mindweave 2.5.0 → 3.0.0

package/dist/dynamo/engine.js

@@ -13,8 +13,11 @@
  * the read-only tool exactly like any other tool call — so this whole function
  * can later move to a server unchanged, with tools executing on the client.
  */
+import { readProfile, profilePrompt } from "../memory/profile.js";
+import { narrationShown, noteReads } from "../cli/toolDisplay.js";
 import { activeDriver, ensureDriver, manifestForModel } from "../drivers/registry.js";
 import { summarizeTask, taskLimitReason } from "./pricing.js";
+import { limitGateReason, noteUsage, refreshUsageLimits, takeLimitWarnings } from "./usageLimits.js";
 import { addTurn, emptySpend } from "./spend.js";
 import { mutationNeedsVerification, isVerification, reScopeCheck, isBackgroundPollStep, stepFailureSignature, repeatFailureStep, repeatFailureNudge, failedActionLabel, firstErrorLine, sameFileEditCounts, overusedSingleEdits, batchEditNudge, narrationFault, narrationNudge, unknownToolError, replyFault, replyRewrite, VERIFY_NUDGE } from "./verify.js";
 import { guardOptions, GUARD_REFUSAL, GUARD_REFUSAL_INPUT, guardRefusalWith, guardQuestion, guardDetail, interpretGuardChoice } from "./guard.js";
@@ -23,19 +26,24 @@ import { findTool, toolSchemas, TOOLS } from "../tools/registry.js";
 import { deferredToolsIndex } from "../tools/deferredNative.js";
 import { prefixPrint, diffPrefix, cacheCallLine, writeCacheLog } from "./cacheBreak.js";
 import { commandShellLabel } from "../tools/runCommand.js";
+import { uiLiveState } from "../tools/ui.js";
+import { isAgenticOnlyRefusal, withAuxModel } from "./auxModel.js";
+import { marathonBlock } from "./marathonPrompt.js";
 import { basePrompt } from "./prompt.js";
 import { basename } from "node:path";
 import { randomUUID } from "node:crypto";
 import { promises as fsp } from "node:fs";
 import { relativize, resolvePath, rootLabel, rootsOf } from "../tools/paths.js";
 import { renderRules, renderSkillCatalog, reloadGovernance, governanceStamp, rescope } from "../governor/index.js";
-import { forkSession, reloadProjectMemory } from "../memory/session.js";
+import { writesAgentState, snapshotAgentState, recordAgentStateChanges } from "../tools/stateCheckpoint.js";
+import { forkSession, reconcileInterruptedTools, reloadProjectMemory, repairToolCallOrder } from "../memory/session.js";
 import { selectActiveFiles } from "../memory/workingSet.js";
 import { directoryNotesFor } from "../memory/projectNotes.js";
 import { rippleCheck } from "../tools/editRipple.js";
 import { fullReadPaths } from "../memory/presence.js";
 import { RESTORE_MAX_TOKENS_PER_FILE, renderRestored, restoreBudgetFor, selectForRestore, } from "../memory/restore.js";
-import { KEEP_LAST_N, KEEP_LAST_N_BOUNDARY, summaryRequest, SUMMARY_SYSTEM_PROMPT, dropOldestRounds, estimateEntriesTokens, estimateTokens, estimateTokensForChars, formatTranscriptForSummary, isContinuation, microcompact, spliceSummary, usableSummary, } from "../memory/compaction.js";
+import { KEEP_LAST_N, KEEP_LAST_N_BOUNDARY, summaryRequest, SUMMARY_SYSTEM_PROMPT, dropOldestRounds, estimateEntriesTokens, estimateTokens, estimateTokensForChars, formatTranscriptForSummary, isContinuation, microcompact, spliceSummary, summaryForWire, summaryIsHistory, usableSummary, } from "../memory/compaction.js";
+import { MAX_PARALLEL_CALLS, partitionCalls, runLimited } from "./toolBatches.js";
 import { loadPlanArtifact, completePlanArtifact, renderPlanBlock, planDivergenceStop } from "./planArtifact.js";
 import { autoCompactThreshold, microCompactThreshold, cacheLikelyCold, clearIsWorthIt, measuredOverhead, sharpContextWindow, } from "./contextWindow.js";
 import { renderSessionMemory, shouldUpdateSessionMemory, updateSessionMemory } from "../memory/sessionMemory.js";
@@ -43,6 +51,7 @@ import { compactFromSessionMemory } from "../memory/sessionMemoryCompact.js";
 import { isContextOverflowError } from "../drivers/contextOverflow.js";
 import { detailOf, providerMessage } from "../drivers/providerError.js";
 import { transcriptPath } from "../memory/store.js";
+import { replaceTranscript } from "../memory/earlier.js";
 /** Stop retrying autocompact after this many consecutive failures in a session, so a
  *  transcript that's irrecoverably over the limit can't hammer the summarizer each turn
  *  (a circuit-breaker for runaway retry loops, which can otherwise pile up thousands of doomed retries). */
@@ -55,14 +64,19 @@ const MAX_COMPACT_FAILURES = 3;
 // line we hold is the thin-prompt boundary: rich on what the harness owns, but
 // we still do NOT teach engineering judgment (how to debug, how to write code) —
 // that is the model's job.
-export function staticSystemPrompt(projectContext, projectMemory, memoryDir, memoryIndex, governance, workspace, priorSessions = 0) {
+export function staticSystemPrompt(projectContext, projectMemory, memoryDir, memoryIndex, governance, workspace, priorSessions = 0, aboutUser = "") {
     let prompt = basePrompt(commandShellLabel());
+    // The user's own profile (memory/profile.ts): name, experience level, reply style.
+    if (aboutUser)
+        prompt += `
+
+${aboutUser}`;
     if (workspace) {
-        prompt += `
-
-This session spans more than one root folder. Each file is addressed as \`label/path\`; search tools cover every root unless you pass a specific \`path\`. The roots are:
-<workspace>
-${workspace}
+        prompt += `
+
+This session spans more than one root folder. Each file is addressed as \`label/path\`; search tools cover every root unless you pass a specific \`path\`. The roots are:
+<workspace>
+${workspace}
 </workspace>`;
     }
     // NOTE: the user's standing rules are deliberately NOT rendered here. They live
@@ -73,41 +87,41 @@ ${workspace}
     // skills are a reference catalog), so they alone get the salience boost. Keeping
     // them out of the prefix also stops a mid-session `remember_rule` from busting it.
