jeopi-cli 16.4.1 → 16.4.3

package/CHANGELOG.md

@@ -2,6 +2,86 @@
 
 ## [Unreleased]
 
+## [16.4.3] - 2026-07-22
+
+### Added
+
+- `jeopi acp` now prints a short hint on stderr when launched from an interactive terminal (stdin is a TTY): the command speaks JSON-RPC over stdout and is meant to be spawned by an ACP client such as Zed, so running it by hand previously showed nothing at all. Ported from oh-my-pi (upstream `54af1c03f`).
+- Added a `c` hotkey in the plan-review overlay that copies the current reviewed plan markdown to the system clipboard, including in-overlay edits. Ported from oh-my-pi (upstream `4fa5b61b0`).
+- `wait()` in browser `run` code now also accepts a predicate function: `wait(fn, { timeout?, interval? })` polls `fn` (sync or async) until it returns truthy and resolves with that value (default 30s timeout, 100ms interval), throwing a named error on timeout instead of stalling into the whole-cell deadline — use it instead of hand-rolled polling Promises inside `tab.evaluate`. `wait(ms)` still sleeps as before. Ported from oh-my-pi (upstream `bd7d39522`, adapted to jeopi's plain-`async function` `waitForBrowserRun` — jeopi's `run-cancellation.ts` has no `markHandled` unhandled-rejection wrapper to preserve).
+- `/tan` now records a `session_init` entry (system prompt, task, and active tool set) on the clone's own session log when the tan is created, matching the tracking `task`-delegated subagents already get. Ported from oh-my-pi (upstream `46ed33f27`, dropped the optional-chaining fallbacks on `sessionManager`/`getActiveToolNames` — jeopi's `AgentSession` type guarantees both non-optionally, matching how `task/executor.ts` already calls `appendSessionInit`).
+- `/tan` clones now receive a developer-message context-switch notice before the user's prompt runs, making explicit that the parent session's prior conversation is not the clone's responsibility and it must focus exclusively on the new request, then stop. Ported from oh-my-pi (upstream `eb52f6ea2`).
+
+### Changed
+
+- Task delegation guidance (`eager-task.md`, forced-delegation mode) now says explicitly that top-level scoping, decomposition, and cross-slice contracts are the primary agent's job — never spawn a subagent to produce the overall plan — and that a single runnable slice should be done inline rather than handed to a lone subagent (a lossy handoff, not parallelism). Ported from oh-my-pi (upstream `1c6f5dc18`, `eager-task.md` portion only — jeopi's `system-prompt.md` delegation section has diverged structurally from upstream's and needs separate manual review before porting the rest of this commit).
+- Hardened `/tan` fork isolation: the clone's inherited todo list is cleared at fork (parent todo reminders no longer drag the tan back onto the parent's task), the fork notice warns that the parent is concurrently editing the same working directory, and the notice is re-injected after each compaction so the fork boundary survives summarization; the clone's provider prompt-cache key now mirrors the parent's actual pinned key instead of always the parent's session id. Ported from oh-my-pi (upstream `0a98aa252`).
+- Per-turn stale-tool-result pruning (`compaction.supersedeReads`/`compaction.dropUseless`) now persists via `rewriteEntries` like every other history rewrite, so the on-disk session file matches the live pruned context — file-based forks (`/fork`, `/tan`) and resume no longer rebuild a divergent, un-pruned prefix and cold-miss the provider prompt cache. Ported from oh-my-pi (upstream `0a98aa252`).
+- Reduced browser action timeout from 15s to 8s to improve agent iteration speed. Ported from oh-my-pi (upstream `9ebc23928`).
+- `tab.evaluate` now always runs in the page's main JavaScript world instead of the puppeteer-default isolated world: page-defined globals (`window.myFlag`, app state, framework internals) are visible without an explicit `//!world=main` directive comment. Ported from oh-my-pi (upstream `8c8afaf47`).
+- Removed the stale `[NEW]` marker from the `/advisor` startup tip. Ported from oh-my-pi (upstream `93db3913d`, `tips.txt` portion only — the accompanying new `->` prompt-queueing tip references jeopi's not-yet-ported sequential message queueing feature, and the Model Hub selection-visual/PageUp-PageDown-clamp fixes in the same commit are coupled to jeopi's not-yet-ported Model Hub feature).
