mixdog 0.8.0 → 0.9.0

package/src/runtime/agent/orchestrator/session/loop.mjs

@@ -3,30 +3,35 @@ import { executeMcpTool, isMcpTool, mcpToolHasField } from '../mcp/client.mjs';
 import { canonicalizeBuiltinToolName, executeBuiltinTool, formatUnknownBuiltinToolMessage, isBuiltinTool } from '../tools/builtin.mjs';
 import { executeBashSessionTool } from '../tools/bash-session.mjs';
 import { executePatchTool } from '../tools/patch.mjs';
-import { executeCodeGraphTool, isCodeGraphTool } from '../tools/code-graph.mjs';
 import { executeInternalTool, isInternalTool } from '../internal-tools.mjs';
 import { collectSkillsCached, loadSkillContent } from '../context/collect.mjs';
-import { traceBridgeLoop, traceBridgeTool, traceBridgeToolFailure, traceBridgeCompact, estimateProviderPayloadBytes, messagePrefixHash } from '../bridge-trace.mjs';
-import { markSessionToolCall, updateSessionStage, SessionClosedError, getSessionAbortSignal, enqueuePendingMessage } from './manager.mjs';
-import { estimateMessagesTokens, estimateRequestReserveTokens } from './context-utils.mjs';
+import { traceAgentLoop, traceAgentTool, traceAgentToolFailure, traceAgentCompact, estimateProviderPayloadBytes, messagePrefixHash } from '../agent-trace.mjs';
+import { isAgentOwner } from '../agent-owner.mjs';
+import { markSessionToolCall, updateSessionStage, SessionClosedError, getSessionAbortSignal, enqueuePendingMessage, bumpUsageMetricsEpoch } from './manager.mjs';
+import { estimateMessagesTokens, estimateRequestReserveTokens, sanitizeToolPairs } from './context-utils.mjs';
 import {
-    compactMessages,
+    recallFastTrackCompactMessages,
     pruneToolOutputs,
     semanticCompactMessages,
-    compactActiveTurn,
-    SUMMARY_PREFIX,
+    compactTypeIsRecallFastTrack,
+    compactTypeIsSemantic,
+    normalizeCompactType,
+    DEFAULT_COMPACT_TYPE,
     DEFAULT_COMPACTION_BUFFER_TOKENS,
     DEFAULT_COMPACTION_BUFFER_RATIO,
     DEFAULT_COMPACTION_KEEP_TOKENS,
     compactionBufferTokensForBoundary,
     normalizeCompactionBufferRatio,
+    drainSessionCycle1,
 } from './compact.mjs';
 import { isContextOverflowError } from '../providers/retry-classifier.mjs';
-import { classifyBashFileLookupCommand, classifyBridgeWorkerGitMutationCommand, stripSoftWarns } from '../tool-loop-guard.mjs';
+import { stripSoftWarns } from '../tool-loop-guard.mjs';
 import { maybeOffloadToolResult } from './tool-result-offload.mjs';
 import { tryReadCached, setReadCached, invalidatePathForSession, markPostEdit, consumePostEditMark, clearReadDedupSession, extractTouchedPathsFromPatch, tryScopedToolCached, setScopedToolCached, clearScopedToolsForSession, clearScopedToolsForSessionPaths, invalidatePrefetchCache } from './read-dedup.mjs';
 import { createScopedCacheOutcome } from './cache/scoped-cache-outcome.mjs';
+import { modelVisibleToolCompletionMessage } from '../../../shared/tool-execution-contract.mjs';
 import { createHash } from 'crypto';
+import { isInvalidToolArgsMarker, formatInvalidToolArgsResult } from '../providers/openai-compat-stream.mjs';
 
 // Tool-name classification for cross-turn read dedup.
 // Strips the MCP prefix so direct calls and MCP-wrapped calls share the
@@ -38,13 +43,9 @@ function _stripMcpPrefix(name) {
 function _isReadTool(name) {
     return _stripMcpPrefix(name) === 'read';
 }
-function _isScalarWriteEditTool(name) {
-    const n = _stripMcpPrefix(name);
-    return n === 'write' || n === 'edit';
-}
 function _isMutationTool(name) {
     const n = _stripMcpPrefix(name);
-    return n === 'apply_patch' || n === 'write' || n === 'edit';
+    return n === 'apply_patch';
 }
 const SCOPED_CACHEABLE_TOOLS = new Set([
     'code_graph',
@@ -52,6 +53,13 @@ const SCOPED_CACHEABLE_TOOLS = new Set([
     'list',
     'glob',
 ]);
+let codeGraphRuntimePromise = null;
+async function executeCodeGraphToolLazy(name, args, cwd, signal = null, options = {}) {
+    codeGraphRuntimePromise ??= import('../tools/code-graph.mjs');
+    const mod = await codeGraphRuntimePromise;
+    if (typeof mod.executeCodeGraphTool !== 'function') throw new Error('code_graph runtime is not available');
+    return mod.executeCodeGraphTool(name, args, cwd, signal, options);
+}
 function _isScopedCacheableTool(name) {
     const n = _stripMcpPrefix(name);
     return SCOPED_CACHEABLE_TOOLS.has(n);
@@ -83,27 +91,25 @@ function _intraTurnSig(name, args) {
     return createHash('sha256').update(`${name}:${_canonicalArgs(args)}`).digest('hex').slice(0, 16);
 }
 
-// Shared pre-dispatch deny — single source of truth for role/scope/permission
-// rejects. Called by BOTH the eager dispatch path (startEagerTool) and the
-// serial dispatch path (executeTool body). Returns null when the call is
-// allowed to proceed; otherwise returns the Error string the serial path
-// would emit. The eager caller ignores the message body and just treats
-// non-null as "do not start eager".
+// Shared pre-dispatch deny — single source of truth for the remaining
+// control-plane / role scoping rejects. Called by BOTH the eager dispatch
+// path (startEagerTool) and the serial dispatch path (executeTool body).
+// Returns null when the call is allowed to proceed; otherwise returns the
+// Error string the serial path would emit. The eager caller ignores the
+// message body and just treats non-null as "do not start eager".
 //
-// Predicates are kept in the same order as the legacy serial branch so a
-// bridge-owned control-plane tool fails on _bridgeOwned+_controlPlaneTool
-// FIRST (not on permission/wrapper checks) — matches the prior wording.
-// Bridge workers are sandboxed to code/research tools. They must never reach
+// This is NOT a permission gate — runtime permission enforcement was removed
+// (every tool call is trusted). What remains is architectural scoping:
+// agent workers are sandboxed to code/research tools. They must never reach
 // owner/host control surfaces: session management, the ENTIRE channels module
 // (Discord messaging, schedules, webhook/config, channel-bridge toggle,
 // command injection), or host input injection. Explicit name list (no imports)
 // keeps this hot-path gate dependency-free; add new owner/channel tools here.
 const WORKER_DENIED_TOOLS = new Set([
-    // session control-plane — unified into the single `bridge` tool
+    // session control-plane — unified into the single `agent` tool
     // (type=spawn|send|close|list). Denying the one name blocks all worker
-    // session control. Legacy names kept for defense-in-depth against any
-    // stale catalog entry that still advertises them.
-    'bridge', 'close_session', 'list_sessions', 'create_session',
+    // session control.
+    'agent',
     // channels module (owner/Discord-facing)
     'reply', 'react', 'edit_message', 'download_attachment', 'fetch',
     'schedule_status', 'trigger_schedule', 'schedule_control',
@@ -114,29 +120,16 @@ const WORKER_DENIED_TOOLS = new Set([
 function _preDispatchDeny(call, toolKind, sessionRef) {
     const name = call?.name;
     if (typeof name !== 'string' || !name) return null;
-    const _bridgeOwned = sessionRef?.scope?.startsWith?.('bridge:') || sessionRef?.owner === 'bridge';
+    const _agentOwned = sessionRef?.scope?.startsWith?.('agent:')
+        || isAgentOwner(sessionRef);
     const _controlPlaneTool = WORKER_DENIED_TOOLS.has(name);
-    if (_bridgeOwned && _controlPlaneTool) {
-        return `Error: control-plane tool "${name}" is Lead-only and not available to bridge agents.`;
+    if (_agentOwned && _controlPlaneTool) {
+        return `Error: control-plane tool "${name}" is Lead-only and not available to agent workers.`;
     }
     const noToolRole = sessionRef?.role === 'cycle1-agent' || sessionRef?.role === 'cycle2-agent';
     if (noToolRole) {
         return `Error: tool "${name}" is not available in role "${sessionRef.role}". Re-emit the answer as pipe-separated text per the role's output format (first character a digit, NO tool_use blocks, NO JSON, NO prose, NO apology).`;
     }
-    if (isBlockedHiddenWrapperCall(name, sessionRef)) {
-        return `Error: tool "${name}" is the wrapper your role (${sessionRef?.role || 'hidden'}) backs. Calling it would spawn another hidden agent of the same kind — use direct read/grep/glob/code_graph instead.`;
-    }
-    const effectivePermission = effectiveToolPermission(sessionRef);
-    const permissionBlocked = isBlockedByPermission(name, toolKind, effectivePermission);
-    if (permissionBlocked && effectivePermission === 'mcp') {
-        return `Error: tool "${name}" is not available on this session (permission=mcp). Use MCP/internal retrieval tools only.`;
-    }
-    if (permissionBlocked && effectivePermission === 'read') {
-        return `Error: tool "${name}" is not available on this session (permission=read). Use Mixdog MCP read/grep/glob/recall/search/explore instead.`;
-    }
-    if (permissionBlocked && effectivePermission && typeof effectivePermission === 'object') {
-        return `Error: tool "${name}" is not permitted on this session by the role's allow/deny permission policy.`;
-    }
     return null;
 }
 /** Exported for smoke tests — same runtime deny as the agent loop. */
@@ -146,26 +139,12 @@ export function preDispatchDenyForSession(sessionRef, call, toolKind = 'builtin'
 import { compressToolResult, recordToolBatch } from '../tools/result-compression.mjs';
 
 
-import { isHiddenRole } from '../internal-roles.mjs';
-import { createRequire } from 'module';
 import { readFileSync as _readFileSync } from 'fs';
 import { fileURLToPath } from 'url';
 import { dirname, resolve as resolvePath, isAbsolute } from 'path';
-// Load the CJS permission evaluator. The hooks/ directory lives above
-// src/runtime/agent/orchestrator/session/, so we walk up from __dirname.
-const _require = createRequire(import.meta.url);
-const _hooksLib = resolvePath(dirname(fileURLToPath(import.meta.url)), '../../../../hooks/lib/permission-evaluator.cjs');
-const { evaluatePermission: _evaluatePermission } = _require(_hooksLib);
 const MCP_TOOL_PREFIX = 'mcp__plugin_mixdog_mixdog__';
 const COMPACT_SAFETY_PERCENT = 1.00;
 const COMPACT_BUFFER_MAX_WINDOW_FRACTION = 0.25;
-// Stricter budget used for the one-shot retry after a provider rejects a send
-// with a context-window-exceeded error. 0.60×contextWindow forces older
-// non-system history into a tighter compact summary when the pre-send estimate
-// under-counted provider-side bytes (tool schemas, framing,
-// provider-internal token accounting). Used exactly once per send; see the
-// retry block around provider.send below.
-const OVERFLOW_RETRY_COMPACT_PERCENT = 0.60;
 
 function estimateMessagesTokensSafe(messages) {
     try { return estimateMessagesTokens(messages); }
@@ -233,18 +212,18 @@ function mergeSteeringEntries(entries) {
     return { content: parts, text: displayText || steeringContentText(parts), count: normalized.length };
 }
 
-class BridgeContextOverflowError extends Error {
+class AgentContextOverflowError extends Error {
     constructor({ stage, sessionId, provider, model, contextWindow, budgetTokens, reserveTokens, messageTokensEst }, cause) {
         const target = [provider, model].filter(Boolean).join('/') || 'target model';
         const causeMsg = cause && cause.message ? `: ${cause.message}` : '';
         super(
-            `bridge context overflow (${target}, stage=${stage || 'compact'}): ` +
+            `agent context overflow (${target}, stage=${stage || 'compact'}): ` +
             `latest turn cannot fit target context budget=${budgetTokens ?? 'unknown'} ` +
             `reserve=${reserveTokens ?? 'unknown'} contextWindow=${contextWindow ?? 'unknown'} ` +
             `messageTokensEst=${messageTokensEst ?? 'unknown'}${causeMsg}`,
         );
-        this.name = 'BridgeContextOverflowError';
-        this.code = 'BRIDGE_CONTEXT_OVERFLOW';
+        this.name = 'AgentContextOverflowError';
+        this.code = 'AGENT_CONTEXT_OVERFLOW';
         this.sessionId = sessionId || null;
         this.provider = provider || null;
         this.model = model || null;
@@ -256,8 +235,8 @@ class BridgeContextOverflowError extends Error {
     }
 }
 
-function bridgeContextOverflowError({ stage, sessionId, sessionRef, model, budgetTokens, reserveTokens, messageTokensEst }, cause) {
-    return new BridgeContextOverflowError({
+function agentContextOverflowError({ stage, sessionId, sessionRef, model, budgetTokens, reserveTokens, messageTokensEst }, cause) {
+    return new AgentContextOverflowError({
         stage,
         sessionId,
         provider: sessionRef?.provider || null,
@@ -270,7 +249,7 @@ function bridgeContextOverflowError({ stage, sessionId, sessionRef, model, budge
 }
 
 // Cache-hit results always inline the cached body. The earlier size-gated
-// `[cache-hit-ref]` branch confused bridge agents whose context did not
+// `[cache-hit-ref]` branch confused agents whose context did not
 // contain the referenced prior tool_result, triggering shell-cat detours.
 // Hard iteration ceiling for every agent loop. Reset to 0 whenever the
 // transcript is compacted (see the trim block below): a long task that keeps
@@ -370,30 +349,22 @@ function _ensureTranscriptPairing(msgs, sessionId) {
     }
 }
 
-// Write-class tools that a permission=read session must not execute. The
-// schema still advertises them to keep one unified shard; this runtime set
-// is the fail-safe reject at call time.
-const READ_BLOCKED_TOOLS = new Set([
-    'shell', 'bash_session',
-    'write',
-    'edit',
-    'apply_patch',
-]);
-const MCP_ONLY_ALLOWED_KINDS = new Set(['mcp', 'internal', 'skill']);
-// Wrappers that hidden retrieval roles back. Hidden roles MUST NOT call
-// these or they spawn another hidden agent of the same kind — nested chain
-// + token burn. Block at call time; the role's rule prompt also says so.
-const RETRIEVAL_WRAPPERS = new Set(['recall', 'search', 'explore']);
-// Hidden roles that may call specific retrieval wrappers. Default policy
-// blocks all hidden→wrapper calls; roles listed here have a documented
-// need:
-//   - scheduler-task / webhook-handler: state-changing agents whose
-//     tasks routinely require both reach-back into past context
-//     (`recall`) and fresh external info (`search`).
-const HIDDEN_ROLE_WRAPPER_ALLOWLIST = {
-    'scheduler-task': new Set(['recall', 'search']),
-    'webhook-handler': new Set(['recall', 'search']),
-};
+/**
+ * Pre-provider transcript repair for the agent loop. Reattach valid tool
+ * results (non-destructive) before any destructive orphan pairing cleanup.