     if (governance.forbidden) {
-        prompt += `
-
-You are FORBIDDEN from modifying these paths — never write, edit, or run a command that changes them. The tools also enforce this and will refuse, but do not even try:
-<forbidden>
-${governance.forbidden}
+        prompt += `
+
+You are FORBIDDEN from modifying these paths — never write, edit, or run a command that changes them. The tools also enforce this and will refuse, but do not even try:
+<forbidden>
+${governance.forbidden}
 </forbidden>`;
     }
     if (governance.forbiddenCommands) {
-        prompt += `
-
-You are FORBIDDEN from running these commands (or any command that contains one) — run_command will refuse them and only the user can lift that. Do not attempt them or a workaround:
-<forbidden_commands>
-${governance.forbiddenCommands}
+        prompt += `
+
+You are FORBIDDEN from running these commands (or any command that contains one) — run_command will refuse them and only the user can lift that. Do not attempt them or a workaround:
+<forbidden_commands>
+${governance.forbiddenCommands}
 </forbidden_commands>`;
     }
     if (governance.skills) {
-        prompt += `
-
-You have project skills available — named procedures you can run. To run one, call use_skill with its name; its full steps are loaded then (you only see the summary here). Use one when its description fits the task:
-<available_skills>
-${governance.skills}
+        prompt += `
+
+You have project skills available — named procedures you can run. To run one, call use_skill with its name; its full steps are loaded then (you only see the summary here). Use one when its description fits the task:
+<available_skills>
+${governance.skills}
 </available_skills>`;
     }
     if (projectContext) {
-        prompt += `
-
-The following describes the project and machine you're working in, captured at the start of this session (a snapshot — use tools for anything current or deeper):
+        prompt += `
+
+The following describes the project and machine you're working in, captured at the start of this session (a snapshot — use tools for anything current or deeper):
 ${projectContext}`;
     }
     if (projectMemory) {
-        prompt += `
-
-The project provides this context in its MINDWEAVE.md — treat it as background facts about this codebase:
-<project_memory>
-${projectMemory}
+        prompt += `
+
+The project provides this context in its MINDWEAVE.md — treat it as background facts about this codebase:
+<project_memory>
+${projectMemory}
 </project_memory>`;
     }
     // Its own past work in this project. The COUNT goes in the prompt (so the model
@@ -117,16 +131,16 @@ ${projectMemory}
     // and a question about past work gets a real answer instead of a deflection.
     if (priorSessions > 0) {
         const s = priorSessions === 1 ? "" : "s";
-        prompt += `
-
+        prompt += `
+
 You have worked in this project before: ${priorSessions} earlier session${s} of yours are saved, and you can read them. When the user refers to earlier work — "last session", "what did we do", "the bug we fixed" — call \`sessions\` to list them, then \`sessions\` again with an id to read the one they mean, and answer from what you find. It is not in your tool list until you load it with find_tools. Do not say you cannot see your past sessions, and do not guess from the project files instead. \`/continue\` is for the user to RESUME a session; it is not a substitute for you looking. Never present another tool's saved conversations as your own.`;
     }
     if (memoryDir) {
-        prompt += `
-
-Your cross-session memory for this project lives in \`${memoryDir}\` (read or grep the topic files there for the full text of any entry). Its index:
-<memory_index>
-${memoryIndex || "(empty — nothing has been saved to memory yet)"}
+        prompt += `
+
+Your cross-session memory for this project lives in \`${memoryDir}\` (read or grep the topic files there for the full text of any entry). Its index:
+<memory_index>
+${memoryIndex || "(empty — nothing has been saved to memory yet)"}
 </memory_index>`;
     }
     // The deferred pool's index. Roughly forty tokens standing in for several hundred of
@@ -134,8 +148,8 @@ ${memoryIndex || "(empty — nothing has been saved to memory yet)"}
     // missing feature, and the model routes around a capability it actually has.
     const deferred = deferredToolsIndex();
     if (deferred) {
-        prompt += `
-
+        prompt += `
+
 ${deferred}`;
     }
     return prompt;
@@ -158,7 +172,9 @@ export function volatileContext(rules, planMode, sessionMemory, approvedPlan = "
 /** Notes for the folders being worked in right now (see memory/projectNotes.ts). */
 directoryNotes = [], 
 /** Where the previous turn left the shell, when this turn started back at the root. */
-cwdResetFrom = "") {
+cwdResetFrom = "", 
+/** A running Marathon's standing block (see marathonPrompt.ts), or "". */
+marathon = "") {
     const parts = [];
     // Each turn starts at the project root, and a model that `cd`-ed into a subfolder last
     // turn does not know that unless it is told. It was not, and a real session ran
@@ -195,6 +211,10 @@ cwdResetFrom = "") {
             "you following that plan. Do not write the plan out as an ordinary reply and stop — prose between steps is " +
             "shortened before the user sees it, so a plan presented that way reaches them in pieces.");
     }
+    // A running Marathon is standing instruction like the approved plan: rendered fresh
+    // every request so compaction cannot lose what the run is for.
+    if (marathon)
+        parts.push(marathon);
     // The maintained session state — first in the volatile tail so the model reads
     // "here's where we are" before the map/task list. Survives compaction.
     const memBlock = renderSessionMemory(sessionMemory);
@@ -451,6 +471,12 @@ function workspaceText(session) {
 function modelSeesImages(session) {
     return manifestForModel(session.modelConfig.model).acceptsImages?.(session.modelConfig.model) ?? false;
 }
+/** "JPG and PNG" from `["image/png", "image/jpeg"]` — the names a user knows the files by. */
+export function imageTypeNames(types) {
+    const names = types.map((t) => ({ "image/jpeg": "JPG", "image/png": "PNG", "image/gif": "GIF", "image/webp": "WebP" })[t] ?? t);
+    const sorted = [...new Set(names)].sort();
+    return sorted.length <= 1 ? (sorted[0] ?? "") : `${sorted.slice(0, -1).join(", ")} and ${sorted[sorted.length - 1]}`;
+}
 async function loadImagePayloads(session) {
     // Nothing to load for a model that cannot look at one. This is the /provider switch
     // case: a picture attached while a vision model was running stays in the transcript,
@@ -476,12 +502,19 @@ async function loadImagePayloads(session) {
     }));
     return out;
 }
+/** What the wire carries in place of an assistant reply that had no words (see buildRequest). */
+export const EMPTY_REPLY_PLACEHOLDER = "(no reply)";
 function buildRequest(session, tools, imagePayloads = new Map(), 
 /** Notes for the folders in play, resolved by the caller (it has to read disk). */
 directoryNotes = []) {
     const canSeeImages = modelSeesImages(session);
+    // The formats it takes, when narrower than everything core attaches. A manifest fact,
+    // like vision itself; absent means every type.
+    const imageTypes = canSeeImages
+        ? manifestForModel(session.modelConfig.model).imageTypes?.(session.modelConfig.model)
+        : undefined;
     const messages = [];
-    for (const e of session.transcript) {
+    for (const [i, e] of session.transcript.entries()) {
         if (e.role === "user" || e.role === "summary") {
             // Attached images ride with the message, but only while their payload is still
             // live: microcompaction drops the refs once the turn is old, and a file deleted
@@ -491,11 +524,16 @@ directoryNotes = []) {
             // A message that arrived mid-turn is framed HERE rather than being stored framed,
             // so the transcript keeps what the person typed and only the wire carries the
             // explanation. Deterministic from the entry, so the cached prefix is unaffected.
