mixdog 0.9.19 → 0.9.21

package/scripts/session-ingest-compaction-smoke.mjs

@@ -0,0 +1,241 @@
+#!/usr/bin/env node
+// Compaction-append collision smoke for the session-ingest RUNTIME (not just
+// the pure helpers). Reproduces the silent-drop bug: after compaction removes an
+// earlier identical untimestamped message from the in-memory array, a newly
+// APPENDED identical message used to reproduce an already-persisted ordinal →
+// same source_ref → INSERT ... ON CONFLICT DO NOTHING silently dropped it.
+//
+// Proves, against an in-memory fake DB that enforces the source_ref uniqueness
+// the real ON CONFLICT relies on:
+//   (1) post-compaction appended untimestamped identical msg → NEW row;
+//   (2) full identical re-ingest in a FRESH runtime (rows already in DB) → 0 dups;
+//   (3) subset re-ingest reproduces the same source_refs as a full re-ingest.
+import { createSessionIngestRuntime } from '../src/runtime/memory/lib/session-ingest-runtime.mjs'
+
+function assert(condition, message) {
+  if (!condition) throw new Error(message)
+}
+
+// Minimal fake DB. Only the two statements the ingest loop issues are modelled:
+//   • SELECT COALESCE(MAX(source_turn) ...)  → per-session max
+//   • INSERT INTO entries(...) ON CONFLICT DO NOTHING → dedupe on source_ref
+// Any other query (the post-ingest raw-embedding flush's schema calls) returns
+// an empty result; flushRawEmbeddings then hits `db._pool` (undefined) and its
+// error is swallowed by the runtime, so the smoke never blocks on embeddings.
+function createFakeDb() {
+  const rows = [] // { ts, role, content, source_ref, session_id, source_turn, project_id }
+  const bySourceRef = new Set()
+  let nextId = 1
+  return {
+    rows,
+    async query(sql, params = []) {
+      if (/MAX\(source_turn\)/.test(sql)) {
+        const sessionId = params[0]
+        let max = 0
+        for (const r of rows) if (r.session_id === sessionId && r.source_turn > max) max = r.source_turn
+        return { rows: [{ max_turn: max }] }
+      }
+      if (/INSERT INTO entries/.test(sql)) {
+        const [ts, role, content, source_ref, session_id, source_turn, project_id] = params
+        if (bySourceRef.has(source_ref)) return { rowCount: 0 } // ON CONFLICT DO NOTHING
+        bySourceRef.add(source_ref)
+        rows.push({ id: nextId++, ts, role, content, source_ref, session_id, source_turn, project_id })
+        return { rowCount: 1 }
+      }
+      return { rows: [] }
+    },
+  }
+}
+
+// Durable high-water store fake (mirrors the DB `meta` kv the facade wires). A
+// SHARED store passed to two runtime instances simulates the state file
+// surviving a process restart; an absent store simulates a deleted state file.
+function makeRuntime(db, durable = new Map()) {
+  return createSessionIngestRuntime({
+    getDb: () => db,
+    log: () => {},
+    parseTsToMs: (v) => (typeof v === 'number' ? v : Number(v) || 0),
+    loadOrdinalHighWater: async (sessionId) => durable.get(sessionId) ?? null,
+    saveOrdinalHighWater: (sessionId, obj) => { durable.set(sessionId, obj); },
+  })
+}
+
+const SESSION = 'compaction-smoke-sess'
+// Untimestamped identical turns (no ts/timestamp → ordinal is what disambiguates).
+const mk = (role, content) => ({ role, content })
+
+// ── Scenario: live process ingests, compaction drops an earlier copy, append ──
+const db = createFakeDb()
+const rt = makeRuntime(db)
+
+// Distinct object identities so compaction survival is by-reference (mirrors the
+// runtime's immutable-transcript assumption).
+const other1 = mk('assistant', 'sure, working on it')
+const dupA = mk('user', 'run it again') // 1st identical untimestamped turn
+const other2 = mk('assistant', 'done')
+const dupB = mk('user', 'run it again') // 2nd identical untimestamped turn (distinct object)
+
+// Call 1 (COLD): full array with two identical untimestamped user turns.