+ * Mutates `messages` in place to preserve the session array reference.
+ */
+export function repairTranscriptBeforeProviderSend(messages, sessionId = null) {
+    if (!Array.isArray(messages)) return messages;
+    const sanitized = sanitizeToolPairs(messages);
+    if (sanitized !== messages) {
+        messages.length = 0;
+        messages.push(...sanitized);
+    }
+    _ensureTranscriptPairing(messages, sessionId);
+    return messages;
+}
+
 // Eager-dispatch: tools with readOnlyHint:true in their declaration are safe
 // to execute during SSE parsing so tool work overlaps with the rest of the
 // stream. Writes, bash, MCP and skills stay serial after send() returns.
@@ -402,94 +373,6 @@ function isEagerDispatchable(name, tools) {
     const def = tools.find(t => t?.name === name);
     return def?.annotations?.readOnlyHint === true;
 }
-// ── Bridge-worker permission enforcement ──────────────────────────────────────
-// Mirrors the PreToolUse hook evaluation for tool calls that originate inside a
-// bridge worker session. Worker dispatch previously bypassed the hook pipeline
-// entirely; this guard closes that gap by running the same evaluator inline.
-//
-// `ask` is treated as deny here — forwarding `ask` decisions to the channel
-// UI approval flow needs bidirectional prompt plumbing that does not exist.
-function _checkWorkerPermission(toolName, toolInput, sessionRef) {
-    const bareToolName = _stripMcpPrefix(toolName);
-    if (sessionRef?.owner === 'bridge' && bareToolName === 'shell') {
-        const cmdClass = classifyBashFileLookupCommand(toolInput?.command);
-        if (cmdClass) {
-            return `Error: bridge worker shell file lookup blocked (${cmdClass}). Use Mixdog MCP read/grep/glob/list directly; shell is only for build/test/run/git-style commands.`;
-        }
-        const gitClass = classifyBridgeWorkerGitMutationCommand(toolInput?.command);
-        if (gitClass) {
-            return `Error: bridge worker git operation blocked (${gitClass}). Git operations are deferred to Lead.`;
-        }
-    }
-    // Even when no explicit permissionMode is propagated to the worker, run
-    // the evaluator under the most restrictive baseline ('default') so the
-    // bypass-proof hard-deny patterns (UNC paths, /etc, C:/Windows, etc.)
-    // and the user's settings.json deny rules still apply. Previously a
-    // missing permissionMode short-circuited to null and the worker
-    // ran ungated — a model could dispatch a bridge to read or write
-    // protected paths even when the same call would have been denied for
-    // the parent. Callers that genuinely need bypassPermissions can still
-    // forward it explicitly via session-builder; this only closes the
-    // silent default-to-bypass path.
-    const permissionMode = sessionRef?.permissionMode || 'default';
-    // Prefix bare mixdog tool names so the evaluator path-logic handles them correctly.
-    const fullName = toolName.startsWith(MCP_TOOL_PREFIX) || toolName.startsWith('mcp__')
-        ? toolName
-        : `${MCP_TOOL_PREFIX}${toolName}`;
-    const projectDir = sessionRef?.cwd || undefined;
-    const userCwd = sessionRef?.cwd || undefined;
-    try {
-        const { decision, reason } = _evaluatePermission({
-            toolName: fullName,
-            toolInput: toolInput || {},
-            permissionMode,
-            projectDir,
-            userCwd,
-        });
-        if (decision === 'deny' || decision === 'ask') {
-            return `Error: tool "${toolName}" blocked by permission evaluator (decision=${decision}): ${reason}`;
-        }
-    } catch (err) {
-        // Evaluator errors must not crash the loop — log and allow.
-        try { process.stderr.write(`[permission-evaluator] error: ${err?.message}\n`); } catch {}
-    }
-    return null;
-}
-function effectiveToolPermission(sessionRef) {
-    return sessionRef?.toolPermission || sessionRef?.permission || null;
-}
-function isBlockedByPermission(toolName, toolKind, permission) {
-    if (permission === 'mcp') return !MCP_ONLY_ALLOWED_KINDS.has(toolKind);
-    if (permission === 'read') return READ_BLOCKED_TOOLS.has(toolName);
-    // Object-form {allow,deny} permission (role template / profile). The
-    // schema-level intersection in createSession only narrows the ADVERTISED
-    // tool list; it is not a runtime execution boundary. Enforce the same
-    // allow/deny here as the fail-safe so a tool call for a non-advertised
-    // (denied / out-of-allow) tool is rejected at dispatch time, matching
-    // the string-form ('read'/'mcp') guards. Names are compared bare +
-    // lowercased to mirror createSession's allow/deny set construction.
-    if (permission && typeof permission === 'object') {
-        const name = String(_stripMcpPrefix(toolName) || '').toLowerCase();
-        const deny = Array.isArray(permission.deny) && permission.deny.length > 0
-            ? permission.deny.map(n => String(n).toLowerCase())
-            : null;
-        if (deny && deny.includes(name)) return true;
-        const allow = Array.isArray(permission.allow) && permission.allow.length > 0
-            ? permission.allow.map(n => String(n).toLowerCase())
-            : null;
-        if (allow && !allow.includes(name)) return true;
-        return false;
-    }
-    return false;
-}
-function isBlockedHiddenWrapperCall(toolName, sessionRef) {
-    if (!RETRIEVAL_WRAPPERS.has(toolName)) return false;
-    if (sessionRef?.owner !== 'bridge') return false;
-    if (!isHiddenRole(sessionRef?.role)) return false;
-    const allow = HIDDEN_ROLE_WRAPPER_ALLOWLIST[sessionRef.role];
-    if (allow && allow.has(toolName)) return false;
-    return true;
-}
 function messagesArrayChanged(before, after) {
     if (!Array.isArray(before) || !Array.isArray(after)) return before !== after;
     if (before.length !== after.length) return true;
@@ -528,38 +411,6 @@ function addUsage(total, usage) {
     }
     return next;
 }
-function splitMessagesForRemoteCompact(messages) {
-    if (!Array.isArray(messages)) return null;
-    const system = messages.filter(m => m?.role === 'system');
-    const nonSystem = messages.filter(m => m?.role !== 'system');
-    let turnStart = -1;
-    for (let i = nonSystem.length - 1; i >= 0; i -= 1) {
-        if (nonSystem[i]?.role === 'user') {
-            turnStart = i;
-            break;
-        }
-    }
-    if (turnStart <= 0) return null;
-    const oldHistory = nonSystem.slice(0, turnStart);
-    if (!oldHistory.length) return null;
-    return [...system, ...oldHistory];
-}
-function markRemoteCompactFallback(messages, providerName) {
-    if (!Array.isArray(messages)) return false;
-    for (const m of messages) {
-        if (m?.role !== 'user' || typeof m.content !== 'string') continue;
-        if (!m.content.startsWith(SUMMARY_PREFIX)) continue;
-        m._mixdogRemoteCompactFallback = 'openai-codex';
-        m._mixdogRemoteCompactProvider = providerName || 'openai-oauth';
-        return true;
-    }
-    return false;
-}
-function providerRemoteCompactEnabled(provider, opts) {
-    if (opts?.remoteCompact === false) return false;
-    if (process.env.MIXDOG_REMOTE_COMPACT === '0') return false;
-    return typeof provider?.remoteCompactMessages === 'function';
-}
 function positiveTokenInt(value) {
     const n = Number(value);
     return Number.isFinite(n) && n > 0 ? Math.floor(n) : null;
@@ -573,35 +424,187 @@ function envTokenInt(name) {
     return positiveTokenInt(process.env[name]);
 }
 function resolveSemanticCompactSetting(sessionRef, cfg = {}) {
-    const env = process.env.MIXDOG_BRIDGE_COMPACT_SEMANTIC;
-    if (env !== undefined) return envFlag('MIXDOG_BRIDGE_COMPACT_SEMANTIC', true);
+    if (process.env.MIXDOG_AGENT_COMPACT_SEMANTIC !== undefined) return envFlag('MIXDOG_AGENT_COMPACT_SEMANTIC', true);
     if (cfg.semantic === false || cfg.semantic === 'false' || cfg.semantic === 'off') return false;
     if (cfg.semantic === true || cfg.semantic === 'true' || cfg.semantic === 'on') return true;
-    // OpenCode keeps compaction as a session concern. For Mixdog, default the
-    // semantic agent only on bridge-owned workers so direct user sessions and
-    // narrow tests do not pay an extra provider call unless they opt in.
-    return sessionRef?.owner === 'bridge';
+    // The compact type is already explicit (`semantic` by default). Honor it
+    // directly instead of substituting another compaction path.
+    return true;
+}
+
+function resolveCompactTypeSetting(_sessionRef, cfg = {}) {
+    const configured = process.env.MIXDOG_AGENT_COMPACT_TYPE
+        ?? process.env.MIXDOG_COMPACT_TYPE
+        ?? cfg.type
+        ?? cfg.compactType
+        ?? cfg.compact_type;
+    return normalizeCompactType(configured, DEFAULT_COMPACT_TYPE);
+}
+
+async function runRecallFastTrackCompact({ sessionRef, messages, compactBudgetTokens, compactPolicy, sessionId, signal }) {
+    if (!sessionId) throw new Error('recall-fasttrack requires a session id');
+    const query = `session:${sessionId}:all-chunks`;
+    const querySha = createHash('sha256').update(query).digest('hex').slice(0, 16);
+    const callerCtx = {
+        callerSessionId: sessionId || null,
+        callerCwd: sessionRef?.cwd || undefined,
+        routingSessionId: sessionId || null,
+        clientHostPid: sessionRef?.clientHostPid,
+        signal: signal || null,
+    };
+    const hydrateLimit = positiveTokenInt(sessionRef?.compaction?.recallIngestLimit)
+        || Math.max(500, Math.min(5000, messages.length || 0));
+    try {
+        await executeInternalTool('memory', {
+            action: 'ingest_session',
+            sessionId,
+            messages,
+            cwd: sessionRef?.cwd,
+            limit: hydrateLimit,
+        }, callerCtx);
+    } catch (err) {
+        try { process.stderr.write(`[loop] recall-fasttrack ingest skipped (sess=${sessionId || 'unknown'}): ${err?.message || err}\n`); } catch {}
+    }
+    const dumpArgs = {
+        action: 'dump_session_roots',
+        sessionId,
+        includeRaw: true,
+        limit: positiveTokenInt(sessionRef?.compaction?.recallChunkLimit ?? sessionRef?.compaction?.recallLimit) || hydrateLimit,
+    };
+    const runTool = (name, args) => executeInternalTool(name, args, callerCtx);
+    let recallText = await executeInternalTool('memory', dumpArgs, callerCtx);
+    let cycle1Text = '';
+    const hasRawRows = /(?:^|\n)# raw_pending\s+\d+\s+id=/i.test(String(recallText || ''));
+    if (hasRawRows) {
+        try {
+            // Drain this session's cycle1 in window×concurrency units until no
+            // raw rows remain, so the injected root is fully chunked rather than
+            // carrying the unprocessed transcript tail (single-pass left raw in).
+            const drained = await drainSessionCycle1(runTool, {
+                sessionId,
+                dumpArgs,
+                deadlineMs: positiveTokenInt(sessionRef?.compaction?.recallCycle1DeadlineMs) || 120_000,
+                maxPasses: positiveTokenInt(sessionRef?.compaction?.recallCycle1MaxPasses) || 0,
+                cycleArgs: {
+                    min_batch: 1,
+                    session_cap: 1,
+                    batch_size: positiveTokenInt(sessionRef?.compaction?.recallCycle1BatchSize) || 100,
+                    rows_per_session: positiveTokenInt(sessionRef?.compaction?.recallRowsPerSession) || 100,
+                    window_size: positiveTokenInt(sessionRef?.compaction?.recallWindowSize) || 20,
+                    concurrency: positiveTokenInt(sessionRef?.compaction?.recallConcurrency) || 5,
+                },
+            });
+            recallText = drained.recallText;
+            cycle1Text = drained.cycle1Text;
+            if (drained.rawRemaining > 0) {
+                try { process.stderr.write(`[loop] recall-fasttrack drained passes=${drained.passes} rawRemaining=${drained.rawRemaining} (sess=${sessionId || 'unknown'})\n`); } catch {}
+            }
+        } catch (err) {
+            try { process.stderr.write(`[loop] recall-fasttrack cycle1 skipped (sess=${sessionId || 'unknown'}): ${err?.message || err}\n`); } catch {}
+        }
+    } else {
+        cycle1Text = 'cycle1: skipped (session chunks already hydrated)';
+    }
+    return recallFastTrackCompactMessages(messages, compactBudgetTokens, {
+        reserveTokens: compactPolicy.reserveTokens,
+        force: true,
+        recallText: [`session_id=${sessionId}`, cycle1Text, recallText].map(v => String(v || '').trim()).filter(Boolean).join('\n\n'),
+        query,
+        querySha,
+        allowEmptyRecall: true,
+        tailTurns: compactPolicy.tailTurns,
+        keepTokens: compactPolicy.keepTokens,
+        preserveRecentTokens: compactPolicy.preserveRecentTokens,
+    });
+}
+// Percent-named inputs (bufferPercent / bufferPct / *_BUFFER_PERCENT) carry a
+// PERCENT: 1 means 1% (0.01). Ratio-named inputs (bufferRatio / bufferFraction)
+// carry a fraction: 0.01 means 1%, and a legacy value > 1 is read as a percent
+// (10 -> 10%). The shared normalizeCompactionBufferRatio only handles the ratio
+// convention, so resolve percent-named values to a fraction first.
