comisai 1.0.42 → 1.0.44

package/node_modules/@comis/agent/dist/executor/prompt-assembly.js

@@ -10,17 +10,74 @@
  * @module
  */
 import * as fs from "node:fs/promises";
-import { wrapExternalContent, safePath, formatSessionKey, generateCanaryToken } from "@comis/core";
+import { wrapExternalContent, safePath, formatSessionKey, generateCanaryToken, scriptTokenFactor, tryGetContext, systemNowMs, } from "@comis/core";
 import { suppressError } from "@comis/shared";
+import { buildSystemPromptReport, persistSystemPromptReport, createRecallTrace, } from "@comis/observability";
 import { loadWorkspaceBootstrapFiles, buildBootstrapContextFiles, assembleRichSystemPrompt, assembleRichSystemPromptBlocks, filterBootstrapFilesForLightContext, filterBootstrapFilesForCron, filterBootstrapFilesForGroupChat, resolveSenderDisplay, buildDateTimeSection, buildInboundMetadataSection, buildSenderTrustSection, buildSubagentRoleSection, // for dynamic preamble injection
 buildVerbosityHintSection, resolveVerbosityProfile, } from "../bootstrap/index.js";
-import { deduplicateResults } from "../rag/rag-retriever.js";
+import { topicMatchScores } from "../memory/topic-key.js";
 import { createHybridMemoryInjector } from "../rag/hybrid-memory-injector.js";
+import { createMemoryRecall } from "../rag/memory-recall.js";
+import { formatMemorySection } from "../rag/rag-retriever.js";
+import { buildTemporalGuidanceBlock } from "../rag/temporal-guidance.js";
+import { buildProfileBlock } from "./user-representation-block.js";
 import { BOOTSTRAP_BUDGET_WARN_PERCENT, CHARS_PER_TOKEN_RATIO } from "../context-engine/index.js";
 import { isBootContentEffectivelyEmpty, BOOT_FILE_NAME } from "../workspace/boot-file.js";
 import { detectOnboardingState } from "../workspace/onboarding-detector.js";
+import { FAIL_CLOSED_PROFILE } from "./model-profile.js";
+import { resolveScaffoldDefaults } from "./scaffold-defaults.js";
+import { economiseForReadOnlyChild } from "../spawn/child-prompt-economy.js";
 import * as os from "node:os";
 // ---------------------------------------------------------------------------
+// C2/S1: Prompt mode resolution for ModelProfile
+// ---------------------------------------------------------------------------
+/**
+ * Resolve the effective PromptMode for a given execution context.
+ *
+ * Priority (highest to lowest):
+ * 1. Compact-secure for small/nano capabilityClass (C2/S1) — wins even for
+ *    cron/heartbeat turns (WR-03: security holds independent of model + operation).
+ * 2. Cron/heartbeat auto-upgrade: "full" → "operational" (frontier/mid + no-profile).
+ * 3. baseMode (operator-explicit or "full" default).
+ *
+ * compact-secure fires ONLY when:
+ *   - compactPromptConfig.enabled is true (default)
+ *   - profile.capabilityClass is "small" or "nano"
+ *   - baseMode is "full" (respect explicit operator overrides)
+ *
+ * WR-03: the compact-secure check is evaluated BEFORE the cron/heartbeat →
+ * operational downgrade. The milestone's premise is "weaker class ⇒ stricter
+ * securityLevel", and compact-secure carries the S1 anti-injection sender-trust
+ * hardening. A cron/heartbeat turn on a small/nano model must NOT silently lose
+ * that hardening — it gets compact-secure, not operational. The operational
+ * downgrade is reserved for frontier/mid (and no-profile) cron/heartbeat turns,
+ * which never enter compact-secure anyway.
+ *
+ * Frontier/mid: never compact-secure. This is the behavior-neutral guarantee
+ * for large-tier models — their prompt stays byte-identical to pre-152 output.
+ *
+ * @internal exported for tests only
+ */
+export function resolvePromptModeForProfile(baseMode, operationType, profile, compactPromptConfig) {
+    // compact-secure: only for small/nano with config flag enabled (default: true).
+    // NEVER for frontier/mid — behavior-neutral guarantee (T-152-05). Evaluated
+    // FIRST so a cron/heartbeat turn on a weak model keeps the S1 hardening (WR-03)
+    // instead of being downgraded to "operational".
+    if ((compactPromptConfig?.enabled ?? true) &&
+        profile !== undefined &&
+        (profile.capabilityClass === "small" || profile.capabilityClass === "nano") &&
+        baseMode === "full" // only auto-downgrade from full; respect explicit baseMode overrides
+    ) {
+        return "compact-secure";
+    }
+    // Cron/heartbeat → operational (frontier/mid + no-profile; small/nano already
+    // resolved to compact-secure above).
+    if ((operationType === "cron" || operationType === "heartbeat") && baseMode === "full") {
+        return "operational";
+    }
+    return baseMode;
+}
+// ---------------------------------------------------------------------------
 // User language extraction
 // ---------------------------------------------------------------------------
 /**
@@ -62,6 +119,109 @@ const sessionCacheSafeParams = new Map();
  *  reuse the snapshot so skills XML fed to assembleRichSystemPrompt stays constant,
  *  preventing cache-invalidating changes when the agent creates skills mid-session. */
 const sessionPromptSkillsXmlSnapshots = new Map();
+/** Per-session location→skillName index, parsed once from the frozen prompt
+ *  skills XML snapshot at the same freeze point as
+ *  `sessionPromptSkillsXmlSnapshots`. ATTR-01 (skill-use attribution): the
+ *  pi-event-bridge consults this index to map a `read` tool's path back to the
+ *  skill the model invoked. Empty when no visible skills are listed (the
+ *  default until learned skills exist), so the attribution path is a no-op. */
+const sessionPromptSkillLocations = new Map();
+/** Reuse-attribution carrier: per-session, per-TURN set of the learned-skill NAMES whose stored
+ *  common-core (topicTokens) the CURRENT turn instantiates (`topicMatchedSkillNames`). The
+ *  pi-event-bridge UNIONS these into the turn's `usedSkillIds`, so a skill APPLIED from the surfaced
+ *  `<available_skills>` summary / recall — without an explicit `read` of its SKILL.md (the ATTR-01
+ *  path) — still promotes on success. Overwritten every prompt assembly (the same per-turn lifecycle
+ *  as the XML/location snapshots). Empty/no-match ⇒ the no-op default. */
+const sessionPromptTopicMatchedSkills = new Map();
+/** Read the per-turn topic-matched learned-skill names for a session. The pi-event-bridge
+ *  calls this when assembling the turn's `usedSkillIds`. Undefined when nothing matched this turn. */
+export function getSessionPromptTopicMatchedSkills(snapshotKey) {
+    return sessionPromptTopicMatchedSkills.get(snapshotKey);
+}
+const sessionPromptSkillSurfacedCensus = new Map();
+/** Read (for postExecution) the per-turn surfaced-skill census. Undefined when no skill overlapped. */
+export function getSessionPromptSkillSurfacedCensus(snapshotKey) {
+    return sessionPromptSkillSurfacedCensus.get(snapshotKey);
+}
+/** Clear the stored census after postExecution emits it — so a later turn that assembles no
+ *  standing-block (e.g. skipRag) never re-emits a stale prior-turn census. */
+export function clearSessionPromptSkillSurfacedCensus(snapshotKey) {
+    sessionPromptSkillSurfacedCensus.delete(snapshotKey);
+}
+const sessionPromptMemoryInjected = new Map();
+/** Read (for postExecution) the per-turn memory-injection summary. Undefined when no injection. */
+export function getSessionPromptMemoryInjected(snapshotKey) {
+    return sessionPromptMemoryInjected.get(snapshotKey);
+}
+/** Clear the stored injection summary after postExecution emits it (avoids a stale re-emit on a
+ *  later no-injection turn). */
+export function clearSessionPromptMemoryInjected(snapshotKey) {
+    sessionPromptMemoryInjected.delete(snapshotKey);
+}
+/**
+ * Parse a frozen `<available_skills>` XML block (the exact shape emitted by
+ * `formatAvailableSkillsXml` in @comis/skills: a sequence of `<skill>` blocks
+ * each carrying `<name>`, `<description>`, `<location>`) into a
+ * `location → skillName` Map. The location is the raw absolute path the `read`
+ * tool reports, so XML entities are unescaped (the inverse of `escapeXml`) to
+ * make the keys/values match raw text. ATTR-01.
