dsh-switchman 1.11.5 → 1.11.7

package/host/context-trim/state.js

@@ -523,8 +523,9 @@ export function ledgerFoldedTokens(messages, ledger) {
 }
 
 /** Ladder census of one ledger: the ACTIVE tier-1 and tier-2 populations
- * (id + summary mass estimate + approxTokens) the trigger and the ladder
- * ship pass read. Pure; never throws. */
+ * (id + summary mass estimate + approxTokens). Test/inspection helper —
+ * NOT read by the trigger: production uses index.js ladderRunsOf, which
+ * also collects tier-3 runs for T3 planning. Pure; never throws. */
 export function ladderCensusOf(ledger, countTokens = null) {
 	const estimate = typeof countTokens === "function"
 		? countTokens

package/host/context-trim/surface.js

@@ -84,7 +84,7 @@
  * and every no-op with pending work is logged to decisions.log.
  */
 
-import { refOf, summaryMessageOf } from "./view.js";
+import { refOf, summaryMessageOf, isFoldSummaryMessage, FOLD_SUMMARY_ID_PREFIX } from "./view.js";
 
 /** Ladder-block probe (tier ≥ 2): a distillation whose surface material is
  * the REPLACEMENT NODES of its consumed blocks, not a raw ref range. */
@@ -545,6 +545,147 @@ export function createSurfaceFoldPass(deps = {}) {
 		}
 	}
 
