelCompat = resolvedModel ? normalizeModelCompat({
                 provider: resolvedModel.provider,
                 id: resolvedModel.id,
+                providerType: deps.getProviderType?.(resolvedModel.provider),
+                comisCompat: deps.getModelCompat?.(resolvedModel.provider, resolvedModel.id),
             }) : undefined;
+            // Resolve ModelProfile once per execution (K1: resolve-once, thread everywhere).
+            // Must be after executionOverrides.model override (above) so the profile reflects
+            // the actual resolved model. Added to RunSessionLockedContext (per-execution record,
+            // NOT PiExecutorDeps which is long-lived across multiple execute() calls).
+            // CR-02: resolvedModel.input is ("text"|"image")[] — assignable to readonly string[]
+            // without a cast now that resolveModelProfile accepts readonly string[] | undefined.
+            // Q3: wire operator capabilityClass override from providers.entries.<id>.capabilities.capabilityClass.
+            // deps.providerCapabilities is already populated by setup-agents-runtime.ts from
+            // container.config.providers?.entries?.[resolved.provider]?.capabilities.
+            // When set, this overrides the provider-family heuristic (ollama → "small" etc.)
+            // and lets operators pin a specific capabilityClass in config (e.g., to treat a
+            // large quantized ollama model as "mid" for context budget + security purposes).
+            // CWF-03: Reconcile effective context window before resolveModelProfile.
+            // capabilityCap is derived from deps.providerCapabilities?.capabilityClass (pre-resolver,
+            // config-side value) — NOT from modelProfile.capabilityClass, which does not exist yet
+            // (resolveModelProfile is what creates it). Using modelProfile here would be circular.
+            // CR-01 fix: when no explicit capabilityClass is present (e.g. plain anthropic/openai
+            // provider with no providers.entries block), treat the cap as Infinity (no constraint).
+            // Only apply a class-derived cap when the operator explicitly set capabilityClass.
+            // Cross-provider stress enabler (2026-06-22): the AGENT-level pin
+            // (agents.<id>.capabilityClass) takes precedence over the PROVIDER-level
+            // value (providers.entries.<id>.capabilities.capabilityClass), so an operator
+            // can force a small-window nano/small treatment on a large-window model
+            // (gpt-5-nano/claude-haiku/gemini-flash) to exercise the context-fit path on
+            // ANY provider. Resolved ONCE here so the capabilityCap below and the
+            // resolveModelProfile override agree on the same class. Unset on both →
+            // undefined → the provider-family heuristic (byte-identical).
+            const explicitClass = config.capabilityClass ?? deps.providerCapabilities?.capabilityClass;
+            const capabilityCap = explicitClass != null
+                ? (DEFAULT_EFFECTIVE_CAP_BY_CLASS[explicitClass] ?? Infinity)
+                : Infinity;
+            // WR-02 (Phase 176 review): the probed served window binds ONLY
+            // executions on the provider it was probed from. deps.servedContextWindow
+            // is bound once at construction to the agent's PRIMARY provider, but
+            // executionOverrides.model can switch providers per-execution (graph
+            // per-node models, subagent spawns — the GBNF-01 resolver-form
+            // precedent). On mismatch: no served clamp AND no served attribution —
+            // otherwise an Ollama-primary agent's 8K num_ctx would silently crush an
+            // override model on another provider and the diagnostics would assert
+            // "Ollama serves only 8192" for a model Ollama does not serve.
+            const servedWindow = deps.servedContextWindow !== undefined &&
+                deps.servedContextWindow.providerKey === resolvedProviderKey
+                ? deps.servedContextWindow.window
+                : undefined;
+            const effectiveContextWindowResult = resolveEffectiveContextWindow({
+                configured: resolvedModel?.contextWindow ?? 8_192,
+                served: servedWindow,
+                capabilityCap,
+            });
+            // KNOB-02 (Phase 176): the window provenance is BORN here — the TRUE
+            // configured window before resolveModelProfile below overwrites
+            // profile.contextWindow with the reconciled value. Threaded along the
+            // modelProfile chain into BOTH computeTokenBudgetForProfile call sites
+            // (executor-tool-assembly + lcd-assembler via ContextEngineDeps) so a
+            // served-bound budget reports raw=configured with windowCapSource "served".
+            const windowProvenance = {
+                configuredWindow: resolvedModel?.contextWindow ?? 8_192,
+                ...(servedWindow !== undefined && { served: servedWindow }),
+                reconcileSource: effectiveContextWindowResult.source,
+            };
+            if (effectiveContextWindowResult.source !== "configured") {
+                deps.logger.debug({
+                    source: effectiveContextWindowResult.source,
+                    effectiveWindow: effectiveContextWindowResult.effectiveWindow,
+                    configured: resolvedModel?.contextWindow,
+                    served: servedWindow,
+                    capabilityCap,
+                    submodule: "context-window-reconcile",
+                }, "Context window reconciled (served or capability cap bound)");
+                // KNOB-02: promote the FIRST reconcile of a session to INFO — the
+                // reconcile is load-bearing diagnostic evidence (which window actually
+                // bound, and why) and must not depend on logLevel=debug having been set
+                // before the incident. The bounded session latch keeps it to exactly
+                // once per session (clearSessionState grants a fresh INFO on
+                // delete/reset/expiry); the DEBUG above stays per-turn.
+                const reconcileLatchKey = formatSessionKey(sessionKey);
+                if (!getWindowReconcileLogged(reconcileLatchKey)) {
+                    setWindowReconcileLogged(reconcileLatchKey);
+                    deps.logger.info({
+                        source: effectiveContextWindowResult.source,
+                        effectiveWindow: effectiveContextWindowResult.effectiveWindow,
+                        configured: resolvedModel?.contextWindow ?? 8_192,
+                        served: servedWindow,
+                        capabilityCap,
+                        submodule: "context-window-reconcile",
+                    }, "Context window reconciled (served or capability cap bound)");
+                }
+            }
+            const modelProfile = resolveModelProfile(resolvedModel
+                ? { ...resolvedModel, contextWindow: effectiveContextWindowResult.effectiveWindow }
+                : undefined, 
+            // Use the resolved explicitClass (agent-level pin > provider-level) so the
+            // pinned class drives BOTH the capabilityCap above and the profile here.