+const arr1 = [other1, dupA, other2, dupB]
+let r1 = await rt.ingestSessionMessages({ sessionId: SESSION, messages: arr1, limit: 5000 })
+const userRows1 = db.rows.filter(r => r.role === 'user' && r.content === 'run it again')
+assert(userRows1.length === 2, `cold ingest must persist BOTH identical untimestamped turns (got ${userRows1.length})`)
+const refDupA = userRows1[0].source_ref
+const refDupB = userRows1[1].source_ref
+assert(refDupA !== refDupB, 'the two identical untimestamped turns must persist under distinct source_refs')
+
+// Compaction: drop the FIRST identical copy (dupA) and some other rows; KEEP the
+// second identical copy object (dupB) — this is what makes the array position of
+// the surviving/new identical turn shift down onto an already-persisted ordinal.
+// Then APPEND a genuinely new identical turn (distinct object).
+const dupC = mk('user', 'run it again') // NEW appended identical turn
+const arr2 = [dupB, mk('assistant', 'ok next'), dupC]
+
+// Call 2 (WARM, same runtime/process): the appended dupC must persist as a NEW row.
+let r2 = await rt.ingestSessionMessages({ sessionId: SESSION, messages: arr2, limit: 5000 })
+const userRows2 = db.rows.filter(r => r.role === 'user' && r.content === 'run it again')
+assert(
+  userRows2.length === 3,
+  `INVARIANT 1: post-compaction appended identical turn must persist as a NEW row (expected 3 total, got ${userRows2.length}) — this is the silent-drop bug`,
+)
+const refDupC = userRows2.find(r => r.source_ref !== refDupA && r.source_ref !== refDupB)?.source_ref
+assert(refDupC, 'appended identical turn must have a fresh source_ref above the persisted high-water')
+// dupB survived: it must have deduped (reused its recorded ordinal), NOT minted a new row.
+assert(db.rows.filter(r => r.source_ref === refDupB).length === 1, 'survived identical turn must dedupe, not duplicate')
+
+// ── INVARIANT 2: fresh runtime (new process), full identical re-ingest ────────
+// Rows already in DB; re-ingesting the CURRENT array from start=0 must create
+// ZERO new rows.
+const rowCountBefore = db.rows.length
+const rtFresh = makeRuntime(db) // cold state for this "process"
+await rtFresh.ingestSessionMessages({ sessionId: SESSION, messages: arr2, limit: 5000 })
+assert(
+  db.rows.length === rowCountBefore,
+  `INVARIANT 2: full identical re-ingest in a fresh process must create 0 duplicates (before=${rowCountBefore} after=${db.rows.length})`,
+)
+
+// ── INVARIANT 3: subset re-ingest reproduces the same source_refs as full ─────
+// Fresh DB + fresh runtime; ingest the full array, capture refs; then a NEW
+// fresh DB/runtime ingesting the same array via a small window (subset, seeded
+// from the prefix) must reproduce the identical source_refs.
+function refsFor(messages, opts) {
+  const d = createFakeDb()
+  const r = makeRuntime(d)
+  return { d, r }
+}
+{
+  const fullMsgs = [mk('user', 'x'), mk('assistant', 'y'), mk('user', 'x'), mk('user', 'x'), mk('assistant', 'y')]
+  const { d: dFull, r: rFull } = refsFor()
+  await rFull.ingestSessionMessages({ sessionId: 'subset-sess', messages: fullMsgs, limit: 5000 })
+  const fullRefs = dFull.rows.filter(r => r.session_id === 'subset-sess').map(r => r.source_ref).sort()
+
+  // Subset: fresh process, window = last 2 messages, prefix seeded internally.
+  const { d: dSub, r: rSub } = refsFor()
+  await rSub.ingestSessionMessages({ sessionId: 'subset-sess', messages: fullMsgs, limit: 2 })
+  const subRefs = dSub.rows.filter(r => r.session_id === 'subset-sess').map(r => r.source_ref)
+  for (const ref of subRefs) {
+    assert(fullRefs.includes(ref), `INVARIANT 3: subset re-ingest source_ref ${ref} must match a full re-ingest ref`)
+  }
+  // The subset window's last two messages are `x`(3rd occurrence) and `y`(2nd);
+  // their refs must equal the full re-ingest's 3rd `x` and 2nd `y` refs.
+  assert(subRefs.length === 2, `subset window should ingest exactly its 2 messages (got ${subRefs.length})`)
+}
+
+// ── INVARIANT 1 across RESTART: fresh runtime (new process), same DB ──────────
+// A restart = a NEW runtime instance (empty in-memory ordinal state AND empty
+// WeakMap) ingesting a reloaded transcript against the SAME DB that already
+// holds prior rows. When the reloaded (compacted) array still RETAINS the
+// identical copies, positional ordinals reproduce each survivor's OWN live row,
+// and a freshly appended identical turn takes a free ordinal and persists NEW.