+	function nudgeTextOf(message) {
+		try {
+			const content = message?.content;
+			if (typeof content === "string") return content;
+			if (!Array.isArray(content)) return "";
+			return content.map((part) => typeof part?.text === "string" ? part.text : "").join("");
+		} catch {
+			return "";
+		}
+	}
+	let nudgeCounter = 0; // unique suffix per speak: colliding explicit ids would collide in ref resolution
+	function nudgeMessage(sessionId, text) {
+		const token = String(sessionId ?? "").replace(/[^A-Za-z0-9_-]/gu, "_").slice(0, 128) || "session";
+		return {
+			id: "trim_nudge_" + token + "_" + (++nudgeCounter),
+			role: "user",
+			content: [{ type: "text", text: String(text ?? "") }],
+			source: { kind: "user" },
+		};
+	}
+	/** Surface nudge availability excludes sessions with an open compaction pair. */
+	function nudgeSupported(sessionId) {
+		try {
+			const session = sessionOf(sessionId);
+			return surfaceCapable(session) && !lockOpenCached(sessionId, session);
+		} catch {
+			return false;
+		}
+	}
+	/** Append one advisory nudge as a suffix-only user message. Returns
+	 * { seq, error }: seq is null when the host rejected the append, and error
+	 * carries the rejection message so the skip row can name the real cause
+	 * (a bare append-failed row once hid a v4 turn-discipline rejection). */
+	function nudgeAppend(sessionId, text) {
+		const session = sessionOf(sessionId);
+		if (!surfaceCapable(session)) return { seq: null, error: null };
+		try {
+			const event = session.append("user/message", nudgeMessage(sessionId, text), { surfaceOp: "append" });
+			return { seq: Number.isFinite(event?.seq) ? event.seq : null, error: null };
+		} catch (error) {
+			return { seq: null, error: String(error?.message ?? error) };
+		}
+	}
+	/** Prune advisory nudge nodes with point-sized compaction events. Only
+	 * seqs still live on the surface are pruned: a fold may already have
+	 * consumed one, and re-shadowing a vanished seq fails the v4 validator.
+	 * Each seq gets its own prune event (start === end) so a non-contiguous
+	 * set can never cover unlisted live turns — matching the contiguous
+	 * range/seq pairing of the ladder and T1 passes. The metering prune is
+	 * paired with its replacement (shadow-price protocol, mirroring the
+	 * host's compaction-tool-result-pruner): the surfaceOp replace on the
+	 * replacement is what actually retires the node from surface.nodes —
+	 * a bare compaction/prune never moves the live surface, so without
+	 * the pair the same nudge was re-found and re-pruned on EVERY boundary
+	 * (one duplicate fold-marker event per step, 2026-11-14). */
+	/** Retired-nudge stub: id and text intentionally miss both nudgeScan
+	 * signatures (id prefix "trim_nudge_", text prefix "[SWITCHMAN:TRIM]
+	 * Advisory nudge") so a retired stub is never re-discovered. */
+	function retiredNudgeMessage(sessionId) {
+		const token = String(sessionId ?? "").replace(/[^A-Za-z0-9_-]/gu, "_").slice(0, 128) || "session";
+		return {
+			id: "trim_retired_nudge_" + token + "_" + (++nudgeCounter),
+			role: "user",
+			content: [{ type: "text", text: "[SWITCHMAN:TRIM] (advisory nudge retired — pressure is back below the fold line)" }],
+			source: { kind: "user" },
+		};
+	}
+	function nudgePrune(sessionId, seqs) {
+		try {
+			const session = sessionOf(sessionId);
+			if (!surfaceCapable(session) || !Array.isArray(seqs)) return false;
+			const nodes = session.surface.nodes;
+			if (!Array.isArray(nodes)) return false;
+			const live = [...new Set(seqs.filter((seq) => Number.isFinite(seq)))].filter((seq) => nodes.includes(seq));
+			if (live.length === 0) return true; // already consumed by a fold: nothing to undo
+			if (live.includes(nodes[0])) {
+				let headEvent;
+				try {
+					headEvent = typeof session.eventAt === "function" ? session.eventAt(nodes[0]) : undefined;
+				} catch {
+					headEvent = undefined;
+				}
+				const headMessage = headEvent === undefined ? null : messageOfEvent(session, headEvent);
+				// Fail closed: an unreadable head node or the protected system head
+				// must never be shadowed ("compaction cannot shadow the protected
+				// system head").
+				if (headMessage === null || headMessage === undefined || headMessage.role === "system") return false;
+			}
+			for (const seq of live) {
+				const event = session.append("compaction/prune", {
+					shadowedRange: { start: seq, end: seq },
+					shadowedSeqs: [seq],
+					shadowedTokenCount: 1,
+				});
+				if (!Number.isFinite(event?.seq)) return false;
+				// Shadow-price pairing: the replacement — not the metering
+				// prune — retires the node from the live surface.
+				let retired;
+				try {
+					retired = session.append("user/message", retiredNudgeMessage(sessionId), {
+						surfaceOp: { op: "replace", startSeq: seq, endSeq: seq },
+						sourceEventSeqs: [seq],
+					});
+				} catch {
+					return false;
+				}
+				if (!Number.isFinite(retired?.seq)) return false;
+			}
+			return true;
+		} catch {
+			return false;
+		}
+	}
+	/** Find visible advisory nudges from the tail, bounded to recent surface nodes. */
+	function nudgeScan(sessionId) {
+		try {
+			const session = sessionOf(sessionId);
+			if (!surfaceCapable(session) || typeof session.eventAt !== "function") return [];
+			const nodes = session.surface.nodes;
+			const first = Math.max(0, nodes.length - 50);
+			const found = [];
+			for (let index = nodes.length - 1; index >= first; index--) {
+				const seq = nodes[index];
+				let event;
+				try {
+					event = session.eventAt(seq);
+				} catch {
+					continue;
+				}
+				const message = event === undefined ? null : messageOfEvent(session, event);
+				if (message === null || message === undefined) continue;
+				const hasNudgeId = typeof message.id === "string" && message.id.startsWith("trim_nudge_");
+				const hasNudgeText = nudgeTextOf(message).startsWith("[SWITCHMAN:TRIM] Advisory nudge");
+				if (hasNudgeId || hasNudgeText) found.push(seq);
+			}
+			return found;
+		} catch {
+			return [];
+		}
+	}
+
 	/** In-memory idempotence belt over the durable block marker: the same
 	 * (session, range, contentGeneration) is never replaced twice even if a
 	 * crash lost the ledger persist. Bounded like the other registries. */
@@ -612,6 +753,21 @@ export function createSurfaceFoldPass(deps = {}) {
 		return mark !== null && typeof mark === "object" && typeof mark.reason === "string" && mark.reason !== "" ? mark : null;
 	}
 
