gentle-pi 3.7.0 → 4.0.0

package/bin/gentle-shell.mjs

@@ -6,10 +6,12 @@
 // process, filesystem, and child process.
 import {
 	accessSync,
+	chmodSync,
 	closeSync,
 	constants as fsConstants,
 	existsSync,
 	mkdirSync,
+	mkdtempSync,
 	openSync,
 	readdirSync,
 	readFileSync,
@@ -19,8 +21,7 @@ import {
 	statSync,
 	writeFileSync,
 } from "node:fs";
-import { createRequire } from "node:module";
-import { constants as osConstants, homedir } from "node:os";
+import { constants as osConstants, homedir, tmpdir } from "node:os";
 import { delimiter, dirname, join, resolve as resolvePath } from "node:path";
 import { spawn, spawnSync } from "node:child_process";
 import { fileURLToPath } from "node:url";
@@ -53,6 +54,13 @@ import {
 	restoreJsonField,
 	shellQuote,
 } from "../runtime/gentle-shell-launcher.mjs";
+import {
+	parseResumeHandoff,
+	planResumeHint,
+	RESUME_HANDOFF_DIR_PREFIX,
+	RESUME_HANDOFF_ENV,
+	RESUME_HANDOFF_FILE,
+} from "../runtime/gentle-shell-resume-hint.mjs";
 import { GENTLE_AI_VERSION, gentleAiBinaryPath, PackageLocalGentleAiBinaryMissingError } from "../runtime/gentle-ai-binary.mjs";
 import { DEFAULT_THEME_NAME, installIsolatedTuiModeSetting } from "../scripts/install-tui-mode-setting.mjs";
 
@@ -72,17 +80,30 @@ function readJsonIfExists(path) {
 	}
 }
 
-// @earendil-works/pi-coding-agent ships as an optional peer dependency: it may
-// not be installed at all, so a resolution failure here is expected, not an error.
+// Resolve the public ESM entry without importing the agent or reaching through
+// its exports map. Only an absent optional peer permits PATH fallback; malformed
+// installed metadata must not silently select a different runtime.
 function resolveBundledCli() {
+	let publicEntry;
 	try {
-		const require = createRequire(import.meta.url);
-		const pkgJsonPath = require.resolve("@earendil-works/pi-coding-agent/package.json");
-		const cliPath = join(dirname(pkgJsonPath), "dist", "bundle", "cli.js");
-		return existsSync(cliPath) ? cliPath : undefined;
-	} catch {
-		return undefined;
+		publicEntry = fileURLToPath(import.meta.resolve("@earendil-works/pi-coding-agent"));
+	} catch (error) {
+		if (error.code === "ERR_MODULE_NOT_FOUND") return undefined;
+		throw error;
 	}
+	const entry = realpathSync(publicEntry);
+	const root = dirname(dirname(entry));
+	const expectedEntry = join(root, "dist", "index.js");
+	const metadata = JSON.parse(readFileSync(join(root, "package.json"), "utf8"));
+	if (entry !== expectedEntry || metadata.name !== "@earendil-works/pi-coding-agent" ||
+		metadata.bin?.pi !== "dist/bundle/cli.js") {
+		throw new Error("Unsupported adjacent Pi package entry/name/bin metadata");
+	}
+	const cliPath = join(root, metadata.bin.pi);
+	if (realpathSync(cliPath) !== cliPath || !statSync(cliPath).isFile()) {
+		throw new Error("Unsupported adjacent Pi CLI path");
+	}
+	return cliPath;
 }
 
 function findOnPath(name) {
@@ -162,6 +183,45 @@ function isDirectory(path) {
 	}
 }
 