+ *
+ * Pure + total: never throws. `undefined`/empty/no-`<skill>` input yields an
+ * empty Map. A `<skill>` block missing either `<name>` or `<location>` is
+ * skipped (defensive — the producer always emits both).
+ *
+ * @param xml - The frozen prompt-skills XML snapshot, or undefined.
+ * @returns location→skillName Map (empty when nothing to index).
+ */
+export function parseSkillLocationIndex(xml) {
+    const index = new Map();
+    if (!xml)
+        return index;
+    // Match each <skill>…</skill> block, then pull <name> + <location> from it.
+    const blockRe = /<skill>([\s\S]*?)<\/skill>/g;
+    let block;
+    while ((block = blockRe.exec(xml)) !== null) {
+        const body = block[1] ?? "";
+        const nameMatch = /<name>([\s\S]*?)<\/name>/.exec(body);
+        const locationMatch = /<location>([\s\S]*?)<\/location>/.exec(body);
+        if (!nameMatch || !locationMatch)
+            continue;
+        const name = unescapeXml(nameMatch[1] ?? "");
+        const location = unescapeXml(locationMatch[1] ?? "");
+        if (location === "")
+            continue;
+        index.set(location, name);
+    }
+    return index;
+}
+/**
+ * Inverse of `escapeXml` (@comis/skills processor.ts). `&amp;` is decoded LAST
+ * so an escaped literal like `&amp;lt;` round-trips to `&lt;` (not `<`).
+ */
+function unescapeXml(str) {
+    return str
+        .replace(/&lt;/g, "<")
+        .replace(/&gt;/g, ">")
+        .replace(/&quot;/g, '"')
+        .replace(/&apos;/g, "'")
+        .replace(/&amp;/g, "&");
+}
+/**
+ * Read the frozen location→skillName index for a session. The pi-event-bridge
+ * calls this on a `read` tool execution to attribute skill use (ATTR-01).
+ * Returns undefined when no snapshot has been frozen for the session yet.
+ *
+ * @param snapshotKey - The formatted session key used at the freeze point.
+ */
+export function getSessionPromptSkillLocations(snapshotKey) {
+    return sessionPromptSkillLocations.get(snapshotKey);
+}
+/** Per-agent dedup for the WR-02 "S1: sender-trust not injected in compact-secure"
+ *  WARN. The trigger (compact-secure promptMode + senderTrustDisplayConfig disabled)
+ *  is STATIC per agent, so emitting it once-per-prompt-assembly spams the log on every
+ *  turn (live finding, 2026-06-12 UC-4 run: 9× in a 9-turn small-model session). The
+ *  operator signal is preserved once per agent; the per-turn repetition is dropped. */
+const wr02SenderTrustWarnedAgents = new Set();
 // ---------------------------------------------------------------------------
 // Feature flag hash for tool cache key invalidation.
 // Computes a stable string from config fields that affect tool rendering.
@@ -106,6 +266,16 @@ export function clearSessionBootstrapFileSnapshot(sessionKey) {
  */
 export function clearSessionPromptSkillsXmlSnapshot(sessionKey) {
     sessionPromptSkillsXmlSnapshots.delete(sessionKey);
+    // ATTR-01: clear the parsed location index in lockstep with the XML snapshot.
+    sessionPromptSkillLocations.delete(sessionKey);
+}
+/**
+ * Reset the per-agent WR-02 sender-trust WARN dedup. Test-only seam (mirrors
+ * the clearSession* snapshot resets) so suites don't leak the once-per-agent
+ * state across cases.
+ */
+export function clearWr02SenderTrustWarned() {
+    wr02SenderTrustWarnedAgents.clear();
 }
 /**
  * Get the frozen prompt state for a session (sub-agent cache prefix sharing).
@@ -121,6 +291,49 @@ export function getCacheSafeParams(sessionKey) {
 export function clearCacheSafeParams(sessionKey) {
     sessionCacheSafeParams.delete(sessionKey);
 }
+/**
+ * Construct the recall-trace recorder from `diagnostics.recallTrace` config, mirroring
+ * how `createCacheTrace` is wired in pi-executor: the `enabled` gate, the optional
+ * `filePath` override, and the `confinedBaseDir` (the daemon containment base —
+ * `~/.comis` — for ancestor-symlink rejection, applied only when no explicit path is set,
+ * exactly like cacheTrace). Returns `null` when config is absent or `enabled: false`
+ * (the recorder's null-when-disabled contract), so the default leaves recall unchanged.
+ * Extracted as a small helper to keep the recall block legible.
+ */
+export function buildRecallTrace(cfg, agentId, sessionId, 
+// Resolve the recorder's containment base from the SAME data-dir
+// source the memory.recall_trace reader uses (handler: `deps.dataDir ??
+// ~/.comis`). Hardcoding os.homedir()/.comis made the writer and reader point
+// at different files under a non-default COMIS_DATA_DIR, so the diagnostic
+// returned nothing. Threaded from the daemon composition root (it is already
+// available there; mirrors how cacheTrace forwards `config.dataDir` as its
+// confinedBaseDir).
+dataDir, 
+// Thread the REAL scope into the recorder envelope so on-disk records
+// carry the authoritative `sessionKey` + `tenantId`. Production wiring used to
+// pass NO envelope, so records had neither field — the handler's session
+// selector (rec.sessionKey) and tenant scope-filter (rec.tenantId) were dead
+// (zero records returned; cross-tenant filter never fired). `agentId` is
+// already the top-level recorder field, so only sessionKey + tenantId ride the
+// envelope cluster.
+envelope) {
+    if (cfg?.enabled !== true)
+        return null;
+    // Match the reader's base EXACTLY: the handler uses `deps.dataDir ??
+    // safePath(os.homedir(), ".comis")` and passes it straight to
+    // resolveRecallTraceFilePath. `dataDir` arrives pre-resolved from the daemon
+    // composition root; the fallback goes through safePath (no path.join).
+    const confinedBaseDir = cfg.filePath === undefined ? (dataDir ?? safePath(os.homedir(), ".comis")) : undefined;
+    return createRecallTrace({
+        enabled: true,
+        agentId,
+        sessionId,
+        ...(envelope !== undefined ? { envelope } : {}),
+        ...(cfg.filePath !== undefined ? { filePath: cfg.filePath } : {}),
+        ...(cfg.maxFileBytes !== undefined ? { maxFileBytes: cfg.maxFileBytes } : {}),
+        ...(confinedBaseDir !== undefined ? { confinedBaseDir } : {}),
+    });
+}
 // ---------------------------------------------------------------------------
 // Helpers (moved from pi-executor.ts -- only used for InboundMetadata)
 // ---------------------------------------------------------------------------
@@ -212,6 +425,54 @@ function isGroupContext(msg) {
 }
 export async function assembleExecutionPrompt(params) {
     const { config, deps, msg, sessionKey, agentId, mergedCustomTools, logger } = params;
+    // Consolidated lightContext flag: heartbeat implies light-context regardless
+    // of the explicit msg.metadata.lightContext flag. Callers that only set the
+    // metadata flag OR only set operationType="heartbeat" produce identical
+    // prompt output. Hoisted above the parent-cache reuse branch so BOTH paths
+    // share the same bootstrap filter dispatch (WR-01).
+    const effectiveLightContext = msg.metadata?.lightContext === true || params.operationType === "heartbeat";
+    // SD6 (Phase 159): capability-gated bootstrap.maxChars.
+    // resolveScaffoldDefaults handles the === 20_000 sentinel check internally.
+    // Fail-closed: absent modelProfile → FAIL_CLOSED_PROFILE (nano) → 3_500 (conservative).
+    const { bootstrapMaxChars, bootstrapTotalMaxChars } = resolveScaffoldDefaults(params.modelProfile ?? FAIL_CLOSED_PROFILE, config);
+    // Snapshot-aware bootstrap load + per-turn filter dispatch + char-budget
+    // build. Shared by the full-assembly path AND the parent-cache reuse path so
+    // the reuse path can resolve DET-02 tier-2 (USER.md preferred language)
+    // without drifting from the full path's filtering (WR-01). The session
+    // snapshot keeps loadWorkspaceBootstrapFiles to once per session and keeps the
+    // system-prompt prefix stable across turns.