+            explicitClass);
             // 5. Execute within session adapter (use ephemeral adapter if provided)
             const sessionAdapter = overrides?.ephemeralSessionAdapter ?? deps.sessionAdapter;
             const lockResult = await sessionAdapter.withSession(sessionKey, (sm) => runSessionLocked(sm, {
@@ -219,7 +360,10 @@ export function createPiExecutor(config, deps) {
                 safetyReinforcement,
                 resolvedModel,
                 modelCompat,
+                modelProfile,
+                windowProvenance,
                 activeStepCounter,
+                budgetWindow,
                 sessionAdapter,
                 cacheRetentionRef,
                 adaptiveRetentionRef,
@@ -232,7 +376,14 @@ export function createPiExecutor(config, deps) {
     };
 }
 async function runSessionLocked(sm, ctx) {
-    const { config, deps, result, msg, sessionKey, tools, onDelta, agentId, _directives, _prevTimestamp, executionOverrides, executionStartMs, effectiveTimeout, sepEnabled, executionPlanRef, safetyReinforcement, resolvedModel, modelCompat, activeStepCounter, sessionAdapter, cacheRetentionRef, adaptiveRetentionRef, minTokensOverrideRef, } = ctx;
+    const { config, deps, result, msg, sessionKey, tools, onDelta, agentId, _directives, _prevTimestamp, executionOverrides, executionStartMs, effectiveTimeout, sepEnabled, executionPlanRef, safetyReinforcement, resolvedModel, modelCompat, modelProfile, windowProvenance, activeStepCounter, budgetWindow, sessionAdapter, cacheRetentionRef, adaptiveRetentionRef, minTokensOverrideRef, } = ctx;
+    // WT-01: the per-run workspace jail. A `spawn --worktree` child runs in an
+    // isolated git worktree (executionOverrides.workspaceDir, confined under the
+    // agent's own jailed workspace, T-219-11), so the SDK session cwd + the
+    // resource-loader / context-engine / command-handler workspace root all use it
+    // — exec/read/write/edit resolve inside the worktree. Absent ⇒ deps.workspaceDir
+    // (the agent's shared workspace — byte-identical to today's path).
+    const effectiveWorkspaceDir = executionOverrides?.workspaceDir ?? deps.workspaceDir;
     // Reset closure for postExecution finally-block (writes back through the
     // factory's MutableRef-backed `let`s so the next execute() starts fresh).
     const executionCacheRetentionClear = () => { cacheRetentionRef.set(undefined); };
@@ -276,8 +427,9 @@ async function runSessionLocked(sm, ctx) {
         deliveredGuides = new Set();
         setDeliveredGuides(formattedKeyForGuides, deliveredGuides);
     }
-    // Detect onboarding state for post-execution completion check
-    const isOnboarding = await detectOnboardingState(deps.workspaceDir);
+    // Detect onboarding state for post-execution completion check (WT-01: the
+    // worktree is the child's actual working tree, so onboarding state reflects it).
+    const isOnboarding = await detectOnboardingState(effectiveWorkspaceDir);
     // Capture prompt skills XML once at execution start.
     // Skills registered during tool calls (e.g., skill-creator creating stock-scanner)
     // do not mutate the system prompt until the next execution.
@@ -292,35 +444,12 @@ async function runSessionLocked(sm, ctx) {
     const toolAssembly = await assembleTools({
         config, deps: frozenDeps, sessionKey, msg, tools, executionOverrides,
         isFirstMessageInSession, sm, formattedKeyForGuides, deliveredGuides,
-        resolvedModel, modelCompat, agentId, safetyReinforcement, _directives,
+        resolvedModel, modelCompat, modelProfile, windowProvenance, agentId, safetyReinforcement, _directives,
     });
     const { mergedCustomTools, } = toolAssembly;
-    const { deferralResult, deferredContext, capabilityIndexResult, modelTier, discoveryTracker, settingsManager, resourceLoaderOptions, promptResult, cachedSystemTokensEstimate, } = toolAssembly;
+    const { deferralResult, deferredContext, capabilityIndexResult, capabilityClass, budgetWindowTokens, discoveryTracker, settingsManager, resourceLoaderOptions, promptResult, cachedSystemTokensEstimate, cachedFreshTailPreambleTokens, } = toolAssembly;
     const currentDiscoveryTracker = toolAssembly.currentDiscoveryTracker;
-    const { systemPrompt, systemPromptBlocks, dynamicPreamble, inlineMemory } = promptResult;
-    // DAG ingestion hook -- install BEFORE microcompaction
-    // so microcompaction is the outer wrapper. Execution order: microcompaction first -> DAG ingest second.
-    // DAG ingest receives the post-microcompaction message (with disk offload references).
-    const baseContextEngineConfigForHook = config.contextEngine ?? ContextEngineConfigSchema.parse({});
-    if (baseContextEngineConfigForHook.version === "dag" && deps.contextStore) {
-        const tenantId = deps.tenantId ?? "default";
-        const hookFormattedKey = formatSessionKey(sessionKey);
-        const existingConv = deps.contextStore.getConversationBySession(tenantId, hookFormattedKey);
-        let hookConversationId;
-        if (existingConv) {
-            hookConversationId = existingConv.conversation_id;
-        }
-        else {
-            hookConversationId = deps.contextStore.createConversation({
-                tenantId,
-                agentId: agentId ?? config.name,
-                sessionKey: hookFormattedKey,
-            });
-        }
-        // Store for later use by context engine
-        sm.__dagConversationId = hookConversationId;
-        installDagIngestionHook(sm, deps.contextStore, hookConversationId, deps.logger, (text) => Math.ceil(text.length / CHARS_PER_TOKEN_RATIO));
-    }
+    const { systemPrompt, systemPromptBlocks, dynamicPreamble, inlineMemory, recalledMemories, userLanguage } = promptResult;
     const resourceLoader = new DefaultResourceLoader(resourceLoaderOptions);
     await resourceLoader.reload();
     // The SDK's `tools` is an allowlist of tool *names* (not definitions).