+{
+  const rdb = createFakeDb()
+  const S = 'restart-sess'
+  const rtA = makeRuntime(rdb)
+  await rtA.ingestSessionMessages({ sessionId: S, messages: [mk('user', 'ping'), mk('assistant', 'pong'), mk('user', 'ping')], limit: 5000 })
+  const pingBefore = rdb.rows.filter(r => r.content === 'ping')
+  assert(pingBefore.length === 2, `pre-restart should persist 2 identical pings (got ${pingBefore.length})`)
+  const beforeIds = new Set(pingBefore.map(r => r.id))
+
+  // Restart: brand-new runtime (fresh WeakMap + ordinal state), same DB. The
+  // reloaded compacted array RETAINS both ping copies (compaction dropped only
+  // the non-identical `pong`); append a genuinely new identical ping. The
+  // reloaded objects are DISTINCT references from the pre-restart ones.
+  const rtB = makeRuntime(rdb)
+  await rtB.ingestSessionMessages({ sessionId: S, messages: [mk('user', 'ping'), mk('user', 'ping'), mk('user', 'ping')], limit: 5000 })
+  const pingAfter = rdb.rows.filter(r => r.content === 'ping')
+  assert(pingAfter.length === 3, `RESTART: appended identical turn must persist as a NEW row (expected 3, got ${pingAfter.length})`)
+  // Row-identity (not ref-membership) check: the survivor re-ingest must DEDUPE
+  // onto the 2 pre-existing live rows (same ids, no re-insert) and add EXACTLY
+  // one NEW row (the append) — proving survivors mapped to live rows, not dropped.
+  const survivorRows = pingAfter.filter(r => beforeIds.has(r.id))
+  const newRows = pingAfter.filter(r => !beforeIds.has(r.id))
+  assert(survivorRows.length === 2, `RESTART: survivors must reuse the 2 live rows (got ${survivorRows.length})`)
+  assert(newRows.length === 1, `RESTART: exactly one NEW appended row expected (got ${newRows.length})`)
+}
+
+// ── INVARIANT 1 across RESTART, LATER-WARM append (durable high-water) ────────
+// The path the reviewer disproved: after restart the cold replay of a COMPACTED
+// array seeds occNext = survivor-count T, but the DB holds K>T copies. A NEW
+// untimestamped identical turn arriving in a LATER (warm) call is distinguishable
+// (it is genuinely new, not one of the cold-replay survivors) and MUST persist —
+// only the durable per-identity high-water K makes that possible.
+{
+  const durable = new Map()   // survives the "restart" (shared across runtimes)
+  const rdb = createFakeDb()  // DB rows survive the restart too
+  const S = 'restart-warm-sess'
+
+  // Pre-restart process: build K=3 persisted copies of an identical untimestamped
+  // turn (cold [X,other,X] → 2 copies; then in-process compaction+append → 3rd).
+  const rtA = makeRuntime(rdb, durable)
+  const xa1 = mk('user', 'again'); const xa2 = mk('user', 'again')
+  await rtA.ingestSessionMessages({ sessionId: S, messages: [xa1, mk('assistant', 'ok'), xa2], limit: 5000 })
+  const xa3 = mk('user', 'again') // in-process appended (compaction kept xa2)
+  await rtA.ingestSessionMessages({ sessionId: S, messages: [xa2, mk('assistant', 'ok2'), xa3], limit: 5000 })
+  assert(rdb.rows.filter(r => r.content === 'again').length === 3, 'pre-restart should hold K=3 identical copies')
+  assert(durable.has(S), 'durable high-water must have been persisted for the duplicate identity')
+
+  // Restart: fresh runtime (empty WeakMap + ordinal state), SAME db + durable.
+  // Reloaded COMPACTED array retains only ONE copy (T=1).
+  const rtB = makeRuntime(rdb, durable)
+  const rx = mk('user', 'again') // reloaded survivor (distinct object)
+  await rtB.ingestSessionMessages({ sessionId: S, messages: [rx], limit: 5000 }) // COLD replay (T=1)
+  assert(rdb.rows.filter(r => r.content === 'again').length === 3, 'cold replay of survivor must not add rows (dedupe)')
+
+  // LATER warm call on rtB appends a genuinely new identical turn.