+function _resolveBufferRatioCandidate(percentInputs, ratioInputs) {
+    for (const raw of percentInputs) {
+        const n = Number(raw);
+        if (Number.isFinite(n) && n > 0) return Math.min(1, n / 100);
+    }
+    for (const raw of ratioInputs) {
+        const n = Number(raw);
+        if (Number.isFinite(n) && n > 0) return n > 1 ? n / 100 : n;
+    }
+    return null;
 }
 function resolveCompactBufferRatio(cfg = {}) {
-    return normalizeCompactionBufferRatio(
-        cfg.bufferPercent
-            ?? cfg.bufferPct
-            ?? cfg.bufferRatio
-            ?? cfg.bufferFraction
-            ?? process.env.MIXDOG_BRIDGE_COMPACT_BUFFER_PERCENT
-            ?? process.env.MIXDOG_BRIDGE_COMPACT_BUFFER_RATIO,
-        DEFAULT_COMPACTION_BUFFER_RATIO,
+    const resolved = _resolveBufferRatioCandidate(
+        [cfg.bufferPercent, cfg.bufferPct, process.env.MIXDOG_AGENT_COMPACT_BUFFER_PERCENT],
+        [cfg.bufferRatio, cfg.bufferFraction, process.env.MIXDOG_AGENT_COMPACT_BUFFER_RATIO],
     );
+    return normalizeCompactionBufferRatio(resolved, DEFAULT_COMPACTION_BUFFER_RATIO);
+}
+const LEGACY_DEFAULT_COMPACTION_BUFFER_RATIO = 0.1;
+function isPersistedZeroBufferTelemetry(cfg = {}, boundaryTokens = 0) {
+    const boundary = positiveTokenInt(boundaryTokens);
+    if (!boundary) return false;
+    if (envTokenInt('MIXDOG_AGENT_COMPACT_BUFFER_TOKENS')) return false;
+    for (const envName of ['MIXDOG_AGENT_COMPACT_BUFFER_PERCENT', 'MIXDOG_AGENT_COMPACT_BUFFER_RATIO']) {
+        const n = Number(process.env[envName]);
+        if (Number.isFinite(n) && n > 0) return false;
+    }
+    for (const key of ['bufferPercent', 'bufferPct', 'bufferFraction']) {
+        const n = Number(cfg?.[key]);
+        if (Number.isFinite(n) && n > 0) return false;
+    }
+    const ratio = Number(cfg?.bufferRatio);
+    if (Number.isFinite(ratio) && ratio > 0) return false;
+    const explicitTokens = Number(cfg?.bufferTokens ?? cfg?.buffer);
+    if (!Number.isFinite(explicitTokens) || explicitTokens !== 0) return false;
+    return true;
+}
+function isLegacyDefaultBufferTelemetry(cfg = {}, boundaryTokens = 0) {
+    const boundary = positiveTokenInt(boundaryTokens);
+    if (!boundary) return false;
+    if (envTokenInt('MIXDOG_AGENT_COMPACT_BUFFER_TOKENS')) return false;
+    for (const envName of ['MIXDOG_AGENT_COMPACT_BUFFER_PERCENT', 'MIXDOG_AGENT_COMPACT_BUFFER_RATIO']) {
+        const n = Number(process.env[envName]);
+        if (Number.isFinite(n) && n > 0) return false;
+    }
+    // Percent/fraction-named fields are operator config. The legacy default
+    // telemetry persisted bufferTokens + bufferRatio after a check/compact pass.
+    for (const key of ['bufferPercent', 'bufferPct', 'bufferFraction']) {
+        const n = Number(cfg?.[key]);
+        if (Number.isFinite(n) && n > 0) return false;
+    }
+    const explicitTokens = positiveTokenInt(cfg?.bufferTokens ?? cfg?.buffer);
+    const ratio = Number(cfg?.bufferRatio);
+    if (!explicitTokens || !Number.isFinite(ratio) || Math.abs(ratio - LEGACY_DEFAULT_COMPACTION_BUFFER_RATIO) > 1e-9) return false;
+    const expectedTokens = Math.floor(boundary * LEGACY_DEFAULT_COMPACTION_BUFFER_RATIO);
+    const cfgBoundary = positiveTokenInt(cfg?.boundaryTokens);
+    const cfgTrigger = positiveTokenInt(cfg?.triggerTokens);
+    return explicitTokens === expectedTokens
+        || (cfgBoundary === boundary && cfgTrigger > 0 && explicitTokens === Math.max(0, boundary - cfgTrigger));
+}
+function compactBufferConfigForBoundary(cfg = {}, boundaryTokens = 0) {
+    const base = cfg || {};
+    if (!isLegacyDefaultBufferTelemetry(base, boundaryTokens)
+        && !isPersistedZeroBufferTelemetry(base, boundaryTokens)) {
+        return base;
+    }
+    return {
+        ...base,
+        bufferTokens: null,
+        buffer: null,
+        bufferRatio: null,
+    };
 }
 function resolveCompactBufferTokens(boundaryTokens, cfg = {}) {
-    const configured = positiveTokenInt(cfg.bufferTokens ?? cfg.buffer)
-        || envTokenInt('MIXDOG_BRIDGE_COMPACT_BUFFER_TOKENS')
-        || 0;
     const boundary = positiveTokenInt(boundaryTokens);
+    const effectiveCfg = compactBufferConfigForBoundary(cfg, boundary);
+    const configured = positiveTokenInt(effectiveCfg.bufferTokens ?? effectiveCfg.buffer)
+        || envTokenInt('MIXDOG_AGENT_COMPACT_BUFFER_TOKENS')
+        || 0;
     if (!boundary) return configured || DEFAULT_COMPACTION_BUFFER_TOKENS;
     return compactionBufferTokensForBoundary(boundary, {
         explicitTokens: configured,
-        ratio: resolveCompactBufferRatio(cfg),
+        ratio: resolveCompactBufferRatio(effectiveCfg),
         maxRatio: COMPACT_BUFFER_MAX_WINDOW_FRACTION,
     });
 }
@@ -613,7 +616,7 @@ function resolveCompactTargetRatio(cfg = {}) {
         ?? cfg.targetPct
         ?? cfg.targetRatio
         ?? cfg.targetFraction
-        ?? process.env.MIXDOG_BRIDGE_COMPACT_TARGET_PERCENT
+        ?? process.env.MIXDOG_AGENT_COMPACT_TARGET_PERCENT
         ?? process.env.MIXDOG_COMPACT_TARGET_PERCENT
         ?? COMPACT_TARGET_RATIO;
     const n = Number(raw);
@@ -624,15 +627,15 @@ function resolveCompactTargetTokens(boundaryTokens, cfg = {}) {
     const boundary = positiveTokenInt(boundaryTokens);
     if (!boundary) return null;
     const explicit = positiveTokenInt(cfg.targetTokens ?? cfg.target)
-        || envTokenInt('MIXDOG_BRIDGE_COMPACT_TARGET_TOKENS')
+        || envTokenInt('MIXDOG_AGENT_COMPACT_TARGET_TOKENS')
         || envTokenInt('MIXDOG_COMPACT_TARGET_TOKENS');
     if (explicit) return Math.max(1, Math.min(boundary, explicit));
     const minTarget = Math.min(boundary, positiveTokenInt(cfg.targetMinTokens ?? cfg.minTargetTokens)
-        || envTokenInt('MIXDOG_BRIDGE_COMPACT_TARGET_MIN_TOKENS')
+        || envTokenInt('MIXDOG_AGENT_COMPACT_TARGET_MIN_TOKENS')
         || envTokenInt('MIXDOG_COMPACT_TARGET_MIN_TOKENS')
         || COMPACT_TARGET_MIN_TOKENS);
     const maxTarget = Math.min(boundary, positiveTokenInt(cfg.targetMaxTokens ?? cfg.maxTargetTokens)
-        || envTokenInt('MIXDOG_BRIDGE_COMPACT_TARGET_MAX_TOKENS')
+        || envTokenInt('MIXDOG_AGENT_COMPACT_TARGET_MAX_TOKENS')
         || envTokenInt('MIXDOG_COMPACT_TARGET_MAX_TOKENS')
         || COMPACT_TARGET_MAX_TOKENS);
     const byRatio = Math.max(1, Math.floor(boundary * resolveCompactTargetRatio(cfg)));
@@ -640,13 +643,13 @@ function resolveCompactTargetTokens(boundaryTokens, cfg = {}) {
 }
 function resolveCompactKeepTokens(cfg = {}) {
     return positiveTokenInt(cfg.keepTokens ?? cfg.keep?.tokens ?? cfg.preserveRecentTokens)
-        || envTokenInt('MIXDOG_BRIDGE_COMPACT_KEEP_TOKENS')
+        || envTokenInt('MIXDOG_AGENT_COMPACT_KEEP_TOKENS')
         || DEFAULT_COMPACTION_KEEP_TOKENS;
 }
 function resolveWorkerCompactPolicy(sessionRef, tools) {
     if (!sessionRef) return null;
     const cfg = sessionRef.compaction || {};
-    const auto = cfg.auto !== false && envFlag('MIXDOG_BRIDGE_COMPACT_AUTO', true);
+    const auto = cfg.auto !== false && envFlag('MIXDOG_AGENT_COMPACT_AUTO', true);
     if (!auto) return { auto: false };
     const contextWindow = positiveTokenInt(sessionRef.contextWindow ?? cfg.contextWindow);
     const explicitBoundary = positiveTokenInt(sessionRef.compactBoundaryTokens ?? cfg.boundaryTokens);
@@ -656,28 +659,33 @@ function resolveWorkerCompactPolicy(sessionRef, tools) {
         : (explicitBoundary || contextWindow || autoLimit);
     if (!boundaryTokens) return null;
     const compactBoundaryTokens = Math.max(1, Math.floor(boundaryTokens * COMPACT_SAFETY_PERCENT));
-    const autoTriggerTokens = autoLimit && autoLimit <= compactBoundaryTokens ? Math.max(1, autoLimit) : null;
+    // Only an explicit auto-compact limit STRICTLY BELOW the boundary acts as
+    // the trigger. A persisted value == boundary (legacy derived full-window
+    // autoCompactTokenLimit) would set autoTriggerTokens == boundary and
+    // collapse/override the default trigger, so it is ignored in favor of the
+    // default boundary trigger.
+    const autoTriggerTokens = autoLimit && autoLimit < compactBoundaryTokens ? Math.max(1, autoLimit) : null;
+    // Sanitized explicit limit: only a sub-boundary value is a real auto-compact
+    // limit. Anything >= boundary is a legacy derived full-window artifact and
+    // is reported as null so rememberCompactTelemetry does not re-persist it
+    // back onto the session and re-collapse the buffer on the next turn.
+    const explicitAutoCompactTokenLimit = autoTriggerTokens;
     const bufferTokens = autoTriggerTokens
         ? Math.max(0, compactBoundaryTokens - autoTriggerTokens)
         : resolveCompactBufferTokens(compactBoundaryTokens, cfg);
     const bufferRatio = compactBoundaryTokens ? (bufferTokens / compactBoundaryTokens) : resolveCompactBufferRatio(cfg);
     const triggerTokens = autoTriggerTokens || Math.max(1, compactBoundaryTokens - bufferTokens);
     const configuredReserve = positiveTokenInt(cfg.reservedTokens)
-        || envTokenInt('MIXDOG_BRIDGE_COMPACT_RESERVED_TOKENS')
+        || envTokenInt('MIXDOG_AGENT_COMPACT_RESERVED_TOKENS')
         || 0;
     const requestReserve = estimateRequestReserveTokens(tools);
     const keepTokens = resolveCompactKeepTokens(cfg);
+    const compactType = resolveCompactTypeSetting(sessionRef, cfg);
     return {
         auto: true,
-        prune: cfg.prune === true || envFlag('MIXDOG_BRIDGE_COMPACT_PRUNE', false),
-        // Narrow active-turn fallback (bridge/worker only). When system +
-        // current turn alone overflow the budget, shrink older same-turn tool
-        // outputs / drop older same-turn groups before declaring overflow,
-        // preserving system + task user + the latest group(s) and tool
-        // pairing. Defaults on for workers; disable via env to restore the
-        // strict no-fallback behavior.
-        activeTurnFallback: cfg.activeTurnFallback !== false
-            && envFlag('MIXDOG_BRIDGE_COMPACT_ACTIVE_TURN_FALLBACK', true),
+        type: compactType,
+        compactType,
+        prune: cfg.prune === true || envFlag('MIXDOG_AGENT_COMPACT_PRUNE', false),
         boundaryTokens: compactBoundaryTokens,
         triggerTokens,
         bufferTokens,
@@ -687,35 +695,30 @@ function resolveWorkerCompactPolicy(sessionRef, tools) {
         effectiveContextWindowPercent: Number.isFinite(Number(sessionRef.effectiveContextWindowPercent ?? cfg.effectiveContextWindowPercent))
             ? Number(sessionRef.effectiveContextWindowPercent ?? cfg.effectiveContextWindowPercent)
             : null,
-        autoCompactTokenLimit: positiveTokenInt(sessionRef.autoCompactTokenLimit ?? cfg.autoCompactTokenLimit),
-        semantic: resolveSemanticCompactSetting(sessionRef, cfg),
-        semanticTimeoutMs: positiveTokenInt(cfg.timeoutMs) || envTokenInt('MIXDOG_BRIDGE_COMPACT_TIMEOUT_MS') || 30_000,
-        tailTurns: positiveTokenInt(cfg.tailTurns) || envTokenInt('MIXDOG_BRIDGE_COMPACT_TAIL_TURNS') || 2,
+        autoCompactTokenLimit: explicitAutoCompactTokenLimit,
+        semantic: compactTypeIsSemantic(compactType) && resolveSemanticCompactSetting(sessionRef, cfg),
+        recallFastTrack: compactTypeIsRecallFastTrack(compactType),
+        semanticTimeoutMs: positiveTokenInt(cfg.timeoutMs) || envTokenInt('MIXDOG_AGENT_COMPACT_TIMEOUT_MS') || 30_000,
+        tailTurns: positiveTokenInt(cfg.tailTurns) || envTokenInt('MIXDOG_AGENT_COMPACT_TAIL_TURNS') || 2,
         keepTokens,
-        preserveRecentTokens: positiveTokenInt(cfg.preserveRecentTokens) || envTokenInt('MIXDOG_BRIDGE_COMPACT_PRESERVE_RECENT_TOKENS') || keepTokens,
+        preserveRecentTokens: positiveTokenInt(cfg.preserveRecentTokens) || envTokenInt('MIXDOG_AGENT_COMPACT_PRESERVE_RECENT_TOKENS') || keepTokens,
         reserveTokens: requestReserve + configuredReserve,
         requestReserveTokens: requestReserve,
         configuredReserveTokens: configuredReserve,
     };
 }
-function latestProviderContextTokens(sessionRef) {
-    const tokens = positiveTokenInt(sessionRef?.lastContextTokens);
-    if (!tokens) return 0;
-    const compactAt = positiveTokenInt(sessionRef?.compaction?.lastChangedAt ?? sessionRef?.compaction?.lastCompactAt) || 0;
-    const usageAt = positiveTokenInt(sessionRef?.lastContextTokensUpdatedAt) || 0;
-    // Legacy sessions did not stamp usage. Treat that usage as usable until a
-    // new compaction boundary appears; after compaction, only post-compaction
-    // provider usage may pressure the next auto-compact decision.