+// Reuse Herdr's managed bridge, never its transport. This process-boundary
+// lookup is deliberately best-effort and does not modify either agent home.
+function managedHerdrExtensionArgs(home, args) {
+	const env = process.env;
+	if (home.mode !== "isolated" || args.piSubcommand !== undefined || args.passthrough[0] === "mcp") return [];
+	if (env.HERDR_ENV !== "1" || !env.HERDR_SOCKET_PATH?.trim() || !env.HERDR_PANE_ID?.trim()) return [];
+	if (env.GENTLE_PI_AGENTS_CHILD === "1" || !process.stdin.isTTY || !process.stdout.isTTY) return [];
+	// Only automatic interactive loading: a user opt-out must not become an
+	// explicit -e (which Pi loads even under --no-extensions). Conservatively
+	// skip ambiguous mode flags too; --mode text alone still allows a TUI.
+	const forwarded = args.passthrough;
+	if (forwarded.some((arg) => ["--no-extensions", "-ne", "--print", "-p", "--export", "--list-models", "-v"].includes(arg))) return [];
+	if (forwarded.some((arg, i) => (arg === "--mode" && forwarded[i + 1] !== "text") || arg.startsWith("--mode="))) return [];
+	try {
+		if (!statSync(env.HERDR_SOCKET_PATH).isSocket()) return [];
+	} catch {
+		return [];
+	}
+	// Prefer a bridge in the selected home over adding a competing copy; keep
+	// the incoming Pi home override before falling back to Herdr's usual home.
+	const agentHomes = [home.dir, env.PI_CODING_AGENT_DIR, join(homedir(), ".pi", "agent")];
+	for (const agentHome of agentHomes) {
+		if (!agentHome) continue;
+		const bridge = join(agentHome, "extensions", "herdr-agent-state.ts");
+		try {
+			if (!statSync(bridge).isFile()) continue;
+			accessSync(bridge, fsConstants.R_OK);
+			// Pi's package-manager.toResolvedPaths and resource-loader.mergePaths
+			// dedupe canonical files across discovery, explicit -e and manifests.
+			// Existence alone is NOT proof of loading: declare the resource and
+			// let that resolver dedupe it, including explicit aliases from argv.
+			return ["-e", realpathSync(bridge)];
+		} catch {
+			// An absent/unreadable bridge never prevents the ordinary launch.
+		}
+	}
+	return [];
+}
+
 // Real-fs adapter for discoverLooseExtensionEntries (lib/gentle-shell-launcher.ts):
 // statSync-based isFile/isDirectory (not readdirSync's Dirent, which uses
 // lstat and so would treat a symlinked file or directory as neither) so a
@@ -254,9 +314,46 @@ function readRawConfig(configPath) {
 function writeRawConfig(configPath, config) {
 	const configDir = dirname(configPath);
 	if (!existsSync(configDir)) mkdirSync(configDir, { recursive: true, mode: 0o700 });
-	const tempPath = join(configDir, `.${basenameOf(configPath)}.gentle-shell-${process.pid}.tmp`);
-	writeFileSync(tempPath, `${JSON.stringify(config, null, 2)}\n`, "utf8");
-	renameSync(tempPath, configPath);
+	writeFileAtomically(configPath, `${JSON.stringify(config, null, 2)}\n`);
+}
+
+// The one atomic write every launcher-owned config/settings update goes
+// through: a temp file next to the real target, then a rename onto it, so a
+// crash or kill never leaves a partial file. When `path` is a symlink (Nix
+// home-manager, stow, and similar dotfile managers ship settings.json and
+// config.json that way), the write lands on the link's real target and the
+// link itself stays in place; renaming onto `path` would replace the link
+// with a regular file. A missing path or a dangling link has no real target
+// to preserve, so it is written at `path` itself, exactly as before this
+// helper existed, instead of creating a file wherever a dangling link points.
+// The permission bits are `mode` when given, otherwise the real target's own
+// (applied with chmod, so the umask cannot narrow them); a new file keeps
+// the default creation mode. The temp file is removed when the write or
+// rename throws, and the error propagates to the caller's own handling.
+function writeFileAtomically(path, data, { mode } = {}) {
+	let target = path;
+	try {
+		target = realpathSync(path);
+	} catch (error) {
+		if (error.code !== "ENOENT") throw error;
+	}
+	let targetMode = mode;
+	if (targetMode === undefined) {
+		try {
+			targetMode = statSync(target).mode & 0o777;
+		} catch (error) {
+			if (error.code !== "ENOENT") throw error;
+		}
+	}
+	const tempPath = join(dirname(target), `.${basenameOf(target)}.gentle-shell-${process.pid}.tmp`);
+	try {
+		writeFileSync(tempPath, data);
+		if (targetMode !== undefined) chmodSync(tempPath, targetMode);
+		renameSync(tempPath, target);
+	} catch (error) {
+		rmSync(tempPath, { force: true });
+		throw error;
+	}
 }
 
 function loadConfig() {
@@ -512,9 +609,7 @@ function restoreFile(snapshot) {
 	}
 	if (currentBytes !== undefined && currentBytes.equals(snapshot.bytes)) return false;
 	mkdirSync(dirname(path), { recursive: true });
-	const tempPath = join(dirname(path), `.${basenameOf(path)}.gentle-shell-restore-${process.pid}.tmp`);
-	writeFileSync(tempPath, snapshot.bytes, { mode: snapshot.mode });
-	renameSync(tempPath, path);
+	writeFileAtomically(path, snapshot.bytes, { mode: snapshot.mode });
 	return true;
 }
 