+  const rxNew = mk('user', 'again')
+  const rowsBeforeAppend = rdb.rows.length
+  await rtB.ingestSessionMessages({ sessionId: S, messages: [rx, rxNew], limit: 5000 })
+  const againAfter = rdb.rows.filter(r => r.content === 'again')
+  assert(
+    againAfter.length === 4,
+    `LATER-WARM RESTART: appended identical turn must persist as a NEW row via durable K (expected 4, got ${againAfter.length})`,
+  )
+  assert(rdb.rows.length === rowsBeforeAppend + 1, 'exactly one new row from the later-warm append')
+}
+
+// ── Zero-dup guarantee when a compacted reload DROPPED an identical copy ──────
+// If the reloaded array is missing an earlier identical untimestamped copy AND
+// the WeakMap survivor signal is gone (restart), the appended identical turn is
+// information-theoretically indistinguishable from the survivors (see the
+// DURABILITY note in session-ingest-runtime.mjs). Contract in that corner: NEVER
+// mint a duplicate survivor row (ON CONFLICT dedupes). The append may collapse;
+// it must not duplicate.
+{
+  const rdb = createFakeDb()
+  const S = 'restart-drop-sess'
+  const rtA = makeRuntime(rdb)
+  await rtA.ingestSessionMessages({ sessionId: S, messages: [mk('user', 'echo'), mk('user', 'echo')], limit: 5000 })
+  const before = rdb.rows.filter(r => r.content === 'echo').length
+  assert(before === 2, `pre-restart should persist 2 identical echoes (got ${before})`)
+  const rowsBefore = rdb.rows.length
+
+  // Restart with a compacted reload that DROPPED one echo, then appended one
+  // (net 2 copies again). Must not mint a duplicate; the append collapses.
+  const rtB = makeRuntime(rdb)
+  await rtB.ingestSessionMessages({ sessionId: S, messages: [mk('user', 'echo'), mk('user', 'echo')], limit: 5000 })
+  const after = rdb.rows.filter(r => r.content === 'echo').length
+  assert(after === before, `RESTART+drop: must not mint a duplicate survivor row (before=${before} after=${after})`)
+  assert(rdb.rows.length === rowsBefore, 'RESTART+drop: no duplicate rows created')
+}
+
+process.stdout.write('session ingest compaction-append smoke passed \u2713\n')

package/scripts/tool-smoke.mjs

@@ -1,9 +1,10 @@
 #!/usr/bin/env node
-import { mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
+import { mkdirSync, mkdtempSync, readdirSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { dirname, join, resolve } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { __applyStandaloneToolDefaultsForTest, __renderToolSearchForTest, compactToolSearchDescription, defaultDeferredToolNames, SKILL_TOOL, TOOL_SEARCH_TOOL } from '../src/mixdog-session-runtime.mjs';
+import { applyInitialDeferredToolManifestToBp1, buildDeferredToolManifest } from '../src/runtime/agent/orchestrator/context/collect.mjs';
 import { buildExplorerPrompt, EXPLORE_TOOL, MAX_FANOUT_QUERIES, normalizeExploreQueries } from '../src/standalone/explore-tool.mjs';
 import { AGENT_TOOL, createStandaloneAgent } from '../src/standalone/agent-tool.mjs';
 import { parseHeadlessRoleCommand } from '../src/app.mjs';
@@ -644,6 +645,72 @@ if (!/^Error[\s:[]/.test(String(stalePatchOut)) || !/apply_patch/i.test(String(s
   throw new Error(`apply_patch stale context must return an Error result, not throw or pass:\n${stalePatchOut}`);
 }
 
+// Malformed-but-unambiguous patch openings must be absorbed (dry-run, so no
+// write). Each targets the same known-good smoke.mjs line the cases above use.