+- Status event log in the eval tool box now shows a tail window of the most recent entries (newest as the live edge, matching the code/output preview convention) behind a leading "… N earlier" marker, instead of a trailing "… N more" marker after the oldest entries; the expanded view widens to the viewport-sized preview window instead of a fixed 10-row cap. Ported from oh-my-pi (upstream `d4ffb4b64`).
+
+### Fixed
+
+- Bare `skill://name` URLs (no relative path) now resolve to the skill directory for path-only tool operations (`bash` `skill://` expansion, `search`/`find` on internal URLs) instead of `SKILL.md`; `read` still returns `SKILL.md` instructions for the bare form. Ported from oh-my-pi (upstream `cf4e510ac`).
+- Fixed expanded (ctrl+O) streaming edit previews duplicating the tool box in terminal scrollback: an unbounded live diff scrolled above the native-scrollback commit boundary mid-stream, freezing a stale preview snapshot that the finalized render then recommitted below. Expanded previews now use a viewport-sized tail window; the full diff still renders once the result finalizes. Ported from oh-my-pi (upstream `896c4bb17`, streaming-diff-cap portion only — the paired `render-initial-messages.test.ts` `Settings` re-init addition was not ported for the same reason as `c69c04836`: jeopi's `renderInitialMessages` reads no global `Settings` state on this test's exercised path).
+- Fixed backgrounded Bash blocks continuing to repaint with live and final job output after entering the background, causing UI flicker; they now freeze with a compact `Backgrounded: <jobId>` footer notice while completion is delivered separately. `EventController`'s "keep updating" tracking (renamed `#backgroundToolCallIds`→`#backgroundTaskCallIds`) is now scoped to `task` calls only — Bash job progress no longer forwards through `onUpdate` once backgrounded. Ported from oh-my-pi (upstream `87a64b2f6`, adapted: the paired `event-controller-task-async-updates.test.ts` test addition was not ported since jeopi doesn't have that precursor test file yet — verified instead via the existing `tools.test.ts`/`bash-sixel-render.test.ts` coverage).
+- Fixed configured `retry.fallbackChains` never engaging on non-retryable ("hard") provider errors (e.g. an error the generic retry classifier rejects outright, or mid-stream Anthropic envelope corruption): a hard error on a model covered by a fallback chain now switches to the next candidate instead of failing the turn immediately, while still never backoff-retrying the failing model itself. New `#isHardErrorFallbackEligible` gate (skips cancellations, context overflow, classifier refusals, and turns that already emitted a tool call) feeds `#handleRetryableError`'s existing model-switch orchestration via a new `hardErrorFallback` option, mirroring how the Fireworks Fast→base degrade already bypasses same-model backoff on a failed switch. Ported from oh-my-pi (upstream `58d6130b5`; the ported tests' `retry.fallbackChains` role key was adapted from upstream's provider-wildcard `"anthropic/*"` to jeopi's named-role convention (`default` + `settings.setModelRole`) — jeopi's `#resolveRetryFallbackRole` resolves chain keys as configured model roles, not provider-wildcard patterns, confirmed by re-running the ported tests against the wildcard form first and observing zero fallback attempts before the fix).
+- Fixed autolearn auto-continue firing a capture turn after an aborted stop (Esc/cancel): the controller now skips any `agent_end` whose last assistant message has `stopReason: "aborted"` (the abort flag on the session is unreliable by the time `agent_end` is delivered to subscribers, so it reads `stopReason` from the event's messages directly). Ported from oh-my-pi (upstream `dac54080d`).
+- Fixed `jeopi -p` looking hung while a text-mode prompt is in flight by writing a one-shot working indicator to stderr before awaiting the model response. Ported from oh-my-pi (upstream `1a3e137f1`).
+- Fixed MCP tools receiving session image attachments as raw `local://...` URIs by resolving them to session-local filesystem paths before `tools/call` is sent — MCP servers run out-of-process and cannot resolve jeopi's internal URL scheme. `CustomToolContext` gained `localProtocolOptions`, threaded from `AgentSession` into every MCP tool's context and walked recursively over string/array/object args before dispatch. Ported from oh-my-pi (upstream `b097019fe`; also applied the follow-up test typing cleanup from `81c4cb6df`).