@@ -342,7 +471,7 @@ async function runSessionLocked(sm, ctx) {
     //      override the SDK built-ins via Map.set() in the registry
     //      build (`agent-session.js:1810-1813` in pi-coding-agent@0.68.0).
     const sessionOptions = {
-        cwd: deps.workspaceDir,
+        cwd: effectiveWorkspaceDir,
         authStorage: deps.authStorage,
         modelRegistry: deps.modelRegistry,
         model: resolvedModel ?? undefined,
@@ -358,6 +487,170 @@ async function runSessionLocked(sm, ctx) {
     }
     // Compute formatted key early for trace file paths and active run registry
     const formattedKey = formatSessionKey(sessionKey);
+    // Per-session trajectory recorder. The recorder writes one JSONL line
+    // per typed-EventBus event the bridge translates; attachTrajectoryToEventBus
+    // subscribes once for the duration of this execute() call. Both the
+    // recorder and the bridge subscription are torn down in the runner-block
+    // finally (after postExecution).
+    // createTrajectoryRecorder returns null when COMIS_TRAJECTORY=0 or
+    // diagnostics.trajectory.enabled=false — the null-check below makes
+    // the wiring a no-op in that case.
+    let trajectoryRecorder = null;
+    let trajectoryUnsubscribe;
+    // Cache-trace recorder local-variable lifecycle. Mirrors the trajectory
+    // pattern — declared here, assigned inside the try below, torn down in
+    // the finally block at end of execute().
+    let cacheTrace = null;
+    let unsubscribeCacheTrace;
+    try {
+        // Confine trajectory writes to the operator's resolved data root (so an
+        // ancestor-symlink escape is rejected at open()) UNLESS they explicitly set
+        // `diagnostics.trajectory.dir` — then they own that path and confinement is
+        // skipped. The base is `deps.dataDir` (config.dataDir / COMIS_DATA_DIR), NOT
+        // a hardcoded ~/.comis: a custom-dataDir install keeps its session files —
+        // and their co-located trajectory files — under that root, so a ~/.comis
+        // base would silently reject every write while the pointer still advertises
+        // the file (the 260611 session-index bug class). See resolveTrajectoryConfinedBase.
+        const trajectoryConfinedBase = resolveTrajectoryConfinedBase(deps.trajectoryConfig?.dir, deps.dataDir);
+        // Recorder lifecycle:
+        //   - `deps.trajectoryRegistry` present → session-scoped: registry
+        //     owns the recorder + bridge subscription for the session's
+        //     lifetime, this `execute()` call just looks it up (or
+        //     materializes it on the first turn). `flushAndClose` runs in
+        //     the daemon's shutdown chain via `closeAll()`, NOT in this
+        //     execute's finally — that's what fixes per-turn seq reset
+        //     and repeated session.started/ended deviations.
+        //   - `deps.trajectoryRegistry` undefined → fall back to per-turn
+        //     construction (legacy path; kept so tests + non-daemon callers
+        //     keep working).
+        const trajectoryInit = {
+            agentId: agentId ?? config.name,
+            sessionId: formattedKey,
+            sessionKey: formattedKey,
+            // WT-01: record the run's ACTUAL working tree (the worktree when present)
+            // so the trajectory reflects where exec/read/write ran, not the shared dir.
+            workspaceDir: effectiveWorkspaceDir,
+            // Pointer-file sidecar. createTrajectoryRecorder
+            // calls writeTrajectoryPointerFileBestEffort when sessionFile is
+            // set, producing <sessionFile>.trajectory-path.json next to the
+            // per-session JSONL transcript. The pointer is best-effort
+            // (symlinked parents / unwritable dirs no-op silently).
+            // The registry's first-init-wins contract means the
+            // pointer is written exactly once at recorder creation.
+            // sessionAdapter.getSessionPath is sync + pure (safePath under
+            // the hood) — zero overhead at trajectoryInit construction.
+            sessionFile: sessionAdapter.getSessionPath(sessionKey),
+            // provider + modelId + modelApi live inside the `model` cluster
+            // on TrajectoryRecorderInit (architecture invariant: ≤12 optional
+            // fields per interface). The runtime lifts each cluster field
+            // onto the trajectory envelope when defined.
+            // modelApi is not threaded from this site yet — wire it in when
+            // resolvedModel exposes the API discriminator.
+            model: {
+                provider: resolvedModel?.provider ?? config.provider,
+                modelId: resolvedModel?.id ?? config.model,
+            },
+            ...(trajectoryConfinedBase !== undefined
+                ? { confinedBaseDir: trajectoryConfinedBase }
+                : {}),
+            ...(deps.trajectoryConfig?.enabled !== undefined
+                ? { enabled: deps.trajectoryConfig.enabled }
+                : {}),
+            ...(deps.trajectoryConfig?.dir !== undefined
+                ? { trajectoryDir: deps.trajectoryConfig.dir }
+                : {}),
+            ...(deps.trajectoryConfig?.maxFileBytes !== undefined
+                ? { maxRuntimeFileBytes: deps.trajectoryConfig.maxFileBytes }
+                : {}),
+        };
+        const eventTypes = deps.trajectoryConfig?.eventTypes;
+        const eventTypesFilter = eventTypes && eventTypes.length > 0
+            ? (n) => eventTypes.includes(n)
+            : undefined;
+        if (deps.trajectoryRegistry !== undefined) {
+            // Session-scoped: registry returns the same recorder across turns.
+            // The bridge subscription is owned by the registry — no
+            // `trajectoryUnsubscribe` to track locally; the registry's
+            // `close(formattedKey)` (driven by session-destroy) and
+            // `closeAll()` (daemon shutdown) own the teardown.