-    if (compactAt > 0 && usageAt > 0 && usageAt <= compactAt) return 0;
-    if (compactAt > 0 && usageAt === 0) return 0;
-    return tokens;
-}
-function compactPressureTokens(messageTokensEst, policy, sessionRef) {
-    const estimated = messageTokensEst === null
-        ? null
-        : Math.max(0, messageTokensEst + (policy?.reserveTokens || 0));
-    const providerReported = latestProviderContextTokens(sessionRef);
-    return Math.max(estimated ?? 0, providerReported || 0);
+/** Transcript + request reserve only (never provider lastContextTokens). */
+function compactPressureTokens(messageTokensEst, policy) {
+    if (messageTokensEst === null) return 0;
+    return Math.max(0, messageTokensEst + (policy?.reserveTokens || 0));
+}
+
+/** Telemetry pressure when a reactive overflow retry forces the next compact. */
+function compactionTelemetryPressureTokens(messageTokensEst, policy, { reactivePending = false } = {}) {
+    const base = compactPressureTokens(messageTokensEst, policy);
+    if (!reactivePending) return base;
+    const floor = positiveTokenInt(policy?.triggerTokens) || positiveTokenInt(policy?.boundaryTokens) || 0;
+    return floor ? Math.max(base, floor) : base;
 }
 function compactTargetBudget(policy) {
     const boundary = positiveTokenInt(policy?.boundaryTokens);
@@ -724,10 +727,11 @@ function compactTargetBudget(policy) {
     const targetEffective = resolveCompactTargetTokens(boundary, policy) || boundary;
     return Math.max(1, Math.min(boundary, targetEffective + reserve));
 }
-function shouldCompactForSession(messageTokensEst, policy, sessionRef) {
+function shouldCompactForSession(messageTokensEst, policy, { forceReactive = false } = {}) {
     if (!policy?.auto || !policy.boundaryTokens) return false;
+    if (forceReactive) return true;
     if (messageTokensEst === null) return true;
-    return compactPressureTokens(messageTokensEst, policy, sessionRef) >= (policy.triggerTokens || policy.boundaryTokens);
+    return compactPressureTokens(messageTokensEst, policy) >= (policy.triggerTokens || policy.boundaryTokens);
 }
 function countPrunedToolOutputs(before, after) {
     if (!Array.isArray(before) || !Array.isArray(after)) return 0;
@@ -760,7 +764,10 @@ function rememberCompactTelemetry(sessionRef, policy, meta = {}) {
         rawContextWindow: policy.rawContextWindow || null,
         effectiveContextWindowPercent: policy.effectiveContextWindowPercent ?? null,
         autoCompactTokenLimit: policy.autoCompactTokenLimit || null,
+        type: policy.compactType || policy.type || DEFAULT_COMPACT_TYPE,
+        compactType: policy.compactType || policy.type || DEFAULT_COMPACT_TYPE,
         semantic: policy.semantic === true ? 'auto' : false,
+        recallFastTrack: policy.recallFastTrack === true,
         semanticModel: policy.semanticModel || null,
         semanticTimeoutMs: policy.semanticTimeoutMs || null,
         tailTurns: policy.tailTurns || null,
@@ -770,12 +777,26 @@ function rememberCompactTelemetry(sessionRef, policy, meta = {}) {
         lastBeforeTokens: meta.beforeTokens ?? null,
         lastAfterTokens: meta.afterTokens ?? null,
         lastPressureTokens: meta.pressureTokens ?? null,
+        currentEstimatedTokens: meta.pressureTokens ?? prev.currentEstimatedTokens ?? null,
+        lastApiRequestTokens: positiveTokenInt(sessionRef?.lastContextTokens) || prev.lastApiRequestTokens || null,
         lastStage: meta.stage || prev.lastStage || null,
         lastChanged: changed,
-        lastRemote: meta.remoteCompact === true,
+        lastTrigger: meta.trigger || prev.lastTrigger || null,
         lastSemantic: meta.semanticCompact === true,
-        lastSemanticError: meta.semanticError || null,
+        lastSemanticError: Object.hasOwn(meta, 'semanticError')
+            ? (meta.semanticError ?? null)
+            : (prev.lastSemanticError ?? null),
+        lastRecallFastTrack: meta.recallFastTrack === true,
+        lastRecallFastTrackError: Object.hasOwn(meta, 'recallFastTrackError')
+            ? (meta.recallFastTrackError ?? null)
+            : (prev.lastRecallFastTrackError ?? null),
+        lastError: Object.hasOwn(meta, 'compactError') || Object.hasOwn(meta, 'lastError')
+            ? (meta.compactError ?? meta.lastError ?? null)
+            : (prev.lastError ?? null),
         lastPruneCount: meta.pruneCount || 0,
+        lastDurationMs: meta.durationMs != null && Number.isFinite(Number(meta.durationMs))
+            ? Math.max(0, Math.round(Number(meta.durationMs)))
+            : null,
         compactCount: (prev.compactCount || 0) + (changed ? 1 : 0),
     };
     if (changed) {
@@ -786,13 +807,32 @@ function rememberCompactTelemetry(sessionRef, policy, meta = {}) {
     }
     sessionRef.contextWindow = policy.contextWindow || sessionRef.contextWindow;
     sessionRef.rawContextWindow = policy.rawContextWindow || sessionRef.rawContextWindow;
-    sessionRef.autoCompactTokenLimit = policy.autoCompactTokenLimit || sessionRef.autoCompactTokenLimit || null;
     sessionRef.compactBoundaryTokens = policy.boundaryTokens || sessionRef.compactBoundaryTokens || null;
+    // Persist only the sanitized (sub-boundary) explicit limit. policy.autoCompactTokenLimit
+    // is already null for legacy derived full-window values, so a stale
+    // boundary-sized autoCompactTokenLimit on the session is cleared here rather
+    // than carried forward to re-collapse the buffer next turn.
+    {
+        const _boundary = positiveTokenInt(sessionRef.compactBoundaryTokens);
+        const _prevLimit = positiveTokenInt(sessionRef.autoCompactTokenLimit);
+        const _keepPrev = _prevLimit && (!_boundary || _prevLimit < _boundary) ? _prevLimit : null;
+        sessionRef.autoCompactTokenLimit = policy.autoCompactTokenLimit || _keepPrev || null;
+    }
     if (policy.effectiveContextWindowPercent !== null) {
         sessionRef.effectiveContextWindowPercent = policy.effectiveContextWindowPercent;
     }
 }
-const SKILL_TOOL_NAMES = new Set(['skills_list', 'skill_view', 'skill_execute']);
+
+function emitCompactEvent(opts, event = {}) {
+    if (!opts || typeof opts.onCompactEvent !== 'function') return;
+    try { opts.onCompactEvent({ ts: Date.now(), ...event }); }
+    catch { /* best-effort UI/log hook */ }
+}
+
+function compactEventType(policy, fallback = DEFAULT_COMPACT_TYPE) {
+    return policy?.compactType || policy?.type || fallback;
+}
+const SKILL_TOOL_NAMES = new Set(['Skill', 'skills_list', 'skill_view']);
 const SPECIAL_TOOL_NAMES = new Set(['bash_session', 'apply_patch', 'code_graph']);
 const BASH_SESSION_HEADER_RE = /\[session: ([^\]\r\n]+)\]/;
 const STORED_TOOL_ARG_BODY_KEY_RE = /^(?:content|old_string|new_string|patch|rewrite)$/i;
@@ -908,12 +948,55 @@ function buildSkillsListResponse(cwd) {
 function viewSkill(cwd, name) {
     if (!name) return 'Error: skill name is required';
     const content = loadSkillContent(name, cwd);
-    return content || `Error: skill "${name}" not found`;
+    if (!content) return `Error: skill "${name}" not found`;
+    return `<skill>\n<name>${String(name).replace(/[<>&]/g, (ch) => ({ '<': '&lt;', '>': '&gt;', '&': '&amp;' }[ch]))}</name>\n${content}\n</skill>`;
 }
-function executeSkill(cwd, name, _args) {
-    if (!name) return 'Error: skill name is required';
-    const content = loadSkillContent(name, cwd);
-    return content || `Error: skill "${name}" not found`;
+
+/** Normalize PostToolUse hook override values (legacy MCP text envelopes only). */
+export function normalizeHookUpdatedToolOutput(value) {
+    if (typeof value === 'string') return value;
+    if (value == null) return '';
+    if (typeof value === 'object' && Array.isArray(value.content)) {
+        const hasNonText = value.content.some((c) => c && typeof c === 'object' && c.type && c.type !== 'text');
+        if (hasNonText) return value;
+        return value.content
+            .map((c) => (c?.type === 'text' ? c.text || '' : JSON.stringify(c)))
+            .join('\n');
+    }
+    return value;
+}
+
+export function resolveToolResultAfterHook(originalResult, hookResult) {
+    if (!hookResult || typeof hookResult !== 'object' || hookResult.updatedToolOutput === undefined) {
+        return originalResult;
+    }
+    const updated = normalizeHookUpdatedToolOutput(hookResult.updatedToolOutput);
+    return updated === undefined ? originalResult : updated;
+}
+
+function parseNativeToolSearchPayload(toolName, result) {
+    if (toolName !== 'tool_search' || typeof result !== 'string') return null;
+    try {
+        const parsed = JSON.parse(result);
+        const native = parsed?.nativeToolSearch;
+        if (!native || typeof native !== 'object') return null;
+        const toolReferences = Array.isArray(native.toolReferences)
+            ? native.toolReferences.map((name) => String(name || '').trim()).filter(Boolean)
+            : [];
+        const openaiTools = Array.isArray(native.openaiTools)
+            ? native.openaiTools.filter((tool) => tool && typeof tool === 'object')
+            : [];
+        if (!toolReferences.length && !openaiTools.length) return null;
+        return {
+            toolReferences,
+            openaiTools,
+            summary: typeof native.summary === 'string' && native.summary
+                ? native.summary
+                : `Loaded deferred tools: ${toolReferences.join(', ') || openaiTools.map((tool) => tool.name).filter(Boolean).join(', ')}`,
+        };
+    } catch {
+        return null;
+    }
 }
 function extractBashSessionId(result) {
     if (typeof result !== 'string') return null;
@@ -921,8 +1004,8 @@ function extractBashSessionId(result) {
     return match ? match[1] : null;
 }
 
-export function buildBridgeBashSessionArgs(args, sessionRef) {
-    if (sessionRef?.owner !== 'bridge') return null;
+export function buildAgentBashSessionArgs(args, sessionRef) {
+    if (!isAgentOwner(sessionRef)) return null;
     // run_in_background is a detached one-shot job, incompatible with the
     // persistent bash session. Fall through to the background-job path
     // (executeBuiltinTool -> startBackgroundShellJob) so the worker gets a
@@ -944,6 +1027,51 @@ export function buildBridgeBashSessionArgs(args, sessionRef) {
     return routedArgs;
 }
 
+export function formatMissingToolApprovalUiDenial(toolName, askReason) {
+    const reason = String(askReason || 'approval requested by hook').trim();
+    const name = String(toolName || 'tool');
+    return `Error: tool "${name}" denied by hook: approval required but no approval UI is available${reason ? ` (${reason})` : ''}`;
+}
+
+/**
+ * Resolve PreToolUse `{ action: 'ask' }` against an optional approval callback.
+ * Returns `{ denial }` when the tool must not run; otherwise `{ approval }`.
+ */
+export async function resolvePreToolAskApproval({
+    toolName,
+    args,
+    cwd,
+    sessionId,
+    toolCallId,
+    askReason,
+    toolApprovalHook,
+}) {
+    const name = String(toolName || 'tool');
+    const reason = String(askReason || 'approval requested by hook').trim();
+    if (typeof toolApprovalHook !== 'function') {
+        return { denial: formatMissingToolApprovalUiDenial(name, reason) };
+    }
+    let approval;
+    try {
+        approval = await toolApprovalHook({
+            name,
+            args,
+            cwd,
+            sessionId,
+            toolCallId: toolCallId || null,
+            reason,
+        });
+    } catch (error) {
+        const detail = error?.message || String(error || 'approval failed');
+        return { denial: `Error: tool "${name}" denied by hook: ${detail}` };
+    }
+    if (!approvalGranted(approval)) {
+        const detail = approvalReason(approval, reason || 'not approved');
+        return { denial: `Error: tool "${name}" denied by hook: ${detail}` };
+    }
+    return { approval };
+}
+
 function _scopedCacheOutcomeForCall(sessionRef, toolCallId, toolName, callerSessionId, executeOpts = {}) {
     if (executeOpts.scopedCacheOutcome) {
         if (sessionRef && toolCallId) {
@@ -972,14 +1100,20 @@ async function executeTool(name, args, cwd, callerSessionId, sessionRef, execute
     const toolOpts = scopedCacheOutcome
         ? { ...executeOpts, scopedCacheOutcome }
         : executeOpts;
-    const notifyFn = (text) => {
-        if (!callerSessionId) return;
-        try { enqueuePendingMessage(callerSessionId, String(text || '')); } catch { /* best effort */ }
-    };
+    const notificationSessionId = String(executeOpts.notifySessionId || sessionRef?.ownerSessionId || callerSessionId || '').trim();
+    const notifyFn = typeof executeOpts.notifyFn === 'function'
+        ? executeOpts.notifyFn
+        : (text, meta = {}) => {
+            if (!notificationSessionId) return;
+            try {
+                const visible = modelVisibleToolCompletionMessage(text, meta);
+                if (visible) enqueuePendingMessage(notificationSessionId, visible);
+            } catch { /* best effort */ }
+        };
     const completionToolOpts = {
         ...toolOpts,
         sessionId: callerSessionId,
-        callerSessionId,
+        callerSessionId: notificationSessionId || callerSessionId,
         routingSessionId: callerSessionId,
         clientHostPid: sessionRef?.clientHostPid,
         notifyFn,
@@ -987,6 +1121,9 @@ async function executeTool(name, args, cwd, callerSessionId, sessionRef, execute
     const beforeToolHook = typeof executeOpts.beforeToolHook === 'function'
         ? executeOpts.beforeToolHook
         : sessionRef?.beforeToolHook;
+    const toolApprovalHook = typeof executeOpts.toolApprovalHook === 'function'
+        ? executeOpts.toolApprovalHook
+        : sessionRef?.toolApprovalHook;
     if (beforeToolHook) {
         try {
             const decision = await beforeToolHook({
@@ -1001,6 +1138,23 @@ async function executeTool(name, args, cwd, callerSessionId, sessionRef, execute
                 const reason = decision?.reason ? `: ${decision.reason}` : '';
                 return `Error: tool "${name}" denied by hook${reason}`;
             }
+            if (action === 'ask') {
+                const askReason = String(decision?.reason || 'approval requested by hook').trim();
+                const askOutcome = await resolvePreToolAskApproval({
+                    toolName: name,
+                    args,
+                    cwd,
+                    sessionId: callerSessionId,
+                    toolCallId: executeOpts.toolCallId || null,
+                    askReason,
+                    toolApprovalHook,
+                });
+                if (askOutcome.denial) return askOutcome.denial;
+                const approval = askOutcome.approval;
+                if (approval && typeof approval === 'object' && approval.args && typeof approval.args === 'object' && !Array.isArray(approval.args)) {
+                    args = approval.args;
+                }
+            }
             if ((action === 'modify' || action === 'rewrite') && decision?.args && typeof decision.args === 'object' && !Array.isArray(decision.args)) {
                 args = decision.args;
             }
@@ -1008,15 +1162,19 @@ async function executeTool(name, args, cwd, callerSessionId, sessionRef, execute
             // Hooks are policy extensions. A broken hook must not wedge the agent loop.