+- Fixed extension-registered MCP tools (loaded via extensions rather than the session's own MCP config) resolving `local://` session attachments incorrectly because `ExtensionContext`/`ExtensionRunner` never carried the calling session's `localProtocolOptions` through to their `CustomToolContext`. Threaded `localProtocolOptions` from `createAgentSession` into `ExtensionRunner`'s constructor/`createContext()`, `ExtensionContext`, and `createCustomToolContext` in `sdk.ts`. Ported from oh-my-pi (upstream `3ebcb3690`).
+- Fixed `jeopi plugin install github:owner/repo --force` failing with Bun `DependencyLoop` when replacing an existing pinned git plugin source for the same repository; the installer now removes the stale pinned dependency edge before invoking Bun and restores it on rollback. Ported from oh-my-pi (upstream `63adfeece`).
+- Fixed `ultrathink`, `orchestrate`, and `workflowz` magic keywords not triggering when adjacent to sentence punctuation or quotes (e.g. `orchestrate.` or `"ultrathink,"`) while still ignoring inflections, path/file-extension occurrences (`orchestrate.ts`), code symbol references (`foo::orchestrate`), and direct calls (`orchestrate()`). New shared `magicKeywordRegex` boundary builder replaces each keyword's ad hoc `(?<!\S)…(?!\S)` regex with one that treats letters/digits/`_`/`.`/`/`/`\`/`-` as binding but leaves other punctuation as a valid prose boundary. Ported from oh-my-pi (upstream `e7c678dbe`, `ba7bcf4cd`).
+- Fixed temporary model picks (`Alt+P`, `/switch`, `/model --temporary`) ignoring explicit thinking suffixes from a matching configured role. The temporary picker now carries the resolved role thinking level with the selected model instead of only applying the model default. Ported from oh-my-pi (upstream `9bda84b68`).
+- Fixed subagent model overrides falling back to the parent model when session-sticky OAuth credentials were usable only with the subagent session id; preflight auth checks now preserve that id and model-resolution warnings are logged. Ported from oh-my-pi (upstream `aa470b9e3`).
+- Fixed Python eval `agent()` bridge calls losing in-flight subagent work when the parent cell receives an external abort; the kernel abort is now deferred until already-started bridge calls settle, and new bridge calls are rejected after the abort is pending. Ported from oh-my-pi (upstream `a86c1ec46`).
+- Fixed LSP semantic requests hanging during startup for servers that wait for client configuration: the initialize handshake now sends `workspace/didChangeConfiguration` with the configured settings immediately after `initialized`, before publishing the client ready. Ported from oh-my-pi (upstream `a327992c8`).
+- Fixed `--max-time` duration values like `5s`, `10m`, and `1h` being ignored instead of configuring a session deadline; invalid values (`5d`, `0`, `-1`, `Infinity`, `NaN`) now raise a clean `CliUsageError` (exit code 2, no stack trace) from both `launch` and `acp` instead of silently dropping the deadline. Ported from oh-my-pi (upstream `6fab752eb`, `d670dd5d9`).
+- Fixed `jeopi update` on npm-managed installs (including Windows npm `.cmd`/`.ps1`/`.bat` launchers) so they update through `npm install -g` instead of falling back to binary replacement, which would overwrite an npm-owned shim with a raw downloaded binary. Ported from oh-my-pi (upstream `3876f60d6`).
+- Fixed `write` treating read-only internal URLs like `memory://root/memory_summary.md` as project-relative filesystem paths (leaking paths such as `{cwd}/memory:/root/memory_summary.md` onto disk); any scheme other than `local://` without a `write` hook now raises a clear "read-only for write" error instead of falling through to filesystem-write logic. Ported from oh-my-pi (upstream `a4f43be04`).
+- Fixed `memory://root` resolution leaking between live agents with different working directories: file-backed memory roots now resolve from the calling session's cwd first (fully isolated — no fallback to other live sessions' roots once a caller cwd is known) instead of walking the entire global session registry, and bash internal-URL expansion now threads the caller cwd through so a `memory://` reference redirected inside a bash command can't pick up another live agent's root. Ported from oh-my-pi (upstream `f26fffb8e`). Adaptation: jeopi's `bash-skill-urls.ts` resolve call site does not yet pass `pathOnly: true` (a separate, earlier upstream optimization not present in jeopi) — only `cwd` was threaded through, matching this pair's actual scope.