+            const { recorder } = deps.trajectoryRegistry.getOrCreate(formattedKey, trajectoryInit, deps.eventBus, eventTypesFilter);
+            trajectoryRecorder = recorder;
+            // trajectoryUnsubscribe stays undefined — registry owns it.
+        }
+        else {
+            // Legacy per-turn path. flushAndClose still runs in this execute's
+            // finally; seq resets between turns and session.started/ended
+            // fires per turn (deviations E + F). Kept for tests and callers
+            // that haven't wired the registry yet.
+            trajectoryRecorder = createTrajectoryRecorder(trajectoryInit);
+            if (trajectoryRecorder !== null) {
+                trajectoryUnsubscribe = attachTrajectoryToEventBus({
+                    eventBus: deps.eventBus,
+                    recorder: trajectoryRecorder,
+                    ...(eventTypesFilter !== undefined
+                        ? {
+                            filter: eventTypesFilter,
+                        }
+                        : {}),
+                });
+            }
+        }
+        // Cache-trace recorder lifecycle (mirrors trajectory's).
+        // Gated by `deps.cacheTraceConfig.enabled` (forwarded from
+        // AppConfig.diagnostics.cacheTrace by daemon wiring; on by default).
+        // When enabled, instantiate the recorder + subscribe to the live
+        // `observability:token_usage` EventBus emit so the next
+        // `recordStage("session:after", {...})` carries cacheReadInputTokens +
+        // cacheCreationInputTokens. The recorder's null-return semantics
+        // (createCacheTrace returns null when COMIS_DISABLE_CACHE_TRACE=1)
+        // make this a no-op in that case.
+        if (deps.cacheTraceConfig?.enabled) {
+            const cacheTraceConfinedBase = deps.cacheTraceConfig.filePath === undefined
+                ? safePath(os.homedir(), ".comis")
+                : undefined;
+            // §7.2 envelope cluster — wire the contextual fields reachable
+            // from this site without widening the Deps interface. `runId`
+            // and `modelApi` are intentionally OMITTED: neither is threaded
+            // into the executor's scope today (runId has no producer; the
+            // pi-ai Model interface does not expose an `api` discriminator).
+            // A follow-up plan can widen Deps when those values become
+            // available; the optional cluster contract is "wire what's
+            // reachable, omit cleanly otherwise".
+            cacheTrace = createCacheTrace({
+                enabled: true,
+                ...(deps.cacheTraceConfig.filePath !== undefined
+                    ? { filePath: deps.cacheTraceConfig.filePath }
+                    : {}),
+                ...(deps.cacheTraceConfig.maxFileBytes !== undefined
+                    ? { maxFileBytes: deps.cacheTraceConfig.maxFileBytes }
+                    : {}),
+                includeMessages: deps.cacheTraceConfig.includeMessages ?? false,
+                includePrompt: deps.cacheTraceConfig.includePrompt ?? true,
+                includeSystem: deps.cacheTraceConfig.includeSystem ?? true,
+                agentId: agentId ?? config.name,
+                sessionId: formattedKey,
+                provider: resolvedModel?.provider ?? config.provider,
+                modelId: resolvedModel?.id ?? config.model,
+                envelope: {
+                    sessionKey: formattedKey,
+                    ...(deps.tenantId !== undefined ? { tenantId: deps.tenantId } : {}),
+                    ...(effectiveWorkspaceDir !== undefined
+                        ? { workspaceDir: effectiveWorkspaceDir }
+                        : {}),
+                },
+                ...(cacheTraceConfinedBase !== undefined
+                    ? { confinedBaseDir: cacheTraceConfinedBase }
+                    : {}),
+            });
+            if (cacheTrace !== null) {
+                unsubscribeCacheTrace = attachCacheTraceToEventBus(cacheTrace, deps.eventBus);
+            }
+        }
+    }
+    catch (err) {
+        // Best-effort — recorder construction must never block execution.
+        deps.logger.debug({ err, hint: "trajectory/cache-trace recorder init failed; continuing without sidecar", errorKind: "internal" }, "Trajectory/cache-trace recorder init failed");
+    }
     // Per-execution tool retry breaker (state resets each message)
     const toolRetryBreakerConfig = config.toolRetryBreaker;
     const toolRetryBreaker = toolRetryBreakerConfig?.enabled !== false
@@ -373,6 +666,9 @@ async function runSessionLocked(sm, ctx) {
     const messageSendLimiter = createMessageSendLimiter({
         maxSendsPerExecution: deps.maxSendsPerExecution ?? 3,
     });
+    // Per-execution turn-loop detector (FIX #2): dedup idempotent reads + break a
+    // runaway repeating-tool loop early. Closure-local, one per run.
+    const turnLoopDetector = createTurnLoopDetector();
     // Proactive safety -- block tool execution before it starts when
     // safety limits are already reached. Existing reactive checks in
     // pi-event-bridge remain as fallback for limits crossed during execution.
@@ -380,11 +676,14 @@ async function runSessionLocked(sm, ctx) {
     // not load pi-mono extensions, so this override is safe.
     // v0.65.0: setBeforeToolCall() removed; beforeToolCall is now a direct property.
     session.agent.beforeToolCall =
-        createBeforeToolCallGuard(activeStepCounter, deps.budgetGuard, deps.circuitBreaker, toolRetryBreaker, messageSendLimiter);
+        createBeforeToolCallGuard(activeStepCounter, budgetWindow, deps.circuitBreaker, toolRetryBreaker, messageSendLimiter, turnLoopDetector);
     // Mid-turn tool injection -- when discover_tools returns sideEffects.discoveredTools,
     // inject the full ToolDefinitions into the live agentic loop tools array so the LLM can
     // call them in the same turn (not just the next message).
     session.agent.afterToolCall = async (callCtx) => {
+        // FIX #2: populate the loop detector cache on EVERY tool result (before the
+        // discovery early-return) so normal reads fill it; mutations clear it.
