mixdog 1.0.12 → 1.1.0

package/src/runtime/agent/orchestrator/providers/openai-compat-chat-stream.mjs

@@ -41,6 +41,7 @@ export async function consumeCompatChatCompletionStream(
     parseToolCalls,
     knownToolNames,
     semanticIdleTimeoutMs,
+    firstByteTimeoutMs,
   } = {}
 ) {
   const idleOverrideEnabled = Number.isFinite(Number(semanticIdleTimeoutMs)) && Number(semanticIdleTimeoutMs) > 0;
@@ -57,7 +58,11 @@ export async function consumeCompatChatCompletionStream(
   reportTransport(state);
   const iterator = stream[Symbol.asyncIterator]();
   let iteratorDone = false;
-  const firstByteTimeout = createTimeoutSignal(signal, PROVIDER_FIRST_BYTE_TIMEOUT_MS, `${label} first byte`);
+  const firstByteTimeout = createTimeoutSignal(
+    signal,
+    Number(firstByteTimeoutMs) > 0 ? Number(firstByteTimeoutMs) : PROVIDER_FIRST_BYTE_TIMEOUT_MS,
+    `${label} first byte`
+  );
   try {
     while (true) {
       const { value: chunk, done } = await nextAsyncWithWatchdog(iterator, {

package/src/runtime/agent/orchestrator/providers/openai-compat-models.mjs

@@ -7,13 +7,15 @@ const MODEL_LIST_TIMEOUT_MS = resolveTimeoutMs('MIXDOG_COMPAT_MODEL_LIST_TIMEOUT
   maxMs: PROVIDER_GENERATE_TOTAL_TIMEOUT_MS,
 });
 
-export async function fetchCompatModelItems(provider) {
-  const timeout = createTimeoutSignal(null, MODEL_LIST_TIMEOUT_MS, `${provider.name} model list`);
+// `keyless` omits the Authorization header entirely (keyless endpoints);
+// `signal` aborts the request together with the list timeout.
+export async function fetchCompatModelItems(provider, { signal = null, keyless = false } = {}) {
+  const timeout = createTimeoutSignal(signal, MODEL_LIST_TIMEOUT_MS, `${provider.name} model list`);
   try {
     const res = await fetch(`${String(provider.baseURL || '').replace(/\/+$/, '')}/models`, {
       method: 'GET',
       headers: {
-        Authorization: `Bearer ${provider.apiKey || 'no-key'}`,
+        ...(keyless ? {} : { Authorization: `Bearer ${provider.apiKey || 'no-key'}` }),
         ...(provider.defaultHeaders || {}),
       },
       signal: timeout.signal,
@@ -28,9 +30,9 @@ export async function fetchCompatModelItems(provider) {
   }
 }
 
-export async function listCompatModels(provider, { throwOnError = false } = {}) {
+export async function listCompatModels(provider, { throwOnError = false, signal = null } = {}) {
   try {
-    const list = await provider._fetchModelItems();
+    const list = await provider._fetchModelItems({ signal });
     const models = [];
     for (const m of list) {
       const contextWindow = Number(

package/src/runtime/agent/orchestrator/providers/openai-compat-options.mjs

@@ -3,6 +3,7 @@ import {
   xaiModelSupportsReasoningEffort,
   normalizeOpencodeGoReasoningEffort,
 } from './openai-compat-xai.mjs';
+import { isCustomProviderName, resolveCustomReasoning } from './custom-reasoning.mjs';
 
 function normalizeReasoningEffort(value, allowed) {
   const effort = String(value ?? '')
@@ -15,6 +16,17 @@ function normalizeReasoningEffort(value, allowed) {
 // backend are frequently rejected by another even when the core Chat schema
 // is shared.
 export function applyCompatProviderChatOptions(params, providerName, opts = {}, config = {}, modelInfo = null) {
+  if (isCustomProviderName(providerName)) {
+    // User-defined provider: the model row's reasoning settings decide the
+    // level and its wire shape (custom-reasoning.mjs).
+    const { fields } = resolveCustomReasoning({
+      protocol: 'openai-chat',
+      model: modelInfo,
+      effort: opts.effort ?? config?.reasoningEffort,
+    });
+    Object.assign(params, fields);
+    return params;
+  }
   if (providerName === 'openrouter') {
     const effort = normalizeReasoningEffort(opts.openRouterReasoningEffort ?? opts.effort ?? config?.reasoningEffort, [
       'none',