@@ -574,10 +669,7 @@ function restoreManagedAssetDigestField(path, originalText) {
 	if (currentText === undefined) return false;
 	const restoredText = restoreJsonField(originalText, currentText, MANAGED_ASSET_DIGEST_FIELD);
 	if (restoredText === undefined) return false;
-	const mode = statSync(path).mode & 0o777;
-	const tempPath = join(dirname(path), `.${basenameOf(path)}.gentle-shell-restore-${process.pid}.tmp`);
-	writeFileSync(tempPath, restoredText, { mode });
-	renameSync(tempPath, path);
+	writeFileAtomically(path, restoredText);
 	return true;
 }
 
@@ -618,10 +710,7 @@ function enforceDefaultThemeField(settingsPath, originalSettingsText) {
 		? restoreJsonField(originalSettingsText, currentText, "theme")
 		: forceJsonFieldIfAbsentInOriginal(originalSettingsText, currentText, "theme", DEFAULT_THEME_NAME);
 	if (newText === undefined) return false;
-	const mode = statSync(settingsPath).mode & 0o777;
-	const tempPath = join(dirname(settingsPath), `.${basenameOf(settingsPath)}.gentle-shell-restore-${process.pid}.tmp`);
-	writeFileSync(tempPath, newText, { mode });
-	renameSync(tempPath, settingsPath);
+	writeFileAtomically(settingsPath, newText);
 	return originalHadTheme ? "restored" : "forced";
 }
 
@@ -641,6 +730,53 @@ function safely(label, path, fallback, fn) {
 	}
 }
 
+// gentle-pi replaces Pi's replaceable builtin codemode with its own decorated
+// codemode tool (extensions/quiet-tools.ts -> registerCompactCodemode in
+// lib/codemode-renderer.ts), and Pi prints a startup warning whenever a
+// builtin loses its tool to another extension. Pi's only per-builtin opt-out
+// is a `-builtin:<name>` entry in the settings `extensions` array, so every
+// normal launch ensures that entry in the settings.json of a home
+// gentle-shell owns (see main, below).
+const BUILTIN_CODEMODE_EXTENSION = "builtin:codemode";
+
+// Pure: returns `settingsText` with `-<builtin>` appended to its `extensions`
+// array (created when absent), or undefined when nothing should change — the
+// text does not parse as a JSON object, `extensions` exists but is not an
+// array, or the array already holds any explicit entry for the builtin
+// (`+`, `-`, `!`, or bare), which is the user's own decision. Keeps every
+// other key and entry in place, plus the text's own indentation and trailing
+// newline (same detection as detectJsonFormatting in
+// lib/gentle-shell-launcher.ts).
+function withBuiltinExtensionExcluded(settingsText, builtin) {
+	let settings;
+	try {
+		settings = JSON.parse(settingsText);
+	} catch {
+		return undefined;
+	}
+	if (typeof settings !== "object" || settings === null || Array.isArray(settings)) return undefined;
+	const extensions = Object.prototype.hasOwnProperty.call(settings, "extensions") ? settings.extensions : [];
+	if (!Array.isArray(extensions)) return undefined;
+	if (extensions.some((entry) => typeof entry === "string" && entry.replace(/^[+!-]/, "") === builtin)) return undefined;
+	const indent = settingsText.match(/\{\r?\n([ \t]+)/)?.[1];
+	const serialized = JSON.stringify({ ...settings, extensions: [...extensions, `-${builtin}`] }, null, indent);
+	return settingsText.endsWith("\n") ? `${serialized}\n` : serialized;
+}
+
+// Applies withBuiltinExtensionExcluded to an existing settings.json with the
+// same atomic temp-file-then-rename write as the restores above. A missing
+// settings.json is left missing: only the brand-new-home bootstrap
+// (installIsolatedTuiModeSetting) seeds that file, and this launch-time step
+// never takes over that role. Returns true when it actually wrote the file.
+function ensureBuiltinCodemodeExcluded(settingsPath) {
+	const currentText = readJsonIfExists(settingsPath);
+	if (currentText === undefined) return false;
+	const newText = withBuiltinExtensionExcluded(currentText, BUILTIN_CODEMODE_EXTENSION);
+	if (newText === undefined) return false;
+	writeFileAtomically(settingsPath, newText);
+	return true;
+}
+
 // Provisions `home` with everything `gentle-ai install --agent pi` installs
 // into a regular Pi, by spawning the package-local pinned gentle-ai binary
 // (never a PATH `gentle-ai`) with PI_CODING_AGENT_DIR/GENTLE_PI_AGENT_HOME set
@@ -1139,6 +1275,21 @@ async function main() {
 		// exits with the same signal-derived code instead of falling through
 		// to launch pi.
 		if (autoProvisionResult !== undefined) process.exit(autoProvisionResult.exitCode);
+
+		// Runs after auto-provision, so it sees settings.json exactly as that
+		// run left it. Only a home gentle-shell owns, by the same rule
+		// auto-provisioning uses (homeIsForeign): never --link (excluded above),
+		// a foreign --home, or pi's own default agent home, since plain pi may
+		// share those and would lose its builtin codemode. `setup` (including
+		// --dry-run) returned before this point.
+		const settingsPath = join(home.dir, "settings.json");
+		const excluded = safely("exclude Pi's builtin codemode in your Gentle Shell settings", settingsPath, false, () => {
+			const previous = provisionedEntry(readRawConfig(resolveConfigPath()), safeRealpath(home.dir));
+			return !homeIsForeign(home, previous, homeHadContentBeforeBootstrap) && ensureBuiltinCodemodeExcluded(settingsPath);
+		});
+		if (excluded) {
+			process.stderr.write(`gentle-shell: disabled Pi's builtin codemode in ${settingsPath} (Gentle Shell ships its own codemode tool)\n`);
+		}
 	}
 