+        turnLoopDetector.recordCall(callCtx.toolCall.name, callCtx.args, callCtx.result);
         const sideEffects = callCtx.result?.sideEffects;
         if (!sideEffects?.discoveredTools?.length)
             return undefined;
@@ -443,8 +742,12 @@ async function runSessionLocked(sm, ctx) {
     let geminiCachedTokens = 0;
     const streamSetup = setupStreamWrappers({
         config, deps, sessionKey, formattedKey, sm,
-        resolvedModel, modelTier, executionOverrides,
+        resolvedModel, capabilityClass, modelProfile, executionOverrides,
         deferralResult, systemPromptBlocks, agentId,
+        // Forward the cache-trace recorder so the wrapper chain
+        // can include the cache-trace `stream:context` emit. When the
+        // recorder is null (disabled), setupStreamWrappers skips the wrapper.
+        ...(cacheTrace !== null ? { cacheTrace } : {}),
         getAdaptiveRetention: () => adaptiveRetentionRef.get(),
         getExecutionCacheRetention: () => cacheRetentionRef.get(),
         getExecutionMinTokensOverride: () => minTokensOverrideRef.get(),
@@ -469,14 +772,82 @@ async function runSessionLocked(sm, ctx) {
     // TypeScript declares transformContext as private, but it's a plain instance property
     // accessible at runtime. Same pattern as streamFn override above.
     const ceSetup = setupContextEngine({
-        config, deps: frozenDeps, formattedKey, sessionKey: formattedKey, msg, sm, session,
+        config, deps: frozenDeps, formattedKey, sessionKey: formattedKey,
+        // R4 (132-03): the dag assembler's LCD read scope tenant — the SAME source
+        // executor-post-execution uses for the ingest scope (deps.tenantId ?? the
+        // session key's tenant), so read + write scopes agree (WR-02).
+        tenantId: frozenDeps.tenantId ?? sessionKey.tenantId,
+        // DAG-CRIT-1: the dag assembler's LCD read scope agentId — the SAME
+        // `effectiveAgentId = agentId ?? "default"` expression executor-post-execution
+        // uses for the LCD ingest WRITE scope, so the read scope == the write scope and
+        // the assembler stops failing closed (the positional turn agentId never reaches
+        // frozenDeps, so deps.agentId would be undefined on this path).
+        agentId: agentId ?? "default",
+        msg, sm, session,
         resolvedModel, executionOverrides,
         cacheBreakDetector,
         contextEngineRef,
         getCachedSystemTokensEstimate: () => cachedSystemTokensEstimate,
+        getCachedFreshTailPreambleTokens: () => cachedFreshTailPreambleTokens,
         getTokenAnchor: () => tokenAnchor,
         onAnchorReset: () => { tokenAnchor = null; },
         currentDiscoveryTracker,
+        modelProfile, // already in scope: resolved once per execution in step 4 (the resolveModelProfile call after the CWF-03 reconcile); consumed by assembleTools' profile budget (step 5, "System token estimate")
+        // KNOB-02: served/capability window provenance for the lcd-assembler's budget
+        // (the second computeTokenBudgetForProfile call site) — sibling of modelProfile.
+        windowProvenance,
+        // Phase 166 T-S4: thread security-pin markers so the dag eviction never drops canary/security context.
+        // contentDelimiter defaults to "" (fail-closed: isSecurityRelevantMessage with empty contentDelimiter
+        // only matches on canaryToken — defense-in-depth; a real delimiter is injected by Plan 04).
+        securityPinMarkers: frozenDeps.canaryToken
+            ? { canaryToken: frozenDeps.canaryToken, contentDelimiter: "" }
+            : undefined,
+        // Phase 166 Fix 3 (Plan 04): thread assembled-input + effective-window tokens so
+        // config-resolver can clamp max_tokens per-dispatch (CWF-02).
+        onAssembledInputTokens: (tokens) => {
+            streamSetup.assembledInputTokensRef.current = tokens;
+        },
+        onEffectiveWindow: (windowTokens) => {
+            streamSetup.effectiveWindowRef.current = windowTokens;
+            // CR-02 (Phase 166): also update outputHeadroomRef so config-resolver uses the
+            // REAL floor for this dispatch (not the stale MIN_VISIBLE_OUTPUT_TOKENS=768).
+            // Re-derive from the current thinking level + model reasoning style so the
+            // headroom always tracks the live values at the moment the pre-flight fires.
+            const rsStyle = (modelProfile?.reasoningStyle ?? "none");
+            const tLevel = (config.thinkingLevel ?? "medium");
+            streamSetup.outputHeadroomRef.current = computeOutputHeadroom(rsStyle, tLevel);
+        },
+        getThinkingLevel: () => config.thinkingLevel ?? undefined,
+        // Phase 166 Fix 3: thinking-effort governor — down-shifts session.setThinkingLevel
+        // before the LLM call when the context engine detects the window is too tight.
+        // Gated by config.thinking.downshiftOnTightWindow (D-05 discretion).
+        // Pattern from executor-command-handlers.ts:98 — try/catch with WARN + errorKind.
+        // A bare empty catch is PROHIBITED (AGENTS.md §2.2): silent swallow means thinking
+        // is never reduced — the exact failure mode the governor must prevent.
+        onThinkingDownshifted: config.thinking?.downshiftOnTightWindow !== false
+            ? (level) => {
+                // CR-02 (Phase 166): update outputHeadroomRef with the POST-DOWNSHIFT headroom
+                // so config-resolver clamps max_tokens to the REDUCED thinking reserve after
+                // the governor fires. This must happen BEFORE session.setThinkingLevel so the
+                // headroom tracks the final level that will be used for this dispatch.