-            const said = e.role === "user" && e.arrival ? arrivalNote(e.arrival, e.content) : e.content;
+            // A summary is sent as background once the user has written after it, so its
+            // hand-off "next step" cannot keep overriding what they actually asked.
+            const said = e.role === "summary"
+                ? summaryForWire(e.content, summaryIsHistory(e, session.transcript.slice(i + 1)))
+                : e.arrival ? arrivalNote(e.arrival, e.content) : e.content;
             if (refs && refs.length > 0) {
                 const images = [];
                 const missing = [];
                 const unseen = [];
+                const wrongType = [];
                 for (const ref of refs) {
                     // Told, never silently dropped. A message that mentions a screenshot and
                     // carries nothing reads to the model as a picture it failed to notice; the
@@ -504,6 +542,12 @@ directoryNotes = []) {
                         unseen.push(basename(ref.path));
                         continue;
                     }
+                    // A format the provider would reject: held back the same way, so the model
+                    // can tell the user which formats work instead of the whole request failing.
+                    if (imageTypes && !imageTypes.includes(ref.mediaType)) {
+                        wrongType.push(basename(ref.path));
+                        continue;
+                    }
                     const data = imagePayloads.get(ref.path);
                     if (data)
                         images.push({ path: ref.path, mediaType: ref.mediaType, data });
@@ -514,10 +558,17 @@ directoryNotes = []) {
                     ...(unseen.length > 0
                         ? [`${unseen.join(", ")} was attached, but the model now running cannot see images`]
                         : []),
+                    ...(wrongType.length > 0 && imageTypes
+                        ? [
+                            `${wrongType.join(", ")} was attached but not sent: the model now running ` +
+                                `accepts only ${imageTypeNames(imageTypes)} images, so tell the user to ` +
+                                `convert it or switch models`,
+                        ]
+                        : []),
                     ...(missing.length > 0 ? [`${missing.join(", ")} could not be read from disk`] : []),
                 ];
-                const content = notes.length > 0 ? `${said}
-
+                const content = notes.length > 0 ? `${said}
+
 [${notes.join("; ")}]` : said;
                 messages.push({ role: "user", content, ...(images.length > 0 ? { images } : {}) });
                 continue;
@@ -525,10 +576,15 @@ directoryNotes = []) {
             messages.push({ role: "user", content: said });
         }
         else if (e.role === "assistant") {
+            const calls = e.toolCalls && e.toolCalls.length > 0;
             messages.push({
                 role: "assistant",
-                content: e.content,
-                ...(e.toolCalls && e.toolCalls.length > 0 ? { tool_calls: toWire(e.toolCalls) } : {}),
+                // A reply with no words and no tool calls (an empty completion, a filtered one) is
+                // stored as it came, but several providers reject an empty assistant message and it
+                // would be sent on every later request. A placeholder goes on the wire instead; a
+                // message that carries tool calls may have no words and is left alone.
+                content: calls || e.content.trim() !== "" ? e.content : EMPTY_REPLY_PLACEHOLDER,
+                ...(calls ? { tool_calls: toWire(e.toolCalls) } : {}),
             });
         }
         else {
@@ -542,7 +598,7 @@ directoryNotes = []) {
     // END of the system prompt. The end, because everything before it is the prefix every
     // session shares and caches against; appending leaves that untouched.
     const agentPrompt = session.toolContext.agentPrompt;
-    const base = staticSystemPrompt(session.projectContext, session.projectMemory, session.memoryDir, session.memoryIndex, gov, workspaceText(session), session.priorSessions);
+    const base = staticSystemPrompt(session.projectContext, session.projectMemory, session.memoryDir, session.memoryIndex, gov, workspaceText(session), session.priorSessions, profilePrompt(readProfile()));
     return {
         system: agentPrompt ? `${base}\n\n${agentPrompt}` : base,
         messages,
@@ -557,6 +613,11 @@ directoryNotes = []) {
         // the command's own result says where it is now.
         session.toolContext.cwdResetFrom && session.toolContext.cwd === session.cwd
             ? relativize(session.toolContext, session.toolContext.cwdResetFrom)
+            : "", 
+        // Lead agent only: a fork inherits `marathon` by reference, and a verifier told to
+        // "keep working toward the goal" would stop being an independent check.
+        session.marathon?.status === "running" && (session.toolContext.subagentDepth ?? 0) === 0
+            ? marathonBlock(session.marathon.goal, session.marathon.turnsSpent === 0 ? "plan" : "run")
             : ""),
         tools,
         model: session.modelConfig,
@@ -582,14 +643,27 @@ async function backgroundEventNotes(session) {
  * app", which blamed the user for the agent's own restart and gave the model a second,
  * contradictory account of the same event.
  */
-export function backgroundEventNote({ info, kind, tail, wake, }) {
+export function backgroundEventNote({ info, kind, tail, wake, ports, }) {
     // It came up. This is the only positive event a server ever produces, and it is
     // what lets the model actually deliver the "I'll tell you when it's running" it
     // was told to say. Nothing has gone wrong, so there is nothing to fix.
+    // Something it started opened a port after it was already running: typically the app
+    // a build was producing has opened (its window, its debugging port), which is what an
+    // agent that ended its turn to "wait for the app" was waiting for.
+    if (kind === "opened") {
+        const list = (ports ?? []).join(", ");
+        return (`[Background shell #${info.id} (\`${info.command}\`) opened port ${list}.]\n` +
+            `Recent output:\n${tail || "(no output)"}\n\n` +
+            `Something it started is now listening there: usually the app or server you were waiting for has ` +
+            `opened. If you were waiting for it, carry on now (for an app's debugging port, call ui with that ` +
+            `port). If you were not, there is nothing to do. Nothing is wrong: do not restart it.`);
+    }
     if (kind === "ready") {
-        return (`[Background shell #${info.id} (\`${info.command}\`) is up and running.]\n` +
+        const on = info.listening?.length ? ` (listening on port ${info.listening.join(", ")})` : "";
+        return (`[Background shell #${info.id} (\`${info.command}\`) is up and running${on}.]\n` +
             `Recent output:\n${tail || "(no output)"}\n\n` +
-            `Tell the user in one short line that it's running. Nothing is wrong — do not investigate, ` +
+            `Tell the user in one short line that it's running, and do not repeat anything you already said ` +
+            `about it. Nothing is wrong — do not investigate, ` +
             `do not restart it, and do not change any files because of this. Running only means the ` +
             `process started: do not describe what it shows or say a change is visible unless you ` +
             `have actually looked.`);
@@ -677,7 +751,7 @@ export function callIsConcurrencySafe(tool, args) {
  * an unreadable rules directory must not take the turn down with it — on any failure the
  * session simply keeps the governance it already had.