+const smokeBody = `@@
+-process.stdout.write('smoke passed ✓\\n');
++process.stdout.write('smoke passed ok\\n');
+*** End Patch
+`;
+const absorbCases = [
+  ['leading blank lines', `\n\n*** Begin Patch\n*** Update File: scripts/smoke.mjs\n${smokeBody}`],
+  ['decorated begin header', `*** Begin Patch (V4A) ***\n*** Update File: scripts/smoke.mjs\n${smokeBody}`],
+  ['bare file path opening', `*** Begin Patch\nscripts/smoke.mjs\n${smokeBody}`],
+  ['File: prefixed opening', `*** Begin Patch\nFile: scripts/smoke.mjs\n${smokeBody}`],
+  ['unified body in envelope', `*** Begin Patch\n--- scripts/smoke.mjs\n+++ scripts/smoke.mjs\n${smokeBody}`],
+];
+for (const [label, patch] of absorbCases) {
+  const out = await executePatchTool('apply_patch', { base_path: root, dry_run: true, fuzzy: false, patch }, root);
+  assertOk(`apply_patch absorbs ${label}`, out, /checked|validated|dry|OK/i);
+}
+
+const ambiguousPatchOut = await executePatchTool('apply_patch', {
+  base_path: root,
+  dry_run: true,
+  fuzzy: false,
+  patch: `*** Begin Patch\nthis line is not a valid opening\n${smokeBody}`,
+}, root);
+if (!/^Error[\s:[]/.test(String(ambiguousPatchOut)) || !/before a file header|V4A/i.test(String(ambiguousPatchOut))) {
+  throw new Error(`apply_patch must keep erroring on genuinely ambiguous openings:\n${ambiguousPatchOut}`);
+}
+
+// Unified-looking first body line but real V4A file sections appear later: the
+// envelope must NOT be stripped to unified — it stays ambiguous and errors.
+const mixedPatchOut = await executePatchTool('apply_patch', {
+  base_path: root,
+  dry_run: true,
+  fuzzy: false,
+  patch: `*** Begin Patch\n--- scripts/smoke.mjs\n*** Update File: scripts/smoke.mjs\n${smokeBody}`,
+}, root);
+if (!/^Error[\s:[]/.test(String(mixedPatchOut)) || !/before a file header|V4A/i.test(String(mixedPatchOut))) {
+  throw new Error(`apply_patch must keep erroring on mixed unified/V4A openings:\n${mixedPatchOut}`);
+}
+
+// Compacted-history placeholder guard: EVERY [mixdog compacted …] variant must
+// be rejected with the corrective message BEFORE format dispatch/salvage, both
+// as the first line and standalone mid-body (after a *** Begin Patch header).
+const compactedGuardCases = [
+  ['legacy key: prefix', '[mixdog compacted patch: 4096 chars, sha256:deadbeefdeadbeef]\n*** Begin Patch\n*** Update File: a.txt\n+x\n*** End Patch\n'],
+  ['variant key form', '[mixdog compacted patch v4a, sha256:deadbeefdeadbeef]\n*** Begin Patch\n*** Update File: a.txt\n+x\n*** End Patch\n'],
+  ['no chars/sha detail', '[mixdog compacted old_string]\n'],
+  ['mid-body standalone', '*** Begin Patch\n*** Update File: a.txt\n[mixdog compacted patch v4a, sha256:deadbeefdeadbeef]\n*** End Patch\n'],
+];
+for (const [label, patch] of compactedGuardCases) {
+  const out = await executePatchTool('apply_patch', { base_path: root, dry_run: true, fuzzy: false, patch }, root);
+  if (!/^Error[\s:[]/.test(String(out)) || !/compacted-history placeholder/i.test(String(out))) {
+    throw new Error(`apply_patch must reject compacted placeholder (${label}):\n${out}`);
+  }
+}
+// A legit unified edit whose body content mentions the literal text on a diff
+// line (+/-/space) must still parse — the guard only trips on non-diff lines.
+const compactedFalsePositiveOut = await executePatchTool('apply_patch', {
+  base_path: root,
+  dry_run: true,
+  fuzzy: false,
+  patch: `*** Begin Patch\n*** Add File: compacted-note.txt\n+[mixdog compacted patch: 10 chars, sha256:abc]\n*** End Patch\n`,
+}, root);
+assertOk('apply_patch keeps diff-line placeholder text', compactedFalsePositiveOut, /checked|validated|dry|OK/i);
+
 const shellOutPromise = executeBuiltinTool('shell', {
   command: 'node --version',
   cwd: root,
@@ -1485,7 +1552,10 @@ setInternalToolsProvider({
       const resumed = await resumeSession(session.id, 'full');
       const resumedTools = (resumed?.tools || []).map((tool) => tool?.name).filter(Boolean);
       const expected = expectedForHiddenAgent(permission, schemaAllowedTools);
-      if (expected && (JSON.stringify(tools) !== JSON.stringify(expected) || JSON.stringify(resumedTools) !== JSON.stringify(expected))) {
+      // Order-insensitive: the session tool surface follows catalog order, while
+      // schemaAllowedTools declares an allow-set; only set equality is contractual.