+                const rsStyle = (modelProfile?.reasoningStyle ?? "none");
+                const downshiftedLevel = level;
+                streamSetup.outputHeadroomRef.current = computeOutputHeadroom(rsStyle, downshiftedLevel);
+                try {
+                    // eslint-disable-next-line @typescript-eslint/no-explicit-any -- SDK internal API not typed
+                    session.setThinkingLevel(level);
+                    frozenDeps.logger.debug({ thinkingLevel: level }, "thinking-effort governor: session.setThinkingLevel applied");
+                }
+                catch (govErr) {
+                    frozenDeps.logger.warn({
+                        err: govErr,
+                        thinkingLevel: level,
+                        hint: "session.setThinkingLevel() failed in thinking-effort governor; thinking reserve not reduced — dispatch continues at original level",
+                        errorKind: "config",
+                    }, "thinking-effort governor: setThinkingLevel failed");
+                }
+            }
+            : undefined,
     });
     // eslint-disable-next-line @typescript-eslint/no-explicit-any -- SDK internal: no public type for agent.transformContext
     session.agent.transformContext = ceSetup.contextEngine.transformContext;
@@ -499,6 +870,34 @@ async function runSessionLocked(sm, ctx) {
         // eslint-disable-next-line @typescript-eslint/no-explicit-any
         session.agent.transformContext = ceSetup.contextEngine.transformContext;
     }
+    // DEPTH-03 (Plan 174-03): bootstrap crash-recovery sweep. Runs ONCE per session —
+    // after the context engine is wired, BEFORE the first turn's afterTurn ingest — so a
+    // mid-turn crash gap (messages written to the JSONL trajectory but never ingested into
+    // the durable LCD store because the daemon was killed before afterTurn) is
+    // continue-appended EXACTLY ONCE. WR-02 (Plan 174-04): gated on the existing
+    // `isFirstMessageInSession` signal (truly run-once) — turns 2+ were already idempotent
+    // via the durable cursor, so skipping them removes per-turn LCD single-flight overhead.
+    // Extracted to `maybeRunBootstrapSweep` (state-first helper, IN-01) to keep the in-lock
+    // body from accreting another wiring block; the recovery itself (the EXISTING
+    // ingestTurnGuarded path + the shouldRunLcdStorePasses dag gate) lives in
+    // `bootstrapLcdSweep`. The scope is built exactly as the afterTurn block does so read
+    // scope == write scope (DAG-CRIT-1 / WR-02): conversationId === sessionKey ===
+    // formattedKey, agentId === `agentId ?? "default"`. The JSONL-loaded live array is the
+    // same ref executor-post-execution reads at the afterTurn site (typed unknown on
+    // AgentSession — no public SDK type for it).
+    await maybeRunBootstrapSweep({
+        isFirstMessageInSession,
+        contextStore: frozenDeps.contextStore,
+        formattedKey,
+        tenantId: frozenDeps.tenantId ?? sessionKey.tenantId,
+        agentId: agentId ?? "default",
+        live: (session.agent.state
+            ?.messages ?? []),
+        clock: frozenDeps.clock,
+        logger: frozenDeps.logger,
+        eventBus: frozenDeps.eventBus,
+        config,
+    });
     // Align register/deregister key shape with
     // BackgroundSessionResolver.formatComposite so production lookups via
     // resolveActiveSession({agentId, channelType, channelId}) find the
@@ -613,7 +1012,7 @@ async function runSessionLocked(sm, ctx) {
             blockPercent: contextGuardConfig?.blockPercent,
         })
         : undefined;
-    // Quick 215: Resettable prompt timeout -- tool completions reset the timer
+    // Resettable prompt timeout -- tool completions reset the timer
     let currentResetTimer;
     // API-grounded token anchor -- updated on each turn_end, reset on compaction
     let tokenAnchor = null;
@@ -625,12 +1024,46 @@ async function runSessionLocked(sm, ctx) {
     const executionId = randomUUID();
     // Budget trajectory warning: shared mutable ref between bridge (writer) and prompt runner (reader)
     const budgetWarningRef = { current: false };
+    // LAT-02 (177-03): deltas (text + thinking) reset the stall budget — ALWAYS-
+    // defined (the bridge presence-gates on deps.onDelta), live-ref
+    // (currentResetTimer is assigned later at onResetTimer), throttled ~1/s.
+    const onDeltaWithStallReset = createDeltaResetComposer({}, {
+        channelOnDelta: onDelta,
+        getResetTimer: () => currentResetTimer,
+        clock: deps.clock,
+    });
     const bridge = createPiEventBridge({
         eventBus: deps.eventBus,
-        budgetGuard: deps.budgetGuard,
+        // CR-01: this run's execution-local window (NOT the shared per-agent guard),
+        // so recordUsage / the turn-end budget check are scoped to THIS execution.
+        budgetGuard: budgetWindow,
         costTracker: deps.costTracker,
+        // Phase 177: the daemon-wide spend accumulator REFERENCE (Pitfall 4 — the
+        // per-agent guards read the SAME instance) + its scope/config. The scope's
+        // tenant is read directly off the structured SessionKey (it already carries
+        // tenantId; the formatted-string parser is only needed on the bus path). When
+        // spendAccumulator is absent the bridge's spend path is a no-op.
+        ...(deps.spendAccumulator && deps.spendConfig
+            ? {
+                spendAccumulator: deps.spendAccumulator,
+                spendConfig: deps.spendConfig,
+                spendScope: { tenantId: sessionKey.tenantId ?? "default", agentId: agentId ?? "default" },
+            }
+            : {}),
+        // Phase 213-08 (BUDGET-01/02): thread the late-bound per-root budget holder +
+        // the run's rootRunId resolver into the bridge — the SAME daemon-wide-REF,
+        // absent ⇒ no-op pattern as spendAccumulator. The bridge sibling's the per-root
+        // reserve next to checkSpendCeiling so a self-spawning loop (incl. a zero-price
+        // model) trips the token/wall-clock limbs on the live LLM-spend path.
+        ...(deps.boundedAutonomyBudget && deps.resolveRootRunId
+            ? {
+                boundedAutonomyBudget: deps.boundedAutonomyBudget,
+                resolveRootRunId: deps.resolveRootRunId,
+            }
+            : {}),
         stepCounter: activeStepCounter,
         circuitBreaker: deps.circuitBreaker,
+        turnLoopDetector,
         sessionKey,
         agentId: agentId ?? "default",
         channelId: msg.channelId ?? "",
@@ -639,7 +1072,18 @@ async function runSessionLocked(sm, ctx) {
         model: config.model,
         operationType: executionOverrides?.operationType ?? "interactive",
         logger: deps.logger,
-        onDelta,
+        // Resolved daemon data dir — the bridge's session-index writer
+        // (appendSessionIndexEntry) otherwise falls back to the REAL ~/.comis,
+        // diverging from config.dataDir / COMIS_DATA_DIR installs (260611
+        // live-fire: 166 blocked test-guard writes per MEM suite run).