+	/** Terminal supersede test: EVERY captured event seq has left the live
+	 * surface, so the fold's material is already off the wire (host
+	 * compaction consumed the range, or an earlier ship whose marker was
+	 * later lost). Such a capture can never validate again —
+	 * the block terminates as surfaceSuperseded instead of living forever
+	 * in the generation-keyed incomplete-seqs retry loop. */
+	function captureFullyShadowed(nodes, block) {
+		// An unreadable/empty surface is fail-safe: nothing is proven gone,
+		// so never terminalize on it (a valid block would be lost forever).
+		if (!Array.isArray(nodes) || nodes.length === 0) return false;
+		if (!Array.isArray(block?.surfaceSeqs) || block.surfaceSeqs.length === 0) return false;
+		const live = new Set(nodes);
+		return block.surfaceSeqs.every((seq) => !live.has(seq));
+	}
+
 	/** One no-op row (only when the pass had pending work — a vacuous sweep
 	 * with nothing to ship stays silent, matching the early-return style of
 	 * the fold cycle's own action=none rows). Whole-pass reasons (disabled /
@@ -657,6 +813,8 @@ export function createSurfaceFoldPass(deps = {}) {
 		})();
 		const pending = blocks.filter((block) => {
 			if (block?.surfaceReplaced !== null && block?.surfaceReplaced !== undefined) return false;
+			// Terminal supersede (see captureFullyShadowed): never pending again.
+			if (block?.surfaceSuperseded !== null && block?.surfaceSuperseded !== undefined) return false;
 			const tomb = tombstoneOf(block);
 			if (tomb === null) return true;
 			// Re-open only when the surface content changed since the skip.
@@ -720,6 +878,21 @@ export function createSurfaceFoldPass(deps = {}) {
 				}
 				const waiting = consumed.find((entry) => entry.surfaceReplaced === null || entry.surfaceReplaced === undefined);
 				if (waiting !== undefined) {
+					if (waiting?.surfaceSuperseded !== null && waiting?.surfaceSuperseded !== undefined) {
+						// The consumed block's material left the surface entirely: its
+						// replacement node can never materialize, so the distillation
+						// is terminal too (same proof as the T1 supersede — no
+						// generation-keyed retry can revive either block).
+						block.surfaceSuperseded = { reason: "ladder-consumed-superseded", at: Date.now() };
+						delete block.surfaceSkip;
+						try {
+							store.persist(ledger);
+						} catch {
+							/* best effort */
+						}
+						skip(sessionId, "superseded-ladder-consumed", via, `block=${block.id} consumed=${waiting.id}`, false);
+						continue;
+					}
 					if (tombstoneOf(waiting) !== null) {
 						// A consumed block is hard-skipped on this generation: its
 						// replacement node can never materialize, so the ladder span
@@ -753,7 +926,7 @@ export function createSurfaceFoldPass(deps = {}) {
 				const idIndexOf = new Map();
 				for (let i = 0; i < nodeMessages.length; i++) {
 					const message = nodeMessages[i];
-					if (message !== null && typeof message === "object" && typeof message.id === "string" && message.id.startsWith("acp_summary_")) {
+					if (isFoldSummaryMessage(message)) {
 						idIndexOf.set(message.id, i);
 					}
 				}
@@ -765,7 +938,7 @@ export function createSurfaceFoldPass(deps = {}) {
 						atSeqs.push(atSeq);
 						continue;
 					}
-					const relocatedIdx = idIndexOf.get(`acp_summary_${entry.id}`);
+					const relocatedIdx = idIndexOf.get(`${FOLD_SUMMARY_ID_PREFIX}${entry.id}`);
 					if (relocatedIdx === undefined) {
 						unresolved = entry;
 						break;
@@ -795,7 +968,7 @@ export function createSurfaceFoldPass(deps = {}) {
 				// picked up a stranger's acp_summary node is not this fold's
 				// material (the length check alone cannot tell them apart).
 				if (spanExact) {
-					const expectedIds = new Set(consumed.map((entry) => `acp_summary_${entry.id}`));
+				const expectedIds = new Set(consumed.map((entry) => `${FOLD_SUMMARY_ID_PREFIX}${entry.id}`));