+    async function resolveBootstrapContextFiles(mode) {
+        if (mode === "none") {
+            return { bootstrapContextFiles: [], bootstrapFilesForReport: [] };
+        }
+        const bsSnapKey = formatSessionKey(sessionKey);
+        let bootstrapFiles = sessionBootstrapFileSnapshots.get(bsSnapKey);
+        if (!bootstrapFiles) {
+            bootstrapFiles = await loadWorkspaceBootstrapFiles(deps.workspaceDir);
+            sessionBootstrapFileSnapshots.set(bsSnapKey, bootstrapFiles);
+        }
+        // Bootstrap filter dispatch:
+        //  - effectiveLightContext (heartbeat / explicit flag) -> HEARTBEAT.md only
+        //  - operationType === "cron" -> SOUL.md + ROLE.md only
+        //  - group chat context -> strip USER.md for privacy
+        if (effectiveLightContext) {
+            bootstrapFiles = filterBootstrapFilesForLightContext(bootstrapFiles);
+        }
+        else if (params.operationType === "cron") {
+            bootstrapFiles = filterBootstrapFilesForCron(bootstrapFiles);
+        }
+        else if (config.bootstrap?.groupChatFiltering !== false &&
+            isGroupContext(msg)) {
+            bootstrapFiles = filterBootstrapFilesForGroupChat(bootstrapFiles);
+        }
+        return {
+            bootstrapContextFiles: buildBootstrapContextFiles(bootstrapFiles, {
+                maxChars: bootstrapMaxChars,
+                totalMaxChars: bootstrapTotalMaxChars,
+            }),
+            bootstrapFilesForReport: bootstrapFiles,
+        };
+    }
     // Parent prefix reuse when model+provider match.
     // When a sub-agent has CacheSafeParams from its parent and the resolved model/provider
     // matches, skip the entire system prompt assembly (bootstrap loading, tool/bootstrap snapshots,
@@ -261,6 +522,22 @@ export async function assembleExecutionPrompt(params) {
         if (promptSkillsXml) {
             dynamicPreambleParts.push(`## Available Skills\n${promptSkillsXml}`);
         }
+        // WR-06 (ATTR-01): this reuse path re-emits the `## Available Skills` block
+        // (a learned-skill <location> can be visible to the model), so it MUST also
+        // populate the location→skillName index the bridge reads — otherwise
+        // getSessionPromptSkillLocations() returns undefined and skill-use
+        // attribution silently no-ops for the DOMINANT cache-reuse (sub-agent) path
+        // (the precise seam-mismatch class that bit Phase 200). The full-assembly
+        // path freezes this in lockstep with its XML snapshot (see the
+        // sessionPromptSkillLocations.set below); here we key on the same
+        // formatSessionKey(sessionKey) and freeze once (don't clobber an index a
+        // prior full assembly already froze for this session).
+        if (sessionKey) {
+            const reuseSnapshotKey = formatSessionKey(sessionKey);
+            if (!sessionPromptSkillLocations.has(reuseSnapshotKey)) {
+                sessionPromptSkillLocations.set(reuseSnapshotKey, parseSkillLocationIndex(promptSkillsXml));
+            }
+        }
         // Active prompt skill
         const activePromptSkillContent = msg.metadata?.promptSkillContent;
         if (activePromptSkillContent) {
@@ -278,6 +555,13 @@ export async function assembleExecutionPrompt(params) {
                 workspaceDir: deps.spawnPacket.workspaceDir,
                 parentSummary: deps.spawnPacket.parentSummary,
                 agentWorkspaces: deps.spawnPacket.agentWorkspaces,
+                // GEN-03 (CR-01): the inherited conversation language was dropped on
+                // this cache-reuse path — the DOMINANT runtime path for same-model
+                // sub-agents — so a he/ar/ru sub-agent produced English output. Thread
+                // it so both role-section call sites are symmetric. en/undefined emits
+                // nothing (buildSubagentRoleSection guards on `language && !== "en"`),
+                // so the en path stays byte-identical (I1).
+                language: deps.spawnPacket.language,
             });
             if (roleLines.length > 0)
                 dynamicPreambleParts.push(roleLines.join("\n"));
@@ -317,93 +601,362 @@ export async function assembleExecutionPrompt(params) {
         }
         const dynamicPreamble = dynamicPreambleParts.join("\n\n");
         logger.info({ agentId, parentModel: parentCache.model, parentProvider: parentCache.provider }, "Using parent cache prefix (model/provider match)");
-        return { systemPrompt: parentCache.frozenSystemPrompt, systemPromptBlocks: parentCache.frozenSystemPromptBlocks, dynamicPreamble, inlineMemory: undefined };
+        // WR-01: resolve DET-02 tier-2 (USER.md preferred language) on the reuse
+        // path too. Pre-fix this hardcoded `undefined`, so a sub-agent that took the
+        // (dominant) cache-reuse path resolved its degraded reply WITHOUT tier-2 —
+        // silently falling through to tier-3 (inbound script). Compute promptMode
+        // (the same pure resolution as the full path) and load USER.md via the
+        // shared snapshot-aware helper so the filtering (incl. group-chat USER.md
+        // stripping) matches the full path. The system prompt itself is still the
+        // parent's frozen prefix — only the dynamic tier-2 signal is recovered.
+        const reuseBaseMode = config.bootstrap?.promptMode ?? "full";
+        const reusePromptMode = resolvePromptModeForProfile(reuseBaseMode, params.operationType, params.modelProfile, config.contextEngine?.compactPrompt);
+        const { bootstrapContextFiles: reuseBootstrapFiles } = await resolveBootstrapContextFiles(reusePromptMode);
+        const reuseUserLanguage = extractUserLanguage(reuseBootstrapFiles);
+        // STRIP-01/02 (cache-reuse path): the reused prefix is the PARENT's full
+        // frozen prompt, so a read-only child drops the heavy blocks here too (else
+        // the dominant same-model sub-agent path leaks the full inherited context).
+        const reuseEconomised = deps.spawnPacket
+            ? economiseForReadOnlyChild(parentCache.frozenSystemPrompt, parentCache.frozenSystemPromptBlocks, mergedCustomTools.map((t) => t.name))
+            : { systemPrompt: parentCache.frozenSystemPrompt, systemPromptBlocks: parentCache.frozenSystemPromptBlocks };
+        return { systemPrompt: reuseEconomised.systemPrompt, systemPromptBlocks: reuseEconomised.systemPromptBlocks, dynamicPreamble, inlineMemory: undefined, recalledMemories: undefined, userLanguage: reuseUserLanguage };
     }
     // 1. Resolve promptMode
-    // Cron and heartbeat auto-upgrade from "full" -> "operational" to trim
-    // interactive-only sections (compaction recovery, silent replies, reactions,
-    // media, SEP, sender trust). An explicit `config.bootstrap?.promptMode` wins
-    // -- operators can still force "minimal"/"none"/"full" if they have reason.
+    // Priority: cron/heartbeat → operational; small/nano + compactPrompt.enabled → compact-secure;
+    // operator override wins over compact-secure (only baseMode="full" gets auto-downgraded).
+    // An explicit `config.bootstrap?.promptMode` wins for all modes including "minimal"/"none".
     const baseMode = config.bootstrap?.promptMode ?? "full";
-    const promptMode = (params.operationType === "cron" || params.operationType === "heartbeat") && baseMode === "full"
-        ? "operational"
-        : baseMode;
-    // Consolidated lightContext flag: heartbeat implies light-context regardless
-    // of the explicit msg.metadata.lightContext flag. Callers that only set the
-    // metadata flag OR only set operationType="heartbeat" produce identical
-    // prompt output.
-    const effectiveLightContext = msg.metadata?.lightContext === true || params.operationType === "heartbeat";
-    // 2. Load workspace bootstrap files (skip for "none" mode)
-    let bootstrapContextFiles = [];
-    if (promptMode !== "none") {
-        const bootstrapMaxChars = config.bootstrap?.maxChars ?? 20_000;
-        // Snapshot raw bootstrap files on first turn to keep system prompt stable.
-        // When the agent writes workspace files mid-session (e.g., IDENTITY.md during onboarding),
-        // the next disk read returns different content, changing the system prompt digest and
-        // invalidating the entire cache prefix. The snapshot ensures loadWorkspaceBootstrapFiles
-        // is only called once per session. Per-turn filtering (lightContext, groupChat) still
-        // applies on the snapshot since those depend on per-message metadata.