+        dataDir: deps.dataDir,
+        // Thread the operator $HOME so the bridge's tool:started/tool:executed
+        // params compact $HOME→~ for ALL bus consumers (delivery-tracer, trajectory
+        // writers, plan-stream), not only the activity renderer. Matches the
+        // os.homedir() sanctioned-root pattern already used in this file for the
+        // trajectory-confinement base.
+        homeDir: os.homedir(),
+        onDelta: onDeltaWithStallReset,
         memoryPort: deps.memoryPort,
         onAbort: () => {
             session.abortCompaction();
@@ -663,7 +1107,10 @@ async function runSessionLocked(sm, ctx) {
         },
         providerHealth: deps.providerHealth,
         onToolExecutionEnd: () => { currentResetTimer?.(); },
-        getCurrentModel: () => session.model?.id ?? config.model,
+        // RECORD-01 (v2.28 260621): when the configured model is unregistered, pi
+        // falls back to its own default model object (e.g. gemini-*); record the
+        // CONFIGURED model so token_usage/cost are not mislabeled. See observedModelId.
+        getCurrentModel: () => observedModelId(resolvedModel, session.model?.id, config.model),
         onCacheReads: capturedBridgeRetention
             ? (tokens) => { capturedBridgeRetention.recordCacheReads(tokens); }
             : undefined,
@@ -730,12 +1177,61 @@ async function runSessionLocked(sm, ctx) {
             return live;
         },
         getSessionJsonlPath: () => sessionAdapter.getSessionPath(sessionKey),
+        // Forward the session-scoped registry so the bridge's `agent_start`
+        // case can suppress per-turn `session:started` re-emits (session-scoped recorder lifecycle).
+        // When undefined (non-daemon callers), the bridge falls back to the
+        // legacy unconditional emit.
+        ...(deps.trajectoryRegistry !== undefined ? { trajectoryRegistry: deps.trajectoryRegistry } : {}),
+        // Provide a snapshot of harness/model/config at
+        // bridge-creation time so trace.metadata can be emitted once per session.
+        // Fields that are not readily available at this scope are omitted;
+        // buildTraceMetadata's compactObject strips undefined cleanly.
+        runtimeSnapshot: {
+            harness: {
+                type: "comis",
+                // version is not yet threaded into PiExecutorDeps; a future change
+                // will wire deps.appVersion here. Use package.json version constant
+                // when available, otherwise "unknown" until that wiring lands.
+                version: "unknown",
+                os: process.platform,
+                node: process.version,
+                ...(effectiveWorkspaceDir !== undefined ? { workspaceDir: effectiveWorkspaceDir } : {}),
+            },
+            model: {
+                provider: resolvedModel?.provider ?? config.provider,
+                modelId: resolvedModel?.id ?? config.model,
+                ...(resolvedModel?.api !== undefined ? { modelApi: resolvedModel.api } : {}),
+            },
+            config,
+            // Populate plugins and skills from the registry snapshot.
+            // The minimal deps interface exposes getSnapshot?() optionally; legacy
+            // callers (tests with the two-method mock) safely degrade to [].
+            // TODO: wire deps.pluginRegistry once a plugin-registry
+            // seam exists at this scope. Until then, plugins[] stays empty by design.
+            plugins: [],
+            skills: deps.skillRegistry?.getSnapshot?.()?.skills?.map((s) => ({
+                id: s.name,
+                ...(s.version !== undefined ? { version: String(s.version) } : {}),
+            })) ?? [],
+            // Scaffold in place so future writers cannot bypass
+            // the redactor. When userPromptPrefixText is wired from a config path,
+            // pass it here; the helper routes it through redactString +
+            // substitutePathsInString before assignment. See pi-executor-prompting.ts.
+            prompting: buildPromptingSnapshot({}),
+            redaction: { policy: "platform-aware" },
+        },
         perExecutionBudgetCap: config.budgets?.perExecution,
         budgetWarningRef,
         toolRetryBreaker,
         ttlSplit,
         graphId: executionOverrides?.graphId,
         nodeId: executionOverrides?.nodeId,
+        // Pass sub-agent's active tool groups for "Tool X not found" enrichment
+        activeToolGroups: executionOverrides?.activeToolGroups,
+        // F-13: the assembled tool names, so a "Tool X not found" error can suggest the
+        // closest real tool when a small model hallucinates a name (e.g. an mcp__-prefixed
+        // guess for a builtin). Names only — no schemas/secrets.
+        allToolNames: mergedCustomTools.map((t) => t.name),
         onCacheBreakDetected: capturedBridgeRetention
             ? (event) => {
                 if (event.reason === "lookback_window_exceeded") {
@@ -777,12 +1273,13 @@ async function runSessionLocked(sm, ctx) {
             : undefined,
     });
     const unsubscribe = session.subscribe(bridge.listener);
-    // Execution started bookend (Finding 1)
+    // Execution started bookend
     deps.logger.info({
+        step: "agent-execute",
         agentId,
         sessionKey: formattedKey,
         modelId: resolvedModel?.id,
-        modelTier,
+        capabilityClass,
         activeToolCount: mergedCustomTools.length,
     }, "Execution started");
     // Generic sideEffects processing for tool results.
@@ -865,11 +1362,12 @@ async function runSessionLocked(sm, ctx) {
             systemPrompt,
             mergedCustomTools,
             cmdResult, sepEnabled, executionPlanRef,
-            _directives, _prevTimestamp, resolvedModel,
+            _directives, _prevTimestamp, resolvedModel, modelProfile,
             deps: {
                 eventBus: deps.eventBus,
                 logger: deps.logger,
-                budgetGuard: deps.budgetGuard,
+                // CR-01: this run's execution-local window (precheck + envelope snapshot).