  */
-async function refreshGovernance(session, force = false) {
+export async function refreshGovernance(session, force = false) {
     try {
         const stamp = await governanceStamp(session.toolContext.cwd);
         // Skipping when the stamp is unchanged is what keeps our OWN writes from causing a
@@ -738,13 +812,13 @@ export async function respond(session, options = {}) {
 function implementFromScratch(priorPath, plan) {
     const path = priorPath;
     const where = path
-        ? `
-
+        ? `
+
 If you need something exact from the planning that produced this — a snippet, an ` +
             `error message, a path — the full conversation is at: ${path}`
         : "";
-    return `Implement the following plan:
-
+    return `Implement the following plan:
+
 ${plan}${where}`;
 }
 /**
@@ -781,11 +855,23 @@ async function respondTurn(session, options = {}) {
     // every subsequent turn, and it keeps `activeDriver()` safe to call synchronously
     // from here down (including from inside a tool).
     await ensureDriver(session.modelConfig.model);
+    // Bring the user's usage limits up to date, once per top-level turn. Cheap when they are off
+    // (one small file read); a sub-agent's turn is inside this one and does not repeat it.
+    if ((session.toolContext.subagentDepth ?? 0) === 0)
+        await refreshUsageLimits().catch(() => { });
     // Pick up a governance file the USER edited by hand since the last turn. One stat
     // pass over a few small directories, taken here because a turn is the only moment
     // governance is consulted — so it is fresh exactly where it is used, with no watcher
     // to own, poll or tear down. See refreshGovernance.
     await refreshGovernance(session);
+    // A history the provider would reject is healed here, before anything is sent. The usual
+    // cause is a turn that ended with tool calls still unanswered (a tool that threw, a crash
+    // between the call and its result): every later request would then be refused, and the only
+    // cure used to be restarting, which repairs the same thing on load. Both repairs return the
+    // same array when there is nothing to do, so a healthy session pays one scan per turn.
+    const healed = reconcileInterruptedTools(repairToolCallOrder(session.transcript), "the turn ended before this tool returned");
+    if (healed !== session.transcript)
+        session.transcript = healed;
     // Resume an approved plan from disk, once per session (undefined = unchecked).
     // A plan approved last session is still the agreed scope this session — that is
     // the point of it being an artifact — and the user deleting the file (or its
@@ -840,7 +926,13 @@ async function respondTurn(session, options = {}) {
     // Session): fork a scoped child, forward the child's usage to this turn's meter,
     // and share this turn's abort signal so Esc stops a sub-agent too.
     session.toolContext.forkChild = (task, opts) => forkSession(session, task, opts);
-    session.toolContext.reportUsage = (u) => options.onEvent?.({ type: "usage", ...u });
+    session.toolContext.reportUsage = (u) => {
+        options.onEvent?.({ type: "usage", ...u });
+        // A sub-agent's calls arrive here as events, but its own turn already counted them toward the
+        // limits; only a bare usage (a page-summarising call, say) is new.
+        if (!("type" in u))
+            countUsage(session, u, options);
+    };
     // The raw event sink, so spawn_subagent can surface a child's nested activity
     // (its lifecycle + tagged tool calls) up this same stream instead of running dark.
     session.toolContext.emitEvent = options.onEvent;
@@ -916,6 +1008,7 @@ async function respondTurn(session, options = {}) {
     // Narration budget: one nudge per turn, and the turn's earlier prose to compare against.
     let narrationNudged = false;
     const narratedBefore = [];
+    const readThisTurn = new Set(); // files read so far, for narrationShown
     // Judged next to the prose, pushed after the tool results — see the gate below.
     let pendingNarrationFault = null;
     let lastFailSig = null;
@@ -932,6 +1025,12 @@ async function respondTurn(session, options = {}) {
     // no matter how the turn ends (finish, pause, interrupt, throw). Labeled with
     // the request that drove it. No-op when nothing was edited.
     const turnLabel = lastUserText(session);
+    // The message that opened this turn, stamped now if the save that normally stamps it
+    // has not run yet. The checkpoint below carries that stamp, which is how a rewind to
+    // this message (or any earlier one) finds the file changes to take back with it.
+    const opener = turnOpener(session);
+    if (opener && opener.ts === undefined)
+        opener.ts = Date.now();
     // Fold this turn's cost into the session total on the way out, however the turn ends.
     // In the `finally` rather than the success path on purpose: an interrupted or failed
     // turn still spent the tokens it spent, and a spend figure that quietly omits the
@@ -968,7 +1067,7 @@ async function respondTurn(session, options = {}) {
     finally {
         recordSpend();
         const before = session.toolContext.checkpoints?.list().length ?? 0;
-        session.toolContext.checkpoints?.seal(turnLabel);
+        session.toolContext.checkpoints?.seal(turnLabel, opener?.ts);
         // Say that a restore point exists. It was made silently, so `/undo` was a feature
         // you had to already know about — and the moment to learn it is the moment there is
         // something to undo, not after you have lost it.
@@ -982,11 +1081,16 @@ async function respondTurn(session, options = {}) {
         for (let step = 0; stepLimit === undefined || step < stepLimit; step++) {
             if (options.signal?.aborted)
                 return interrupted(session);
+            // The user's own usage limit: a step that began under it has finished, so this is the
+            // boundary. Nothing is lost; the work carries on once the window reopens.
+            const heldBack = (session.toolContext.subagentDepth ?? 0) === 0 ? limitGateReason() : null;
+            if (heldBack)
+                return pauseTask(session, options, heldBack, "limit");
             // Stop before another (billable) call if a cost/time ceiling is hit — pause
             // losslessly, exactly like the step budget, so the user can raise it and resume.
             const limitReason = taskLimitReason(summarizeTask(usages, session.modelConfig.model), Date.now() - startedAt, limits);
             if (limitReason)
-                return pauseTask(session, options, `hit the ${limitReason}`);
+                return pauseTask(session, options, `hit the ${limitReason}`, "costTimeLimit");
             await maybeCompact(session, options);
             // NO working-set block is built or sent. It used to be: the current contents of
             // every active file, rebuilt each step and injected at the tail — up to 12K tokens
@@ -1086,7 +1190,7 @@ async function respondTurn(session, options = {}) {
                 if (!shed)
                     return false;
                 overflowRecovered = true;
-                session.transcript = shed;
+                replaceTranscript(session, shed);
                 await options.persist?.();
                 options.onActivity?.("conversation was too long — dropped the oldest turns and retried", {
                     context: true,
@@ -1119,6 +1223,7 @@ async function respondTurn(session, options = {}) {
             // may span several calls across tool rounds, and the UI sums them.
             emitUsage(result, options);
             if (result.usage) {
+                countUsage(session, result.usage, options);
                 usages.push(result.usage);
                 usageTimes.push(Date.now());
                 writeCacheLog(cacheCallLine({
@@ -1155,7 +1260,7 @@ async function respondTurn(session, options = {}) {
                 if (content.trim())
                     session.transcript.push({ role: "assistant", content });
                 await options.persist?.();
-                return pauseTask(session, options, note);
+                return pauseTask(session, options, note, result.stop);
             }
             // No tool calls → the model is done. Record the reply.
             if (toolCalls.length === 0) {
@@ -1221,6 +1326,13 @@ async function respondTurn(session, options = {}) {
             // Durable BEFORE running the tools: if the machine dies mid-tool, the resume path
             // sees these dangling tool_calls and reconciles them (reconcileInterruptedTools).
             await options.persist?.();
+            // Whether the words above lead to anything on screen, before any tool is announced.