package/src/runtime/agent/orchestrator/providers/openai-compat-responses.mjs

@@ -19,9 +19,11 @@ import {
   responseOutputText,
   collectCompatResponseSearchSources,
   toXaiResponsesInput,
+  xaiSystemInstructions,
 } from './openai-compat-wire.mjs';
 import { preparePdfTextForProvider } from './media-normalization.mjs';
 import { normalizeOpencodeGoReasoningEffort } from './openai-compat-xai.mjs';
+import { isCustomProviderName, resolveCustomReasoning } from './custom-reasoning.mjs';
 import { createProviderReplay } from './lib/provider-replay.mjs';
 import {
   applyCompatToolChoice,
@@ -38,11 +40,17 @@ import {
 // provider switch never replays foreign encrypted items into this gateway.
 const COMPAT_RESPONSES_STATE_KEY = 'compatResponses';
 
-function resolveReasoningEffort(provider, useModel, opts) {
-  const modelInfo =
-    (typeof provider.getCachedModelInfo === 'function' && provider.getCachedModelInfo(useModel)) ||
-    getModelMetadataSync(useModel, provider.name);
-  return normalizeOpencodeGoReasoningEffort(opts.effort ?? provider.config?.reasoningEffort, modelInfo);
+// The request's `reasoning` field, or null. Custom providers snap onto their
+// own model row (never promoting); gateway brands keep the catalog promotion.
+function resolveReasoning(provider, useModel, opts) {
+  const effort = opts.effort ?? provider.config?.reasoningEffort;
+  const cached = (typeof provider.getCachedModelInfo === 'function' && provider.getCachedModelInfo(useModel)) || null;
+  if (isCustomProviderName(provider.name)) {
+    return resolveCustomReasoning({ protocol: 'openai-responses', model: cached, effort }).fields.reasoning || null;
+  }
+  const modelInfo = cached || getModelMetadataSync(useModel, provider.name);
+  const reasoningEffort = normalizeOpencodeGoReasoningEffort(effort, modelInfo);
+  return reasoningEffort ? { effort: reasoningEffort } : null;
 }
 
 /** The request body: lowered transcript plus the per-turn knobs (output cap,
@@ -63,8 +71,14 @@ function buildCompatResponsesParams({ provider, useModel, input, previousRespons
     params.parallel_tool_calls = true;
   }
   applyCompatToolChoice(params, opts);
-  const reasoningEffort = resolveReasoningEffort(provider, useModel, opts);
-  if (reasoningEffort) params.reasoning = { effort: reasoningEffort };
+  const reasoning = resolveReasoning(provider, useModel, opts);
+  if (reasoning) params.reasoning = reasoning;
+  // Opt-in per-provider final shaping (a provider passes the hook in its config).
+  const hook = provider.config?.responsesParamsHook;
+  if (typeof hook === 'function') {
+    const modelInfo = (typeof provider.getCachedModelInfo === 'function' && provider.getCachedModelInfo(useModel)) || null;
+    hook(params, { useModel, opts, modelInfo });
+  }
   return params;
 }
 
@@ -146,8 +160,14 @@ export async function sendCompatResponses(provider, messages, useModel, tools, o
     replayProvider,
     providerName: provider.name,
     nativePdf: provider.nativePdf,
+    // Opt-in: system prompts travel as top-level `instructions`, not input items.
+    includeSystem: provider.config?.responsesSystemAsInstructions !== true,
   });
   const params = buildCompatResponsesParams({ provider, useModel, input, previousResponseId, tools, opts });
+  if (provider.config?.responsesSystemAsInstructions === true) {
+    const instructions = xaiSystemInstructions(messages);
+    if (instructions) params.instructions = instructions;
+  }
 
   try {
     opts.onStageChange?.('requesting');