+      const asSet = (list) => JSON.stringify(list.slice().sort());
+      if (expected && (asSet(tools) !== asSet(expected) || asSet(resumedTools) !== asSet(expected))) {
         throw new Error(`hidden agent ${agent} schema mismatch: expected=${expected.join(', ')} tools=${tools.join(', ')} resumed=${resumedTools.join(', ')}`);
       }
       const leaked = tools.filter((name) => hiddenBadTools.has(name) && !(expected || []).includes(name));
@@ -1644,15 +1714,25 @@ if (/line\/context/i.test(JSON.stringify(readTool?.inputSchema || {}))) {
   // session's provider/model in place, or a mid-conversation model/provider
   // switch silently forces a full prompt-cache rewrite (seen as a
   // promptΔ spike + cache_ratio=0% turn in session-bench).
-  const runtimeSrc = readFileSync(resolve(root, 'src/mixdog-session-runtime.mjs'), 'utf8');
+  // God-file splits move implementation into module dirs; scan facade + all
+  // split modules so these source-text guards survive refactors.
+  const readMjsSources = (rel) => {
+    const abs = resolve(root, rel);
+    if (rel.endsWith('.mjs')) return readFileSync(abs, 'utf8');
+    return readdirSync(abs, { recursive: true })
+      .filter((f) => String(f).endsWith('.mjs'))
+      .map((f) => readFileSync(resolve(abs, String(f)), 'utf8'))
+      .join('\n');
+  };
+  const runtimeSrc = [readMjsSources('src/mixdog-session-runtime.mjs'), readMjsSources('src/session-runtime')].join('\n');
   const setRouteBlock = runtimeSrc.match(/async setRoute\(next, options = \{\}\) \{[\s\S]*?\n    \},\n/)?.[0] || '';
   if (!/applyToCurrentSession = options\?\.applyToCurrentSession === true/.test(setRouteBlock)) {
     throw new Error('setRoute must default applyToCurrentSession to false (model changes apply to the next session only)');
   }
-  if (!/if \(!applyToCurrentSession\)/.test(setRouteBlock) || !/return route;/.test(setRouteBlock)) {
+  if (!/if \(!applyToCurrentSession\)/.test(setRouteBlock) || !/return (?:route|getRoute\(\));/.test(setRouteBlock)) {
     throw new Error('setRoute must early-return before touching the live session when applyToCurrentSession is false');
   }
-  const engineSrc = readFileSync(resolve(root, 'src/tui/engine.mjs'), 'utf8');
+  const engineSrc = [readMjsSources('src/tui/engine.mjs'), readMjsSources('src/tui/engine')].join('\n');
   if (/setRoute\(\{ model: m \}, \{ applyToCurrentSession: true \}\)/.test(engineSrc)) {
     throw new Error('TUI setModel must not force applyToCurrentSession:true (model changes must apply to the next session only)');
   }
@@ -1774,16 +1854,23 @@ const toolSearchSession = {
   deferredToolCatalog: smokeCatalog.slice(),
   deferredSelectedTools: [...fullDefaults],
 };
-const searchOnlyResult = JSON.parse(__renderToolSearchForTest({ query: 'shell' }, toolSearchSession, 'full'));
-for (const name of ['shell', 'task']) {
-  if (!searchOnlyResult.selected?.tools?.added?.includes(name)) {
-    throw new Error(`tool_search high-confidence query should auto-load ${name}: ${JSON.stringify(searchOnlyResult.selected)}`);
-  }
+// A plain query is a case-insensitive substring filter over name+description.
+// It lists matches only — it never auto-loads or ranks.