+            {
+                const calls = toolCalls.map((c) => ({ name: c.name, args: parseArgs(c.arguments) }));
+                if (content.trim())
+                    options.onEvent?.({ type: "narration", shown: narrationShown(calls, readThisTurn) });
+                noteReads(calls, readThisTurn);
+            }
             // Narration gate, part one: JUDGE here, where this message's prose and the turn's
             // earlier prose are both in hand. Do NOT push anything yet — an assistant message
             // carrying tool_calls must be followed immediately by a tool message per call, and
@@ -1234,11 +1346,20 @@ async function respondTurn(session, options = {}) {
             // Announce every tool the model chose, in its order, BEFORE running any —
             // the UI's reveal queue paces them and a slow tool (test/run) can show a live
             // "running" state until its end event lands.
-            for (const call of toolCalls) {
+            // A row is announced when its tool actually STARTS, not up front for the whole step.
+            // Announcing every call at once showed a command as running while a Sentinel prompt
+            // for an earlier call was still waiting, and kept rows appearing behind an open
+            // question: work on screen that nobody had approved. A call that never runs (declined,
+            // refused, interrupted) is announced together with its end, so it still gets its row.
+            const announced = new Set();
+            const announce = (call) => {
+                if (announced.has(call.id))
+                    return;
+                announced.add(call.id);
                 options.onEvent?.({ type: "tool", phase: "start", id: call.id, name: call.name, args: parseArgs(call.arguments) });
-            }
-            // Concurrency-safe calls run in PARALLEL; the rest run one at a time, in order
-            // (parallel edits to one file race, and an edit must see the last write). A call
+            };
+            // Consecutive concurrency-safe calls run in PARALLEL; every other call runs alone, in
+            // order (parallel edits to one file race, and an edit must see the last write). A call
             // is concurrency-safe when the tool says so for THESE args (isConcurrencySafe) —
             // e.g. a read-only sub-agent, which lets the model fan out research — otherwise
             // the default is: read-only ⇒ safe, mutating ⇒ serial.
@@ -1246,8 +1367,9 @@ async function respondTurn(session, options = {}) {
                 const tool = lookup(call.name);
                 return tool ? callIsConcurrencySafe(tool, parseArgs(call.arguments)) : false;
             };
-            const parallelCalls = toolCalls.filter(concurrencySafe);
-            const serialCalls = toolCalls.filter((call) => !concurrencySafe(call));
+            // Batches keep the model's ORDER (toolBatches.ts): a read written after an edit has to
+            // see the edit, so read-only calls are only grouped with their neighbours.
+            const batches = partitionCalls(toolCalls, concurrencySafe);
             const runCall = async (call) => {
                 // Esc: once the turn is aborted, no further tool may START. The step loop only
                 // re-checks BETWEEN steps, so without this gate the rest of a batch still runs
@@ -1320,7 +1442,10 @@ async function respondTurn(session, options = {}) {
                 // uniformly — including subagent edits. Fails safe: no approval channel, or an
                 // unclear answer, refuses rather than runs.
                 const ctx = session.toolContext;
-                if (!tool.readOnly && ctx.guarded && !ctx.guardAllowed?.has(call.name)) {
+                // Two kinds of standing "yes": one given during this session (guardAllowed), and
+                // one the user saved in their permissions, for this project or every project.
+                const savedYes = ctx.governance?.sentinelAllow?.includes(call.name) === true;
+                if (!tool.readOnly && ctx.guarded && !ctx.guardAllowed?.has(call.name) && !savedYes) {
                     const args = parseArgs(call.arguments);
                     // The question is one line; WHAT is about to happen rides as detail, which the
                     // CLI prints into the transcript. A gate the user cannot read is a gate they
@@ -1365,21 +1490,61 @@ async function respondTurn(session, options = {}) {
                 // Zero threw — every one returned an error result. So this catches nothing today
                 // and is deliberately defence in depth: it removes a single point of failure
                 // rather than fixing an observed bug, and the next tool added inherits it.
+                announce(call); // approved (or needing no approval): now it is really running
+                // A command waits until its row is actually on screen before it starts, when the caller
+                // paces the screen. Otherwise the screen, which shows one thing at a time, replays a
+                // command that finished long ago and its "running" state is never real. Only commands:
+                // reads and edits take milliseconds, and holding them back would only slow the turn.
+                if (tool.liveRow && options.beforeLiveTool) {
+                    await options.beforeLiveTool(call.id);
+                    if (options.signal?.aborted) {
+                        return {
+                            call,
+                            output: "Not run: the turn was interrupted before this tool started.",
+                            summary: "interrupted",
+                            isError: true,
+                            detail: undefined,
+                        };
+                    }
+                }
                 let result;
                 try {
                     // A per-call channel, so a tool that runs for minutes can say what it is doing.
                     // Scoped to THIS call rather than hung on the shared context, which every tool in
                     // the turn holds the same instance of — with two commands in flight there would be
                     // no way to tell whose output was whose.
-                    result = await tool.execute(parseArgs(call.arguments), session.toolContext, {
-                        progress: (text) => options.onEvent?.({ type: "tool", phase: "progress", id: call.id, text }),
-                    });
+                    // Memories, rules, skills, permissions and MCP servers are written by their own
+                    // helpers, not the edit tools; snapshotting around the call puts them in the same
+                    // undo net as project files, so /undo and a rewind take them back too.
+                    const stateBefore = session.toolContext.checkpoints && writesAgentState(call.name)
+                        ? await snapshotAgentState(session.toolContext)
+                        : null;
+                    try {
+                        result = await tool.execute(parseArgs(call.arguments), session.toolContext, {
+                            progress: (text) => options.onEvent?.({ type: "tool", phase: "progress", id: call.id, text }),
+                        });
+                    }
+                    finally {
+                        if (stateBefore)
+                            await recordAgentStateChanges(session.toolContext, stateBefore);
+                    }
                 }
                 catch (error) {
-                    // An abort is the user, not a fault: let it travel so the loop's own handling
-                    // reports an interruption instead of a broken tool.