package/src/runtime/agent/orchestrator/providers/openai-compat-wire.mjs

@@ -46,7 +46,13 @@ export function toOpenAIMessages(messages, providerName, options = {}) {
   // their official multi-turn shape and cache prefix stability when prior
   // assistant reasoning_content is replayed; reasoning_effort itself remains
   // caller/user-selected.
-  const replaysReasoningContent = options.replaysReasoningContent === true || providerName === 'xai';
+  //
+  // Custom providers pass options.customReplay (custom-reasoning.mjs replay
+  // eligibility). When it is a boolean it alone decides; a replaying custom
+  // endpoint also needs a non-empty reasoning_content on every assistant
+  // tool-call turn, so missing/empty reasoning there is padded with " ".
+  const customReplay = typeof options.customReplay === 'boolean' ? options.customReplay : null;
+  const replaysReasoningContent = customReplay ?? (options.replaysReasoningContent === true || providerName === 'xai');
   const out = [];
   const pendingToolMedia = [];
   const openRouterReasoningDetails = (message) => {
@@ -56,7 +62,11 @@ export function toOpenAIMessages(messages, providerName, options = {}) {
     return Array.isArray(details) && details.length ? details : null;
   };
   const attachAssistantReasoning = (msg, message) => {
-    if (replaysReasoningContent && typeof message.reasoningContent === 'string') {
+    if (customReplay) {
+      const stored = typeof message.reasoningContent === 'string' ? message.reasoningContent : '';
+      if (stored) msg.reasoning_content = stored;
+      else if (Array.isArray(msg.tool_calls) && msg.tool_calls.length) msg.reasoning_content = ' ';
+    } else if (replaysReasoningContent && typeof message.reasoningContent === 'string') {
       msg.reasoning_content = message.reasoningContent;
     }
     const reasoningDetails = openRouterReasoningDetails(message);

package/src/runtime/agent/orchestrator/providers/openai-compat.mjs

@@ -99,11 +99,16 @@ export class OpenAICompatProvider {
     return new (loadOpenAI())({
       baseURL: this.baseURL,
       apiKey,
-      defaultHeaders: this.defaultHeaders,
+      // A keyless endpoint (config.keyless) gets no Authorization header: the
+      // SDK drops a header whose default is null.
+      defaultHeaders: this.config?.keyless ? { ...this.defaultHeaders, Authorization: null } : this.defaultHeaders,
       // The SDK's own retry loop (default 2) would nest underneath our
       // withRetry wrapper and multiply tail latency on a transient
       // backend. We own retry/backoff via withRetry, so disable the SDK's.
       maxRetries: 0,
+      // Opt-in SDK constructor overrides (e.g. an explicit null organization so
+      // the SDK does not inherit OPENAI_ORG_ID from the environment).
+      ...(this.config?.clientOptions || {}),
       // Force the shared long-keepalive undici dispatcher to be installed
       // globally (setGlobalDispatcher) so the SDK's global fetch rides a
       // warm socket pool instead of Node's short-keepalive default. The

package/src/runtime/agent/orchestrator/providers/openai-oauth-login.mjs

@@ -81,7 +81,7 @@ export function createOpenAIOAuthLogin(deps) {
     return tokens;
   }
 
-  async function beginOAuthLogin() {
+  async function beginOAuthLogin({ openBrowser = true } = {}) {
     const pkce = createOAuthPkce(64);
     const state = randomBytes(16).toString('hex');
     const url = new URL(AUTHORIZE_URL);
@@ -141,6 +141,7 @@ export function createOpenAIOAuthLogin(deps) {
         process.stderr.write(
           `\n[openai-oauth] Open this URL to log in to ChatGPT (OpenAI OAuth):\n${url.toString()}\n\n`
         );
+        if (!openBrowser) return;
         try {
           const { openInBrowser } = await import('../../../shared/open-url.mjs');
           openInBrowser(url.toString());