+const listQueryResult = JSON.parse(__renderToolSearchForTest({ query: 'shell' }, toolSearchSession, 'full'));
+if (listQueryResult.selected) {
+  throw new Error(`tool_search plain query must not auto-load: ${JSON.stringify(listQueryResult.selected)}`);
+}
+if (!listQueryResult.matches.some((row) => row.name === 'shell')) {
+  throw new Error(`tool_search plain query should list substring matches: ${JSON.stringify(listQueryResult.matches)}`);
 }
-if (!searchOnlyResult.activeTools.includes('shell') || !searchOnlyResult.activeTools.includes('task')) {
-  throw new Error(`tool_search query should activate legacy selected tools: ${searchOnlyResult.activeTools.join(',')}`);
+if (listQueryResult.activeTools.includes('shell') || (Array.isArray(listQueryResult.discoveredTools) && listQueryResult.discoveredTools.includes('shell'))) {
+  throw new Error(`tool_search plain query must not activate/discover tools: ${JSON.stringify(listQueryResult)}`);
 }
+// query "select:a,b" is the explicit query-side loader (aliases expand).
 const bulkSelectResult = JSON.parse(__renderToolSearchForTest({ query: 'select:shell,recall' }, toolSearchSession, 'full'));
+if (bulkSelectResult.selected?.mode !== 'select') {
+  throw new Error(`tool_search query-select must report select mode: ${JSON.stringify(bulkSelectResult.selected)}`);
+}
 for (const name of ['shell', 'task', 'recall']) {
   if (!bulkSelectResult.activeTools.includes(name)) {
     throw new Error(`tool_search bulk select missing ${name}: ${JSON.stringify(bulkSelectResult)}`);
@@ -1858,7 +1945,8 @@ if (nativeGrokPatchTool?.type !== 'function' || nativeGrokPatchTool?.format || n
 if (nativeGrokPatchTool.parameters?.properties?.patch?.type !== 'string') {
   throw new Error(`Grok native tool_search apply_patch must preserve patch JSON schema: ${JSON.stringify(nativeGrokPatchTool)}`);
 }
-const nativeRunQuerySession = {
+// Native query-select discovers (without mutating active schemas); aliases expand.
+const nativeSelectQuerySession = {
   tools: smokeCatalog.filter((tool) => fullDefaults.has(tool?.name)),
   deferredToolCatalog: smokeCatalog.slice(),
   deferredSelectedTools: [...fullDefaults],
@@ -1866,16 +1954,20 @@ const nativeRunQuerySession = {
   deferredProviderMode: 'native',
   deferredNativeTools: true,
 };
-const nativeRunQueryResult = JSON.parse(__renderToolSearchForTest({ query: 'run tests' }, nativeRunQuerySession, 'full'));
-for (const name of ['shell', 'task']) {
-  if (!nativeRunQueryResult.discoveredTools.includes(name)) {
-    throw new Error(`native tool_search run/tests query should discover ${name}: ${JSON.stringify(nativeRunQueryResult)}`);
+const nativeSelectQueryResult = JSON.parse(__renderToolSearchForTest({ query: 'select:search' }, nativeSelectQuerySession, 'full'));
+for (const name of ['search', 'web_fetch']) {
+  if (!nativeSelectQueryResult.discoveredTools.includes(name)) {
+    throw new Error(`native tool_search query-select should discover ${name}: ${JSON.stringify(nativeSelectQueryResult)}`);
   }
 }
-if (nativeRunQueryResult.activeTools.includes('shell') || nativeRunQueryResult.activeTools.includes('task')) {
-  throw new Error(`native tool_search query must not mutate active schemas: ${JSON.stringify(nativeRunQueryResult)}`);
+if (nativeSelectQueryResult.activeTools.includes('search') || nativeSelectQueryResult.activeTools.includes('web_fetch')) {
+  throw new Error(`native tool_search must not mutate active schemas: ${JSON.stringify(nativeSelectQueryResult)}`);
+}
+if (!nativeSelectQueryResult.nativeToolSearch?.toolReferences?.includes('search')) {
+  throw new Error(`native query-select must return nativeToolSearch payload: ${JSON.stringify(nativeSelectQueryResult.nativeToolSearch)}`);
 }
-const nativeWebQuerySession = {
+// A plain query never auto-loads/discovers, even on native providers.