-                    if (isAbort(error))
-                        throw error;
+                    // An abort is the user, not a fault, so it is NOT reported as a broken tool. But it
+                    // must not travel out of the loop either: the assistant message carrying these calls
+                    // is already saved, so a throw here leaves calls with no results, and every later
+                    // request in the live session is then malformed until the app is restarted. It is
+                    // recorded as an interrupted call instead; when the turn really was stopped the next
+                    // pass through the loop sees the abort and ends the turn cleanly.
+                    if (isAbort(error)) {
+                        return {
+                            call,
+                            output: "Not completed: this call was interrupted before it finished, so its effect is unknown. Check the current state before relying on it.",
+                            summary: "interrupted",
+                            isError: true,
+                            detail: undefined,
+                        };
+                    }
                     return { call, ...toolFailureResult(call.name, error), detail: undefined };
                 }
                 return {
@@ -1388,10 +1553,13 @@ async function respondTurn(session, options = {}) {
                     summary: result.summary,
                     isError: result.isError,
                     detail: result.detail,
+                    detailFull: result.detailFull,
                     detailKind: result.detailKind,
                     quiet: result.quiet,
                     fullContentOf: result.fullContentOf,
                     images: result.images,
+                    web: result.web,
+                    ui: result.ui,
                     displayKind: result.displayKind,
                     displayName: result.displayName,
                     awaitsModel: result.awaitsModel,
@@ -1403,6 +1571,7 @@ async function respondTurn(session, options = {}) {
             // the model's call order (the sort below); only the UI events go out eagerly.
             const runAndEmit = async (call) => {
                 const r = await runCall(call);
+                announce(r.call); // one that never ran gets its start now, right before its end
                 options.onEvent?.({
                     type: "tool",
                     phase: "end",
@@ -1411,16 +1580,23 @@ async function respondTurn(session, options = {}) {
                     summary: r.summary ?? r.call.name,
                     error: r.isError ?? false,
                     detail: r.detail,
+                    ...("detailFull" in r && r.detailFull ? { detailFull: r.detailFull } : {}),
                     ...(r.detailKind ? { detailKind: r.detailKind } : {}),
                     ...(r.quiet ? { quiet: true } : {}),
                     ...(r.displayKind ? { displayKind: r.displayKind } : {}),
                     ...(r.displayName ? { displayName: r.displayName } : {}),
+                    ...(r.images?.length ? { images: r.images.map((i) => i.path) } : {}),
+                    ...(r.web ? { web: r.web } : {}),
+                    ...(r.ui ? { ui: r.ui } : {}),
                 });
                 return r;
             };
-            const results = await Promise.all(parallelCalls.map(runAndEmit));
-            for (const call of serialCalls) {
-                results.push(await runAndEmit(call));
+            const results = [];
+            for (const batch of batches) {
+                if (batch.parallel)
+                    results.push(...(await runLimited(batch.calls, MAX_PARALLEL_CALLS, runAndEmit)));
+                else
+                    results.push(await runAndEmit(batch.calls[0]));
             }
             // Hand results back in the model's original call order (start events were emitted
             // in that order too), no matter which lane each call ran in.
@@ -1465,6 +1641,9 @@ async function respondTurn(session, options = {}) {
                     ...(result.quiet ? { quiet: true } : {}),
                     ...(result.displayName ? { displayName: result.displayName } : {}),
                     ...(result.displayKind ? { displayKind: result.displayKind } : {}),
+                    ...(result.images?.length ? { imagePaths: result.images.map((i) => i.path) } : {}),
+                    ...(result.web ? { web: result.web } : {}),
+                    ...(result.ui ? { ui: result.ui } : {}),
                     ...(result.isError ? { isError: true } : {}),
                     // Presence, as recorded by the tool that knows: this result IS the whole
                     // content of that file. Not display — the presence derivation reads it.
@@ -1734,10 +1913,19 @@ async function respondTurn(session, options = {}) {
         // transcript, task list, and working set are all intact, so telling Mindweave to
         // continue resumes exactly here with nothing lost, and the user stays in control of
         // the spend.
-        return pauseTask(session, options, `reached the step budget of ${stepLimit} tool steps in one turn`);
+        return pauseTask(session, options, `reached the step budget of ${stepLimit} tool steps in one turn`, "stepBudget");
     }
 }
 /** The most recent user request in the transcript, clipped — labels a checkpoint. */
+/** The last message the person sent, which is what this turn is answering. */
+function turnOpener(session) {
+    for (let i = session.transcript.length - 1; i >= 0; i--) {
+        const e = session.transcript[i];
+        if (e.role === "user" && !e.synthetic)
+            return e;
+    }
+    return undefined;
+}
 function lastUserText(session) {
     for (let i = session.transcript.length - 1; i >= 0; i--) {
         const e = session.transcript[i];
@@ -1769,6 +1957,7 @@ function endTurnWith(session, options, msg) {
  *  one in the same turn (the re-scope guard) — a natural checkpoint to let the user
  *  steer instead of the model taking on scope it wasn't asked for. */
 function pauseReScope(session, options) {
+    options.onPause?.("reScope");
     return endTurnWith(session, options, "(I've finished the task list for what you asked. I have ideas for taking it " +
         "further, but I've stopped here so you can steer — rather than piling on new scope " +
         'on my own. Tell me which direction you want, or say "keep going" to continue.)');
@@ -1778,6 +1967,7 @@ function pauseReScope(session, options) {
  *  to do but wait — end the turn cleanly instead of looping "still running" checks.
  *  Deliberately worded as a status line to the user, not a "paused" apology. */
 function pauseForBackgroundPoll(session, options) {
+    options.onPause?.("backgroundPoll");
     return endTurnWith(session, options, "It's still running in the background. I'll stop checking and let you know as soon " +
         "as it finishes — no need to keep watching.");
 }
@@ -1786,13 +1976,22 @@ function pauseForBackgroundPoll(session, options) {
  *  count, and its real working directory, and it still hasn't moved — so hand the wheel
  *  to the user rather than spend more steps on it. */
 function pauseForRepeatedFailure(session, options, errorOutput) {
+    options.onPause?.("repeatedFailure");
     return endTurnWith(session, options, `I've hit the same failure several times in a row and I'm not making progress, so I've ` +
         `stopped rather than retry the same thing again. The error was:\n\n${firstErrorLine(errorOutput)}\n\n` +
         `Tell me how you'd like to proceed, or I can try a different approach.`);
 }
 /** Record and return a clean, lossless pause reply (well-formed transcript) when a
- *  guard trips — step budget or a cost/time ceiling. Saying "continue" resumes. */
-function pauseTask(session, options, reason) {
+ *  guard trips — step budget or a cost/time ceiling. Saying "continue" resumes.