+- Fixed todo reminders auto-continuing over interactive assistant questions: a stop-time todo reminder is now suppressed when the assistant's last text-only turn is a genuine prompt-shaped question directed at the user (a trailing `?`-terminated line matching a question word/label, or a `you`/`your`/`we`/`our`-directed line) or ends with an explicit response cue (`confirm`, `reply`, `choose`, `pick`, `decide`, `advise`, `answer`, `let me know`, `tell me`) — narrowed after an initial looser heuristic false-positived on ordinary prose containing "answer" or TypeScript optional-property syntax (`foo?:`). Ported from oh-my-pi (upstream `6b6471c86`, `3617668c6`).
+- Fixed weak subagent tool callers retrying empty `yield` results forever; repeated untyped `result: {}` submissions (more than 3 consecutive) now abort the child explicitly with guidance instead of leaving the parent waiting indefinitely. The retry budget resets after any valid yield. Ported from oh-my-pi (upstream `a34d99c6a`).
+- Fixed macOS runtime diagnostics (e.g. `MallocStackLogging: can't turn off malloc stack logging because it was not enabled`) written directly to fd 2 by libmalloc painting into the TUI viewport. While the TUI owns the terminal, stderr is now redirected to the jeopi log file and restored at every ownership handoff (external editor, Ctrl+Z suspend, shutdown, crash restore); fatal crash reports still reach the real terminal. Ported from oh-my-pi (upstream `4eaca82fa` by @Kormákur, `17486d200` by @Kormákur — squashed same-day fixup that creates the log directory before opening the redirect target so a fresh profile doesn't silently fall back to `/dev/null`).
+- Fixed throttled live command output holding a quiet final chunk until the command exited: a timer now flushes any pending throttled chunk at the throttle boundary even while the stream stays quiet, instead of only flushing on the next chunk or `dump()`. Ported from oh-my-pi (upstream `71aaad50e` by @wolfiesch).
+- MCP stdio server launches now use Bun's argv-first `spawn(cmd, opts)` overload instead of the single-object `spawn({ cmd, ... })` form, so macOS TCC Apple Events prompts reach children (e.g. `xcrun mcpbridge`) the same way the JS eval kernel path already does — the object-overload spawn was timing out before the prompt fired. Ported from oh-my-pi (upstream `a0a6949a4`).
+- Session title generation no longer leaks `<think>`/`<thinking>`/`<reasoning>` tag or fenced-code reasoning envelopes from OpenAI-compatible endpoints that ignore reasoning disablement: leaked envelopes are stripped before `<title>` markers are parsed, a `<title>` marker found *inside* a leaked envelope is ignored in favor of the next visible one, and literal reasoning syntax that's part of a genuine (non-leaked) title is preserved verbatim. Ported from oh-my-pi (upstream `851186f5d`, `0420d44d3`, `65b0f0532`, `a16c60014`).
+- `read` with a `:raw` selector (alone or combined with a line range, e.g. `:raw:31-31`) no longer pads the result with leading/trailing context lines — raw output has no line numbers, so padding was indistinguishable from the requested content. Non-raw range reads keep expanding with context as before. Ported from oh-my-pi (upstream `83fbefac2`).
+- `glob` no longer reports the contradictory "No files found matching pattern" next to a "timed out; returning 0 partial matches" notice. A timed-out empty scan now states explicitly that the result is incomplete (not proof of absence) and suggests scoping to a deeper directory; the TUI renders it as "No matches before timeout (scan incomplete)" instead of a definitive no-files claim. Ported from oh-my-pi (upstream `530faffd2`).
+- Empty assistant `stop` responses that exhaust the empty-stop retry cap now always emit a failed `auto_retry_end` session event (previously only when a prior transient-error retry had already set a nonzero retry attempt), so the TUI surfaces a visible retry failure instead of silently settling. Ported from oh-my-pi (upstream `51cc34ac6`).
+- JS eval cells no longer lose top-level `function` and `var` declarations across cells when the defining cell contained top-level `await`: the async wrapper was scoping them to the cell's IIFE instead of publishing them to the worker global, so a later cell saw a `ReferenceError`. Ported from oh-my-pi (upstream `b6f83021c`).
+- Perplexity search results are now reliably grounded: `skip_search_enabled` is `false` (was `true`, letting the backend classifier skip retrieval for queries it judged answerable from memory and return an ungrounded "I don't currently have live access" refusal) plus `always_search_override: true` as a second guarantee, and the OAuth ask request declares no tool-approval UI / no local browser agent so the stream never stalls waiting on a confirmation the tool can't render. Ported from oh-my-pi (upstream `dabe233c6`).