+const nativePlainQuerySession = {
   tools: smokeCatalog.filter((tool) => fullDefaults.has(tool?.name)),
   deferredToolCatalog: smokeCatalog.slice(),
   deferredSelectedTools: [...fullDefaults],
@@ -1883,35 +1975,48 @@ const nativeWebQuerySession = {
   deferredProviderMode: 'native',
   deferredNativeTools: true,
 };
-const nativeWebQueryResult = JSON.parse(__renderToolSearchForTest({ query: 'web docs' }, nativeWebQuerySession, 'full'));
-for (const name of ['search', 'web_fetch']) {
-  if (!nativeWebQueryResult.discoveredTools.includes(name)) {
-    throw new Error(`native tool_search web/docs query should discover ${name}: ${JSON.stringify(nativeWebQueryResult)}`);
+for (const q of ['run tests', 'web docs', 'memory previous', 'status']) {
+  const r = JSON.parse(__renderToolSearchForTest({ query: q }, nativePlainQuerySession, 'full'));
+  if (r.selected || r.discoveredTools.length) {
+    throw new Error(`native tool_search plain query "${q}" must not auto-load/discover: ${JSON.stringify(r)}`);
   }
 }
-const nativeRecallQuerySession = {
-  tools: smokeCatalog.filter((tool) => fullDefaults.has(tool?.name)),
-  deferredToolCatalog: smokeCatalog.slice(),
-  deferredSelectedTools: [...fullDefaults],
-  deferredDiscoveredTools: [],
-  deferredProviderMode: 'native',
-  deferredNativeTools: true,
+// Skill-style deferred manifest: `- name: description` lines, `<`/`>` sanitized,
+// bare names allowed, header instructs direct calls, empty pool → ''.
+const manifestText = buildDeferredToolManifest([
+  { name: 'shell', description: 'Run commands.' },
+  { name: 'search', description: 'Web <search> now.' },
+  'recall',
+]);
+if (!/<available-deferred-tools>/.test(manifestText) || !/- shell: Run commands\./.test(manifestText)) {
+  throw new Error(`deferred manifest must render "- name: description" lines: ${manifestText}`);
+}
+if (!/call any tool listed below directly/i.test(manifestText)) {
+  throw new Error(`deferred manifest must tell the model it can call listed tools directly: ${manifestText}`);
+}
+if (!/^- recall$/m.test(manifestText)) {
+  throw new Error(`deferred manifest must allow bare names without descriptions: ${manifestText}`);
+}
+if (/[<>]/.test(manifestText.replace(/<\/?available-deferred-tools>/g, ''))) {
+  throw new Error(`deferred manifest must sanitize angle brackets in descriptions: ${manifestText}`);
+}
+if (buildDeferredToolManifest([]) !== '') {
+  throw new Error('empty deferred pool must yield an empty manifest');
+}
+const bp1ManifestSession = {
+  messages: [{ role: 'system', content: 'BASE PROMPT' }],
+  deferredToolCatalog: [
+    { name: 'shell', description: 'Run commands.' },
+    { name: 'recall', description: 'Recall prior work.' },
+  ],
 };
-const nativeRecallQueryResult = JSON.parse(__renderToolSearchForTest({ query: 'memory previous' }, nativeRecallQuerySession, 'full'));
-if (!nativeRecallQueryResult.discoveredTools.includes('recall') || nativeRecallQueryResult.discoveredTools.includes('memory')) {
-  throw new Error(`native tool_search memory previous should discover recall only: ${JSON.stringify(nativeRecallQueryResult)}`);
+applyInitialDeferredToolManifestToBp1(bp1ManifestSession, ['shell', 'recall']);
+const bp1ManifestText = bp1ManifestSession.messages[0].content;
+if (!/- shell: Run commands\./.test(bp1ManifestText) || !/- recall: Recall prior work\./.test(bp1ManifestText)) {
+  throw new Error(`BP1 deferred manifest must carry catalog descriptions: ${bp1ManifestText}`);
 }
-const ambiguousStatusSession = {
-  tools: smokeCatalog.filter((tool) => fullDefaults.has(tool?.name)),
-  deferredToolCatalog: smokeCatalog.slice(),
-  deferredSelectedTools: [...fullDefaults],
-  deferredDiscoveredTools: [],
-  deferredProviderMode: 'native',
-  deferredNativeTools: true,
-};
-const ambiguousStatusResult = JSON.parse(__renderToolSearchForTest({ query: 'status' }, ambiguousStatusSession, 'full'));
-if (ambiguousStatusResult.selected || ambiguousStatusResult.discoveredTools.length) {
-  throw new Error(`tool_search ambiguous status query must not auto-load: ${JSON.stringify(ambiguousStatusResult)}`);
+if (bp1ManifestSession.deferredToolBp1Applied !== true) {
+  throw new Error('BP1 deferred manifest injection must mark deferredToolBp1Applied');
 }
 const replyTool = CHANNEL_TOOL_DEFS.find((tool) => tool.name === 'reply');
 if (!/configured channel/i.test(replyTool?.description || '') || !/local .*paths/i.test(replyTool?.inputSchema?.properties?.files?.description || '')) {