mixdog 1.2.2 → 1.2.3

package/src/runtime/agent/orchestrator/runtime-core/tool-exposure.mjs

@@ -0,0 +1,96 @@
+// Versioned tool exposure. deferredProviderMode classifies the provider
+// (native tool search or not); toolExposureMode records how the session's
+// tools reach the model. Non-native providers use the fixed bridge: a small
+// eager core plus the shared load_tool and call_tool, with every other tool
+// only in the session's scoped catalog. Native sessions carry no field.
+import { deferredProviderMode } from './tool-catalog-schema.mjs';
+import { TOOL_SEARCH_TOOL } from './tool-defs.mjs';
+
+export const TOOL_EXPOSURE_BRIDGE = 'bridge-v1';
+export const TOOL_EXPOSURE_NATIVE = 'native';
+export const TOOL_SURFACE_MIGRATION_INTENT = 'tool_surface_bridge_migration';
+
+const BRIDGE_PROVIDER_MODES = new Set(['canonical', 'manifest']);
+// call_tool, and the retired search_tools an older bridge surface carried.
+const BRIDGE_ONLY_TOOL_NAMES = new Set(['search_tools', 'call_tool']);
+// load_tool definitions earlier bridge surfaces carried: the describe-only
+// bridge loader, and the shared loader with query/cursor inputs.
+const LEGACY_BRIDGE_LOAD_TOOL_DESCRIPTIONS = new Set([
+  'Describe tools by exact name: description, input schema and annotations, or the part one JSON Pointer selects. Large definitions arrive in chunks; pass nextCursor back for the rest. Describing never enables a tool.',
+  'Load full schemas for missing deferred tool names/aliases; batch needed names in one call. Or find tools by keyword with query. Pass nextCursor back for the next page.',
+]);
+const SHARED_LOAD_TOOL_SCHEMA = JSON.stringify(TOOL_SEARCH_TOOL.inputSchema);
+
+/** `route`: the session's pinned wire route (session.wireRoute), when one exists. */
+export function toolExposureModeForProvider(provider, route = null) {
+  return BRIDGE_PROVIDER_MODES.has(deferredProviderMode(provider, route)) ? TOOL_EXPOSURE_BRIDGE : TOOL_EXPOSURE_NATIVE;
+}
+
+export function isToolBridgeEnabled(session) {
+  return session?.toolExposureMode === TOOL_EXPOSURE_BRIDGE;
+}
+
+/**
+ * The exposure a session's persisted surface was built with, or null before
+ * it has one. Surfaces persisted before exposure versions: native providers
+ * were already native; fixed-surface providers carried the whole catalog.
+ */
+export function sessionToolExposure(session) {
+  if (session?.toolExposureMode) return session.toolExposureMode;
+  if (!session?.deferredProviderMode) return null;
+  return session.deferredProviderMode === 'native' ? TOOL_EXPOSURE_NATIVE : 'legacy-fixed';
+}
+
+/**
+ * True when an existing surface was built for another exposure than
+ * `provider` needs, or is a bridge surface an earlier bridge revision built
+ * (bridgeSurfaceOutdated).
+ */
+export function toolExposureMigrationNeeded(session, provider = session?.provider) {
+  const current = sessionToolExposure(session);
+  if (current === null) return false;
+  const target = toolExposureModeForProvider(provider, session?.wireRoute);
+  return current !== target || (target === TOOL_EXPOSURE_BRIDGE && bridgeSurfaceOutdated(session));
+}
+
+/**
+ * A bridge session an earlier bridge revision built: its fixed prompt holds
+ * other bridge guidance than the current one (the guidance-only block, or
+ * guidance naming search_tools or query), or its eager surface still carries
+ * search_tools or a load_tool other than the shared one.
+ */
+export function bridgeSurfaceOutdated(session) {
+  if (!isToolBridgeEnabled(session)) return false;
+  const tools = Array.isArray(session.tools) ? session.tools : [];
+  const staleTool = tools.some(
+    (tool) =>
+      tool?.name === 'search_tools' ||
+      (tool?.name === TOOL_SEARCH_TOOL.name &&
+        (tool.description !== TOOL_SEARCH_TOOL.description ||
+          JSON.stringify(tool.inputSchema) !== SHARED_LOAD_TOOL_SCHEMA))
+  );
+  if (staleTool) return true;
+  return (Array.isArray(session.messages) ? session.messages : []).some(
+    (message) =>
+      message?.role === 'system' &&
+      typeof message.content === 'string' &&
+      message.content.includes('<tool-bridge>') &&
+      !message.content.includes(TOOL_BRIDGE_GUIDANCE)
+  );
+}
+
+/** A bridge-only definition (never part of the scoped catalog). */
+export function isBridgeToolDefinition(tool) {
+  const name = String(tool?.name || '');
+  if (BRIDGE_ONLY_TOOL_NAMES.has(name)) return true;
+  return name === TOOL_SEARCH_TOOL.name && LEGACY_BRIDGE_LOAD_TOOL_DESCRIPTIONS.has(tool?.description);
+}
+
+// Static and byte-stable; it follows the deferred roster (the same
+// <available-deferred-tools> block native sessions get), never replaces it.
+// A prompt holding any other bridge guidance is migrated once.
+export const TOOL_BRIDGE_GUIDANCE = [
+  '<tool-bridge>',
+  'Deferred tools (listed above, or announced later as added) are not defined here: run one with call_tool {name, arguments}, and use load_tool first to see its parameters (a keyword instead of a name searches the deferred tools). Call directly defined tools directly.',
+  '</tool-bridge>',
+].join('\n');