 					for (let i = ladderFirstIdx; i <= ladderLastIdx; i++) {
 						const message = nodeMessages[i];
 						if (message === null || message === undefined || typeof message.id !== "string" || !expectedIds.has(message.id)) {
@@ -807,7 +980,7 @@ export function createSurfaceFoldPass(deps = {}) {
 				if (spanExact) {
 					for (let i = ladderFirstIdx; i <= ladderLastIdx; i++) {
 						const message = nodeMessages[i];
-						if (message === null || message === undefined || typeof message.id !== "string" || !message.id.startsWith("acp_summary_")) {
+					if (!isFoldSummaryMessage(message)) {
 							spanExact = false;
 							break;
 						}
@@ -906,6 +1079,23 @@ export function createSurfaceFoldPass(deps = {}) {
 				const located = locateOnSurface(pairs, block);
 				if (located === null) {
 					if (Array.isArray(block.surfaceSeqs)) {
+						if (captureFullyShadowed(nodes, block)) {
+							// Every captured seq has left the live surface: the range was
+							// already shadowed wholesale (host compaction, a prior ship
+							// whose marker was later lost). The material is
+							// off the wire and this capture can never validate again —
+							// terminate the block instead of re-tombstoning it on every
+							// generation bump (the pending filter drops it for good).
+							block.surfaceSuperseded = { reason: "shadowed", at: Date.now() };
+							delete block.surfaceSkip;
+							try {
+								store.persist(ledger);
+							} catch {
+								/* best effort */
+							}
+							skip(sessionId, "superseded-shadowed", via, `block=${block.id}`, false);
+							continue;
+						}
 						block.surfaceSkip = { reason: "incomplete-seqs", contentGeneration: liveGeneration, at: Date.now() };
 						skip(sessionId, "incomplete-seqs", via, `block=${block.id}`, false);
 					} else {
@@ -930,6 +1120,23 @@ export function createSurfaceFoldPass(deps = {}) {
 						&& nodes[located[0]] === storedFirst
 						&& nodes[located[1]] === storedLast;
 					if (!endpointsMatch) {
+						if (captureFullyShadowed(nodes, block)) {
+							// Every captured seq has left the live surface: the range was
+							// already shadowed wholesale (host compaction, a prior ship
+							// whose marker was later lost). The material is
+							// off the wire and this capture can never validate again —
+							// terminate the block instead of re-tombstoning it on every
+							// generation bump (the pending filter drops it for good).
+							block.surfaceSuperseded = { reason: "shadowed", at: Date.now() };
+							delete block.surfaceSkip;
+							try {
+								store.persist(ledger);
+							} catch {
+								/* best effort */
+							}
+							skip(sessionId, "superseded-shadowed", via, `block=${block.id} relocated-range`, false);
+							continue;
+						}
 						block.surfaceSkip = { reason: "incomplete-seqs", contentGeneration: liveGeneration, at: Date.now() };
 						skip(sessionId, "incomplete-seqs", via, `block=${block.id} relocated-range`, false);
 						continue;
@@ -1127,7 +1334,11 @@ export function createSurfaceFoldPass(deps = {}) {
 				const sessionId = sessionIdOfAgent(payload?.agent);
 				if (sessionId === null) return;
 				const hint = payload?.agent !== null && typeof payload?.agent === "object" ? payload.agent.session : null;
-				void sweep(sessionId, "turn-stopping", hint);
+				void sweep(sessionId, "turn-stopping", hint).catch(() => {
+					/* sweep is fire-and-forget on this boundary; a rejection must not
+					   surface as an unhandledRejection (the listener's own try only
+					   covers synchronous throws — async rejects bypass it). */
+				});
 			} catch {
 				/* listener must never throw */
 			}
@@ -1136,5 +1347,5 @@ export function createSurfaceFoldPass(deps = {}) {
 		warn(`[context-trim] agent/turn-stopping hook failed: ${error?.message ?? error}`);
 	}
 