         }
     }
+    const afterToolHook = typeof executeOpts.afterToolHook === 'function'
+        ? executeOpts.afterToolHook
+        : sessionRef?.afterToolHook;
+    const __result = await (async () => {
+    if (name === 'Skill') {
+        return viewSkill(cwd, args?.name);
+    }
     if (name === 'skills_list') {
         return buildSkillsListResponse(cwd);
     }
     if (name === 'skill_view') {
         return viewSkill(cwd, args?.name);
     }
-    if (name === 'skill_execute') {
-        return executeSkill(cwd, args?.name, args?.args);
-    }
     if (isMcpTool(name)) {
         // 24h trace data shows ~24% of external MCP calls are cwd-sensitive
         // (bash / grep / read / list / glob etc.) but the worker session's
@@ -1029,10 +1187,10 @@ async function executeTool(name, args, cwd, callerSessionId, sessionRef, execute
         const finalArgs = needsCwdInjection ? { ...(args || {}), cwd } : args;
         return executeMcpTool(name, finalArgs);
     }
-    if (isCodeGraphTool(name)) {
+    if (name === 'code_graph') {
         // cwd chain: args.cwd (caller-explicit) → session cwd → undefined (handler throws)
         const graphCwd = (typeof args?.cwd === 'string' && args.cwd.trim()) ? args.cwd.trim() : cwd;
-        return executeCodeGraphTool(name, args, graphCwd, null, toolOpts);
+        return executeCodeGraphToolLazy(name, args, graphCwd, null, toolOpts);
     }
     if (isInternalTool(name)) {
         // callerSessionId propagates into server.mjs dispatchTool so that
@@ -1048,14 +1206,14 @@ async function executeTool(name, args, cwd, callerSessionId, sessionRef, execute
         });
     }
     if (name === 'shell') {
-        const routedArgs = buildBridgeBashSessionArgs(args, sessionRef);
+        const routedArgs = buildAgentBashSessionArgs(args, sessionRef);
         if (!routedArgs) {
             // clientHostPid scopes background shell-jobs to the dispatching
-            // terminal's claude.exe pid (bridge sessions store it on sessionRef);
+            // terminal's claude.exe pid (agent sessions store it on sessionRef);
             // without it resolveJobOwnerHostPid falls back to the daemon-global env.
             return executeBuiltinTool(name, args, cwd, completionToolOpts);
         }
-        // Thread the session's AbortSignal so bridge type=close can interrupt the
+        // Thread the session's AbortSignal so agent type=close can interrupt the
         // persistent child process. getSessionAbortSignal is imported at top of
         // loop.mjs from manager.mjs; callerSessionId identifies the controller.
         let _bashAbortSignal = null;
@@ -1079,7 +1237,8 @@ async function executeTool(name, args, cwd, callerSessionId, sessionRef, execute
         return result;
     }
     if (name === 'apply_patch') {
-        return executePatchTool(name, args, cwd, { sessionId: callerSessionId });
+        const patchArgs = typeof args === 'string' ? { patch: args } : args;
+        return executePatchTool(name, patchArgs, cwd, { sessionId: callerSessionId });
     }
     if (isBuiltinTool(name)) {
         // clientHostPid threaded for the same per-terminal job-scope reason as
@@ -1087,6 +1246,23 @@ async function executeTool(name, args, cwd, callerSessionId, sessionRef, execute
         return executeBuiltinTool(name, args, cwd, completionToolOpts);
     }
     return formatUnknownBuiltinToolMessage(name, args, 'tool');
+    })();
+    if (typeof afterToolHook === 'function') {
+        try {
+            const hookResult = await afterToolHook({
+                name,
+                args,
+                cwd,
+                sessionId: callerSessionId,
+                toolCallId: executeOpts.toolCallId || null,
+                result: __result,
+            });
+            return resolveToolResultAfterHook(__result, hookResult);
+        } catch {
+            // PostToolUse hooks are best-effort; never let one break the tool result.
+        }
+    }
+    return __result;
 }
 /**
  * Agent loop: send → tool_call → execute → re-send → repeat until text.
@@ -1115,6 +1291,22 @@ const INCOMPLETE_STOP_REASONS = new Set([
     'pause_turn', 'max_tokens', 'length', 'MAX_TOKENS', 'OTHER',
 ]);
 
+export function approvalGranted(value) {
+    if (value === true) return true;
+    if (!value || typeof value !== 'object') return false;
+    if (value.approved === true || value.allow === true || value.allowed === true) return true;
+    const decision = String(value.decision || value.action || value.result || '').trim().toLowerCase();
+    return decision === 'approve' || decision === 'approved' || decision === 'allow' || decision === 'yes';
+}
+
+export function approvalReason(value, fallback = '') {
+    if (value && typeof value === 'object') {
+        const reason = String(value.reason || value.message || '').trim();
+        if (reason) return reason;
+    }
+    return fallback;
+}
+
 export async function agentLoop(provider, messages, model, tools, onToolCall, cwd, sendOpts) {
     let iterations = 0;
     let toolCallsTotal = 0;
@@ -1122,6 +1314,12 @@ export async function agentLoop(provider, messages, model, tools, onToolCall, cw
     let firstTurnUsage;
     let response;
     let contractNudges = 0;
+    let contextOverflowRetryUsed = false;
+    // Set when a provider context-overflow refusal triggers the in-turn
+    // reactive compact retry below; consumed by the next pre-send compact pass
+    // so its telemetry/events carry trigger:'reactive' (distinct from the
+    // proactive pre-send pressure trigger). Cleared after that pass reads it.
+    let reactiveOverflowRetryPending = false;
     const opts = sendOpts || {};
     const sessionId = opts.sessionId || null;
     const signal = opts.signal || null;
@@ -1131,9 +1329,8 @@ export async function agentLoop(provider, messages, model, tools, onToolCall, cw
         ? tools.find(tool => tool?.name === forcedFirstTool)
         : null;
     // Opaque providerState passthrough. The loop never inspects provider-native
-    // payloads; the originating provider owns them. OpenAI Codex uses this for
-    // native remote compaction prefixes, and stateful Responses providers may
-    // use it for continuation anchors.
+    // payloads; the originating provider owns them. Stateful Responses
+    // providers may use it for continuation anchors.
     let providerState = opts.providerState ?? undefined;
     const throwIfAborted = () => {
         if (signal?.aborted) {
@@ -1146,17 +1343,34 @@ export async function agentLoop(provider, messages, model, tools, onToolCall, cw
         }
     };
     const sessionRef = opts.session || null;
+    const loopUsageMetricsEpoch = () => Number(sessionRef?.usageMetricsEpoch) || 0;
+    const loopUsageMetricsTurnId = () => Number(sessionRef?.usageMetricsTurnId) || 0;
+    // Sub-agent (worker/heavy-worker/reviewer/debugger/explore/…) sessions
+    // drop mid-turn assistant preamble text outright. Only the final
+    // <final-answer> reply is consumed by Lead, so any "Now let me…" prose
+    // that precedes a tool call is pure noise — both for live surfacing AND
+    // for the agent's own history (where it re-enters context as input
+    // tokens on every later turn). Drop it at the runtime, no model-side rule:
+    //   - streaming  : opts.onTextDelta suppressed (token-by-token preamble)
+    //   - buffered   : opts.onAssistantText skipped (response.content below)
+    //   - history    : tool-call turn content blanked before messages.push
+    // Reasoning/thinking deltas, tool calls, and the final answer are kept.
+    const suppressMidTurnText = isAgentOwner(sessionRef);
+    if (suppressMidTurnText) opts.onTextDelta = undefined;
     const pushToolResultMessage = (message) => {
         messages.push(message);
         try { opts.onToolResult?.(message); } catch {}
     };
-    const drainSteeringIntoMessages = (stage = 'mid-turn') => {
+    const drainSteeringIntoMessages = (stage = 'mid-turn', options = {}) => {
         if (typeof opts.drainSteering !== 'function') return false;
         let steerMsgs = [];
         try { steerMsgs = opts.drainSteering(sessionId) || []; }
         catch { steerMsgs = []; }
         const merged = mergeSteeringEntries(steerMsgs);
         if (!merged) return false;
+        if (typeof options.beforeAppend === 'function') {
+            try { options.beforeAppend(); } catch { /* best-effort hook */ }
+        }
         messages.push({ role: 'user', content: merged.content });
         try { opts.onSteerMessage?.(merged.text || steeringContentText(merged.content)); } catch {}
         if (sessionId) {
@@ -1164,11 +1378,29 @@ export async function agentLoop(provider, messages, model, tools, onToolCall, cw
         }
         return true;
     };
+    const pushIntermediateAssistantResponse = (resp) => {
+        if (!resp) return false;
+        const content = typeof resp.content === 'string' ? resp.content : (resp.content == null ? '' : String(resp.content));
+        const reasoningContent = typeof resp.reasoningContent === 'string' && resp.reasoningContent
+            ? resp.reasoningContent
+            : '';
+        const reasoningItems = Array.isArray(resp.reasoningItems) && resp.reasoningItems.length
+            ? resp.reasoningItems
+            : null;
+        if (!content && !reasoningContent && !reasoningItems) return false;
+        messages.push({
+            role: 'assistant',
+            content,
+            ...(reasoningItems ? { reasoningItems } : {}),
+            ...(reasoningContent ? { reasoningContent } : {}),
+        });
+        return true;
+    };
     const maxLoopIterations = Number.isFinite(sessionRef?.maxLoopIterations)
         ? sessionRef.maxLoopIterations
         : MAX_LOOP_ITERATIONS;
     // Tool execution must use the session cwd even when the caller omitted the
-    // legacy positional cwd argument. Bridge workers always carry their cwd on
+    // legacy positional cwd argument. Agent workers always carry their cwd on
     // sessionRef; falling through to pwd()/process.cwd() resolves relatives
     // against the host/plugin root instead of the worker workspace.
     cwd = cwd || sessionRef?.cwd || undefined;
@@ -1178,6 +1410,11 @@ export async function agentLoop(provider, messages, model, tools, onToolCall, cw
             process.stderr.write(`[loop] hard iteration cap ${maxLoopIterations} reached (sess=${sessionId || 'unknown'}); stopping loop.\n`);
             break;
         }
+        // Drain queued steering/prompts BEFORE the
+        // pre-send compact check. The compact decision must see the exact
+        // message set that the next provider.send would receive, including
+        // tool results plus any queued user input/notifications.
+        drainSteeringIntoMessages('pre-send');
         const compactPolicy = resolveWorkerCompactPolicy(sessionRef, tools);
         if (compactPolicy?.auto) {
             // Snapshot pre-compact shape so compact_meta can record the actual
@@ -1185,11 +1422,25 @@ export async function agentLoop(provider, messages, model, tools, onToolCall, cw
             // a best-effort JSON.stringify length — close enough to the
             // payload we hand the provider for prefix-cache analysis.
             const beforeCount = messages.length;
-            let beforeBytes = null;
-            try { beforeBytes = Buffer.byteLength(JSON.stringify(messages), 'utf8'); } catch { beforeBytes = null; }
+            // beforeBytes is only ever read inside the shouldCompact telemetry
+            // branches below. Computing it eagerly serialized the ENTIRE message
+            // array (Buffer.byteLength(JSON.stringify(messages))) on every loop
+            // iteration — including the common no-compact path — which grows
+            // linearly with transcript size and was a real per-iteration drag.
+            // Defer it to a memoized lazy getter so the no-compact path pays
+            // nothing and the compact path still gets an exact byte count once.
+            let _beforeBytes;
+            let _beforeBytesComputed = false;
+            const getBeforeBytes = () => {
+                if (_beforeBytesComputed) return _beforeBytes;
+                _beforeBytesComputed = true;
+                try { _beforeBytes = Buffer.byteLength(JSON.stringify(messages), 'utf8'); } catch { _beforeBytes = null; }
+                return _beforeBytes;
+            };
             const messageTokensEst = estimateMessagesTokensSafe(messages);
-            const pressureTokens = compactPressureTokens(messageTokensEst, compactPolicy, sessionRef);
-            const shouldCompact = shouldCompactForSession(messageTokensEst, compactPolicy, sessionRef);
+            const reactivePending = reactiveOverflowRetryPending === true;
+            const shouldCompact = shouldCompactForSession(messageTokensEst, compactPolicy, { forceReactive: reactivePending });
+            const pressureTokens = compactionTelemetryPressureTokens(messageTokensEst, compactPolicy, { reactivePending });
             const compactBudgetTokens = shouldCompact
                 ? (compactTargetBudget({ ...compactPolicy, pressureTokens }) || compactPolicy.boundaryTokens)
                 : compactPolicy.boundaryTokens;
@@ -1202,18 +1453,27 @@ export async function agentLoop(provider, messages, model, tools, onToolCall, cw
                 });
             } else {
                 try { opts.onStageChange?.('compacting'); } catch { /* best-effort */ }
+                const compactStartedAt = Date.now();
+                // A pending reactive-overflow retry makes THIS compact pass the
+                // recovery from a provider overflow refusal, not the proactive
+                // pressure trigger. Tag the emitted events so telemetry can tell
+                // them apart, then clear the one-shot flag.
+                const compactTrigger = reactiveOverflowRetryPending ? 'reactive' : 'auto';
+                reactiveOverflowRetryPending = false;
                 rememberCompactTelemetry(sessionRef, compactPolicy, {
                     stage: 'compacting',
                     beforeTokens: messageTokensEst,
                     afterTokens: messageTokensEst,
                     pressureTokens,
+                    trigger: compactTrigger,
                 });
                 let compacted;
-                let remoteCompactResult = null;
                 let pruneCount = 0;
                 let summaryChanged = false;
                 let semanticCompactResult = null;
                 let semanticCompactError = null;
+                let recallFastTrackResult = null;
+                let recallFastTrackError = null;
                 try {
                     let compactInputMessages = messages;
                     if (compactPolicy.prune) {
@@ -1223,12 +1483,32 @@ export async function agentLoop(provider, messages, model, tools, onToolCall, cw
                         pruneCount = countPrunedToolOutputs(messages, pruned);
                         compactInputMessages = pruned;
                     }
-                    // Pre-send compaction replaces destructive drop: older
-                    // non-system history is condensed into one summary message.
-                    // The current turn and tool pairing stay intact; if those
-                    // mandatory parts cannot fit, compactMessages throws instead
-                    // of silently discarding user-visible context.
-                    if (compactPolicy.semantic) {
+                    if (compactPolicy.recallFastTrack) {
+                        try {
+                            recallFastTrackResult = await runRecallFastTrackCompact({
+                                sessionRef,
+                                messages: compactInputMessages,
+                                compactBudgetTokens,
+                                compactPolicy,
+                                sessionId,
+                                signal,
+                            });
+                            const recallMessages = Array.isArray(recallFastTrackResult?.messages)
+                                ? recallFastTrackResult.messages
+                                : null;
+                            if (!recallMessages) throw new Error('recall-fasttrack compact produced no messages');
+                            compacted = recallMessages;
+                        } catch (recallErr) {
+                            recallFastTrackError = recallErr;
+                            try {
+                                process.stderr.write(
+                                    `[loop] recall-fasttrack compact failed (sess=${sessionId || 'unknown'}): ` +
+                                    `${recallErr?.message || recallErr}\n`,
+                                );
+                            } catch { /* best-effort */ }
+                            throw recallErr;
+                        }
+                    } else if (compactPolicy.semantic) {
                         try {
                             semanticCompactResult = await semanticCompactMessages(
                                 provider,
@@ -1253,10 +1533,8 @@ export async function agentLoop(provider, messages, model, tools, onToolCall, cw
                             const semanticMessages = Array.isArray(semanticCompactResult?.messages)
                                 ? semanticCompactResult.messages
                                 : null;
-                            if (semanticMessages && (semanticCompactResult?.semantic === true
-                                || messagesArrayChanged(compactInputMessages, semanticMessages))) {
-                                compacted = semanticMessages;
-                            }
+                            if (!semanticMessages) throw new Error('semantic compact produced no messages');
+                            compacted = semanticMessages;
                             if (semanticCompactResult?.usage) {
                                 lastUsage = addUsage(lastUsage, semanticCompactResult.usage);
                                 if (!firstTurnUsage) firstTurnUsage = normalizeUsage(semanticCompactResult.usage);
@@ -1265,6 +1543,8 @@ export async function agentLoop(provider, messages, model, tools, onToolCall, cw
                                         opts.onUsageDelta({
                                             sessionId,
                                             iterationIndex: iterations + 1,
+                                            usageMetricsTurnId: loopUsageMetricsTurnId(),
+                                            usageMetricsEpoch: loopUsageMetricsEpoch(),
                                             deltaInput: semanticCompactResult.usage.inputTokens || 0,
                                             deltaOutput: semanticCompactResult.usage.outputTokens || 0,
                                             deltaCachedRead: semanticCompactResult.usage.cachedTokens || 0,
@@ -1280,127 +1560,46 @@ export async function agentLoop(provider, messages, model, tools, onToolCall, cw
                             try {
                                 process.stderr.write(
                                     `[loop] semantic compact failed (sess=${sessionId || 'unknown'}): ` +
-                                    `${semanticErr?.message || semanticErr}; falling back to deterministic compact\n`,
-                                );
-                            } catch { /* best-effort */ }
-                        }
-                    }
-                    if (!compacted) {
-                        try {
-                            compacted = compactMessages(compactInputMessages, compactBudgetTokens, {
-                                reserveTokens: compactPolicy.reserveTokens,
-                                force: true,
-                            });
-                        } catch (deterministicErr) {
-                            // Deterministic (and any prior semantic) compaction
-                            // failed because system + the entire current turn is
-                            // mandatory and overflows the budget. For bridge
-                            // workers, fall back to the narrow active-turn
-                            // compactor, which shrinks older same-turn tool
-                            // outputs / drops older same-turn groups while
-                            // preserving system + task user + the latest
-                            // group(s) and tool pairing. It still throws (and we
-                            // surface overflow below) when even that floor cannot
-                            // fit, so overflow/cancellation behavior is preserved.