 	const packageRootExplicit = args.packageRoot !== undefined;
@@ -1228,22 +1379,96 @@ async function main() {
 		takeOver,
 		otherPackagePaths,
 		looseExtensionEntries,
-		passthrough: args.passthrough,
+		passthrough: [...managedHerdrExtensionArgs(home, args), ...args.passthrough],
 		piSubcommand: args.piSubcommand,
 		baseEnv: process.env,
+		homedir: homedir(),
 	});
 
+	// Only an interactive session ends with pi's exit resume hint, which
+	// gentle-shell completes with its own line; a pi subcommand gets no handoff.
+	const resumeHandoff = args.piSubcommand === undefined ? createResumeHandoff() : undefined;
+	const childEnv = resumeHandoff ? { ...invocation.env, [RESUME_HANDOFF_ENV]: resumeHandoff.path } : invocation.env;
+
 	const launchPlan = planSpawn({ command: invocation.command, args: invocation.args, platform: process.platform });
-	const child = spawn(launchPlan.command, launchPlan.args, { stdio: "inherit", env: invocation.env, shell: launchPlan.shell });
+	let child;
+	try {
+		child = spawn(launchPlan.command, launchPlan.args, { stdio: "inherit", env: childEnv, shell: launchPlan.shell });
+	} catch (error) {
+		resumeHandoff?.dispose();
+		throw error;
+	}
+	// Only SIGHUP means the terminal is gone. pi may survive a forwarded
+	// SIGINT and keep running, so other signals must not silence the hint.
+	let terminalHungUp = false;
 	for (const signal of ["SIGINT", "SIGTERM", "SIGHUP"]) {
-		process.on(signal, () => child.kill(signal));
+		process.on(signal, () => {
+			if (signal === "SIGHUP") terminalHungUp = true;
+			child.kill(signal);
+		});
 	}
-	child.on("error", (error) => fail(`Could not start pi: ${error.message}`, 1));
+	child.on("error", (error) => {
+		resumeHandoff?.dispose();
+		fail(`Could not start pi: ${error.message}`, 1);
+	});
 	child.on("exit", (code, signal) => {
-		process.exit(signal ? signalExitCode(signal) : (code ?? 1));
+		const exitCode = signal ? signalExitCode(signal) : (code ?? 1);
+		if (resumeHandoff) {
+			const hint = planResumeHint({
+				handoff: resumeHandoff.read(),
+				homeFlags: homeSelectorFlags(home),
+				stdoutIsTTY: process.stdout.isTTY === true,
+				terminalHungUp,
+				platform: process.platform,
+				color: process.stdout.hasColors?.() === true,
+			});
+			resumeHandoff.dispose();
+			// TTY writes are asynchronous on Windows: exit only once the
+			// hint is flushed, or it can be lost.
+			if (hint) {
+				// A write error (e.g. EIO on a closed terminal) must not turn
+				// pi's exit into a launcher crash.
+				process.stdout.once("error", () => process.exit(exitCode));
+				process.stdout.write(hint, () => process.exit(exitCode));
+				return;
+			}
+		}
+		process.exit(exitCode);
 	});
 }
 