-	return { sweep, captureFoldSeqs, enabledNow, supported };
+	return { sweep, captureFoldSeqs, enabledNow, supported, nudgeSupported, nudgeAppend, nudgePrune, nudgeScan };
 }

package/host/context-trim/trigger.js

@@ -32,7 +32,7 @@
  * which keeps the decision unit-testable (golden thresholds).
  */
 
-import { estimateTokensOf, refPositions, segmentBounds } from "./view.js";
+import { estimateTokensOf, isFoldSummaryMessage, refPositions, segmentBounds } from "./view.js";
 
 /** Hard minimum wall-clock interval between side-model folds. */
 export const FOLD_MIN_INTERVAL_MS = 60_000;
@@ -50,10 +50,16 @@ export const LADDER_MIN_INTERVAL_MS = 120_000;
  * first segment boundary strictly after the frontier AND after the task
  * intent (the first user message — bili's protected zone: the session's
  * opening task statement is never folded) to the last segment end that
- * still clears the protected tail. Returns { startIdx, endIdx } or null
- * when nothing is foldable (empty history, everything folded, or
- * protected tail covers it all). */
-export function computeFoldableRange(messages, ledger, protectedTail) {
+ * still clears the protected tail. Prior fold summaries (acp_summary_*,
+ * which the surface pass relocates right after the intent segment) are
+ * NEVER inside the range: they stay live on the surface and consolidate
+ * only through ladder T2/T3 distillation. This exclusion is load-bearing —
+ * the frontier message is itself shadowed once its fold ships, so without
+ * it the fallback start slid onto the last summary and every later fold
+ * re-absorbed the previous summary (the rolling-absorb regression).
+ * Returns { startIdx, endIdx } or null when nothing is foldable (empty
+ * history, everything folded, or protected tail covers it all). */
+export function computeFoldableRange(messages, ledger, protectedTail, options = {}) {
 	if (!Array.isArray(messages) || messages.length === 0) return null;
 	const tail = Number.isInteger(protectedTail) && protectedTail > 0 ? protectedTail : 0;
 	const tailStart = messages.length - tail;
@@ -75,19 +81,30 @@ export function computeFoldableRange(messages, ledger, protectedTail) {
 	// Task-intent protection: the first user message states the task; the
 	// segment containing it is never folded (its summary would become the
 	// only carrier of the task for the rest of the session — the dominant
-	// early-drift failure this guard prevents).
-	const firstUserIdx = messages.findIndex((message) => message?.role === "user");
-	if (firstUserIdx >= 0) {
-		for (const [start, end] of segmentBounds(messages)) {
-			if (start <= firstUserIdx && firstUserIdx <= end) {
-				startFrom = Math.max(startFrom, end + 1);
-				break;
+	// early-drift failure this guard prevents). Opt-out: trimProtectTaskIntent
+	// =false lets the intent segment fold like any other raw content; the
+	// system-head clamp above is unaffected — it applies only when the head is actually a system message.
+	if (options?.protectTaskIntent !== false) {
+		const firstUserIdx = messages.findIndex((message) => message?.role === "user");
+		if (firstUserIdx >= 0) {
+			for (const [start, end] of segmentBounds(messages)) {
+				if (start <= firstUserIdx && firstUserIdx <= end) {
+					startFrom = Math.max(startFrom, end + 1);
+					break;
+				}
 			}
 		}
 	}
 	let best = null;
 	for (const [start, end] of segmentBounds(messages)) {
 		if (start < startFrom) continue; // behind the frontier / intent
+		if (isFoldSummaryMessage(messages[start])) {
+			// A summary is its own segment (plain user message, no tool pair).
+			// Ahead of the first raw segment: skip the summary run. After raw
+			// segments have begun: stop — never bridge a span across one.
+			if (best !== null) break;
+			continue;
+		}
 		if (end >= tailStart) break; // segment would cut into the protected tail
 		if (best === null) best = { startIdx: start, endIdx: end };
 		else best.endIdx = end; // extend the contiguous span

package/host/context-trim/view.js

@@ -250,18 +250,33 @@ export function renderSummaryText(block) {
 	return `[SWITCHMAN:TRIM] ${block.summary}`;
 }
 