-                            if (!compactPolicy.activeTurnFallback) throw deterministicErr;
-                            compacted = compactActiveTurn(compactInputMessages, compactBudgetTokens, {
-                                reserveTokens: compactPolicy.reserveTokens,
-                                force: true,
-                            });
-                            try {
-                                process.stderr.write(
-                                    `[loop] active-turn fallback compaction (sess=${sessionId || 'unknown'}): ` +
-                                    `${deterministicErr?.message || deterministicErr}\n`,
+                                    `${semanticErr?.message || semanticErr}\n`,
                                 );
                             } catch { /* best-effort */ }
+                            throw semanticErr;
                         }
+                    } else {
+                        throw new Error(`compact type ${compactPolicy.compactType || compactPolicy.type || DEFAULT_COMPACT_TYPE} is unavailable for auto compact`);
                     }
                     summaryChanged = messagesArrayChanged(compactInputMessages, compacted);
-                    if (summaryChanged && providerRemoteCompactEnabled(provider, opts)) {
-                        const compactInput = splitMessagesForRemoteCompact(messages);
-                        if (compactInput) {
-                            try {
-                                remoteCompactResult = await provider.remoteCompactMessages(
-                                    compactInput,
-                                    model,
-                                    tools,
-                                    {
-                                        ...opts,
-                                        thinkingBudgetTokens: undefined,
-                                        xaiReasoningEffort: undefined,
-                                        reasoningEffort: undefined,
-                                        effort: 'low',
-                                        providerState,
-                                        iteration: iterations + 1,
-                                        remoteCompact: true,
-                                        onToolCall: undefined,
-                                        onStreamDelta: undefined,
-                                    },
-                                );
-                                if (remoteCompactResult?.providerState !== undefined) {
-                                    markRemoteCompactFallback(compacted, provider?.name);
-                                }
-                                if (remoteCompactResult?.usage) {
-                                    lastUsage = addUsage(lastUsage, remoteCompactResult.usage);
-                                    if (!firstTurnUsage) firstTurnUsage = normalizeUsage(remoteCompactResult.usage);
-                                    if (sessionId && opts.onUsageDelta) {
-                                        try {
-                                            opts.onUsageDelta({
-                                                sessionId,
-                                                iterationIndex: iterations + 1,
-                                                deltaInput: remoteCompactResult.usage.inputTokens || 0,
-                                                deltaOutput: remoteCompactResult.usage.outputTokens || 0,
-                                                deltaCachedRead: remoteCompactResult.usage.cachedTokens || 0,
-                                                deltaCacheWrite: remoteCompactResult.usage.cacheWriteTokens || 0,
-                                                source: 'remote_compact',
-                                                ts: Date.now(),
-                                            });
-                                        } catch { /* best-effort */ }
-                                    }
-                                }
-                            } catch (remoteErr) {
-                                try {
-                                    process.stderr.write(
-                                        `[loop] remote compact failed (sess=${sessionId || 'unknown'}): ` +
-                                        `${remoteErr?.message || remoteErr}; falling back to local summary\n`,
-                                    );
-                                } catch { /* best-effort */ }
-                                traceBridgeCompact({
-                                    sessionId,
-                                    iteration: iterations + 1,
-                                    stage: 'remote_compact',
-                                    prune_count: pruneCount,
-                                    compact_changed: false,
-                                    input_prefix_hash: messagePrefixHash(messages),
-                                    before_count: beforeCount,
-                                    after_count: beforeCount,
-                                    before_bytes: beforeBytes,
-                                    after_bytes: beforeBytes,
-                                    context_window: compactPolicy.contextWindow,
-                                    budget_tokens: compactPolicy.boundaryTokens,
-                                    target_budget_tokens: compactBudgetTokens,
-                                    reserve_tokens: compactPolicy.reserveTokens,
-                                    message_tokens_est: messageTokensEst,
-                                    provider: sessionRef.provider,
-                                    model: sessionRef.model || model,
-                                    error: remoteErr && remoteErr.message ? remoteErr.message : String(remoteErr),
-                                    error_code: 'REMOTE_COMPACT_FAILED',
-                                });
-                            }
-                        }
-                    }
                 } catch (compactErr) {
-                    traceBridgeCompact({
+                    const compactFailMsg = compactErr && compactErr.message ? compactErr.message : String(compactErr);
+                    const semanticFailMsg = semanticCompactError?.message || null;
+                    const recallFailMsg = recallFastTrackError?.message || null;
+                    const compactFailCode = compactErr?.code
+                        || (compactErr?.name === 'AgentContextOverflowError' ? 'AGENT_CONTEXT_OVERFLOW' : null)
+                        || 'compact_failed';
+                    rememberCompactTelemetry(sessionRef, compactPolicy, {
+                        stage: 'overflow_failed',
+                        beforeTokens: messageTokensEst,
+                        afterTokens: messageTokensEst,
+                        pressureTokens,
+                        trigger: compactTrigger,
+                        semanticError: semanticFailMsg,
+                        recallFastTrackError: recallFailMsg,
+                        compactError: semanticFailMsg || recallFailMsg || compactFailMsg,
+                        pruneCount,
+                        durationMs: Date.now() - compactStartedAt,
+                    });
+                    traceAgentCompact({
                         sessionId,
                         iteration: iterations + 1,
                         stage: 'pre_send',
+                        trigger: compactTrigger,
                         prune_count: pruneCount,
                         compact_changed: false,
                         input_prefix_hash: messagePrefixHash(messages),
                         before_count: beforeCount,
                         after_count: messages.length,
-                        before_bytes: beforeBytes,
-                        after_bytes: beforeBytes,
+                        before_bytes: getBeforeBytes(),
+                        after_bytes: getBeforeBytes(),
                         context_window: compactPolicy.contextWindow,
                         budget_tokens: compactPolicy.boundaryTokens,
                         target_budget_tokens: compactBudgetTokens,
@@ -1408,10 +1607,31 @@ export async function agentLoop(provider, messages, model, tools, onToolCall, cw
                         message_tokens_est: messageTokensEst,
                         provider: sessionRef.provider,
                         model: sessionRef.model || model,
+                        error: compactFailMsg,
+                        error_code: compactFailCode,
+                    });
+                    emitCompactEvent(opts, {
+                        sessionId,
+                        stage: 'pre_send',
+                        trigger: compactTrigger,
+                        status: 'failed',
+                        compactType: compactEventType(compactPolicy),
+                        beforeTokens: messageTokensEst,
+                        afterTokens: messageTokensEst,
+                        beforeMessages: beforeCount,
+                        afterMessages: messages.length,
+                        pressureTokens,
+                        triggerTokens: compactPolicy.triggerTokens,
+                        boundaryTokens: compactPolicy.boundaryTokens,
+                        targetBudgetTokens: compactBudgetTokens,
+                        reserveTokens: compactPolicy.reserveTokens,
+                        semantic: compactPolicy.semantic === true,
+                        recallFastTrack: compactPolicy.recallFastTrack === true,
+                        pruneCount,
+                        durationMs: Date.now() - compactStartedAt,
                         error: compactErr && compactErr.message ? compactErr.message : String(compactErr),
-                        error_code: 'BRIDGE_CONTEXT_OVERFLOW',
                     });
-                    throw bridgeContextOverflowError({
+                    throw agentContextOverflowError({
                         stage: 'pre_send',
                         sessionId,
                         sessionRef,
@@ -1426,47 +1646,50 @@ export async function agentLoop(provider, messages, model, tools, onToolCall, cw
                 if (compactChanged) {
                     messages.length = 0;
                     messages.push(...compacted);
-                    if (remoteCompactResult?.providerState !== undefined) {
-                        providerState = remoteCompactResult.providerState;
-                    } else {
-                        // Compacting/pruning the transcript invalidates the
-                        // server-side conversation anchor (xAI Responses /
-                        // Codex WS rely on previous_response_id which points
-                        // at a now-mutated prefix). Drop providerState so the
-                        // next send starts a fresh chain instead of triggering
-                        // silent cache miss or hard mismatch.
-                        providerState = undefined;
-                    }
+                    // Compacting/pruning the transcript invalidates the
+                    // server-side conversation anchor (xAI Responses / openai-oauth
+                    // WS rely on previous_response_id which points at a
+                    // now-mutated prefix). Drop providerState so the next send
+                    // starts a fresh chain.
+                    providerState = undefined;
                     // Compaction shrank the transcript, so prior turns no
                     // longer pressure the window — reset the iteration counter
                     // so a steadily-compacting long task isn't killed by the
                     // cap, while a non-compacting tight loop still hits it.
                     iterations = 0;
+                    // New loop epoch so persistIterationMetrics idempotency keys do not
+                    // collide when iteration indices restart at 1 (incl. iter 1 → iter 1).
+                    if (sessionRef) bumpUsageMetricsEpoch(sessionRef);
                 }
                 const afterTokens = estimateMessagesTokensSafe(messages);
+                const compactDurationMs = Date.now() - compactStartedAt;
                 rememberCompactTelemetry(sessionRef, compactPolicy, {
                     stage: 'pre_send',
                     beforeTokens: messageTokensEst,
                     afterTokens,
                     pressureTokens,
                     compactChanged,
-                    remoteCompact: remoteCompactResult?.providerState !== undefined,
                     semanticCompact: semanticCompactResult?.semantic === true,
                     semanticError: semanticCompactError?.message || null,
+                    recallFastTrack: recallFastTrackResult?.recallFastTrack === true,
+                    recallFastTrackError: recallFastTrackError?.message || null,
+                    compactError: null,
                     pruneCount,
+                    durationMs: compactDurationMs,
                 });
                 let afterBytes = null;
                 try { afterBytes = Buffer.byteLength(JSON.stringify(messages), 'utf8'); } catch { afterBytes = null; }
-                traceBridgeCompact({
+                traceAgentCompact({
                     sessionId,
                     iteration: iterations + 1,
                     stage: 'pre_send',
+                    trigger: compactTrigger,
                     prune_count: pruneCount,
                     compact_changed: compactChanged || summaryChanged,
                     input_prefix_hash: messagePrefixHash(messages),
                     before_count: beforeCount,
                     after_count: messages.length,
-                    before_bytes: beforeBytes,
+                    before_bytes: getBeforeBytes(),
                     after_bytes: afterBytes,
                     context_window: compactPolicy.contextWindow,
                     budget_tokens: compactPolicy.boundaryTokens,
@@ -1476,14 +1699,29 @@ export async function agentLoop(provider, messages, model, tools, onToolCall, cw
                     provider: sessionRef.provider,
                     model: sessionRef.model || model,
                 });
+                emitCompactEvent(opts, {
+                    sessionId,
+                    stage: 'pre_send',
+                    trigger: compactTrigger,
+                    status: compactChanged || summaryChanged || pruneCount > 0 ? 'compacted' : 'no_change',
+                    compactType: compactEventType(compactPolicy),
+                    beforeTokens: messageTokensEst,
+                    afterTokens,
+                    beforeMessages: beforeCount,
+                    afterMessages: messages.length,
+                    pressureTokens,
+                    triggerTokens: compactPolicy.triggerTokens,
+                    boundaryTokens: compactPolicy.boundaryTokens,
+                    targetBudgetTokens: compactBudgetTokens,
+                    reserveTokens: compactPolicy.reserveTokens,
+                    changed: compactChanged || summaryChanged,
+                    semantic: semanticCompactResult?.semantic === true,
+                    recallFastTrack: recallFastTrackResult?.recallFastTrack === true,
+                    pruneCount,
+                    durationMs: compactDurationMs,
+                });
             }
         }
-        // A pre-send compaction pass can take long enough for the user (or a
-        // background completion notification) to enqueue more input. Drain once
-        // immediately before provider.send so that input is included in the very
-        // next request instead of sitting in the queue until after the model has
-        // already answered the pre-compaction prompt.
-        drainSteeringIntoMessages('pre-send');
         const nextIteration = iterations + 1;
         opts.iteration = nextIteration;
         opts.providerState = providerState;
@@ -1518,6 +1756,10 @@ export async function agentLoop(provider, messages, model, tools, onToolCall, cw
         let _mutationEpoch = 0;
         const startEagerTool = (call) => {
             if (!call?.id || pending.has(call.id) || !isEagerDispatchable(call.name, tools)) return null;
+            // Never eager-execute a call whose arguments failed to parse
+            // (invalid-args marker). It has no usable arguments; the serial
+            // body handles it via the invalid-args feedback path.
+            if (isInvalidToolArgsMarker(call.arguments)) return null;
             const _sig = _intraTurnSig(call.name, call.arguments);
             if (_eagerInFlightSigs.has(_sig)) return null;
             // Repeat-failure guard also gates eager dispatch (reviewer-flagged):
@@ -1538,20 +1780,55 @@ export async function agentLoop(provider, messages, model, tools, onToolCall, cw
             _eagerInFlightSigs.set(_sig, call.id);
             entry.promise = (async () => {
                 try {
-                    const permBlocked = _checkWorkerPermission(call.name, call.arguments, sessionRef);
-                    if (permBlocked !== null) return { ok: true, value: permBlocked };
-                    return { ok: true, value: await executeTool(call.name, call.arguments, cwd, sessionId, sessionRef, { toolCallId: call.id, signal }) };
+                    return { ok: true, value: await executeTool(call.name, call.arguments, cwd, sessionId, sessionRef, { toolCallId: call.id, signal, notifyFn: opts.notifyFn, toolApprovalHook: opts.onToolApproval }) };
                 } catch (error) {
                     return { ok: false, error };
                 }
             })()
-                .finally(() => {
+                .then((settled) => {
                     entry.endedAt = Date.now();
+                    // EARLY UI-ONLY NOTIFY (completion-order, NOT history).