package/src/runtime/agent/orchestrator/providers/quota-reading.mjs

@@ -0,0 +1,70 @@
+/**
+ * quota-reading.mjs — the authoritative "can this provider serve this model
+ * now?" answer a quota resume asks before it fires. Every account is
+ * re-measured with a forced usage reading (the account pool's own probe), and
+ * the answer is the pool's own choice over the fresh readings, so a resume
+ * fires exactly when a send would find a usable account.
+ */
+import {
+  ACCOUNT_PROVIDERS,
+  chooseProviderAccount,
+  quotaWindowAppliesToModel,
+  readProviderAccountPool,
+} from '../../../shared/provider-accounts.mjs';
+import { fetchOAuthUsageSnapshot } from './oauth-usage.mjs';
+import { getProvider } from './registry.mjs';
+
+const forcedReading = (routeInfo, providerObj) =>
+  fetchOAuthUsageSnapshot(routeInfo, providerObj, () => {}, { force: true }).catch(() => null);
+
+const positive = (value) => typeof value === 'number' && Number.isFinite(value) && value > 0;
+
+/** Measured evidence in this one reading that `model` can be served: an
+ *  applicable window with a numeric meter and none of them spent, or, when
+ *  the account pays with credits, a positive measured balance. A failed,
+ *  unknown or balance-only reading is no evidence. */
+function readingServesModel(reading, model, useCredits) {
+  if (!reading) return false;
+  const balance = reading.balance;
+  if (
+    useCredits &&
+    balance &&
+    (balance.unlimited === true || positive(balance.remainingCredits) || positive(balance.remainingUsd))
+  ) {
+    return true;
+  }
+  const measured = (reading.quotaWindows || []).filter(
+    (window) =>
+      quotaWindowAppliesToModel(window, model) && typeof window?.usedPct === 'number' && Number.isFinite(window.usedPct)
+  );
+  return measured.length > 0 && measured.every((window) => window.usedPct < 100);
+}
+
+export async function providerQuotaUsable(providerName, model = '', { provider = getProvider(providerName) } = {}) {
+  // Only an account-pooled provider reports exhausted quota at all.
+  if (!ACCOUNT_PROVIDERS.includes(providerName)) return true;
+  const pool = readProviderAccountPool(providerName);
+  const useCredits = pool.useCredits === true;
+  // Only this reading counts as evidence: an account whose forced reading
+  // failed or measured nothing for this model stays exhausted however its
+  // older record reads; the pool's own choice (selection, blocks) decides
+  // among the rest.
+  if (pool.accounts.length > 0) {
+    const readings = await Promise.all(
+      pool.accounts.map((row) =>
+        forcedReading(
+          { provider: providerName, accountId: row.id },
+          typeof provider?.forAccount === 'function' ? provider.forAccount(row.id) : provider
+        )
+      )
+    );
+    const unproven = new Set(
+      pool.accounts.filter((_, index) => !readingServesModel(readings[index], model, useCredits)).map((row) => row.id)
+    );
+    if (unproven.size === pool.accounts.length) return false;
+    return chooseProviderAccount(readProviderAccountPool(providerName), unproven, Date.now(), model) !== null;
+  }
+  // No roster: the single credential's fresh meter decides.
+  const reading = await forcedReading({ provider: providerName, model: '' }, provider);
+  return readingServesModel(reading, model, useCredits);
+}

package/src/runtime/agent/orchestrator/providers/registry.mjs

@@ -256,21 +256,50 @@ async function _initProvidersUnsynchronized(config, signal = null) {
         return { name, inst, sig };
       } catch (err) {
         const msg = err instanceof Error ? err.message : String(err);
-        return { name, error: new Error(`[provider] Failed to init "${name}": ${msg}`) };
+        const error = new Error(`[provider] Failed to init "${name}": ${msg}`);
+        // One invalid custom provider is isolated: it is skipped (never
+        // partially loaded) and reported, the rest of the registry builds.
+        if (isCustomProviderConfig(name, cfg) && !signal?.aborted) return { name, error, isolated: true };
+        return { name, error };
       }
     })
   );
+  const nextInitErrors = new Map();
   for (const result of enabledResults) {
     throwIfAborted(signal);
     if (!result) continue;
+    if (result.isolated) {
+      nextInitErrors.set(result.name, result.error.message);
+      process.stderr.write(`${result.error.message} (provider skipped; fix its configuration)\n`);
+      continue;
+    }
     if (result.error) throw result.error;
     next.set(result.name, result.inst);
     if (result.sig !== null) nextSignatures.set(result.name, result.sig);
   }
+  _providerInitErrors = nextInitErrors;
   // Second guard: every entry was disabled. Same reasoning — keep the
-  // existing registry rather than going dark.
+  // existing registry rather than going dark. Isolation still holds: a live
+  // instance of a provider that is now an invalid custom config is removed
+  // (the rest of the registry stays), and the recorded reasons are reported.
   if (next.size === 0) {
-    throw noEnabledProvidersError('[provider] all providers disabled in config — refusing to clear registry');
+    let removed = false;
+    for (const name of nextInitErrors.keys()) {
+      removed = providers.delete(name) || removed;
+      signatures.delete(name);
+    }
+    if (removed) {
+      _providerCatalogRevision += 1;
+      _startupCatalogRefreshPromise = null;
+      // The live registry no longer reflects the last applied config.
+      _lastAppliedSig = null;
+    }
+    const reasons = [...nextInitErrors.values()];
+    throw noEnabledProvidersError(
+      `[provider] all providers disabled in config — refusing to clear registry${
+        reasons.length ? `; invalid custom providers skipped: ${reasons.join('; ')}` : ''
+      }`
+    );
   }
   // OAuth preservation guard. anthropic-oauth / openai-oauth are NOT stored
   // in mixdog-config.json — buildDefaultConfig injects them at runtime by
@@ -320,6 +349,12 @@ async function _initProvidersUnsynchronized(config, signal = null) {
   signatures.clear();
   for (const [k, v] of nextSignatures) signatures.set(k, v);
 }
+
+// Custom providers skipped by the last applied init, by name → error message.
+let _providerInitErrors = new Map();
+export function getProviderInitErrors() {
+  return new Map(_providerInitErrors);
+}
 // Register a lazily self-healed OAuth instance. Bumps the catalog revision and
 // drops the settled startup-refresh epoch so the newcomer's catalog is fetched
 // instead of inheriting a refresh that finished before it existed.