package/src/runtime/agent/orchestrator/session/catalog-db/schema.mjs

@@ -11,7 +11,7 @@ import { createHash } from 'node:crypto';
 
 /** Bumped whenever the table layout or a codec changes: the DB is then
  *  dropped and backfilled again from the JSON catalog. */
-export const SCHEMA_VERSION = 4;
+export const SCHEMA_VERSION = 5;
 /** PRAGMA application_id ('MXSC'): a file without it is not this catalog. */
 export const APPLICATION_ID = 0x4d585343;
 
@@ -59,6 +59,8 @@ const FIELDS = [
   ['importKey', 'import_key', 'loose'],
   // Source session of an inherited (forked) session (schema 4).
   ['inheritedFromSessionId', 'inherited_from_session_id', 'loose'],
+  // Real human turns (null for a row written before schema 5).
+  ['realTurnCount', 'real_turn_count', 'loose'],
 ];
 
 const COLUMN_TYPES = { text: 'TEXT', real: 'REAL', int: 'INTEGER', bool: 'INTEGER', json: 'TEXT', optjson: 'TEXT' };

package/src/runtime/agent/orchestrator/session/compact/constants.mjs

@@ -15,8 +15,9 @@ export {
   compactionBufferTokensForBoundary,
 };
 
-export const SUMMARY_PREFIX_ANCHOR =
-  'A previous model worked on this task and produced the compacted handoff summary below.';
+import { SUMMARY_PREFIX_ANCHOR } from './summary-anchor.mjs';
+
+export { SUMMARY_PREFIX_ANCHOR };
 export const SUMMARY_PREFIX = `${SUMMARY_PREFIX_ANCHOR} Build on the work already done and avoid duplicating it. The summary covers the session; retained requests and execution records follow it. Actual tool outcomes take precedence over plans or older claims in the summary.`;
 export const SUMMARY_OUTPUT_TOKENS = 4_096;
 // Longest a handoff summary call may run: the default, the config fallback,

package/src/runtime/agent/orchestrator/session/compact/messages.mjs

@@ -1,13 +1,14 @@
 // Message classification, protected-context splitting, and summary-message
 // construction helpers.
-import { SUMMARY_PREFIX, SUMMARY_PREFIX_ANCHOR } from './constants.mjs';
+import { SUMMARY_PREFIX } from './constants.mjs';
 import { sha16, roleCounts } from './text-utils.mjs';
 import { carryMessageId, withoutMessageIdsReplacer } from '../message-ids.mjs';
-import { isImportedMessage } from '../imported-message.mjs';
 import {
-  isInternalRuntimeNotificationText,
-  isModelVisibleToolCompletionWrapper,
-} from '../../../../shared/tool-execution-contract.mjs';
+  isActualUserInstructionMessage,
+  isInjectedSkillBodyMessage,
+  isProtectedContextUserMessage,
+  isSummaryMessage,
+} from './user-message-kind.mjs';
 
 export function compactHeader(oldHistory) {
   // Stable display ids are bookkeeping, not conversation: the header names
@@ -23,94 +24,14 @@ export function makeSummaryMessage(content) {
   return { role: 'user', content, meta: { source: 'compact-summary' } };
 }
 