-        const bsSnapKey = formatSessionKey(sessionKey);
-        let bootstrapFiles = sessionBootstrapFileSnapshots.get(bsSnapKey);
-        if (!bootstrapFiles) {
-            bootstrapFiles = await loadWorkspaceBootstrapFiles(deps.workspaceDir, bootstrapMaxChars);
-            sessionBootstrapFileSnapshots.set(bsSnapKey, bootstrapFiles);
-        }
-        // Bootstrap filter dispatch:
-        //  - effectiveLightContext (heartbeat / explicit flag) -> HEARTBEAT.md only
-        //  - operationType === "cron" -> SOUL.md + ROLE.md only
-        //  - group chat context -> strip USER.md for privacy
-        if (effectiveLightContext) {
-            bootstrapFiles = filterBootstrapFilesForLightContext(bootstrapFiles);
-        }
-        else if (params.operationType === "cron") {
-            bootstrapFiles = filterBootstrapFilesForCron(bootstrapFiles);
-        }
-        else if (config.bootstrap?.groupChatFiltering !== false &&
-            isGroupContext(msg)) {
-            bootstrapFiles = filterBootstrapFilesForGroupChat(bootstrapFiles);
+    const promptMode = resolvePromptModeForProfile(baseMode, params.operationType, params.modelProfile, config.contextEngine?.compactPrompt);
+    // WR-02: warn when compact-secure is active but senderTrustDisplayConfig is disabled.
+    // The sender-trust section wiring is correct (MODES_FULL_MIN_COMPACT includes it), but
+    // the data it receives is always an empty array when the feature is not configured —
+    // producing a structurally-satisfied but content-empty section. Operators should
+    // configure senderTrustDisplayConfig to get meaningful anti-injection trust display.
+    // WR-02 trigger is STATIC per agent (capabilityClass-derived promptMode +
+    // per-agent senderTrustDisplayConfig), so warn ONCE per agent — not per
+    // prompt assembly — to keep the log readable (the per-turn repetition was
+    // pure noise: 9× in a 9-turn small-model session, 2026-06-12 UC-4 run).
+    if (promptMode === "compact-secure" && !deps.senderTrustDisplayConfig?.enabled) {
+        const wr02Key = agentId ?? config.name;
+        if (!wr02SenderTrustWarnedAgents.has(wr02Key)) {
+            wr02SenderTrustWarnedAgents.add(wr02Key);
+            logger.warn({
+                submodule: "prompt-assembly",
+                hint: "compact-secure mode active but senderTrustDisplayConfig is disabled — sender-trust section will be empty. Configure senderTrustDisplayConfig.enabled=true for S1 anti-injection trust display.",
+                errorKind: "config",
+            }, "S1: sender-trust not injected in compact-secure (feature disabled)");
         }
-        bootstrapContextFiles = buildBootstrapContextFiles(bootstrapFiles, { maxChars: bootstrapMaxChars });
     }
-    // 3. RAG retrieval via hybrid memory injector (non-fatal)
-    // Top-1 result goes inline with user message for maximum LLM attention;
-    // remaining results go into the dynamic preamble (same location as before).
+    // 2. Load workspace bootstrap files (skip for "none" mode) via the shared
+    // snapshot-aware helper. `bootstrapFilesForReport` tracks the raw post-filter
+    // shape so the SystemPromptReport can populate injectedWorkspaceFiles[] with
+    // missing/truncated/rawChars/injectedChars accounting. The same helper feeds
+    // the parent-cache reuse path's tier-2 resolution (WR-01), so the filter
+    // dispatch can never drift between the two paths.
+    const { bootstrapContextFiles, bootstrapFilesForReport } = await resolveBootstrapContextFiles(promptMode);
+    // 3. RAG recall via createMemoryRecall + hybrid memory injector (non-fatal).
+    // `memorySections` = prompt content (retrieved sections + §7.3 guidance block when
+    // present); the `retrieved*` accumulators are telemetry truth — retrieved memory
+    // only, excluding the fixed guidance block.
     let memorySections = [];
     let inlineMemory;
+    // id + content of the recalled memories, surfaced on the result so the
+    // turn-end hook (executor-post-execution.ts) can attribute used-vs-ignored from
+    // the agent response. Stays in-process — only ids/counts ever leave the agent.
+    let recalledMemories;
+    let retrievedSectionsChars = 0;
+    let retrievedRagHits = 0;
     if (deps.memoryPort && config.rag?.enabled && !params.skipRag) {
         const ragStart = deps.clock.now();
         try {
-            logger.debug({ agentId, queryLength: msg.text.length }, "RAG search started");
-            const searchResults = await deps.memoryPort.search(sessionKey, msg.text, {
-                limit: config.rag.maxResults,
+            // Recall-trace recorder, null-when-disabled (default-off). Constructed
+            // per assembly but shares a daemon-wide queued writer by path (the recorder's
+            // registry contract), so recordRecall is fire-and-forget — no per-recall
+            // flushAndClose (that would tear down the shared writer; mirrors the cacheTrace
+            // daemon-wide lifecycle). `eventBus` is the already-in-scope bus (used for
+            // memory:injected below) — threading both here keeps memory:recalled/reranked at
+            // the canonical one-per-recall site inside createMemoryRecall.
+            // Pass the authoritative scope envelope so on-disk records carry
+            // `sessionKey` (the formatted key the CLI's recall-trace <session> selector
+            // compares against) AND `tenantId` (the read-side cross-tenant filter).
+            // tenantId comes from the per-agent config tenant, falling back to the
+            // SessionKey's tenant.
+            const recallTraceSessionKey = formatSessionKey(sessionKey);
+            const recallTrace = buildRecallTrace(deps.recallTraceConfig, agentId ?? config.name, recallTraceSessionKey, deps.dataDir, { sessionKey: recallTraceSessionKey, tenantId: deps.tenantId ?? sessionKey.tenantId });
+            // Single recall orchestrator: search->fuse->rerank->score->trust-filter
+            // ->dedup. Rerank opt-in/default-OFF -> fusion order. Non-fatal.
+            // The recall-utility feedback toggle: the `rag.feedback` schema field is added
+            // later, so read it through a structural widening that compiles against today's
+            // strict RagConfig (optional-chaining → off when absent; correct once the field exists).
+            // The boost MAGNITUDE is the single canonical `rag.scoring.usefulnessAlpha` (passed via
+            // `scoring` below) — there is NO alpha on `feedback`.
+            const ragFeedback = config.rag
+                .feedback;
+            // Recall scoring is the FIXED config.rag.scoring alphas (Phase 224, RECALL-02/03):
+            // the UCB online-tuning bandit + its per-intent tuned-alpha overlay are deleted, so
+            // there is no learned-weight read on the recall hot path — ranking is fused RRF + the
+            // cross-encoder reranker over the config-sourced alphas only. Deterministic + LLM-free.
+            const recall = createMemoryRecall({
+                memoryPort: deps.memoryPort,
+                reranker: deps.reranker,
+                entityStore: deps.entityStore,
+                temporalStore: deps.temporalStore,
+                causalStore: deps.causalStore,
+                tripleStore: deps.tripleStore,
+                embeddingStore: deps.embeddingStore,
+                usefulnessStore: deps.usefulnessStore,
+                // R6: wire the pinned-first lane store so Step 0 of the recall pipeline
+                // (`if (cfg_pinned?.enabled === true && deps.pinnedStore !== undefined)`) can fire
+                // at runtime. The same `memoryAdapter` already passed as `memoryPort` implements
+                // `MemoryPinnedStore`; the daemon composition root threads it here through
+                // PiExecutorDeps.pinnedStore → PromptAssemblyParams.deps.pinnedStore. Default-OFF
+                // byte-identity: with `rag.pinned.enabled=false` (the default) no query runs.
+                ...(deps.pinnedStore !== undefined ? { pinnedStore: deps.pinnedStore } : {}),
+                // DIST-03 (Phase 173, the C1→C2 carry-in): thread the provenance read
+                // store so createMemoryRecall's post-fusion down-weighting pass can fire
+                // live. The daemon composition root threads it here through
+                // PiExecutorDeps.provenanceStore → PromptAssemblyParams.deps.provenanceStore.
+                // DEFAULT-OFF byte-identity: absent OR no lcd_distilled result → no read.
+                ...(deps.provenanceStore !== undefined ? { provenanceStore: deps.provenanceStore } : {}),
+                timers: deps.timers,
+                clock: deps.clock,
+                logger,
+                ...(recallTrace !== null ? { recallTrace } : {}),
+                ...(deps.eventBus !== undefined ? { eventBus: deps.eventBus } : {}),
+            }, {
+                maxResults: config.rag.maxResults,
                 minScore: config.rag.minScore,
-                agentId,
+                includeTrustLevels: config.rag.includeTrustLevels,
+                rerank: config.rag.rerank,
+                // Fixed config-sourced scoring alphas — no learned overlay (Phase 224, RECALL-02/03).