+/** Wire-id prefix of every fold-summary synthetic message. The single
+ * definition: summaryMessageOf builds ids from it, isFoldSummaryMessage
+ * recognizes them, and ladder relocation re-derives the same ids. */
+export const FOLD_SUMMARY_ID_PREFIX = "acp_summary_";
+
 /** The ONE synthetic message replacing a folded range (brief: synthetic
  * user message; id carries the acp_summary_ prefix downstream tooling
  * skips). Pure — same block, same bytes. The ladder replaces messages BY
  * this id (id-suffix = block id), which is why ids must stay stable. */
 export function summaryMessageOf(block) {
 	return {
-		id: `acp_summary_${block.id}`,
+		id: `${FOLD_SUMMARY_ID_PREFIX}${block.id}`,
 		role: "user",
 		content: [{ type: "text", text: renderSummaryText(block) }],
 	};
 }
 
+/** True when one wire message is a prior fold's synthetic summary
+ * (acp_summary_<blockId>). Recognition rides the id prefix only — never
+ * the source kind (the v4 validator rejects compact-checkpoint sources
+ * outside a compaction/start..end pair). Range selection and the advisory
+ * fold tool use this to KEEP summaries out of new raw folds: summaries
+ * stay live on the surface and consolidate only through ladder T2/T3. */
+export function isFoldSummaryMessage(message) {
+	return typeof message?.id === "string" && message.id.startsWith(FOLD_SUMMARY_ID_PREFIX);
+}
+
 /** Locate a block's range in a positions map at/after afterIdx. Strict:
  * both endpoint refs must resolve and the located span must equal the
  * block's stored message count (guards against re-sent histories that no
@@ -310,7 +325,7 @@ function locateBlock(positions, block, afterIdx) {
  * -> index, for every synthetic message. One index per id (a block renders
  * at most once — single consumption). */
 function summaryPositionsOf(messages) {
-	const prefix = "acp_summary_";
+	const prefix = FOLD_SUMMARY_ID_PREFIX;
 	const positions = new Map();
 	messages.forEach((message, index) => {
 		const id = message?.id;

package/host/context-watch.js

@@ -136,8 +136,8 @@ function isRoot(ctx, agent) {
 function readThresholds(config) {
 	return {
 		soft: readNumber(config.wmSoftTokens, 80000),
-		hard: readNumber(config.wmHardTokens, 95000),
-		force: readNumber(config.wmForceTokens, 150000),
+		hard: readNumber(config.wmHardTokens, 100000),
+		force: readNumber(config.wmForceTokens, 200000),
 	};
 }
 