-// A compact summary message is a synthetic role:'user' message carrying the
-// SUMMARY_PREFIX anchor. It is NOT a real user turn: it must be excluded from
-// real user-turn boundary calculations and treated as merge input, otherwise
-// an old summary can sit in the preserved tail as a live user message,
-// duplicate, or fail to merge across repeated compaction.
-export function isSummaryMessage(m) {
-  return (
-    m?.role === 'user' &&
-    !isImportedMessage(m) &&
-    (String(m?.meta?.source || '') === 'compact-summary' ||
-      (typeof m.content === 'string' &&
-        m.content.startsWith(SUMMARY_PREFIX_ANCHOR) &&
-        /\nmessages=\d+\s+(?:sha256=|compact_type=)/.test(m.content)))
-  );
-}
-
-export function isProtectedContextUserMessage(m) {
-  if (m?.role !== 'user' || typeof m.content !== 'string' || isImportedMessage(m)) return false;
-  let content = m.content.trim();
-  if (!content.toLowerCase().startsWith('<system-reminder>')) return false;
-  const closingTag = '</system-reminder>';
-  // A runtime turn may carry several reminders (Goal, clock, tool delta).
-  // Only text outside those envelopes is a human instruction. Keep this
-  // compatible with stored turns that predate explicit source metadata.
-  while (content.toLowerCase().startsWith('<system-reminder>')) {
-    const closingIndex = content.toLowerCase().indexOf(closingTag);
-    if (closingIndex < 0) return true;
-    content = content.slice(closingIndex + closingTag.length).trim();
-  }
-  return content === '';
-}
-
-// An injected Skill-body user message (the general newMessages channel carries
-// the full SKILL.md body as a role:'user' message after the Skill tool_result).
-// Like isSummaryMessage / isProtectedContextUserMessage, it is detected by
-// content prefix (the `<skill>` envelope from buildSkillResultEnvelope) so the
-// check survives even if the synthetic `meta` field is dropped during a tail
-// rebuild. It is NOT the human's latest prompt and must be excluded from
-// "latest human request" selection (deriveCurrentRequest). The `meta:'skill'`
-// marker is also honoured.
-export function isInjectedSkillBodyMessage(m) {
-  if (m?.role !== 'user' || isImportedMessage(m)) return false;
-  if (m.meta === 'skill') return true;
-  return typeof m.content === 'string' && m.content.trimStart().startsWith('<skill>');
-}
-
-const SYNTHETIC_USER_SOURCES = new Set([
-  'goal-continuation',
-  'goal-closeout',
-  'compact-context',
-  'compact-active-turn-continuation',
-  'compact-execution-recovery',
-  'max-output-recovery',
-  'refusal-recovery',
-  'stream-cut-recovery',
-]);
-const SYNTHETIC_USER_CONTROL_RE =
-  /^(?:\[mixdog-runtime\]|\[request interrupted(?: by user(?: for tool use)?| by process restart)?\])(?:\s|$)/i;
-
-function userMessageText(message) {
-  if (typeof message?.content === 'string') return message.content;
-  if (!Array.isArray(message?.content)) return '';
-  return message.content.map((block) => (typeof block === 'string' ? block : block?.text || '')).join('');
-}
-
-export function isActualUserInstructionMessage(message) {
-  if (
-    message?.role !== 'user' ||
-    isSummaryMessage(message) ||
-    isProtectedContextUserMessage(message) ||
-    isInjectedSkillBodyMessage(message)
-  ) {
-    return false;
-  }
-  const text = userMessageText(message);
-  // Imported prose is the user's own words whatever it looks like.
-  if (isImportedMessage(message)) return text.trim().length > 0;
-  if (/^Reference files:\s*/i.test(text.trimStart())) return false;
-  if (
-    SYNTHETIC_USER_CONTROL_RE.test(text.trimStart()) ||
-    isInternalRuntimeNotificationText(text) ||
-    isModelVisibleToolCompletionWrapper(text) ||
-    SYNTHETIC_USER_SOURCES.has(String(message?.meta?.source || ''))
-  ) {
-    return false;
-  }
-  return text.trim().length > 0 || (Array.isArray(message.content) && message.content.length > 0);
-}
+// User-message classification lives in the import-light user-message-kind.mjs
+// (the session store counts real turns with it); re-exported for callers.
+export {
+  isActualUserInstructionMessage,
+  isInjectedSkillBodyMessage,
+  isProtectedContextUserMessage,
+  isSummaryMessage,
+};
 