+- `WelcomeComponent`'s weighted tip picker (`pickWeightedTip`) now takes the tip list and a uniform sample explicitly instead of reading module-level `TIPS`/`Math.random()`, and is exported for tests. The weighted-selection test sweeps a synthetic tip list so a `tips.txt` that ships zero `[NEW]` tips no longer fails the suite. Ported from oh-my-pi (upstream `6bd51d4ad`).
+- Fixed ACP turns ending silently when the provider request failed before streaming any assistant output (e.g. an intermittent `HTTP 400 model_not_supported` after retries): such failures emit only `agent_end` with the error on the assistant message, which never mapped to a session update. The error message is now delivered to the client as an `agent_message_chunk`, without duplicating errors that already streamed. Ported from oh-my-pi (upstream `54af1c03f`).
+- Fixed browser screenshots capturing the wrong tab or hanging until the op timeout when multiple tabs share one Chromium (sibling headless tabs, `cdp_url`/app attach): CDP reads the *active* target's compositor surface, so a backgrounded page could stall waiting for a frame or return a sibling's pixels. The worker now activates the page (`bringToFront`) before every capture, best-effort.
+- Fixed cmux `tab.screenshot({ selector })` silently returning a full-viewport capture that models consumed as an element crop. The cmux daemon has no element-clip or full-page capture; the tool still scrolls the selector into view but now labels the image as full-viewport (same for `fullPage`) instead of mislabeling it.
+- Fixed cmux `tab.evaluate()` / `elementHandle.evaluate()` errors surfacing as the daemon's opaque `js_error: A JavaScript exception occurred`. Scripts now run inside a page-side try/catch envelope that returns the real message and stack, and a Promise return (which the daemon cannot serialize) yields an actionable "evaluates synchronously" error instead of an unsupported-type failure. Ported from oh-my-pi (upstream `d993b13c8`).
+- Fixed `jeopi commit` agent sessions so a valid proposal is committed before session teardown can dispose mnemopi/autolearn resources, missing required host outputs now fail non-zero instead of returning cleanly, and git subprocesses no longer force `GPG_TTY=not a tty` on signing-enabled repositories. Ported from oh-my-pi (upstream `159484ca6`).
+- Fixed the `/move` directory picker drawing a fixed 68-column frame inside wider full-width overlays instead of honoring the assigned overlay width. Ported from oh-my-pi (upstream `b35e4c413`).
+- Fixed snapcompact inline imaging for GitHub Copilot Business and Enterprise models that advertise image input, removing the stale non-personal-host block. Ported from oh-my-pi (upstream `e58d2c460`, `4bae9a42a`, `b0f22caf8`).
+- Fixed advisor config collapsing an explicit empty tool list into the default `read`/`grep`/`glob` subset, so `/advisor config` can no longer disable all advisor tools — an omitted `tools` field still falls back to the default, but an explicit `tools: []` now grants none. Ported from oh-my-pi (upstream `7d72ee9e0`, `dabb2291a`).
+- Fixed first-run interactive startup rendering the full packaged changelog when the last-seen marker is missing, malformed, or unreadable. Startup upgrade notes now show at most three unseen releases and cap Markdown source at 64 KiB; `/changelog full` remains the explicit full-history path. Ported from oh-my-pi (upstream `f53411295`, `449310eb1`).
+- Fixed `runSearchQuery` leaking a self-discovered `AuthStorage` (never closed) and silently proceeding with an undefined store when discovery failed. It now throws when no auth storage is available and closes any storage it opened itself in a `finally` block, leaving a caller-supplied storage untouched. Ported from oh-my-pi (upstream `376084c19`).
+- Fixed `write` blocking for the full inline LSP diagnostics poll window instead of returning immediately and delivering slow diagnostics via the existing deferred late-diagnostics channel (already used by `edit`). Extracted the deferred-diagnostics bookkeeping (pending-fetch cancellation, mutation-version staleness, dedup) from `EditTool` into a shared `DeferredDiagnostics` class used by both tools. Ported from oh-my-pi (upstream `b0d98d9e2`).