+                scoring: config.rag.scoring,
+                lanes: config.rag.lanes,
+                entityLane: config.rag.entityLane,
+                // MMR diversity re-rank + query understanding. Both are
+                // fully-defaulted RagConfig fields (.strictObject + .default() on every
+                // field), so they pass DIRECTLY — no optional-chaining / structural widening like
+                // `feedback` above (which predates its config landing). Default-OFF ⇒ recall is
+                // byte-identical until an operator opts in (rag.mmr.enabled / rag.queryUnderstanding.*).
+                mmr: config.rag.mmr,
+                queryUnderstanding: config.rag.queryUnderstanding,
+                // The FadeMem per-type decay gate. A fully-defaulted RagConfig field
+                // (.strictObject + .default()), so it passes DIRECTLY — same as mmr/
+                // queryUnderstanding, no optional-chaining / structural widening. Default-OFF ⇒
+                // score.ts forces forgetFactor to exactly 1.0 ⇒ byte-identical recall until an
+                // operator opts in (rag.forget.enabled); the neutral byte-identity holds even when on.
+                forget: config.rag.forget,
+                // R6: forward the pinned-memory injection config so Step 0 knows the cap.
+                // A fully-defaulted RagConfig field (same posture as mmr/forget), so it passes DIRECTLY.
+                // Default-OFF (`enabled:false`) ⇒ the pinned lane is skipped (byte-identical).
+                pinned: config.rag.pinned,
+                // R3: forward the base-score floor gate.
+                // SD2 (Phase 158): capability-gated baseFloor.
+                // Resolved: explicit config.rag.baseFloor (>0) wins; for small/nano with
+                // baseFloor===0 (schema default/"unset"), applies SMALL_NANO_DEFAULT_BASE_FLOOR=0.15.
+                // frontier/mid with no config: effective floor remains 0 (byte-identical).
+                // Fail-closed when modelProfile absent → 0 floor (frontier-equivalent behavior).
+                // T-153-poison: boosts cannot resurrect a low-base memory (floor gates pre-boost).
+                baseFloor: params.modelProfile !== undefined
+                    ? resolveScaffoldDefaults(params.modelProfile, config).baseFloor
+                    : config.rag.baseFloor,
+                // RETR-04 / WR-02 (Phase 173): thread the unified-arbiter-active signal so the
+                // recall baseFloor gate is FAIL-CLOSED under the arbiter (an unconfigured floor
+                // resolves to the class default instead of silently skipping) AND the trust gate
+                // runs upstream of fusion. relevanceFirst=true only for small/nano non-caching
+                // models (resolveScaffoldDefaults); frontier/mid → false → recall byte-identical
+                // (LOCKED #2). Absent modelProfile → undefined → off (recency-first, byte-identical).
+                ...(params.modelProfile !== undefined
+                    ? { relevanceFirst: resolveScaffoldDefaults(params.modelProfile, config).relevanceFirst }
+                    : {}),
+                ...(ragFeedback !== undefined ? { feedback: ragFeedback } : {}),
             });
-            if (searchResults.ok && searchResults.value.length > 0) {
-                // Post-filter by allowed trust levels
-                const allowedTrustLevels = new Set(config.rag.includeTrustLevels);
-                const filtered = searchResults.value.filter(r => allowedTrustLevels.has(r.entry.trustLevel));
-                // Deduplicate near-identical content
-                const deduped = deduplicateResults(filtered);
-                if (deduped.length > 0) {
-                    // Hybrid split: top-1 inline with user message, rest in dynamic preamble
-                    const injector = createHybridMemoryInjector({
-                        onSuspiciousContent: deps.onSuspiciousContent,
-                    });
-                    const injection = injector.split(deduped, config.rag.maxContextChars);
-                    inlineMemory = injection.inlineMemory;
-                    memorySections = injection.systemPromptSections;
+            const recalled = await recall.recall(msg.text, sessionKey, agentId);
+            if (recalled.ok && recalled.value.length > 0) {
+                // Hybrid split: top-1 inline with user message, rest in dynamic preamble.
+                const ranked = recalled.value;
+                // Capture id + content for turn-end attribution (in-process only).
+                recalledMemories = ranked.map((r) => ({ id: r.entry.id, content: r.entry.content }));
+                const injector = createHybridMemoryInjector({
+                    onSuspiciousContent: deps.onSuspiciousContent,
+                });
+                // Budget accounting: subtract pinnedChars from maxContextChars BEFORE sizing
+                // fused recall. Pinned entries are identified by entry.pinned===true (set by
+                // rowToEntry from the DB column; the recall pipeline's Step-0 lane prepends them).
+                // CR-03: use entry.pinned to identify actual pinned entries rather than a positional
+                // slice(0, maxPinnedInjection). When real pins < cap, the positional slice over-counts
+                // and incorrectly measures fused entries in pinnedChars, silently dropping them from
+                // injector.split. The entry.pinned filter deducts only real-pin chars.
+                // pinnedChars is 0 when pinning is disabled (default-off — byte-identical behavior).
+                const pinnedSet = config.rag.pinned?.enabled === true
+                    ? ranked.filter((r) => r.entry.pinned === true)
+                    : [];
+                let fusedSet = ranked.filter((r) => r.entry.pinned !== true);
+                let pinnedChars = 0;
+                if (pinnedSet.length > 0) {
+                    const pinnedSection = formatMemorySection(pinnedSet, config.rag.maxContextChars);
+                    pinnedChars = pinnedSection ? pinnedSection.length : 0;
                 }
-                logger.debug({ agentId, resultCount: deduped.length, durationMs: deps.clock.now() - ragStart }, "RAG search complete");
-            }
-            else {
-                logger.debug({ agentId, resultCount: 0, durationMs: deps.clock.now() - ragStart }, "RAG search complete");
+                // R3: small/nano profile count cap (3 items max) and chars cap (2000/1000).
+                // Applied AFTER the base-floor filter in the recall pipeline, at the injection site.
+                // Caps are conservative but generous for small models; frontier/mid are uncapped.
+                // T-153-03b: accepted DoS risk — caps are well above typical useful recall sets.
+                const maxRecallItems = params.modelProfile?.capabilityClass === "small" || params.modelProfile?.capabilityClass === "nano"
+                    ? 3
+                    : undefined;
+                const maxRecallChars = params.modelProfile?.capabilityClass === "small"
+                    ? 2000
+                    : params.modelProfile?.capabilityClass === "nano"
+                        ? 1000
+                        : undefined;
+                if (maxRecallItems !== undefined && fusedSet.length > maxRecallItems) {
+                    fusedSet = fusedSet.slice(0, maxRecallItems);
+                }
+                const remainingChars = Math.max(0, Math.min(config.rag.maxContextChars - pinnedChars, maxRecallChars !== undefined ? maxRecallChars : Infinity));
+                const injection = injector.split(fusedSet, remainingChars);
+                inlineMemory = injection.inlineMemory;
+                // Own the array — `injection.systemPromptSections` is what telemetry
+                // reads, so pushing the guidance block into an alias of it would inflate
+                // retrieved-memory metrics. Snapshot RETRIEVED-only char + RAG-hit counts
+                // BEFORE the push so charsInjected/ragHits stay consistent with hitCount.
+                memorySections = [...injection.systemPromptSections];
+                retrievedSectionsChars = memorySections.reduce((sum, s) => sum + s.length, 0);
+                retrievedRagHits = memorySections.length + (inlineMemory ? 1 : 0);
+                // Read-time contradiction guidance: inject the §7.3 block when
+                // >=2 surfaced memories are co-retrieved for the same query. Pure formatter; no
+                // deletion, no content echo. The >=2 gate is tightened with entity overlap.
+                // FIXED guidance text, NOT a retrieved memory — excluded from telemetry above.
+                const temporalGuidance = buildTemporalGuidanceBlock(ranked);
+                if (temporalGuidance)
+                    memorySections.push(temporalGuidance);
+                // STORE the memory-injection summary (do NOT emit here): postExecution emits memory:injected
+                // AFTER the trajectory bridge has subscribed. The inline assembly runs inside assembleTools,
+                // BEFORE attachTrajectoryToEventBus (pi-executor), so an inline emit fired to NO listener and
+                // the trajectory missed the RAG record on every turn — the same pre-bridge timing bug fixed
+                // for memory:skill_surfaced (finding A). Fires only on turns where the injector produced
+                // content (this block is reached only then). Retrieved memory ONLY (inline + retrieved
+                // sections), never the guidance block — keeps charsInjected consistent with hitCount.