package/src/runtime/agent/orchestrator/runtime-core/builtin-features.mjs

@@ -21,6 +21,8 @@ import { readBridgeDiscovery } from '../../../bridge-discovery.mjs';
 import { HEADLESS_MODEL_TOOL_NAMES, HEADLESS_TOOL_PROFILE, normalizeToolProfile } from './tool-profile.mjs';
 import { DEFERRED_DEFAULT_LEAD_TOOLS } from './tool-catalog-data.mjs';
 import { gitExecutablePresent } from '../../../shared/path-executable.mjs';
+import { onnxRuntimeSupported } from '../../../shared/onnx-runtime-support.mjs';
+import { setBuiltinInstalledInConfig, withGrandfatheredBuiltins } from '../../../shared/builtin-grandfathering.mjs';
 
 // Browser Use / Computer Use have no install marker: the desktop app publishes
 // a loopback bridge discovery file while the feature is on. The same file
@@ -37,8 +39,14 @@ function bridgePresent(file) {
   }
 }
 
-export const INSTALLABLE_BUILTIN_IDS = Object.freeze(['git', 'memory', 'office', 'tidy', 'localProvider', 'autoEffort']);
-const GRANDFATHERED_BUILTIN_IDS = Object.freeze(['git', 'memory', 'office']);
+export const INSTALLABLE_BUILTIN_IDS = Object.freeze([
+  'git',
+  'memory',
+  'office',
+  'tidy',
+  'localProvider',
+  'autoEffort',
+]);
 
 /** Model-facing activation for one gated feature: an explicit MIXDOG_FEATURE_*
  *  env override (headless/bench) wins, otherwise the install marker and the
@@ -85,6 +93,7 @@ export function builtinFeatureActive(configLike, id) {
   // the judge model downloads at boot, and until it is on disk every call keeps
   // the user's effort.
   if (id === 'autoEffort') {
+    if (!onnxRuntimeSupported()) return false;
     return featureEnvOverride('MIXDOG_FEATURE_AUTO_EFFORT') ?? moduleEnabled(configLike, 'autoEffort', true);
   }
   // Media Studio is a hidden built-in like setup: no Settings card, no install
@@ -117,7 +126,13 @@ export function builtinFeatureActive(configLike, id) {
  *  overrides), which the caller passes in. */
 export function featureDisallowedToolsFor(
   configLike,
-  { browserAvailable = false, computerAvailable = false, terminalAvailable = false, toolProfile = 'interactive', gitAvailable } = {}
+  {
+    browserAvailable = false,
+    computerAvailable = false,
+    terminalAvailable = false,
+    toolProfile = 'interactive',
+    gitAvailable,
+  } = {}
 ) {
   const browser = featureEnvOverride('MIXDOG_FEATURE_BROWSER') ?? browserAvailable === true;
   const computer = featureEnvOverride('MIXDOG_FEATURE_COMPUTER') ?? computerAvailable === true;
@@ -162,35 +177,4 @@ export function localGitToolsActive(configLike, { gitAvailable } = {}) {
   );
 }
 