 export function latestActualUserInstructionIndex(messages) {
   for (let index = (Array.isArray(messages) ? messages.length : 0) - 1; index >= 0; index -= 1) {

package/src/runtime/agent/orchestrator/session/compact/summary-anchor.mjs

@@ -0,0 +1,5 @@
+// Leaf constant: the anchor sentence every compact summary message opens with.
+// Kept import-free so store-layer code can classify messages without pulling
+// the context-utils graph (which cycles back into the session store).
+export const SUMMARY_PREFIX_ANCHOR =
+  'A previous model worked on this task and produced the compacted handoff summary below.';

package/src/runtime/agent/orchestrator/session/compact/user-message-kind.mjs

@@ -0,0 +1,120 @@
+// Classification of role:'user' messages: the human's own instruction versus
+// compact summaries and runtime-injected turns. Import-light on purpose (no
+// context-utils graph) so the session store can count real human turns;
+// compact/messages.mjs re-exports everything here.
+import { SUMMARY_PREFIX_ANCHOR } from './summary-anchor.mjs';
+import { isImportedMessage } from '../imported-message.mjs';
+import {
+  isInternalRuntimeNotificationText,
+  isModelVisibleToolCompletionWrapper,
+} from '../../../../shared/tool-execution-contract.mjs';
+
+// A compact summary message is a synthetic role:'user' message carrying the
+// SUMMARY_PREFIX anchor. It is NOT a real user turn: it must be excluded from
+// real user-turn boundary calculations and treated as merge input, otherwise
+// an old summary can sit in the preserved tail as a live user message,
+// duplicate, or fail to merge across repeated compaction.
+export function isSummaryMessage(m) {
+  return (
+    m?.role === 'user' &&
+    !isImportedMessage(m) &&
+    (String(m?.meta?.source || '') === 'compact-summary' ||
+      (typeof m.content === 'string' &&
+        m.content.startsWith(SUMMARY_PREFIX_ANCHOR) &&
+        /\nmessages=\d+\s+(?:sha256=|compact_type=)/.test(m.content)))
+  );
+}
+
+export function isProtectedContextUserMessage(m) {
+  if (m?.role !== 'user' || typeof m.content !== 'string' || isImportedMessage(m)) return false;
+  let content = m.content.trim();
+  if (!content.toLowerCase().startsWith('<system-reminder>')) return false;
+  const closingTag = '</system-reminder>';
+  // A runtime turn may carry several reminders (Goal, clock, tool delta).
+  // Only text outside those envelopes is a human instruction. Keep this
+  // compatible with stored turns that predate explicit source metadata.
+  while (content.toLowerCase().startsWith('<system-reminder>')) {
+    const closingIndex = content.toLowerCase().indexOf(closingTag);
+    if (closingIndex < 0) return true;
+    content = content.slice(closingIndex + closingTag.length).trim();
+  }
+  return content === '';
+}
+
+// An injected Skill-body user message (the general newMessages channel carries
+// the full SKILL.md body as a role:'user' message after the Skill tool_result).
+// Like isSummaryMessage / isProtectedContextUserMessage, it is detected by
+// content prefix (the `<skill>` envelope from buildSkillResultEnvelope) so the
+// check survives even if the synthetic `meta` field is dropped during a tail
+// rebuild. It is NOT the human's latest prompt and must be excluded from
+// "latest human request" selection (deriveCurrentRequest). The `meta:'skill'`
+// marker is also honoured.
+export function isInjectedSkillBodyMessage(m) {
+  if (m?.role !== 'user' || isImportedMessage(m)) return false;
+  if (m.meta === 'skill') return true;