@@ -154,8 +154,9 @@ export function measureNow(ctx, agent) {
 		// longer receives — high bias), while the bare view never counts the
 		// system/tool sections (low bias). max(view, wire) fixes both and puts
 		// the watermark tiers (soft/hard/force + read budget) on the SAME
-		// boundary as the fold engine — wmHardTokens 95k ≈ trim pressure
-		// 97.5k (65% of the 150k window) — holds in units, not just in
+		// boundary as the fold engine — wmHardTokens 100k = trimAdvisoryPercent
+		// 50% × the 200k cap, and wmForceTokens 200k = the cap itself — holds
+		// in units, not just in
 		// numbers. Strictly additive +
 		// fail-open: any trim failure falls back to the stored measure.
 		try {
@@ -207,7 +208,11 @@ const PAUSED_LINE =
 function renderRootWatermark(level, status) {
 	if (level === "ok") return "";
 	if (level === "soft") return "[SWITCHMAN:WATERMARK] soft tier: prefer delegating lightweight work (subagent/workflow) over reading more context yourself.";
-	if (level === "hard") return "[SWITCHMAN:WATERMARK] hard tier: stop broad reading (read/glob/grep are budget-limited this turn) and start wrapping up.";
+	if (level === "hard")
+		return (
+			"[SWITCHMAN:WATERMARK] hard tier: stop broad reading (read/glob/grep are budget-limited this turn) and start wrapping up. " +
+			"If a fold or handover was committed within the last turn, this tier may reflect pre-fold pressure — the next turn carries the reduced history; do not re-verify with broad reads."
+		);
 	const lines = ["[SWITCHMAN:WATERMARK] force tier: MANDATORY wrap-up now — produce the final answer from what you already hold."];
 	const phase = status?.phase;
 	if (phase === "backup") {
@@ -276,7 +281,11 @@ function subagentWindowTokens(ctx, state, sessionId) {
 async function primeSubagentWindow(ctx, state, route, key) {
 	try {
 		const llm = ctx.get?.("llm", false);
-		const info = await llm?.resolveModelInfo?.({ provider: route.provider, model: route.model });
+		// Host contract: resolveModelInfo(provider, model) takes TWO strings. The
+		// object shape threw NO_ADAPTER and subagent window scaling silently fell
+		// back to static tiers (found 2026-11-14; same contract every other
+		// call site already follows).
+		const info = await llm?.resolveModelInfo?.(route.provider, route.model);
 		const windowTokens = info?.context?.contextWindow;
 		const value = Number.isFinite(windowTokens) && windowTokens > 0 ? windowTokens : null;
 		state.subWindow.set(key, { value, at: Date.now() });
@@ -900,7 +909,7 @@ function applyContextWatch(ctx, config) {
 			if (sessionId !== null && ACCOUNT_TOOLS.has(exec?.name ?? "")) {
 				const entry = accountRead(state, sessionId, resultTokens(result));
 				if (GATED_TOOLS.has(exec.name) && !state.paused.has(sessionId)) {
-					const budget = readNumber(config.wmReadBudgetTokens, 3000);
+					const budget = readNumber(config.wmReadBudgetTokens, 3500);
 					const ceiling = budget * CEILING_MULTIPLE;
 					const used = measureNow(ctx, exec.agent);
 					const th = readThresholds(config);
@@ -946,7 +955,7 @@ function applyContextWatch(ctx, config) {
 			if (!GATED_TOOLS.has(exec?.name ?? "")) return next();
 			const sessionId = sessionIdOf(exec?.agent);
 			if (sessionId === null || state.paused.has(sessionId)) return next();
-			const budget = readNumber(config.wmReadBudgetTokens, 3000);
+			const budget = readNumber(config.wmReadBudgetTokens, 3500);
 			if (turnUsed(state, sessionId) < budget * CEILING_MULTIPLE) return next();
 			const used = measureNow(ctx, exec.agent);
 			if (used === null) return next();

package/host/intent.js

@@ -144,9 +144,9 @@ function routeOf(value) {
  *  handover off the user's raw window is respected as-is — they opted out
  *  of the handover pipeline, so the 0.8 line may sit wherever they put it. */
 export function effectiveContextWindow(config) {
-	const user = Math.max(1024, Math.round(readNumber(config.intentContextWindow, 200000)));
+	const user = Math.max(1024, Math.round(readNumber(config.intentContextWindow, 250000)));
 	if (!readBool(config.wmAutoHandover)) return user;
-	const floor = Math.ceil(readNumber(config.wmForceTokens, 150000) / 0.8);
+	const floor = Math.ceil(readNumber(config.wmForceTokens, 200000) / 0.8);
 	return Math.max(user, floor);
 }
 
@@ -553,6 +553,38 @@ async function classifyOnce(ctx, config, route, system, input, turnSignal) {
 	}
 }
 