+                    // The serial result-collection loop below `await`s each
+                    // eager promise strictly in CALL order, so a fast call[1]
+                    // that settles before a slow call[0] cannot surface its
+                    // tool card completion until call[0] resolves. Fire
+                    // onToolResult here — the instant THIS eager tool settles —
+                    // so parallel cards complete independently in the order they
+                    // actually finish.
+                    //
+                    // This message is NOT pushed into `messages`: provider
+                    // history ordering stays exactly call-order. The serial loop
+                    // still builds the REAL tool_result and pushes it via
+                    // pushToolResultMessage (which fires onToolResult AGAIN for
+                    // the same toolCallId in call order — the TUI dedupes by id,
+                    // so the duplicate notify is harmless). __earlyNotify marks
+                    // this as the pre-history, UI-only signal.
+                    //
+                    // Only genuinely-executed eager promises reach here:
+                    // startEagerTool never creates an entry for dedup /
+                    // repeat-failure-guard / pre-dispatch-deny / invalid-args
+                    // calls (they return null above), so those `continue`-before-
+                    // execution stub paths can never early-notify (contract #5).
+                    try {
+                        const _earlyContent = settled && settled.ok
+                            ? (typeof settled.value === 'string'
+                                ? settled.value
+                                : (settled.value == null ? '' : String(settled.value)))
+                            : `Error: ${settled && settled.error instanceof Error ? settled.error.message : String(settled && settled.error)}`;
+                        opts.onToolResult?.({
+                            role: 'tool',
+                            toolCallId: call.id,
+                            content: _earlyContent,
+                            isError: !(settled && settled.ok),
+                            __earlyNotify: true,
+                        });
+                    } catch { /* best-effort — UI notify must never break the eager path */ }
                     // Intentionally do NOT delete _sig here — see the block
                     // comment above. The sig must outlive promise settlement
                     // so a later same-turn streaming duplicate stays blocked
                     // at the _eagerInFlightSigs.has(_sig) guard until the turn
                     // boundary recreates the Map.
+                    return settled;
                 });
             pending.set(call.id, entry);
             return entry;
@@ -1573,11 +1850,9 @@ export async function agentLoop(provider, messages, model, tools, onToolCall, cw
             if (_streamEagerBlocked) return;
             startEagerTool(call);
         };
-        // Repair any dangling assistant tool_use left over from a prior
-        // abort/error path before the provider sees the transcript. No-op
-        // on the healthy iteration cycle (every assistant tool_use is
-        // followed by tool results in the same loop body below).
-        _ensureTranscriptPairing(messages, sessionId);
+        // Reattach separated tool results, then drop only truly dangling
+        // assistant/orphan pairs before the provider sees the transcript.
+        repairTranscriptBeforeProviderSend(messages, sessionId);
         // Strip soft-warn markers from prior tool results before the next
         // send. Marker bytes (Tool-budget(xN), Same-file reads(xN), etc.)
         // mutate every turn with dynamic counters, so leaving them in the
@@ -1595,145 +1870,59 @@ export async function agentLoop(provider, messages, model, tools, onToolCall, cw
         try {
             response = await provider.send(messages, model, sendTools.length ? sendTools : undefined, opts);
         } catch (sendErr) {
-            // Context-window-exceeded is a deterministic refusal: the request is
-            // simply too large. Retry ONCE with a stricter budget using the
-            // same summary-based compaction path. It never falls back to
-            // destructive trim/drop: if system + current turn + compact marker
-            // cannot fit, surface overflow. Unrelated errors (network, stall,
-            // auth, etc.) re-throw untouched — they are handled by the
-            // provider/bridge retry layers.
+            // Context-window-exceeded is a deterministic refusal from the API.
+            // Recover context overflow reactively by compacting and retrying
+            // in the same active turn. MixDog's proactive estimator can miss a
+            // provider-specific overhead spike, so do one reactive retry by
+            // marking the live session over-threshold and looping back through
+            // the normal pre-send auto-compact path. If compaction/retry still
+            // fails, surface the overflow normally.
             if (
                 !isContextOverflowError(sendErr)
                 || !(sessionRef && typeof sessionRef.contextWindow === 'number')
             ) {
                 throw sendErr;
             }
-            const overflowPolicy = resolveWorkerCompactPolicy(sessionRef, sendTools.length ? sendTools : tools);
-            const overflowBase = overflowPolicy?.boundaryTokens || sessionRef.contextWindow;
-            const overflowStrictBudget = Math.floor(overflowBase * OVERFLOW_RETRY_COMPACT_PERCENT);
-            const overflowBudget = Math.max(1, Math.min(
-                overflowBase,
-                overflowPolicy?.triggerTokens || overflowBase,
-                overflowStrictBudget || overflowBase,
-            ));
-            const overflowReserve = overflowPolicy?.reserveTokens || estimateRequestReserveTokens(sendTools.length ? sendTools : tools);
-            const beforeCount = messages.length;
-            let beforeBytes = null;
-            try { beforeBytes = Buffer.byteLength(JSON.stringify(messages), 'utf8'); } catch { beforeBytes = null; }
-            const messageTokensEst = estimateMessagesTokensSafe(messages);
-            let recompacted;
-            try {
-                recompacted = compactMessages(messages, overflowBudget, { reserveTokens: overflowReserve, force: true });
-            } catch (compactErr) {
-                // Same narrow active-turn fallback as the pre-send path: when
-                // system + the whole current turn overflow even the stricter
-                // overflow-retry budget, shrink older same-turn tool outputs /
-                // drop older same-turn groups before surfacing overflow. Throws
-                // (caught below) when even the floor cannot fit, preserving the
-                // overflow error behavior.
-                if (overflowPolicy?.activeTurnFallback) {
-                    try {
-                        recompacted = compactActiveTurn(messages, overflowBudget, { reserveTokens: overflowReserve, force: true });
-                        try {
-                            process.stderr.write(
-                                `[loop] active-turn fallback compaction on overflow retry ` +
-                                `(sess=${sessionId || 'unknown'} iter=${nextIteration}): ` +
-                                `${compactErr?.message || compactErr}\n`,
-                            );
-                        } catch { /* best-effort */ }
-                    } catch { recompacted = undefined; }
-                }
-                if (!recompacted) {
-                traceBridgeCompact({
-                    sessionId,
-                    iteration: nextIteration,
-                    stage: 'overflow_retry',
-                    prune_count: 0,
-                    compact_changed: false,
-                    input_prefix_hash: messagePrefixHash(messages),
-                    before_count: beforeCount,
-                    after_count: messages.length,
-                    before_bytes: beforeBytes,
-                    after_bytes: beforeBytes,
-                    context_window: overflowPolicy?.contextWindow || sessionRef.contextWindow,
-                    budget_tokens: overflowBudget,
-                    reserve_tokens: overflowReserve,
-                    message_tokens_est: messageTokensEst,
-                    provider: sessionRef.provider,
-                    model: sessionRef.model || model,
-                    error: compactErr && compactErr.message ? compactErr.message : String(compactErr),
-                    error_code: 'BRIDGE_CONTEXT_OVERFLOW',
-                });
-                throw bridgeContextOverflowError({
-                    stage: 'overflow_retry',
-                    sessionId,
-                    sessionRef,
-                    model,
-                    budgetTokens: overflowBudget,
-                    reserveTokens: overflowReserve,
-                    messageTokensEst,
-                }, compactErr);
-                }
+            const compactPolicyForRetry = resolveWorkerCompactPolicy(sessionRef, sendTools.length ? sendTools : tools);
+            if (!contextOverflowRetryUsed && compactPolicyForRetry?.auto) {
+                contextOverflowRetryUsed = true;
+                // Mark the next pre-send compact as REACTIVE (driven by a
+                // provider overflow refusal) rather than the normal proactive
+                // pressure trigger, so the compact event/telemetry the loop
+                // emits on the retry is distinguishable downstream.
+                reactiveOverflowRetryPending = true;
+                opts.onToolCall = undefined;
+                try {
+                    process.stderr.write(
+                        `[loop] context overflow on send (sess=${sessionId || 'unknown'} iter=${nextIteration}); ` +
+                        `reactive compact retry messages=${messages.length}\n`,
+                    );
+                } catch { /* best-effort */ }
+                continue;
             }
-            const compactChanged = messagesArrayChanged(messages, recompacted);
-            const pruneCount = Math.max(beforeCount - recompacted.length, 0);
-            messages.length = 0;
-            messages.push(...recompacted);
-            let afterBytes = null;
-            try { afterBytes = Buffer.byteLength(JSON.stringify(messages), 'utf8'); } catch { afterBytes = null; }
-            traceBridgeCompact({
-                sessionId,
-                iteration: nextIteration,
-                stage: 'overflow_retry',
-                prune_count: pruneCount,
-                compact_changed: compactChanged,
-                input_prefix_hash: messagePrefixHash(messages),
-                before_count: beforeCount,
-                after_count: messages.length,
-                before_bytes: beforeBytes,
-                after_bytes: afterBytes,
-                context_window: overflowPolicy?.contextWindow || sessionRef.contextWindow,
-                budget_tokens: overflowBudget,
-                reserve_tokens: overflowReserve,
-                message_tokens_est: messageTokensEst,
-                provider: sessionRef.provider,
-                model: sessionRef.model || model,
-            });
-            rememberCompactTelemetry(sessionRef, overflowPolicy, {
-                stage: 'overflow_retry',
-                beforeTokens: messageTokensEst,
-                afterTokens: estimateMessagesTokensSafe(messages),
-                compactChanged,
-                pruneCount,
-            });
-            // The transcript prefix changed; the server-side conversation anchor
-            // (previous_response_id / WS continuation) is now invalid. Drop
-            // providerState so the retry starts a fresh chain instead of
-            // tripping a silent cache miss or hard mismatch.
-            providerState = undefined;
-            opts.providerState = undefined;
-            // Drop eager-dispatch state before the retry send. A tool_use
-            // streamed by the failed first send could otherwise orphan its
-            // eager result or be double-dispatched; force the retry's tools
-            // through the serial post-send path with a clean matching slate.
-            opts.onToolCall = undefined;
-            pending.clear();
-            _eagerInFlightSigs.clear();
             try {
                 process.stderr.write(
                     `[loop] context overflow on send (sess=${sessionId || 'unknown'} iter=${nextIteration}); ` +
-                    `retrying once at budget=${overflowBudget} reserve=${overflowReserve} ` +
-                    `messages=${messages.length}\n`,
+                    `surfacing overflow after reactive compact retry messages=${messages.length}\n`,
                 );
             } catch { /* best-effort */ }
-            response = await provider.send(messages, model, sendTools.length ? sendTools : undefined, opts);
+            throw agentContextOverflowError({
+                stage: 'send',
+                sessionId,
+                sessionRef,
+                model,
+                budgetTokens: sessionRef.contextWindow,
+                reserveTokens: compactPolicyForRetry?.reserveTokens,
+                messageTokensEst: estimateMessagesTokensSafe(messages),
+            }, sendErr);
         }
         opts.onToolCall = undefined;
+        contextOverflowRetryUsed = false;
         // Capture opaque state for the next turn (may be undefined — that's
         // the stateless contract for providers that don't use continuation).
         providerState = response?.providerState ?? undefined;
         iterations = nextIteration;
-        traceBridgeLoop({
+        traceAgentLoop({
             sessionId,
             iteration: iterations,
             sendMs: Date.now() - sendStartedAt,
@@ -1760,12 +1949,15 @@ export async function agentLoop(provider, messages, model, tools, onToolCall, cw
         // signal) — bail before processing any of its output.
         throwIfAborted();
         // Incremental metric persistence (fix A): push per-iteration token delta
-        // immediately so watchdog / bridge type=list sees live totals mid-turn.
+        // immediately so watchdog / agent type=list sees live totals mid-turn.
         if (sessionId && opts.onUsageDelta && response.usage) {
             try {
                 opts.onUsageDelta({
                     sessionId,
                     iterationIndex: iterations,
+                    usageMetricsTurnId: loopUsageMetricsTurnId(),
+                    source: 'provider_send',
+                    usageMetricsEpoch: loopUsageMetricsEpoch(),
                     deltaInput: response.usage.inputTokens || 0,
                     deltaOutput: response.usage.outputTokens || 0,
                     deltaPrompt: response.usage.promptTokens || 0,
@@ -1778,8 +1970,8 @@ export async function agentLoop(provider, messages, model, tools, onToolCall, cw
                 });
             } catch { /* best-effort — never break the loop */ }
         }
-        // No tool calls. For PUBLIC bridge agents, the bridge contract
-        // (rules/bridge/00-common.md) requires either a tool call or a
+        // No tool calls. For PUBLIC agents, the agent contract
+        // (rules/agent/00-common.md) requires either a tool call or a
         // `<final-answer>` wrapped reply.
         // A text-only turn without those tags violates the contract (e.g.
         // Opus 4.6 emits 'Now I'll polish…' preamble before its first tool
@@ -1805,6 +1997,17 @@ export async function agentLoop(provider, messages, model, tools, onToolCall, cw
             const isHidden = HIDDEN_ROLE_NAMES.has(sessionRole);
             const stopReason = response.stopReason ?? response.stop_reason ?? null;
             const isIncompleteStop = stopReason && INCOMPLETE_STOP_REASONS.has(stopReason);
+            // A user/schedule notification can arrive while provider.send() is
+            // returning a terminal no-tool response. Drain once before accepting
+            // it as final so the queued input is handled in the same active turn
+            // instead of waiting for post-turn TUI drain. If the model already
+            // produced assistant text, persist that as an intermediate assistant
+            // message before appending the steered user message.
+            if (drainSteeringIntoMessages('final-pre-send', {
+                beforeAppend: () => pushIntermediateAssistantResponse(response),
+            })) {
+                continue;
+            }
             if (!hasContent && !isHidden) {
                 if (contractNudges >= 1) break;
                 contractNudges += 1;
@@ -1821,6 +2024,16 @@ export async function agentLoop(provider, messages, model, tools, onToolCall, cw
         }
         const calls = response.toolCalls;
         toolCallsTotal += calls.length;
+        // Surface any mid-turn assistant text (preamble that precedes a tool
+        // call) to the UI. Providers that stream text via onTextDelta already
+        // rendered it; providers that return the text only in response.content
+        // (no deltas) would otherwise show nothing before the tool card. The
+        // engine de-dups against already-streamed text, so emitting here is
+        // safe for both paths. Sub-agent sessions suppress it entirely
+        // (suppressMidTurnText) — Lead only consumes the final answer.
+        if (!suppressMidTurnText && typeof response.content === 'string' && response.content.trim()) {
+            try { opts.onAssistantText?.(response.content); } catch { /* best-effort */ }
+        }
         // Per-turn batch shape — one row per assistant turn so trace
         // consumers can derive multi-tool adoption ratio without scanning
         // every assistant message body.
@@ -1830,11 +2043,14 @@ export async function agentLoop(provider, messages, model, tools, onToolCall, cw
         // OpenAI Responses API replay payload (encrypted_content blobs);
         // providers that ignore it just see an extra field and drop it,
         // openai-oauth.convertMessagesToResponsesInput emits matching
-        // type:'reasoning' input items on the next turn to keep the Codex
+        // type:'reasoning' input items on the next turn to keep the openai-oauth
         // server-side cache prefix stable.
         const _assistantTurnMsg = {
             role: 'assistant',
-            content: response.content || '',
+            // Sub-agent tool-call turns carry only mid-turn preamble in
+            // response.content (the real result rides the later final-answer
+            // turn). Blank it so it never accumulates as input tokens.