+  return typeof m.content === 'string' && m.content.trimStart().startsWith('<skill>');
+}
+
+const SYNTHETIC_USER_SOURCES = new Set([
+  'goal-continuation',
+  'goal-closeout',
+  'compact-context',
+  'compact-active-turn-continuation',
+  'compact-execution-recovery',
+  'max-output-recovery',
+  'refusal-recovery',
+  'stream-cut-recovery',
+]);
+const SYNTHETIC_USER_CONTROL_RE =
+  /^(?:\[mixdog-runtime\]|\[request interrupted(?: by user(?: for tool use)?| by process restart)?\])(?:\s|$)/i;
+
+function userMessageText(message) {
+  if (typeof message?.content === 'string') return message.content;
+  if (!Array.isArray(message?.content)) return '';
+  return message.content.map((block) => (typeof block === 'string' ? block : block?.text || '')).join('');
+}
+
+export function isActualUserInstructionMessage(message) {
+  if (
+    message?.role !== 'user' ||
+    isSummaryMessage(message) ||
+    isProtectedContextUserMessage(message) ||
+    isInjectedSkillBodyMessage(message)
+  ) {
+    return false;
+  }
+  const text = userMessageText(message);
+  // Imported prose is the user's own words whatever it looks like.
+  if (isImportedMessage(message)) return text.trim().length > 0;
+  if (/^Reference files:\s*/i.test(text.trimStart())) return false;
+  if (
+    SYNTHETIC_USER_CONTROL_RE.test(text.trimStart()) ||
+    isInternalRuntimeNotificationText(text) ||
+    isModelVisibleToolCompletionWrapper(text) ||
+    SYNTHETIC_USER_SOURCES.has(String(message?.meta?.source || ''))
+  ) {
+    return false;
+  }
+  return text.trim().length > 0 || (Array.isArray(message.content) && message.content.length > 0);
+}
+
+// Control rows the runtime writes as user turns when a turn is cut short.
+// isActualUserInstructionMessage deliberately keeps treating "[truncated]" as
+// an instruction (compaction tail selection depends on it), so the real-turn
+// predicate below recognizes it on its own.
+const CONTROL_MARKER_RE = /^\[(?:truncated|request interrupted(?: by user(?: for tool use)?| by process restart)?)\]$/i;
+
+/** Whether a message stands for real human conversation: a compact summary
+ *  (it replaced earlier human turns), imported prose, or the user's own
+ *  instruction without runtime provenance (`meta.source`/`meta.synthetic`,
+ *  `internal`/`synthetic` flags) or a recognized control marker. Used to tell
+ *  a real conversation from a synthetic-only transcript in catalog rows. */
+export function isRealTurnMessage(message) {
+  if (isSummaryMessage(message)) return true;
+  if (!isActualUserInstructionMessage(message)) return false;
+  if (isImportedMessage(message)) return true;
+  if (message.internal === true || message.synthetic === true) return false;
+  const meta = message.meta;
+  if (meta && typeof meta === 'object' && (meta.synthetic === true || meta.source)) return false;
+  return !CONTROL_MARKER_RE.test(userMessageText(message).trim());
+}

package/src/runtime/agent/orchestrator/session/context-tool-schema.mjs

@@ -8,6 +8,13 @@ import {
 } from '../runtime-core/provider-request-tools.mjs';
 
 const toolSchemaAnalysisMemo = new WeakMap();
+// Token cost by schema signature. Every new session builds its own tools array
+// with the same schemas; re-estimating the whole serialization (tens of ms,
+// synchronous) per first turn blocked the event loop during session creation.
+// The signature hashes the full serialization, deferred flags included, so it
+// determines the metered text exactly.
+const toolSchemaTokensBySignature = new Map();
+const TOOL_SCHEMA_TOKENS_LIMIT = 32;
 