-export function setBuiltinInstalledInConfig(configLike, id, installed = true) {
-  const next = { ...(configLike || {}) };
-  next.builtins = { ...(next.builtins || {}) };
-  if (installed === true) {
-    next.builtins[id] = { ...(next.builtins[id] || {}), installed: true };
-  } else {
-    const entry = { ...(next.builtins[id] || {}) };
-    delete entry.installed;
-    next.builtins[id] = entry;
-  }
-  return next;
-}
-
-/** Stamp or grandfather the `builtins` section on config adoption. Returns the
- *  same object when the section already exists, so callers can use identity to
- *  decide whether a persist is needed. */
-export function withGrandfatheredBuiltins(configLike) {
-  const config = configLike && typeof configLike === 'object' ? configLike : {};
-  if (config.builtins && typeof config.builtins === 'object') return config;
-  let next = { ...config, builtins: {} };
-  // User-mark keys only: a default in-memory config may carry harmless
-  // structural keys before onboarding ever writes, and must stay "fresh".
-  const existingProfile = ['presets', 'providers', 'modules', 'default', 'memoryTools', 'recap'].some(
-    (key) => config[key] !== undefined
-  );
-  if (existingProfile) {
-    for (const id of GRANDFATHERED_BUILTIN_IDS) {
-      next = setBuiltinInstalledInConfig(next, id, true);
-    }
-  }
-  return next;
-}
+export { setBuiltinInstalledInConfig, withGrandfatheredBuiltins };

package/src/runtime/agent/orchestrator/runtime-core/effort.mjs

@@ -1,5 +1,6 @@
 // Reasoning-effort catalogs and coercion. Pure helpers.
 import { clean } from './session-text.mjs';
+import { customEffortLevels, snapCustomEffort } from '../providers/custom-reasoning.mjs';
 
 const TOOL_MODES = new Set(['full', 'readonly', 'lead']);
 const ALL_EFFORT_LEVELS = new Set(['none', 'minimal', 'low', 'medium', 'high', 'xhigh', 'max', 'ultra']);
@@ -71,6 +72,9 @@ export function normalizeEffortInput(value) {
 }
 
 export function effortOptionsFor(provider, model) {
+  // Custom-provider rows declare their levels authoritatively: an explicit []
+  // (or no declaration) means none, with no family/provider fallback.
+  if (model?.customReasoning) return customEffortLevels(model) || [];
   const providerAllowed = EFFORT_OPTIONS_BY_PROVIDER[provider] || null;
   const normalizeCatalogValues = (values) => {
     const seen = new Set();
@@ -106,6 +110,7 @@ export function effortOptionsFor(provider, model) {
 
 export function coerceEffortFor(provider, model, effort) {
   if (!effort) return null;
+  if (model?.customReasoning) return snapCustomEffort(customEffortLevels(model), effort);
   const allowed = effortOptionsFor(provider, model);
   if (!allowed || allowed.length === 0) return null;
   if (allowed.includes(effort)) return effort;

package/src/runtime/agent/orchestrator/runtime-core/goal-mutations.mjs

@@ -117,19 +117,6 @@ function assertCompletionEvidence(goal, at) {
   }
 }
 
-// Three consecutive turns naming the same blocker confirm it; true once the
-// audit reaches that count.
-function recordBlockAudit(goal, blocker) {
-  const turn = goal.turnCount;
-  const previous = goal.blockAudit;
-  const sameBlocker = previous?.reason === blocker;
-  let count = 1;
-  if (sameBlocker && previous.turn === turn) count = previous.count;
-  else if (sameBlocker && previous.turn === turn - 1) count = previous.count + 1;
-  goal.blockAudit = { reason: blocker, turn, count };
-  return count >= 3;
-}
-
 export function createGoalMutations(ctx) {
   const { root, now, defaultTimeLimitMs, turnGoalIds, turnStartedAt } = ctx;
 