+                sessionPromptMemoryInjected.set(formatSessionKey(sessionKey), {
+                    hitCount: ranked.length,
+                    charsInjected: (injection.inlineMemory?.length ?? 0) + retrievedSectionsChars,
+                    trustTags: Array.from(new Set(ranked.map((r) => r.entry.trustLevel))),
+                    pinnedCount: pinnedSet.length,
+                });
             }
+            logger.debug({ agentId, resultCount: recalled.ok ? recalled.value.length : 0, durationMs: deps.clock.now() - ragStart }, "RAG recall complete");
         }
         catch (err) {
-            logger.warn({ agentId, err, durationMs: deps.clock.now() - ragStart, hint: "RAG search failed — agent will proceed without memory context", errorKind: "dependency" }, "RAG retrieval failed (non-fatal)");
+            logger.warn({ agentId, err, durationMs: deps.clock.now() - ragStart, hint: "RAG recall failed — agent will proceed without memory context", errorKind: "dependency" }, "RAG recall failed (non-fatal)");
+        }
+    }
+    // USER-PROFILE STANDING BLOCK: the LLM-free per-user-profile block is a DURABLE
+    // standing block ("what we know about this user"), NOT a per-recall-conditional one.
+    // FOLD-01 (Phase 225 Plan 02): the source is REWIRED from the deleted
+    // `userRepresentationStore` to the v2.31 mental-model store — a `kind:"profile"`
+    // Mental Model doc (`mentalModelStore.list(scope,"profile")` → `buildProfileBlock`).
+    //
+    // It is injected on its OWN gate — `config.learning.enabled` (the collapsed
+    // learning flag, Phase 226 / SIMPLIFY-05; was learningSkills.enabled)
+    // AND the optional store dep — INDEPENDENT of whether RAG ran, whether recall hit,
+    // and independent of `rag.enabled`. This is why it lives OUTSIDE the
+    // `if (deps.memoryPort && config.rag?.enabled ...)` recall block above: nesting it
+    // there silently dropped the profile on every zero-recall turn (greetings/off-topic/
+    // sparse store) and gave RAG-off deployments ZERO injection.
+    //
+    // Default-OFF byte-identity (the cost gate): with the gate off OR no store dep,
+    // list() is NEVER called and the prompt is byte-identical. When ON, a DETERMINISTIC
+    // `list(scope,"profile")` scoped to THIS prompt's own (tenant, agent) + the pure
+    // buildProfileBlock formatter (NO model call — the recall hot path stays LLM-free).
+    // The profile groupKey is the userId, carried on the doc's `topicKey` (LearningScope
+    // has only (tenant, agent)), so the CURRENT user's doc is selected by
+    // `topicKey === sessionKey.userId` — cross-user isolation at read (T-225-09). The
+    // formatter returns undefined on an empty/absent profile ⇒ nothing pushed ⇒
+    // byte-identity. Non-fatal: a list err is swallowed so the agent proceeds without the
+    // profile. The profile content was redaction-checked + validateLearnedDocBody-clean +
+    // high-trust at WRITE time. memorySections is seeded by the recall block (or empty),
+    // so the profile appends after any retrieved sections + temporal guidance.
+    if (config.learning?.enabled && deps.mentalModelStore) {
+        try {
+            // ONE list of ALL learning docs (kind omitted) — partitioned below for the
+            // user-profile standing block (kind=profile) AND the reuse-attribution topic-match
+            // (kind=skill). A single list keeps the per-turn store cost to ONE read (the
+            // "list runs once" contract) while serving both consumers.
+            const docs = await deps.mentalModelStore.list({
+                tenantId: deps.tenantId ?? sessionKey.tenantId,
+                agentId: agentId ?? config.name,
+            });
+            if (docs.ok) {
+                // --- user-profile standing block (kind=profile) ---
+                // The per-user doc: the profile groupKey is the userId on the doc's topicKey.
+                // Select THIS user's doc by `topicKey === userId`. A doc with an EMPTY topicKey
+                // is user-agnostic (a single-user agent whose builder set no per-user groupKey)
+                // and is shown to any user; a doc carrying a DIFFERENT user's topicKey is NEVER
+                // shown (cross-user isolation — no sole-doc fallback that could leak A's profile
+                // to B). When userId is itself absent, only an empty-topicKey doc qualifies.
+                const profiles = docs.value.filter((d) => d.kind === "profile");
+                const userId = sessionKey.userId;
+                const mine = (userId !== undefined ? profiles.find((d) => d.topicKey === userId) : undefined) ??
+                    profiles.find((d) => d.topicKey === "");
+                if (mine) {
+                    const profileBlock = buildProfileBlock(mine);
+                    if (profileBlock)
+                        memorySections.push(profileBlock);
+                }
+                // --- reuse-attribution by TOPIC MATCH (kind=skill).
+                // Credit any learned skill whose stored common-core (topicTokens) THIS turn instantiates,
+                // so a skill APPLIED from the surfaced `<available_skills>` summary / recall — without an
+                // explicit `read` of its SKILL.md (the ATTR-01 path) — still enters `usedSkillIds` and
+                // promotes on success. Per-turn (the match depends on the turn's request text); the carrier
+                // is unioned into the turn's usedSkillIds by the pi-event-bridge.
+                const skills = docs.value.filter((d) => d.kind === "skill");
+                const scores = topicMatchScores(msg.text, skills.map((s) => ({ name: s.name, topicTokens: s.structuredBody?.topicTokens })));
+                const matched = [...new Set(scores.filter((s) => s.credited).map((s) => s.name))];
+                sessionPromptTopicMatchedSkills.set(formatSessionKey(sessionKey), matched);
+                // One DEBUG line when a turn TOPIC-CREDITS ≥1 learned skill WITHOUT an explicit read —
+                // otherwise the credit is invisible until a downstream proof bump, so confirming "did
+                // reuse-attribution fire this turn" meant grepping outcome_events. Gated on a non-empty
+                // match (the meaningful, low-volume signal — a no-match turn logs nothing). Counts only,
+                // never the skill body.
+                if (matched.length > 0) {
+                    logger.debug({ agentId, step: "skill-topic-match", skillsConsidered: skills.length, matchedCount: matched.length }, "reuse-attribution: turn topic-credited learned skill(s) without an explicit read");
+                }
+                // memory:skill_surfaced (finding A): the full reuse-attribution census. memory:skill_used
+                // (post-execution) fires only when ≥1 skill is CREDITED, so a NEAR-MISS — a skill that
+                // overlapped the turn but missed the credit bar, or a legacy doc with no topicTokens — was
+                // silent ("why wasn't my skill reused?" needed a debugger). Emit per turn when ≥1 learned
+                // skill has ANY token overlap (sharedCount>0) or is credited; carry a content-free score
+                // (name=id, rest=numbers; zero-overlap skills omitted as noise; capped). Best-effort.
+                // STORE the census (do NOT emit here): postExecution emits memory:skill_surfaced after the
+                // trajectory bridge has subscribed. Keep only the skills with token overlap (credited +
+                // near-misses); zero-overlap skills are noise. Capped at 25 (coverage desc).
+                if (skills.length > 0) {
+                    const relevant = scores
+                        .filter((s) => s.sharedCount > 0 || s.credited)
+                        .sort((a, b) => b.coverage - a.coverage || b.sharedCount - a.sharedCount)
+                        .slice(0, 25);
+                    if (relevant.length > 0) {
+                        sessionPromptSkillSurfacedCensus.set(formatSessionKey(sessionKey), {
+                            surfacedCount: skills.length,
+                            creditedCount: matched.length,
+                            scores: relevant,
+                        });
+                    }
+                }
+            }
+        }
+        catch (learningErr) {
+            logger.debug({
+                agentId,
+                err: learningErr,
+                hint: "learning standing-block / skill topic-match read failed; proceeding without",
+                errorKind: "dependency",
+            }, "Learning standing-block read failed (non-fatal)");
         }
     }
+    // (The CHANNEL-RELATIONSHIP STANDING BLOCK — the LLM-free directional `<channel_relationships>`
+    //  injection, gated on `config.socialModeling.enabled && privacyReviewSignedOffBy` + the store dep —
+    //  was DELETED in Phase 226-04 with the rest of the social-modeling subsystem (the RelationshipStore
+    //  port + adapter, the `relationship` table, the offline directional-edge builder). Deleting the
+    //  injection removes a prompt-injected relationship-model surface; no dormant seam left (I1).)