+            content: suppressMidTurnText ? '' : (response.content || ''),
             toolCalls: compactToolCallsForHistory(calls),
             ...(Array.isArray(response.reasoningItems) && response.reasoningItems.length
                 ? { reasoningItems: response.reasoningItems }
@@ -1848,9 +2064,9 @@ export async function agentLoop(provider, messages, model, tools, onToolCall, cw
         //
         // Intra-turn duplicate suppression: when an LLM emits two tool_use
         // blocks with identical (name, args) inside the SAME assistant turn,
-        // re-executing wastes tokens. Restricted to tools with
-        // `readOnlyHint:true` (= isEagerDispatchable) — bash/write/edit/
-        // apply_patch may be intentional repeats with distinct side effects.
+                // re-executing wastes tokens. Restricted to tools with
+                // `readOnlyHint:true` (= isEagerDispatchable) — bash/apply_patch
+                // may be intentional repeats with distinct side effects.
         // Pre-pass identifies duplicates BEFORE startEagerRun so eager
         // dispatch also skips them, not just the for-body.
         const _duplicateCallIds = new Set();
@@ -1915,7 +2131,7 @@ export async function agentLoop(provider, messages, model, tools, onToolCall, cw
             let toolStartedAt;
             let toolEndedAt;
             const toolKind = getToolKind(call.name);
-            // Cross-turn read dedup. Mirrors Anthropic Claude Code's
+            // Cross-turn read dedup. Mirrors a reference agent's
             // fileReadCache.ts: if the path's stat tuple (mtime/size/ino/dev)
             // is unchanged since a prior read in THIS session, return the cached
             // body instead of executing. Both scalar and array/object-array path
@@ -1930,19 +2146,35 @@ export async function agentLoop(provider, messages, model, tools, onToolCall, cw
             let _scopedCacheHit = null;
             let _executeOk = false;
             let _resultKind = 'normal';
-            if (sessionId && _isReadTool(call.name)) {
+            // Invalid-args guard (native convergence): the provider parser tags
+            // a tool call whose arguments JSON could not be parsed with an
+            // invalid-args marker instead of throwing or swallowing to {}.
+            // Such a call must NOT execute — there are no usable arguments and
+            // permission/cache checks are meaningless. Skip straight to the
+            // error-feedback path so the model gets an is_error tool_result and
+            // re-issues the call with valid JSON in the same turn.
+            const _invalidArgs = isInvalidToolArgsMarker(call.arguments);
+            if (_invalidArgs) {
+                // no cache lookup for an un-parseable call
+            } else if (sessionId && _isReadTool(call.name)) {
                 _readCacheHit = tryReadCached({ sessionId, args: call.arguments, cwd });
             } else if (sessionId && _isScopedCacheableTool(call.name)) {
                 _scopedCacheHit = tryScopedToolCached({ sessionId, toolName: _stripMcpPrefix(call.name), args: call.arguments, cwd });
             }
             try {
-                if (_readCacheHit !== null) {
+                if (_invalidArgs) {
+                    toolStartedAt = Date.now();
+                    toolEndedAt = toolStartedAt;
+                    result = formatInvalidToolArgsResult(call);
+                    _resultKind = 'error';
+                    _executeOk = false;
+                } else if (_readCacheHit !== null) {
                     toolStartedAt = Date.now();
                     toolEndedAt = toolStartedAt;
                     const _body = _readCacheHit.content;
                     // Return the cached body byte-for-byte instead of a
                     // human-readable cache marker. The marker made public
-                    // bridge agents treat a successful cached read as a
+                    // agents treat a successful cached read as a
                     // meta instruction and repeat the same read loop.
                     result = _body;
                     _resultKind = 'cache-hit';
@@ -1981,39 +2213,32 @@ export async function agentLoop(provider, messages, model, tools, onToolCall, cw
                     }
                 } else {
                     toolStartedAt = Date.now();
-                    // Runtime permission guard. Schema profiles may hide
+                    // Runtime pre-dispatch deny. Schema profiles may hide
                     // tools for routing efficiency, but this remains the
-                    // safety boundary for any tool_use that still reaches
-                    // the loop. _preDispatchDeny is the SHARED helper used
-                    // by both the eager dispatch path (startEagerTool) and
-                    // this serial path — keeps the bridge-owned control-
-                    // plane reject, role guards, wrapper guards, and
-                    // permission guards consistent across both paths.
+                    // control-plane boundary for any tool_use that still
+                    // reaches the loop. _preDispatchDeny is the SHARED helper
+                    // used by both the eager dispatch path (startEagerTool)
+                    // and this serial path — keeps the agent-owned control-
+                    // plane reject and no-tool role guards consistent across
+                    // both paths.
                     const _denyMsg = _preDispatchDeny(call, toolKind, sessionRef);
                     if (_denyMsg !== null) {
                         result = _denyMsg;
                         toolEndedAt = Date.now();
                         _resultKind = 'error';
                     } else {
-                        const permBlocked = _checkWorkerPermission(call.name, call.arguments, sessionRef);
-                        if (permBlocked !== null) {
-                            result = permBlocked;
-                            toolEndedAt = Date.now();
+                        result = await executeTool(call.name, call.arguments, cwd, sessionId, sessionRef, { toolCallId: call.id, signal, notifyFn: opts.notifyFn, toolApprovalHook: opts.onToolApproval });
+                        toolEndedAt = Date.now();
+                        // Boundary: tool-return string convention → structural kind.
+                        // The only prefix check in this codebase; downstream layers
+                        // operate on _resultKind.
+                        if (classifyResultKind(result) === 'error') {
                             _resultKind = 'error';
+                            _executeOk = false;
                         } else {
-                            result = await executeTool(call.name, call.arguments, cwd, sessionId, sessionRef, { toolCallId: call.id, signal });
-                            toolEndedAt = Date.now();
-                            // Boundary: tool-return string convention → structural kind.
-                            // The only prefix check in this codebase; downstream layers
-                            // operate on _resultKind.
-                            if (classifyResultKind(result) === 'error') {
-                                _resultKind = 'error';
-                                _executeOk = false;
-                            } else {
-                                _executeOk = true;
-                            }
-                            // _resultKind stays 'normal' when tool returned a non-error string.
+                            _executeOk = true;
                         }
+                        // _resultKind stays 'normal' when tool returned a non-error string.
                     }
                 }
                 } // close: else branch of _readCacheHit check
@@ -2038,11 +2263,11 @@ export async function agentLoop(provider, messages, model, tools, onToolCall, cw
                 }
             }
             // A failed executed call keeps its FULL argument body in history so the
-            // model can retry against the original (a large apply_patch `patch` /
-            // edit `old_string` would otherwise be hidden behind a
+            // model can retry against the original (a large apply_patch `patch`
+            // would otherwise be hidden behind a
             // `[mixdog compacted …]` placeholder). Restored IMMEDIATELY — not at end
             // of loop — so an abort or post-processing throw after this point cannot
-            // leave a failed edit compacted. Cache-safe: _assistantTurnMsg is not
+            // leave a failed patch compacted. Cache-safe: _assistantTurnMsg is not
             // transmitted until the next provider.send. Early-continue paths (dedup /
             // repeat-failure-guard) never reach here and stay compacted.
             if ((!_executeOk || _resultKind === 'error') && call?.id) {
@@ -2059,10 +2284,10 @@ export async function agentLoop(provider, messages, model, tools, onToolCall, cw
             if (sessionId && _executeOk && _resultKind === 'normal') {
                 const _toolBare = _stripMcpPrefix(call.name);
                 if (_readCacheHit === null && _isReadTool(call.name)) {
-                    // Post-edit advisory: handle BOTH scalar and array forms
+                    // Post-patch advisory: handle BOTH scalar and array forms
                     // of args.path. The array form (path:[a,b,c] or
                     // path:[{path:a},{path:b}]) was a coverage gap in R1 —
-                    // an LLM that edits X then reads [X,Y] should still see
+                    // an LLM that patches X then reads [X,Y] should still see
                     // the advisory for X.
                     const _argsPath = call.arguments?.path;
                     const _pathList = [];
@@ -2116,59 +2341,14 @@ export async function agentLoop(provider, messages, model, tools, onToolCall, cw
                     } else {
                         clearScopedToolsForSession(sessionId);
                     }
-                } else if (_isScalarWriteEditTool(call.name)) {
-                    // Scalar `args.path` only: precise invalidate + advisory mark.
-                    // Array-form (`edits[]`/`writes[]`): the tool may have partial-
-                    // failed across paths and the result string aggregates;
-                    // full-clear instead of falsely marking every path.
-                    const _scalarPath = call.arguments?.path || call.arguments?.file_path;
-                    const _hasArrayForm = Array.isArray(call.arguments?.edits)
-                        || Array.isArray(call.arguments?.writes);
-                    if (_hasArrayForm) {
-                        clearReadDedupSession(sessionId);
-                        clearScopedToolsForSession(sessionId);
-                        // R20: array-form — walk each entry, extract its path,
-                        // and invalidate the prefetch cache + mark post-edit for
-                        // every distinct touched path. Falls back to the top-
-                        // level `path` (or `file_path`) when an entry omits its
-                        // own path. This covers both edit edits[] and write
-                        // writes[] forms; entries without a resolvable path are
-                        // silently skipped (their stat-validation safety net at
-                        // next lookup still applies).
-                        const _topPath = call.arguments?.path || call.arguments?.file_path;
-                        const _entries = call.arguments?.edits || call.arguments?.writes || [];
-                        const _seenPaths = new Set();
-                        for (const _e of _entries) {
-                            const _ep = _e?.path || _e?.file_path || _topPath;
-                            if (typeof _ep === 'string' && _ep && !_seenPaths.has(_ep)) {
-                                _seenPaths.add(_ep);
-                                invalidatePathForSession(sessionId, _ep, cwd);
-                                markPostEdit({ sessionId, path: _ep, cwd, toolName: _toolBare });
-                                invalidatePrefetchCache(_ep, cwd);
-                            }
-                        }
-                        if (_seenPaths.size > 0) {
-                            clearScopedToolsForSessionPaths(sessionId, [..._seenPaths], cwd);
-                        }
-                    } else if (typeof _scalarPath === 'string') {
-                        invalidatePathForSession(sessionId, _scalarPath, cwd);
-                        markPostEdit({ sessionId, path: _scalarPath, cwd, toolName: _toolBare });
-                        // R20: cross-dispatch prefetch cache invalidation.
-                        invalidatePrefetchCache(_scalarPath, cwd);
-                        // Targeted scoped-cache invalidation for the single touched path (D).
-                        clearScopedToolsForSessionPaths(sessionId, [_scalarPath], cwd);
-                    } else {
-                        // No path extractable — full wipe fallback.
-                        clearScopedToolsForSession(sessionId);
-                    }
                 }
             } // end _executeOk+_resultKind gate (scoped tool cache set)
-            // E: mutation tools (apply_patch / write / edit) must invalidate caches
+            // E: mutation tools (apply_patch) must invalidate caches
             // even on returned-error/partial-fail — the file state is unknown after
             // an error exit, and some tools report failure as an Error: result string
             // rather than throwing.
             // This block runs unconditionally (not gated on _executeOk or _resultKind).
-            if (sessionId && (!_executeOk || _resultKind === 'error') && (_stripMcpPrefix(call.name) === 'apply_patch' || _isScalarWriteEditTool(call.name))) {
+            if (sessionId && (!_executeOk || _resultKind === 'error') && _stripMcpPrefix(call.name) === 'apply_patch') {
                 clearReadDedupSession(sessionId);
             }
             if (_isMutationTool(call.name)) {
@@ -2201,6 +2381,7 @@ export async function agentLoop(provider, messages, model, tools, onToolCall, cw
             // failure push a synthetic Error: tool result for this call.id
             // and skip the cache writes for it.
             let _postProcessOk = true;
+            let _nativeToolSearch = null;
             try {
                 // Offload thresholds are keyed by BARE tool name
                 // (INLINE_THRESHOLD_BY_TOOL: grep=20k, bash=30k, read=Infinity, ...),
@@ -2208,9 +2389,11 @@ export async function agentLoop(provider, messages, model, tools, onToolCall, cw
                 // Otherwise an mcp__..__grep name misses its 20k grep cap and
                 // silently falls back to the 50k default — per-tool limits ignored.
                 const _toolBare = _stripMcpPrefix(call.name);
+                _nativeToolSearch = parseNativeToolSearchPayload(call.name, result);
+                if (_nativeToolSearch?.summary) result = _nativeToolSearch.summary;
                 result = await maybeOffloadToolResult(sessionId, call.id, _toolBare, result);
                 result = compressToolResult(call.name, call.arguments, result, { sessionId, toolKind });
-                traceBridgeTool({
+                traceAgentTool({
                     sessionId,
                     iteration: iterations,
                     toolName: call.name,
@@ -2254,6 +2437,7 @@ export async function agentLoop(provider, messages, model, tools, onToolCall, cw
                     content: result,
                     toolCallId: call.id,
                     toolKind: _resultKind,
+                    ...(_nativeToolSearch ? { nativeToolSearch: _nativeToolSearch } : {}),
                 });
             } catch (postErr) {
                 _postProcessOk = false;
@@ -2262,7 +2446,7 @@ export async function agentLoop(provider, messages, model, tools, onToolCall, cw
                 // too for a clean retry (mirrors the failed-exec path above).
                 if (call?.id) restoreToolCallBodyForId(_assistantTurnMsg, calls, call.id);
                 const _postMsg = `Error: tool result post-processing failed for "${call.name}": ${postErr instanceof Error ? postErr.message : String(postErr)}`;
-                traceBridgeToolFailure({
+                traceAgentToolFailure({
                     sessionId,
                     iteration: iterations,
                     toolName: call.name,
@@ -2293,18 +2477,11 @@ export async function agentLoop(provider, messages, model, tools, onToolCall, cw
             // discard the rest of the batch and skip the next provider.send.
             throwIfAborted();
         }
-        // ── Mid-turn steering (Claude Code / pi agent-loop parity) ──
-        // Before re-sending with the tool results, drain any user / `bridge
-        // type=send` messages that arrived WHILE this tool batch was in
-        // flight and inject them as user turns. This is the difference
-        // between "steer" (interrupt now) and "followUp" (wait for the turn
-        // to finish): previously every injected message was held until the
-        // entire askSession turn completed (manager.mjs _pendingTail drain),
-        // so a user typing mid-task only got picked up after the agent had
-        // already run to completion. Mirrors pi/agent-loop.ts:253 +
-        // 182-190 — steering messages land right before the next assistant
-        // response so the model sees them on its very next iteration.
-        drainSteeringIntoMessages('mid-turn');
+        // Mid-turn steering is drained at the next loop's pre-send point,
+        // AFTER any auto-compact pass. Draining here would put the steering
+        // user turn after the fresh tool results before compaction runs; then
+        // semantic/recall compaction would treat those fresh tool results as
+        // prior history before the model sees them.
         // About to re-send with tool results — transition back to connecting for the next turn.
         if (sessionId) updateSessionStage(sessionId, 'connecting');
     }