@@ -201,10 +188,6 @@ export function createGoalMutations(ctx) {
       clearTurnFailures(goal);
     } else {
       const blocker = validateGoalBlocker(args.blocker);
-      if (!recordBlockAudit(goal, blocker)) {
-        goal.updatedAt = at;
-        return ctx.commit(id, goal);
-      }
       settleActiveClock(id, goal, at);
       goal.status = 'blocked';
       goal.blocker = blocker;

package/src/runtime/agent/orchestrator/runtime-core/goal-state.mjs

@@ -149,7 +149,6 @@ export function normalizeStoredGoal(value, sessionId, resumedAt = Date.now()) {
     tasks: normalizeGoalTasks(value.tasks ?? value.criteria ?? []),
     blocker: clean(value.blocker),
     pauseReason: ['waiting', 'cancelled'].includes(value.pauseReason) ? value.pauseReason : 'user',
-    blockAudit: value.blockAudit && typeof value.blockAudit === 'object' ? value.blockAudit : null,
     failureReason: clean(value.failureReason),
     failureCount: Math.max(0, Math.floor(Number(value.failureCount) || 0)),
     // Observations report progress; they never decide when work is complete.
@@ -207,7 +206,6 @@ export function publicGoal(goal, now = Date.now()) {
     ...goalTaskProgress(tasks),
     blocker: goal.blocker || '',
     pauseReason: goal.pauseReason || 'user',
-    blockAudit: goal.blockAudit || null,
     timeLimitMs: goal.timeLimitMs,
     timeMode: goal.timeMode,
     timeUsedMs,
@@ -288,7 +286,6 @@ export function activateGoal(goal, now = Date.now()) {
   goal.completedAt = null;
   goal.archivedAt = null;
   goal.blocker = '';
-  goal.blockAudit = null;
   // A running Goal has no pause to explain. Leaving the previous reason behind
   // left active records reading as a wait that had already ended.
   goal.pauseReason = 'user';

package/src/runtime/agent/orchestrator/runtime-core/goal-store.mjs

@@ -27,7 +27,6 @@ const REVISION_STATE_FIELDS = [
   'tasksObjectiveRevision',
   'timeMode',
   'pauseReason',
-  'blockAudit',
 ];
 
 function revisionStateKey(goal) {

package/src/runtime/agent/orchestrator/runtime-core/goal-text.mjs

@@ -137,7 +137,7 @@ export function continuationPrompt(goal, { idleReview = false, includeRules = tr
     '- Before completing, audit each user condition on its own: name the evidence that would prove it, inspect current state for it, and match the check to the claim. The audit must prove completion, not merely fail to find remaining work.',
     '- Missing or insufficient evidence means incomplete; keep working. Complete only when every user condition is proven met and no required work remains. Existing checks need not be repeated and verification need not be a separate task row.',
     '- Only the user retires a condition: drop a task because the user changed the objective, never to reach completion — a task dropped this turn blocks completion.',
-    '- Report an impasse that only external state or the user can clear with block once per turn using the same stable blocker description. The runtime keeps the Goal active until 3 consecutive turns confirm it. Treat equivalent blockers as the same condition even when their wording or stated next step changes. Never block for difficulty, uncertainty, merely incomplete work, a choice you can make, confirmation for in-scope work, or clarification that would only help.',
+    '- block stops the Goal immediately. Do not block the first time a blocker appears: block only after the same blocking condition has repeated for at least 3 consecutive Goal turns, counting the user-triggered turn and automatic continuations; after a resume, count only turns since that resume. Until then, re-check the blocker against current state with a tool each turn rather than restating it. Exception: when current state verifies an impasse that only the user can clear (their action, approval, credentials, or a resource they control), block on that turn. Once the threshold is met, block instead of reporting the same blocker again. Treat equivalent blockers as the same condition even when their wording or stated next step changes. Never block for difficulty, uncertainty, merely incomplete work, a choice you can make, confirmation for in-scope work, or clarification that would only help.',
     '- Never complete or block merely because time is low or the turn is ending.',
     '</system-reminder>',
   ].join('\n');

package/src/runtime/agent/orchestrator/runtime-core/goal-tool-defs.mjs

@@ -99,7 +99,7 @@ export const GOAL_TOOL_DEFS = Object.freeze([
           minLength: 1,
           maxLength: 1_000,
           description:
-            'block: stable description of the same impasse only external state or the user can clear, reported once per turn; the runtime stops after 3.',
+            'block: stable description of an impasse only external state or the user can clear; stops the Goal immediately.',
         },
       },
       required: ['action'],