+// Private temp dir for the resume-hint handoff (lib/gentle-shell-resume-hint.ts).
+// Best effort: if it cannot be created, only pi's own hint is printed.
+function createResumeHandoff() {
+	let dir;
+	try {
+		dir = mkdtempSync(join(tmpdir(), RESUME_HANDOFF_DIR_PREFIX));
+	} catch {
+		return undefined;
+	}
+	const path = join(dir, RESUME_HANDOFF_FILE);
+	return {
+		path,
+		read: () => {
+			try {
+				const text = readJsonIfExists(path);
+				return text === undefined ? undefined : parseResumeHandoff(text);
+			} catch {
+				return undefined;
+			}
+		},
+		// Never throws: it runs inside the exit handler, where an EPERM on
+		// Windows would otherwise replace pi's exit code with a crash.
+		dispose: () => {
+			try {
+				rmSync(dir, { recursive: true, force: true });
+			} catch {
+				// A leftover empty temp dir is harmless.
+			}
+		},
+	};
+}
+
 main().catch((error) => {
 	process.stderr.write(`${error instanceof Error ? error.message : String(error)}\n`);
 	process.exit(1);

package/docs/delegated-verification.md

@@ -6,7 +6,30 @@ How the Gentle Pi orchestrator decides who verifies a bounded writer's work. The
 
 The bounded writer runs the exact commands the parent lists under `## Verification`, in the foreground, and reports each as `<command>: <observed result>`. That report is the verification of record and the native review is the independent check. `gentle-ai-verify` is on-demand: a `partial` or `blocked` writer, an expensive or external check the parent wants on a cheaper profile, or a parent spot check.
 
-This `on` path holds only while the native review actually reaches a terminal outcome for the current candidate (gentle-pi#668). A human decline of the consent envelope for this candidate (candidate-scoped, never the RDD kill switch), a clone-local RDD disable discovered mid-flow, or a refused START/STATUS all mean the review never ran, so the parent falls back to the exact risk-gated path below, as if RDD were `off` -- declining a review never lowers the bar below the RDD-off path. `gentle_review`'s `assess` operation accepts an optional `nativeReviewOutcome` (`closed`, `declined`, `unavailable`, or `unknown`) so the caller can state this directly. `closed` is never auto-derived: only a caller that itself just acknowledged the approved review for this exact candidate may pass it, right after that acknowledgement. When `nativeReviewOutcome` is omitted, `assess` only ever tries to auto-derive `declined`/`unavailable`, and only for the exact candidate the event was bound to -- keyed by that candidate's own target identity, never by repository alone, so one candidate's recorded outcome can never leak into a different candidate's `assess` call in the same clone. A missing or mismatched identity fails closed to `unknown`, verified exactly like `off`. The result's `outcome_source` (`explicit`, `derived`, or `unknown`) states which of these produced the value, so a stale or missing derivation is visible rather than silently indistinguishable from a real `unknown`.
+This `on` path holds only while the native review actually reaches a terminal outcome for the current candidate (gentle-pi#668). A human decline of the consent envelope for this candidate (candidate-scoped, never the RDD kill switch), a clone-local RDD disable discovered mid-flow, or a refused START/STATUS all mean the review never ran, so the parent falls back to the exact risk-gated path below, as if RDD were `off` -- declining a review never lowers the bar below the RDD-off path.
+
+### How `assess` resolves the review outcome (gentle-pi#1175)
+
+`gentle_review`'s `assess` operation derives `closed` only from the native `candidate.consumed` fact for this exact candidate. Native writes that fact only when the approved review for that candidate is acknowledged. A caller-supplied `closed` is not authority: without that fact it resolves to `unknown`. A declined, unavailable, or unknown outcome falls back to the RDD-off tier table, and `unknown` is never treated as closed.
+
+Rows apply in order; the first match wins.
+
+| Outcome evidence | Resolved `nativeReviewOutcome` | `outcome_source` |
+| --- | --- | --- |
+| Caller passes `declined`, `unavailable`, or `unknown` | that value | `explicit` |
+| This process recorded `declined`/`unavailable` for this exact candidate | that value (wins over closure) | `derived` |
+| Native reports `candidate.consumed: true` for this candidate | `closed` | `derived` |
+| Anything else, including a bare caller `closed` | `unknown` | `unknown` |
+
+A recorded outcome is keyed by the candidate's own target identity, never by repository alone, so one candidate's outcome never leaks into a different candidate's `assess` call in the same clone.
+
+### How `assess` resolves the writer profile (gentle-pi#1175)
+
+The writer profile comes from the runtime-recorded model and effort of the pending mutations for the root (`writerProfileSource: runtime`). Caller `writerModelId`/`writerEffort` are only a fallback when no runtime evidence exists (`caller`); with neither, the profile is small (`fallback`). A missing model, a `mini` model token (`gemini` is not mini), or `low` effort keeps the conservative small-model bias.
+
+### What `assess` projects
+
+When native reports them, `assess` projects `reviewDue`, `reviewDueReason`, `candidate.consumed`, and the native preflight continuation (`nextTransition`) verbatim. Older binaries omit them, and nothing is invented. The continuation is opaque: relay it unchanged, never rebuild it.
 