     // 4. Build runtime info
     const runtimeInfo = {
         agentId: agentId ?? config.name,
@@ -490,6 +1043,11 @@ export async function assembleExecutionPrompt(params) {
         sessionToolNameSnapshots.set(snapshotKey, toolNames);
     }
     const hasMemoryTools = stableToolNames.includes("memory_store") || stableToolNames.includes("memory_search");
+    // P2: include the Compressed-context uncertainty clause when the DAG (LCD)
+    // engine is enabled. Gated on the per-session, operator-only
+    // `contextEngine.version` (stable config) -- NOT per-turn store state -- so the
+    // cache-stable system-prompt prefix is not thrashed on every compaction.
+    const dagModeEnabled = config.contextEngine?.version === "dag";
     // Snapshot promptSkillsXml on first turn to keep system prompt stable.
     // Skills created mid-session grow the XML (~540 chars per skill), invalidating
     // the entire system prompt cache prefix on every subsequent turn.
@@ -497,6 +1055,10 @@ export async function assembleExecutionPrompt(params) {
     if (promptSkillsXml === undefined && !sessionPromptSkillsXmlSnapshots.has(snapshotKey)) {
         promptSkillsXml = deps.getPromptSkillsXml?.() ?? undefined;
         sessionPromptSkillsXmlSnapshots.set(snapshotKey, promptSkillsXml);
+        // ATTR-01: parse the frozen XML into the location→skillName index ONCE,
+        // in lockstep with the XML snapshot, so the bridge can attribute skill use
+        // from a `read` path. Empty when no skills are listed (the default).
+        sessionPromptSkillLocations.set(snapshotKey, parseSkillLocationIndex(promptSkillsXml));
     }
     const activePromptSkillContent = msg.metadata?.promptSkillContent;
     // Extract user's preferred language from USER.md (if present)
@@ -516,6 +1078,7 @@ export async function assembleExecutionPrompt(params) {
             workspaceDir: deps.spawnPacket.workspaceDir,
             parentSummary: deps.spawnPacket.parentSummary,
             agentWorkspaces: deps.spawnPacket.agentWorkspaces,
+            language: deps.spawnPacket.language,
         };
     }
     // Detect onboarding state from workspace
@@ -562,12 +1125,77 @@ export async function assembleExecutionPrompt(params) {
         excludeBootstrapFromContext: true, // BOOTSTRAP.md is either elevated (onboarding) or dead weight (post-onboarding); never useful in Project Context
         workspaceProfile: config.workspace?.profile,
         sepEnabled: params.sepEnabled,
+        dagModeEnabled,
+        // C2/S1: securityLevel from ModelProfile drives lockdown tightening in compact-secure mode.
+        // Only applied when promptMode === "compact-secure"; ignored for full/operational/minimal.
+        securityLevel: params.modelProfile?.securityLevel,
     };
     let systemPrompt = assembleRichSystemPrompt(assemblerParams);
     // Build structured blocks for multi-block cache_control injection.
     // Uses the same assemblerParams as assembleRichSystemPrompt() -- identity guaranteed
     // by shared buildAllSections().
-    const systemPromptBlocks = assembleRichSystemPromptBlocks(assemblerParams);
+    let systemPromptBlocks = assembleRichSystemPromptBlocks(assemblerParams);
+    // ROOT-CAUSE context-exhaustion guard — degenerate-window compact fallback
+    // (2026-06-22). The window-aware tool-budget fit pass (executor-tool-assembly)
+    // defers tools to fit, but the system prompt itself is non-evictable: a model
+    // whose effective window is SMALLER than its full prompt (e.g. an ~8K window
+    // mid-class model with a ~10K prompt — compact-secure never fires for mid/
+    // frontier) still overflows even with zero tools, and the pre-flight throws
+    // fixed_overhead_exceeds_window. The user's hard requirement is that the agent
+    // NEVER context-exhausts. So when the resolved-mode prompt cannot fit —
+    // systemPromptOnlyTokens + outputHeadroom + messageFloorTokens > effectiveWindow —
+    // re-assemble in the existing compact-secure mode (security floor intact,
+    // ~700 tok), a CHEAP pure re-call (no RAG re-run). This only fires in the
+    // genuinely-degenerate case, so normal windows stay byte-identical (the
+    // window-agnostic baseline when windowFitBudget is absent). compact-secure and
+    // none are already minimal — never re-shrunk.
+    const fitBudget = params.windowFitBudget;
+    if (fitBudget !== undefined &&
+        promptMode !== "compact-secure" &&
+        promptMode !== "none") {
+        // TOK-01: factor the prompt's own script (dense non-Latin prompts carry more
+        // tokens/char), matching estimateSystemTokensFactored at toolOverheadChars=0.
+        const systemPromptOnlyTokens = Math.ceil(systemPrompt.length / (CHARS_PER_TOKEN_RATIO * scriptTokenFactor(systemPrompt)));
+        const minFixed = systemPromptOnlyTokens + fitBudget.outputHeadroom + fitBudget.messageFloorTokens;
+        if (minFixed > fitBudget.effectiveWindow) {
+            const compactParams = { ...assemblerParams, promptMode: "compact-secure" };
+            const compactPrompt = assembleRichSystemPrompt(compactParams);
+            const compactTokens = Math.ceil(compactPrompt.length / (CHARS_PER_TOKEN_RATIO * scriptTokenFactor(compactPrompt)));
+            logger.warn({
+                step: "prompt-compact-fallback",
+                errorKind: "resource",
+                hint: `System prompt (~${systemPromptOnlyTokens} tok) + output headroom (${fitBudget.outputHeadroom}) ` +
+                    `+ message floor (${fitBudget.messageFloorTokens}) exceeds the effective window ` +
+                    `(${fitBudget.effectiveWindow}); fell back to the compact-secure prompt (~${compactTokens} tok) so ` +
+                    `the agent still runs. Raise the model's context window or use a larger model to restore the full prompt.`,
+                agentId: agentId ?? config.name,
+                fromPromptMode: promptMode,
+                effectiveWindow: fitBudget.effectiveWindow,
+                fullPromptTokens: systemPromptOnlyTokens,
+                compactPromptTokens: compactTokens,
+                outputHeadroom: fitBudget.outputHeadroom,
+                messageFloorTokens: fitBudget.messageFloorTokens,
+            }, "prompt compact-fallback: full prompt too large for window, using compact-secure");
+            deps.eventBus?.emit("context:overflow", {
+                agentId: agentId ?? config.name,
+                sessionKey: formatSessionKey(sessionKey),
+                contextTokens: minFixed,
+                budgetTokens: fitBudget.effectiveWindow,
+                recoveryAction: "strip_skills",
+                timestamp: deps.clock?.now() ?? systemNowMs(),
+            });
+            systemPrompt = compactPrompt;
+            systemPromptBlocks = assembleRichSystemPromptBlocks(compactParams);
+        }
+    }
+    // STRIP-01/02: read-only-child input economy. Gating + drop logic all live in
+    // spawn/child-prompt-economy.ts (blocks are always defined on this path).
+    if (deps.spawnPacket) {
+        const economised = economiseForReadOnlyChild(systemPrompt, systemPromptBlocks, stableToolNames);
+        systemPrompt = economised.systemPrompt;
+        if (economised.systemPromptBlocks)
+            systemPromptBlocks = economised.systemPromptBlocks;
+    }
     // 6. Run before_agent_start hook
     const hookResult = await deps.hookRunner?.runBeforeAgentStart({ systemPrompt, messages: [] }, {
         agentId: agentId ?? config.name,
@@ -581,6 +1209,106 @@ export async function assembleExecutionPrompt(params) {
     // This is acceptable: hooks are session-stable, so blocks only
     // matter for the cache prefix split which is unaffected by hook prepends.
     // The frozenSystemPrompt (string) remains the source of truth for content.
+    // Build + persist SystemPromptReport.
+    // Hook site: after assembleRichSystemPrompt + assembleRichSystemPromptBlocks
+    // and after the before_agent_start hook applies any prompt modification —
+    // the report captures the FINAL system prompt that flows to the model
+    // (cache-stable portion). Dynamic preamble is built downstream and is
+    // intentionally not part of the report (it's per-turn diagnostic, not
+    // a system-prompt artifact).