+ *  `tag` tells the two apart for `onPause`; the prose reason stays a free string since
+ *  it already carries the exact number ("the step budget of 40 tool steps"). */
+function pauseTask(session, options, reason, tag) {
+    options.onPause?.(tag);
+    // A usage limit is not something to argue with by saying "continue": it lifts on its own.
+    if (tag === "limit") {
+        return endTurnWith(session, options, `(Paused — ${reason}. The task isn't finished, but nothing is lost: your progress, edits, and task ` +
+            `list are saved. Carry on once it opens.)`);
+    }
     return endTurnWith(session, options, `(Paused — ${reason}. The task isn't finished, but nothing is lost: your progress, ` +
         `edits, and task list are saved. Say "continue" to pick up exactly where I left off.)`);
 }
@@ -1847,6 +2046,18 @@ export function toCallRecord(u, model, at = Date.now()) {
         model,
     };
 }
+/**
+ * A finished model call counts toward the user's limits, and a window crossing 80% or 95%
+ * says so once, as a line in the conversation. Only the top-level turn speaks: a sub-agent's
+ * call is counted, and the parent's next call is what reports where things stand.
+ */
+function countUsage(session, u, options) {
+    noteUsage(session.modelConfig.model, u);
+    if ((session.toolContext.subagentDepth ?? 0) > 0)
+        return;
+    for (const line of takeLimitWarnings())
+        options.onActivity?.(`Usage limit: ${line}`);
+}
 /** Report a turn's token usage to the UI, if the provider returned it. */
 function emitUsage(result, options) {
     if (result.usage) {
@@ -1881,7 +2092,7 @@ async function sweepSessionMemory(session, options) {
     const grown = shouldUpdateSessionMemory(estimateEntriesTokens(session.transcript), session.sessionMemoryTokens ?? 0, session.sessionMemoryInit ?? false);
     if (!grown)
         return;
-    await updateSessionMemory(session);
+    await updateSessionMemory(session, options.signal);
     await options.persist?.(); // durable: the notes sidecar is written by the persister
 }
 /**
@@ -1911,12 +2122,39 @@ export function contextUsed(session) {
         : (session.toolContext.mcp?.estimatedTokens() ?? 0);
     return estimateEntriesTokens(session.transcript) + overhead;
 }
+/**
+ * The auto-compaction bar actually in force for this session: the user's own override
+ * (Settings > Usage > Context, or `/context limit`) if they set one — project first,
+ * then all-projects, per governor/index.ts's context.json — else Mindweave's own
+ * model-anchored default. The env var still wins over either, same as before this
+ * existed: it is the sandbox/CI escape hatch, not a user-facing setting.
+ */
+export function effectiveAutoCompactThreshold(session) {
+    // Optional chaining: a real session always has governance (loadGovernance runs at
+    // session start), but a hand-built test fixture may skip it, and a pure accessor
+    // shouldn't crash on that rather than just falling through to the model default.
+    const base = session.governance?.contextAutoCompactTokens ?? autoCompactThreshold(session.modelConfig.model);
+    return envInt("MINDWEAVE_AUTOCOMPACT_TOKENS", base);
+}
+/**
+ * How full the context is, against the bar auto-compaction fires at: what a front end
+ * draws as the context meter. The same numbers `maybeCompact` decides on, so a full meter
+ * and a compaction cannot disagree.
+ */
+export function contextFill(session) {
+    return {
+        used: contextUsed(session),
+        limit: effectiveAutoCompactThreshold(session),
+        window: sharpContextWindow(session.modelConfig.model),
+    };
+}
 async function maybeCompact(session, options) {
     const model = session.modelConfig.model;
-    // Model-anchored bars (env still overrides), so the thresholds are right per model
-    // instead of a fixed number — and a longer/stronger model automatically gets more room.
+    // Model-anchored bars (env, then the user's own override, still win), so the
+    // thresholds are right per model instead of a fixed number — and a longer/stronger
+    // model automatically gets more room.
     const microBar = envInt("MINDWEAVE_MICROCOMPACT_TOKENS", microCompactThreshold(model));
-    const autoBar = envInt("MINDWEAVE_AUTOCOMPACT_TOKENS", autoCompactThreshold(model));
+    const autoBar = effectiveAutoCompactThreshold(session);
     // MCP tool schemas are sent on every turn but live OUTSIDE the transcript, so the bars
     // could not see them: a 30K-token catalog meant the model was 30K deeper into its real
     // context than this arithmetic believed, and every threshold fired that much too late.
@@ -2021,6 +2259,16 @@ export async function compactNow(session, options = {}) {
 async function autocompact(session, options) {
     if (session.transcript.length === 0)
         return;
+    options.onCompactionStart?.();
+    try {
+        await summarizeAndSplice(session, options);
+    }
+    finally {
+        options.onCompactionEnd?.();
+    }
+}
+/** The body of `autocompact`: the notes when they cover the prefix, else the summarizer. */
+async function summarizeAndSplice(session, options) {
     // Measured BEFORE the summarizer runs, with the same arithmetic the thresholds use,
     // so the bar the user sees is the number the system actually acted on.
     const before = contextUsed(session);
@@ -2042,9 +2290,9 @@ async function autocompact(session, options) {
     // summarizer is about to be paid to produce. When they are current enough to cover
     // the prefix being dropped, spending a model call buys something already owned.
     // Declines rather than approximates: stale or empty notes fall through.
-    const fromNotes = compactFromSessionMemory(session.transcript, session.sessionMemory, session.sessionMemoryEntries, envInt("MINDWEAVE_AUTOCOMPACT_TOKENS", autoCompactThreshold(session.modelConfig.model)), contextUsed(session) - estimateEntriesTokens(session.transcript));
+    const fromNotes = compactFromSessionMemory(session.transcript, session.sessionMemory, session.sessionMemoryEntries, effectiveAutoCompactThreshold(session), contextUsed(session) - estimateEntriesTokens(session.transcript));
     if (fromNotes) {
-        session.transcript = fromNotes.entries;
+        replaceTranscript(session, fromNotes.entries);
         // The notes now describe everything before the tail they were spliced in front of.
         session.sessionMemoryEntries = 1;
         session.sessionMemoryTokens = estimateEntriesTokens(session.transcript);
@@ -2054,15 +2302,31 @@ async function autocompact(session, options) {
     let summary;
     try {
         // Summaries don't need reasoning — use the chosen model with thinking off.
-        const turn = await activeDriver().toolTurn({
-            system: SUMMARY_SYSTEM_PROMPT,
-            messages: [
-                {
-                    role: "user",
-                    content: `${formatTranscriptForSummary(session.transcript)}\n\n${summaryRequest(options.compactFocus)}`,
-                },
-            ],
-            model: { ...session.modelConfig, thinking: false },
+        // With reasoning off where the model allows it; see auxModel.ts.