+- Fixed browser runs silently dropping `display("string")`, `console.log`, and `print` output: the runtime emits those as stream text, which the browser embedders (worker and cmux) routed to the debug log only, so the tool result showed a bare "Ran code on tab". Stream text is now buffered and surfaced as ordered display entries alongside `display()` payloads and screenshots. Ported from oh-my-pi (upstream `a9cdaf427`).
+- Fixed `input.fill is not a function` on element handles from `tab.id()`/`tab.ref()`/`tab.waitFor()`: raw puppeteer ElementHandles expose `type()` but not the `fill()` the tool docs promise. Handles handed to user code now carry a `fill()` matching `tab.fill()` semantics (focus, clear, retype). Ported from oh-my-pi (upstream `a9cdaf427`).
+- Browser selector ops (`click`/`type`/`fill`/`waitFor`/…) that hit their fail-fast timeout now append a match-count diagnosis — "matches no elements" (wrong page, consent wall) vs "matches N element(s) but the action never became possible" (hidden/covered) — instead of a bare `timed out after 15000ms`. Ported from oh-my-pi (upstream `a9cdaf427`).
+- Browser selector ops no longer burn their whole deadline on a selector that matches nothing: a watchdog polls while the action runs and aborts after ~2s of confirmed zero matches with the inspection hint. `waitFor`/`waitForSelector` opt out via an explicit `{ timeout }` (and `hidden: true` waits are exempt — zero matches is their success condition). The per-action ceiling for present-but-unactionable elements also dropped from 15s to 8s. Ported from oh-my-pi (upstream `9ebc23928`).
+- Fixed context promotion docs to match the explicit `contextPromotionTarget` runtime behavior and `contextPromotion.enabled` default. Ported from oh-my-pi (upstream `cbe083224`).
+- Fixed `GenerateImage` rejecting OpenAI Codex-compatible proxy bearer keys when the token does not expose a `chatgpt-account-id`. Ported from oh-my-pi (upstream `748b2dff1`).
+- Fixed the generic Windows release binary (`jeopi-windows-x64.exe`) requiring an AVX2-capable CPU by building it with Bun's baseline x64 runtime instead of the modern target, so older Windows 10 CPUs no longer fail to launch it. Ported from oh-my-pi (upstream `bc7a143c1`).
+- Fixed plugin custom tool loading crashing startup on one malformed tool factory result: a factory returning `null`, an array containing `null`, or an object missing `name`/`description`/`parameters`/`execute` is now reported as a per-entry load error and skipped instead of registering a broken tool (or throwing before the rest load). Ported from oh-my-pi (upstream `459682cc6`).
+- Fixed agents getting stuck waiting for IRC messages from peers that have already stopped running: `irc wait` (bare or `from`-filtered) now aborts immediately if no running peer can ever reply, and re-aborts if the awaited peer (or the last running peer, for an unfiltered wait) goes idle/parked mid-wait, instead of hanging until the timeout. `irc send await:true` is unaffected — an idle recipient is woken by the send itself. Ported from oh-my-pi (upstream `0828c53ca`).
+- Fixed `/btw` side-channel turns on Codex models by preserving the session's websocket preference and shared provider state map instead of forcing SSE with no provider state (previously hardcoded `preferWebsockets: false`), and made Esc dismiss an active `/btw` (or `/omfg`) panel before interrupting loop mode or context maintenance (auto-compaction/handoff/retry), not just a streaming/bash turn or pending submission. Ported from oh-my-pi (upstream `2c161d2a8`, `9269823d1`).
+
+## [16.4.2] - 2026-07-14
+
+### Fixed
+
+- `AgentSession`'s `reasoning_extraction` classifier-refusal auto-degrade (strip unsigned thinking, resend same-model) was gated behind a one-shot latch that, once spent on the first refusal in a session's lifetime, never reset — every subsequent, independent `reasoning_extraction` refusal in the same session (a plausible scenario across multiple turns, interrupts, or advisor exchanges) fell through to the generic backoff ladder with the payload still unstripped, resending it unchanged until the 30-minute wall-clock budget expired and the turn failed visibly with the raw refusal. Replaced the one-shot flag with a bounded, re-triggerable streak: the degrade now fires again for each distinct occurrence (gated on whether there is actually new unsigned thinking to strip, not on session history), capped at 3 consecutive fast-degrades with no intervening success before falling through to the wall-clock-bounded ladder, and resets on any turn that recovers.
+
 ## [16.4.1] - 2026-07-14
 
 ### Fixed