 ## Receipt-driven development off or unknown (gentle-pi#662)
 
@@ -23,3 +46,5 @@ The `gentle_review` tool's `assess` operation (`extensions/gentle-ai.ts`) combin
 
 When RDD is `on` and the native review closed for this candidate, the writer's own self-verification is the record and the closed native review is the independent check, except a passive-risk change, which still gets a structural readback instead; any other `nativeReviewOutcome` under `on` follows this same tier table instead (gentle-pi#668). The small-model bias raises the medium tier to high for verification purposes only; an unknown RDD line never lowers a tier below `off`. The parent's own spot check (re-running one reported command before delivery) stays required in every tier.
 
+A native code review is not a substitute for applicable functional checks: tests, builds, and functional verification such as browser checks for UI changes still run when applicable. Review outcomes never authorize delivery; human consent for native review and the user-owned RDD switch are unchanged.
+

package/docs/gentle-agents-activity.md

@@ -90,6 +90,30 @@ When the whole-payload bound is still exceeded after the field- and item-level t
 
 An active task's `summary` (running, waiting or queued) is never dropped; only its `thread.items` shrink. Finished tasks can be dropped whole by step 3, oldest first.
 
+## Generation and watchdog progress
+
+While an active assistant message streams a tool-call block, validated fresh,
+nonempty argument deltas renew the runner's idle watchdog independently of
+thread/display events. `summary.lastStep` becomes `generating tool arguments`
+and `lastActivityAt` advances; no partial argument data is stored in the thread,
+diagnostic, or progress tracker. `toolCalls` increments only at execution start.
+Token/cost totals still update only from finalized assistant `message_end` usage,
+not streaming usage; static totals do not establish inactivity.
+
+The tracker admits blocks announced by current RPC identity fields or older Pi
+partial snapshots. It rejects empty/malformed deltas, unannounced or closed
+blocks, stale message starts, and duplicate argument fingerprints. RPC provides
+no delta sequence number, so identical chunks within one block are conservatively
+indistinguishable from replay and do not renew liveness. Only hashes are retained,
+with a 4096-fingerprint bound per assistant message; exhaustion fails closed until
+a newer message starts. Unrelated UI and unrecognized event traffic do not renew
+argument liveness. Existing RPC command-response handling is unchanged.
+
+Idle and in-flight execution watchdog budgets are **renewable silence bounds**,
+not absolute run/generation duration limits. Argument generation uses the idle
+budget, not the longer announced-execution budget. Later silence still times out;
+execution start/end and cancellation retain their existing behavior.
+
 ## Coalescing
 
 `createRpcActivityPublisher` subscribes to `TaskStore#subscribeSummary` (task added, removed, or changed status) and to `TaskStore#subscribe(id)` for every known task, including ones added after `start()`. Changes inside a 150 ms window collapse into exactly one `setWidget("gentle-agents", [line])` call; `stop()` tears down every subscription and publishes one final frame.