+        //
+        // `ensureDriver` here, not just at the top of the turn: a sub-agent (or another
+        // background aux call) can run its OWN model in between and leaves `activeDriver()`
+        // pointed at THAT provider, which is a plain global, not scoped to this session. A
+        // compaction landing after one then handed this session's model string to the
+        // wrong provider's API, which correctly refused it as a model it had never heard
+        // of ("Unknown Model, please check the model code.") — same failure shape as the
+        // model call sites in respondTurn, which is why only THIS one call was missing it.
+        //
+        // `withTools`: a real (read-only) tool set, attached only if the model already
+        // refused a bare call — see auxModel.ts for why some free models require it.
+        const turn = await withAuxModel(session.modelConfig, async (model, withTools) => {
+            await ensureDriver(model.model);
+            return activeDriver().toolTurn({
+                system: SUMMARY_SYSTEM_PROMPT,
+                messages: [
+                    {
+                        role: "user",
+                        content: `${formatTranscriptForSummary(session.transcript)}\n\n${summaryRequest(options.compactFocus)}`,
+                    },
+                ],
+                model,
+                ...(withTools ? { tools: toolSchemas({ readOnlyOnly: true }) } : {}),
+            }, { signal: options.signal });
         });
         // The reply is untrusted: a cut-off or all-scratchpad summary must not be allowed
         // to replace the conversation. See usableSummary.
@@ -2070,21 +2334,38 @@ async function autocompact(session, options) {
         // is what keeps the meter honest: a turn that happened to trip the bar spends
         // a whole extra summarisation call, and leaving that out made the figure short
         // by exactly the work nobody could see.
-        if (turn.usage)
+        if (turn.usage) {
             options.onEvent?.({ type: "usage", ...turn.usage });
+            countUsage(session, turn.usage, options);
+        }
         const usable = usableSummary(turn.content, turn.stop);
         if (!usable)
             return void fail(turn.stop && turn.stop !== "end" ? `the summary came back ${turn.stop}` : "the summary was unusable");
         summary = usable;
     }
     catch (error) {
+        // Stopped by the user: not a failed compaction, so nothing to count or report.
+        if (options.signal?.aborted)
+            return;
+        // Some free OpenRouter models gate on the CALLING APP's identity, not the shape of
+        // any one request — real tool schemas (withAuxModel's retry, above) genuinely fix a
+        // model that just needs a non-empty `tools` array, but this specific refusal was
+        // confirmed live to survive that retry too: OpenRouter's own error names the cause
+        // as `"failed_routing_step":"Gate Free Endpoints by Agentic Harness"`, which nothing
+        // Mindweave sends in a request can satisfy. Say so plainly instead of surfacing the
+        // provider's raw JSON, which reads as a Mindweave bug rather than a model limit.
+        if (isAgenticOnlyRefusal(error)) {
+            return void fail(`${session.modelConfig.model} won't serve Mindweave's background calls — some free OpenRouter models restrict ` +
+                `themselves to specific recognised apps, and switching what a request sends can't change that. Pick a ` +
+                `different model for this project, or expect compaction and session notes to stay off on this one.`);
+        }
         return void fail(providerMessage(detailOf(error)) || "the summarizer call failed");
     }
     // A summary replaces the transcript prefix, so file contents read before it are gone.
     // Nothing re-injects them: the working-set block that used to do so was removed for
     // costing up to 12K per model call. The model re-reads what it still needs, which
     // read_file allows because the summary also clears the presence set the dedup checks.
-    session.transcript = spliceSummary(session.transcript, summary, KEEP_LAST_N);
+    replaceTranscript(session, spliceSummary(session.transcript, summary, KEEP_LAST_N));
     // The notes no longer describe the transcript they were measured against, and the
     // summary now covers everything before the kept tail.
     session.sessionMemoryEntries = 1;
@@ -2103,6 +2384,12 @@ async function autocompact(session, options) {
 async function finishCompaction(session, options, before) {
     session.compactFailures = 0; // a clean compaction resets the breaker
     await restoreAfterCompaction(session);
+    // What is still running, said right after the summary: the summary is history, and
+    // may not mention a dev server that is still up or an app still open for testing,
+    // and a model that does not know starts them again.
+    const live = liveStateNote(session.toolContext.backgroundShells?.running() ?? [], uiLiveState(session.toolContext));
+    if (live)
+        session.transcript.splice(1, 0, { role: "user", content: live, synthetic: true });
     // Re-read the governor unconditionally here. The prompt is being rebuilt from scratch
     // at this point, so it is the natural moment to rebuild what it is made of — and it is
     // the one path that does not depend on the stat check being right about anything.
@@ -2126,6 +2413,27 @@ async function finishCompaction(session, options, before) {
     // the moment to pick the file back up, and it costs nothing extra here.
     await reloadProjectMemory(session).catch(() => { });
 }
+/**
+ * The note put after a compaction about what is still running, or null when nothing is
+ * (pure). Background commands are listed with the ports they are listening on, so a
+ * model that has lost the history does not start a second dev server; an app open for
+ * testing is named, with the instruction to look before acting.
+ */
+export function liveStateNote(shells, ui, now = Date.now()) {
+    const lines = [];
+    for (const sh of shells) {
+        const mins = Math.max(0, Math.round((now - sh.startedAt) / 60_000));
+        const ports = sh.listening?.length ? sh.listening : sh.port ? [sh.port] : [];
+        lines.push(`- Background shell #${sh.id} (\`${sh.command}\`): running for ${mins < 1 ? "under a minute" : `${mins} min`}` +
+            `${ports.length ? `, listening on port ${ports.join(", ")}` : ""}.`);
+    }
+    if (ui)
+        lines.push(`- ${ui}`);
+    if (lines.length === 0)
+        return null;
+    return (`[Still running after the compaction. This is the live state now, not history.]\n${lines.join("\n")}\n` +
+        `Do not start any of these again: they are already running. Use shells to check one, kill_shell to stop it.`);
+}
 /**
  * Reconcile the read ledger with the transcript, and put the working files back.
  *
@@ -2152,7 +2460,7 @@ async function restoreAfterCompaction(session) {
     // earlier fix copied every path forward to re-derive the same answer every step.
     // The correctness half. Unconditional, and before anything that can throw.
     reads.clear();
-    const budget = restoreBudgetFor(envInt("MINDWEAVE_AUTOCOMPACT_TOKENS", autoCompactThreshold(session.modelConfig.model)));
+    const budget = restoreBudgetFor(effectiveAutoCompactThreshold(session));
     if (budget <= 0)
         return;
     // What the kept tail still shows. Re-sending a file the model can already see costs