package/src/runtime/agent/orchestrator/runtime-core/goal-tool-exec.mjs

@@ -27,7 +27,6 @@ function toolReply(ctx, id, goal, { full = false, previousIds = null } = {}) {
       timeUsedMs: goal.timeUsedMs,
     };
     if (goal.blocker) goalView.blocker = goal.blocker;
-    if (goal.blockAudit) goalView.blockAudit = goal.blockAudit;
     if (goal.needsTaskReview) goalView.needsTaskReview = true;
   }
   const result = { goal: goalView, remaining_ms: goal?.remainingMs ?? null };
@@ -76,7 +75,7 @@ async function pauseOrResume(ctx, id, args, action) {
       throw new Error(`a ${current.status === 'complete' ? 'completed' : 'stopped'} Goal cannot be paused or resumed`);
     }
     // The model pauses only at the user's explicit request, so its pause is the
-    // user's pause; waits on the user go through the consecutive-turn block audit.
+    // user's pause; waits on the user go through block.
     const change =
       action === 'resume'
         ? { updates: args.updates, tasks: args.tasks, duration: timeLimitMs, timeMode: args.time_mode }

package/src/runtime/agent/orchestrator/runtime-core/goal-turns.mjs

@@ -10,6 +10,7 @@ import {
   checkpointActiveClock,
   clearTurnFailures,
   publicGoal,
+  resumeGoalState,
   runningAgentWork,
   startActiveClock,
   stopActiveClock,
@@ -28,8 +29,7 @@ function settledDurationWait(goal) {
     goal.remainingMs > 0 &&
     !goal.needsTaskReview &&
     goal.tasks.length > 0 &&
-    goal.tasks.every((task) => GOAL_TASK_SETTLED.includes(task.status)) &&
-    goal.blockAudit?.turn !== goal.turnCount
+    goal.tasks.every((task) => GOAL_TASK_SETTLED.includes(task.status))
   );
 }
 
@@ -89,8 +89,7 @@ function applyTurnOutcome(goal, detail, at) {
   }
   if (status === 'failed' && goal.status === 'active') {
     // A failed turn has exhausted its recovery. Starting another Goal turn
-    // retries the same terminal error with a larger transcript. The model's
-    // separate external-blocker audit still spans 3 turns.
+    // retries the same terminal error with a larger transcript.
     stopActiveClock(goal, at);
     goal.status = 'blocked';
     goal.failureReason = clean(detail?.error) || 'Goal turn failed';
@@ -169,6 +168,21 @@ export function createGoalTurnLifecycle(ctx) {
         return published;
       });
     },
+    // A quota resume revives exactly the Goal its failure suspended, and only
+    // while that Goal is still waiting on the limit: a Goal the user paused,
+    // stopped, replaced or completed meanwhile stays as it is.
+    reactivateUsageLimited(sessionId, goalId) {
+      return withMutation(sessionId, async (id) => {
+        const goal = readRecord(id).goal;
+        if (!goal || goal.archivedAt || goal.id !== clean(goalId) || goal.status !== 'usage_limited') return null;
+        try {
+          resumeGoalState(goal, now());
+        } catch {
+          return null;
+        }
+        return commit(id, goal);
+      });
+    },
     continuation(sessionId, { agentStatus = null } = {}) {
       const goal = visibleSnapshot(sessionId);
       if (goal?.status !== 'active') return { run: false, reason: goal?.status || 'missing', goal };

package/src/runtime/agent/orchestrator/runtime-core/orchestration.mjs

@@ -14,9 +14,15 @@ output dependency. Prefer parallel scopes over sequential slices in one agent.
 If the plan has only one scope, Lead executes it directly.`,
 };
 
+const SOLO = `# Orchestration Mode: Solo
+
+Lead executes all work directly and never delegates on its own judgment.
+Only when the user explicitly asks for delegation, load the deferred \`agent\`
+tool and brief each agent as the Lead rules describe.`;
+
 export function orchestrationInstructions(value) {
   const mode = normalizeOrchestrationMode(value);
-  if (mode === 'none') return '';
+  if (mode === 'none') return SOLO;
   return `# Orchestration Mode: ${mode[0].toUpperCase()}${mode.slice(1)}
 
 ${BATCHING[mode]}