+    //
+    // Best-effort: any failure in build/persist is swallowed via try/catch
+    // so it never aborts assembly. Persistence is already best-effort
+    // internally (Result.err is logged), but the caller is non-throwing.
+    if (deps.observabilityStore !== undefined || deps.sessionStore !== undefined) {
+        try {
+            const reportBootstrapFiles = bootstrapFilesForReport.map((f) => {
+                const rawContent = f.content;
+                const rawChars = rawContent !== undefined ? rawContent.length : 0;
+                // The bootstrap context file built from this raw file has a
+                // matching path; truncation may have shortened it.
+                const ctxFile = bootstrapContextFiles.find((c) => c.path === f.name);
+                // `content` for missing files is the "[MISSING] Expected at: ..." marker
+                // — that's a synthetic content, not what was on disk. For the
+                // report's `injectedChars` we want the actual character count
+                // injected into the prompt, including any [MISSING] marker.
+                const injectedChars = ctxFile ? ctxFile.content.length : 0;
+                return {
+                    name: f.name,
+                    missing: f.missing,
+                    rawChars,
+                    injectedChars,
+                    // Only include rawContent for sha256 when the file actually
+                    // existed; missing files have no content to hash.
+                    rawContent: f.missing ? undefined : rawContent,
+                };
+            });
+            const reportTools = mergedCustomTools.map((t) => ({
+                name: t.name,
+                // pi-coding-agent ToolDefinition uses `parameters` for the JSON
+                // schema (see buildBootstrapContextFiles caller / executor-tool-
+                // assembly.ts:367-369).
+                schema: t.parameters,
+            }));
+            const report = buildSystemPromptReport({
+                source: deps.isFirstMessageInSession ? "session-create" : "run",
+                generatedAt: deps.clock.now(),
+                agentId: agentId ?? config.name,
+                sessionId: formatSessionKey(sessionKey),
+                context: {
+                    traceId: tryGetContext()?.traceId,
+                    tenantId: deps.tenantId,
+                    sessionKey: formatSessionKey(sessionKey),
+                    runId: deps.runId,
+                    provider: params.resolvedModelProvider ?? config.provider,
+                    model: params.resolvedModelId ?? config.model,
+                    workspaceDir: deps.workspaceDir,
+                },
+                systemPrompt,
+                bootstrapMaxChars,
+                bootstrapFiles: reportBootstrapFiles,
+                tools: reportTools,
+                policyFilteredToolNames: deps.policyFilteredToolNames,
+                // memoryInjection reflects RETRIEVED memory only (inline + retrieved
+                // sections). The predicate gates on injected content (memorySections
+                // includes the §7.3 guidance block); the COUNTS use the retrieved-only
+                // accumulators so they never tally the fixed guidance text. The
+                // `?? 0` on inlineMemory.length is load-bearing for the sections-only
+                // branch (the outer predicate can be true with inlineMemory undefined).
+                memoryInjection: (inlineMemory !== undefined || memorySections.length > 0)
+                    ? {
+                        ragHits: retrievedRagHits,
+                        charsInjected: (inlineMemory?.length ?? 0) + retrievedSectionsChars,
+                        trustTags: [],
+                    }
+                    : undefined,
+            });
+            const persistResult = await persistSystemPromptReport(report, {
+                observabilityStore: deps.observabilityStore,
+                sessionStore: deps.sessionStore,
+                logger,
+            });
+            if (!persistResult.ok) {
+                // The persist function already logged via the injected logger;
+                // we only log a DEBUG-level summary here for cross-correlation.
+                logger.debug({
+                    agentId: agentId ?? config.name,
+                    sessionKey: formatSessionKey(sessionKey),
+                    errorKind: "dependency",
+                    hint: "SystemPromptReport persistence had partial failure; see prior warn lines",
+                }, "SystemPromptReport persist returned err");
+            }
+        }
+        catch (err) {
+            // Never abort assembly because of the report. Same best-effort
+            // pattern as memory:injected emit above; same risk profile.
+            logger.debug({
+                err,
+                hint: "SystemPromptReport build/persist threw; assembly continues",
+                errorKind: "internal",
+            }, "SystemPromptReport build/persist failed (non-fatal)");
+        }
+    }
     // prependContext relocated to dynamic preamble to preserve cache prefix stability.
     // Hooks may return turn-varying content (timestamps, user state) which would invalidate
     // the cache prefix if injected into the system prompt.
@@ -594,18 +1322,25 @@ export async function assembleExecutionPrompt(params) {
     if (apiSystemPrompt) {
         wrappedApiSystemPrompt = wrapExternalContent(apiSystemPrompt, { source: "api", includeWarning: true, onSuspiciousContent: deps.onSuspiciousContent });
     }
-    // Bootstrap content budget tracking
+    // Bootstrap content budget tracking (F4: denominator = systemPromptChars + toolDefOverheadChars)
     const bootstrapChars = bootstrapContextFiles.reduce((sum, f) => sum + f.content.length, 0);
     const systemPromptChars = systemPrompt.length;
+    const toolDefOverheadChars = mergedCustomTools.reduce((sum, t) => {
+        return sum + (t.name?.length ?? 0) + (t.description?.length ?? 0) +
+            (t.parameters ? JSON.stringify(t.parameters).length : 0);
+    }, 0);
+    const totalEstimatedChars = systemPromptChars + toolDefOverheadChars;
     if (systemPromptChars > 0) {
-        const bootstrapPercent = Math.round((bootstrapChars / systemPromptChars) * 100);
+        const bootstrapPercent = Math.round((bootstrapChars / totalEstimatedChars) * 100);
         if (bootstrapPercent > BOOTSTRAP_BUDGET_WARN_PERCENT) {
             logger.warn({
                 bootstrapChars,
                 systemPromptChars,
+                toolDefOverheadChars,
+                totalEstimatedChars,
                 bootstrapPercent,
                 threshold: BOOTSTRAP_BUDGET_WARN_PERCENT,
-                hint: `Bootstrap files consume ${bootstrapPercent}% of system prompt; consider trimming AGENTS.md or reducing maxChars`,
+                hint: `Bootstrap files consume ${bootstrapPercent}% of estimated total prompt (system + tools); consider total bootstrap budget or reducing maxChars`,
                 errorKind: "resource",
             }, "Bootstrap content exceeds budget threshold");
         }
@@ -771,16 +1506,18 @@ export async function assembleExecutionPrompt(params) {
         dynamicPreambleParts.unshift(wrappedApiSystemPrompt);
     }
     const dynamicPreamble = dynamicPreambleParts.join("\n\n");
-    // Token budget breakdown for optimization measurement.
-    const systemPromptTokens = Math.ceil(systemPrompt.length / CHARS_PER_TOKEN_RATIO);
-    const dynamicPreambleTokens = Math.ceil(dynamicPreamble.length / CHARS_PER_TOKEN_RATIO);
+    // Token budget breakdown for optimization measurement. Script-factored
+    // (TOK-01) so the operator-visible numbers stay consistent with the real
+    // factored reservation in executor-tool-assembly.
+    const systemPromptTokens = Math.ceil(systemPrompt.length / (CHARS_PER_TOKEN_RATIO * scriptTokenFactor(systemPrompt)));
+    const dynamicPreambleTokens = Math.ceil(dynamicPreamble.length / (CHARS_PER_TOKEN_RATIO * scriptTokenFactor(dynamicPreamble)));
     logger.info({
         systemPromptTokens,
         dynamicPreambleTokens,
         systemPromptChars: systemPrompt.length,
         dynamicPreambleChars: dynamicPreamble.length,
         bootstrapChars,
-        bootstrapPercent: systemPromptChars > 0 ? Math.round((bootstrapChars / systemPromptChars) * 100) : 0,
+        bootstrapPercent: totalEstimatedChars > 0 ? Math.round((bootstrapChars / totalEstimatedChars) * 100) : 0,
         toolCount: mergedCustomTools.length,
         isFirstMessage: deps.isFirstMessageInSession ?? false,
         hasSpawnPacket: !!deps.spawnPacket,
@@ -809,5 +1546,5 @@ export async function assembleExecutionPrompt(params) {
             });
         }
     }
-    return { systemPrompt, systemPromptBlocks, dynamicPreamble, inlineMemory };
+    return { systemPrompt, systemPromptBlocks, dynamicPreamble, inlineMemory, recalledMemories, userLanguage };
 }