+/** Whether a classifier endpoint URL may receive conversation excerpts.
+ *  The systemone channel is meant for a LOCAL/LAN decision endpoint
+ *  (ollama); an arbitrary URL would turn the setting into an
+ *  exfiltration channel — any settings writer could aim the per-turn
+ *  excerpt (recent conversation text) at a public server. Allowed:
+ *  http/https URLs whose host is loopback (localhost, 127/8, ::1) or
+ *  private-network (RFC1918 10/8, 172.16/12, 192.168/16, link-local
+ *  169.254/16, fe80::/10, unique-local fc00::/7). Everything else is
+ *  rejected before any byte leaves the process; the classifier then
+ *  fails open to the fallback chain. Exported for tests. */
+export function isAllowedClassifierEndpoint(endpoint) {
+	if (typeof endpoint !== "string") return false;
+	let url;
+	try {
+		url = new URL(endpoint.trim());
+	} catch {
+		return false;
+	}
+	if (url.protocol !== "http:" && url.protocol !== "https:") return false;
+	const host = url.hostname.toLowerCase().replace(/^\[|\]$/gu, "");
+	if (host === "localhost" || host.endsWith(".localhost") || host.endsWith(".local")) return true;
+	const parts = host.split(".");
+	if (parts.length === 4 && parts.every((p) => /^\d{1,3}$/u.test(p))) {
+		const octets = parts.map(Number);
+		if (octets.some((n) => n > 255)) return false;
+		const [a, b] = octets;
+		return a === 127 || a === 10 || (a === 172 && b >= 16 && b <= 31) || (a === 192 && b === 168) || (a === 169 && b === 254);
+	}
+	// IPv6 (brackets stripped): loopback, link-local fe80::/10, unique-local fc00::/7.
+	return host === "::1" || host.startsWith("fe80:") || /^[fF][cCdD][0-9a-fA-F]{2}:/.test(host);
+}
+
 /**
  * Classify via an ollama /v1/systemone decision endpoint (direct HTTP —
  * no llm-service provider registration needed; the model name comes from
@@ -567,6 +599,8 @@ async function classifyOnce(ctx, config, route, system, input, turnSignal) {
 export async function classifySystemone(ctx, config, candidates, current, excerpt, turnSignal) {
 	const endpoint = readField(config.intentClassifierEndpoint).trim();
 	if (endpoint === "") throw new Error("systemone endpoint unset (intentClassifierEndpoint)");
+	if (!isAllowedClassifierEndpoint(endpoint))
+		throw new Error(`systemone endpoint refused (loopback/private URLs only): ${endpoint}`);
 	const model = readField(config.intentClassifierSystemoneModel).trim();
 	if (model === "") throw new Error("systemone model unset (intentClassifierSystemoneModel)");
 	if (candidates.length === 0) throw new Error("no candidates");
@@ -603,6 +637,9 @@ export async function classifySystemone(ctx, config, candidates, current, excerp
 	const signal = turnSignal instanceof AbortSignal ? AbortSignal.any([controller.signal, turnSignal]) : controller.signal;
 	try {
 		signal.throwIfAborted();
+		// Auditable egress record: the classifier ships a conversation excerpt
+		// off-process — every send is logged with the destination host.
+		ctx?.logger?.info?.(`dsh-switchman: intent systemone classifier POST ${new URL(endpoint).host} (excerpt ~${excerpt.length} chars)`);
 		const response = await fetch(endpoint, {
 			method: "POST",
 			headers: { "Content-Type": "application/json" },
@@ -766,7 +803,7 @@ export async function intentStateOf(ctx, config, sessionId = null) {
 			}
 		}
 	}
-	const forceTokens = readNumber(config.wmForceTokens, 150000);
+	const forceTokens = readNumber(config.wmForceTokens, 200000);
 	return {
 		enabled,
 		autoSelected: selection?.provider === AUTO_PROVIDER,
@@ -774,7 +811,7 @@ export async function intentStateOf(ctx, config, sessionId = null) {
 		// catalog route must not mark the feature unconfigured.
 		configured:
 			(kind === "systemone"
-				? readField(config.intentClassifierEndpoint).trim() !== "" &&
+				? isAllowedClassifierEndpoint(readField(config.intentClassifierEndpoint).trim()) &&
 					readField(config.intentClassifierSystemoneModel).trim() !== ""
 				: classifier !== null) &&
 			candidates.length > 0,

package/host/lang.js

@@ -55,10 +55,12 @@ const PROJECT_FILE = "lang.json";
 /** How long a cached settings-describe locale stays fresh (ms). */
 const LOCALE_CACHE_MS = 10_000;
 
-/** Normalize one language value: trim and bound the length; anything else → null. */
+/** Normalize one language value: trim, collapse internal whitespace (newlines
+ *  would break the single-line [SWITCHMAN:LANG] anchor and could smuggle extra
+ *  protocol lines into the system prompt), bound the length; anything else → null. */
 function normalizeLangValue(value) {
 	if (typeof value !== "string") return null;
-	const trimmed = value.trim();
+	const trimmed = value.trim().replace(/\s+/gu, " ");
 	if (trimmed.length === 0 || trimmed.length > MAX_LANG_LEN) return null;
 	return trimmed;
 }