+                budgetGuard: budgetWindow,
                 costTracker: deps.costTracker,
                 authRotation: deps.authRotation,
                 fallbackModels: deps.fallbackModels,
@@ -881,6 +1379,10 @@ async function runSessionLocked(sm, ctx) {
                 canaryToken: deps.canaryToken,
                 clock: deps.clock,
                 timers: deps.timers,
+                // ISSUE #2: the canonical system-tokens estimate the pre-flight throws on, so
+                // wrapEnvelope can size the tight-window residual and drop the heavy
+                // tool-discovery preamble before it overflows (same S → no drift).
+                getSystemTokensEstimate: () => cachedSystemTokensEstimate,
             },
             onResetTimer: (fn) => { currentResetTimer = fn; },
             getLastCacheWriteTokens: () => bridge.getResult().tokensUsed?.cacheWrite ?? 0,
@@ -907,7 +1409,7 @@ async function runSessionLocked(sm, ctx) {
             clock: deps.clock,
             outputGuard: deps.outputGuard,
             canaryToken: deps.canaryToken,
-        }, { error, sessionKey, agentId });
+        }, { error, sessionKey, agentId, executionStartMs });
     }
     finally {
         // Clear thinking ceiling so next execution recalculates from current state.
@@ -918,12 +1420,17 @@ async function runSessionLocked(sm, ctx) {
         // Extracted to executor-post-execution.ts
         await postExecution({
             result, session, sm, config, msg, sessionKey, formattedKey, resolverRegisterKey, agentId,
+            recalledMemories,
+            // ATTR-02: read the per-turn skill-use carrier the bridge wrote (ATTR-01)
+            // back into postExecution, which emits the memory:skill_used write-back.
+            usedSkillIds: [...bridge.getUsedSkillIds()],
+            userMdLanguage: userLanguage, // DET-02 tier-2 (consumed by the degraded-reply resolver, 181-03)
             executionStartMs, executionId, executionOverrides,
             bridge, unsubscribe,
             contextEngineRef, ceSetup, streamSetup,
             getTruncationSummary, getTurnBudgetSummary,
-            executionPlanRef, sepEnabled, isOnboarding,
-            geminiCacheHit, geminiCachedTokens, modelTier,
+            executionPlanRef, isOnboarding,
+            geminiCacheHit, geminiCachedTokens, capabilityClass, budgetWindowTokens,
             provider: resolvedModel?.provider ?? config.provider,
             providerFamily: resolveProviderCapabilities(resolvedModel?.provider ?? config.provider).providerFamily,
             deferralResult, mergedCustomTools, deliveredGuides,
@@ -931,9 +1438,21 @@ async function runSessionLocked(sm, ctx) {
                 eventBus: deps.eventBus,
                 logger: deps.logger,
                 memoryPort: deps.memoryPort,
+                // Phase 128 dag-mode afterTurn ingest write-path (A1). Both the store
+                // and tenantId thread through so postExecution's ingest scope has a
+                // real tenant (T-128-08); absent ⇒ ingest skipped cleanly.
+                contextStore: deps.contextStore,
+                tenantId: deps.tenantId,
+                // Phase 129 (C1): the leaf-summarizer deps getter sourced from the
+                // context-engine setup's shared compaction-model chain. Present ⇒ the
+                // afterTurn leaf pass fires live over threshold (gated additionally on
+                // deps.contextStore inside postExecution); absent ⇒ the pass is gated off.
+                getSummarizerDeps: ceSetup?.getSummarizerDeps,
                 activeRunRegistry: deps.activeRunRegistry,
                 embeddingEnqueue: deps.embeddingEnqueue,
-                workspaceDir: deps.workspaceDir,
+                // WT-01: the post-execution / context-engine workspace root is the run's
+                // actual working tree (the worktree when present).
+                workspaceDir: effectiveWorkspaceDir,
                 clock: deps.clock,
             },
             sessionAdapter,
@@ -941,6 +1460,49 @@ async function runSessionLocked(sm, ctx) {
             adaptiveRetentionClear,
             executionMinTokensOverrideClear,
         });
+        // Tear down the trajectory recorder + bridge subscription as the very
+        // last action of this execute() call. Both are best-effort — a
+        // flush/unsubscribe failure must NEVER throw out of finally.
+        //
+        // When `deps.trajectoryRegistry` is present, the registry owns
+        // both the recorder and its bridge subscription. The teardown
+        // here is a no-op — `closeAll()` (daemon shutdown) and `close()`
+        // (session-destroy) are the only paths that flush + unsubscribe.
+        if (deps.trajectoryRegistry === undefined) {
+            try {
+                trajectoryUnsubscribe?.();
+            }
+            catch {
+                // Unsubscribe failure is unreachable in practice (EventEmitter.off
+                // is sync); swallow defensively so this never aborts cleanup.
+            }
+            if (trajectoryRecorder !== null) {
+                try {
+                    await trajectoryRecorder.flushAndClose();
+                }
+                catch (err) {
+                    deps.logger.debug({ err, hint: "trajectory flushAndClose failed; sidecar may be partial", errorKind: "internal" }, "Trajectory recorder flushAndClose failed");
+                }
+            }
+        }
+        // Tear down the cache-trace recorder + bridge subscription.
+        // Sibling block to the trajectory teardown above — best-effort,
+        // failures must never throw out of finally.
+        try {
+            unsubscribeCacheTrace?.();
+        }
+        catch {
+            // Unsubscribe failure is unreachable in practice (EventEmitter.off
+            // is sync); swallow defensively so this never aborts cleanup.
+        }
+        if (cacheTrace !== null) {
+            try {
+                await cacheTrace.flushAndClose();
+            }
+            catch (err) {
+                deps.logger.debug({ err, hint: "cache-trace flushAndClose failed; sidecar may be partial", errorKind: "internal" }, "Cache-trace recorder flushAndClose failed");
+            }
+        }
     }
     return result;
 }