 function isDeferredToolSchema(tool) {
   return tool?.deferLoading === true || tool?.defer_loading === true;
@@ -58,8 +65,16 @@ function analyzeToolSchemas(tools) {
   // full weight inflated the request reserve. The SIGNATURE keeps hashing
   // the full serialization (a deferred tool joining/leaving must still
   // re-fingerprint the surface); only the token cost drops deferred entries.
-  const meterText = list.some(isDeferredToolSchema) ? serializeToolSchemas(list, { excludeDeferred: true }) : text;
-  const analysis = { signature, tokens: estimateTokens(meterText) };
+  let tokens = toolSchemaTokensBySignature.get(signature);
+  if (tokens === undefined) {
+    const meterText = list.some(isDeferredToolSchema) ? serializeToolSchemas(list, { excludeDeferred: true }) : text;
+    tokens = estimateTokens(meterText);
+    if (toolSchemaTokensBySignature.size >= TOOL_SCHEMA_TOKENS_LIMIT) {
+      toolSchemaTokensBySignature.delete(toolSchemaTokensBySignature.keys().next().value);
+    }
+    toolSchemaTokensBySignature.set(signature, tokens);
+  }
+  const analysis = { signature, tokens };
   if (Array.isArray(tools)) toolSchemaAnalysisMemo.set(tools, analysis);
   return analysis;
 }

package/src/runtime/agent/orchestrator/session/context-utils.mjs

@@ -225,10 +225,14 @@ function messageTextTokens(m, precomputedText = null, precomputedReplay = null)
     m?.role === 'assistant' && Array.isArray(m.providerReplay?.items) && m.providerReplay.items.length
       ? m.providerReplay.items
       : null;
-  const fullTokens = estimateTokens(text);
-  if (!replayItems) return fullTokens;
-  const replayTokens = estimateTokens(precomputedReplay ?? nativeBlocksEstimateText(replayItems));
-  return Math.max(fullTokens - replayTokens, replayTokens);
+  if (!replayItems) return estimateTokens(text);
+  // With visible replay items the text is exactly `${base}\n${replay}`. Meter
+  // each half on its own: the estimator's minimum-cost floors apply to the
+  // joined string, so subtracting est(replay) from est(base + replay)
+  // overstates base.
+  const replay = precomputedReplay ?? nativeBlocksEstimateText(replayItems);
+  const base = text.slice(0, text.length - replay.length - 1);
+  return Math.max(estimateTokens(base), estimateTokens(replay));
 }
 function imageDescriptorAllowance(descriptor) {
   if (descriptor.width && descriptor.height) {

package/src/runtime/agent/orchestrator/session/eager-dispatch/admission.mjs

@@ -12,6 +12,7 @@ import {
 } from '../loop/tool-classify.mjs';
 import { isSingleCallPerTurnTool, isToolCallDedupEligible } from '../loop/tool-helpers.mjs';
 import { lookupToolResultReuse } from '../cache/tool-result-reuse.mjs';
+import { bridgeClassificationTools } from '../loop/tool-call-resolution.mjs';
 
 export function createEagerAdmission({ tools, cwd, sessionId, sessionRef, repeatFailLimit }) {
   // Streaming-time intra-turn dedup. When the LLM emits two
@@ -63,7 +64,7 @@ export function createEagerAdmission({ tools, cwd, sessionId, sessionRef, repeat
     // Authorization precedes cache lookup and dedup, not just IO.
     if (preDispatchDenyForSession(sessionRef, call) !== null) return null;
     const sig = _intraTurnSig(call.name, call.arguments);
-    const dedupEligible = isToolCallDedupEligible(call.name, tools);
+    const dedupEligible = isToolCallDedupEligible(call.name, bridgeClassificationTools(tools, [call]));
     if (dedupEligible && _eagerInFlightSigs.has(sig)) return null;
     // Repeat-failure guard also gates eager dispatch (reviewer-flagged):
     // streaming onToolCall / startEagerRun would otherwise re-run an

package/src/runtime/agent/orchestrator/session/eager-dispatch.mjs

@@ -10,6 +10,7 @@ import { createEagerBarriers } from './eager-dispatch/barriers.mjs';
 import { createEagerEntry, runEagerEntry } from './eager-dispatch/entry.mjs';
 import { executeTool } from './loop/tool-exec.mjs';
 import { isParallelDispatchable } from './loop/tool-helpers.mjs';
+import { resolveExecutionToolCall } from './loop/tool-call-resolution.mjs';
 
 export function createEagerDispatcher({
   tools,
@@ -45,9 +46,13 @@ export function createEagerDispatcher({
       iteration: getNextIteration(),
       localSearchTelemetry: entry.localSearchTelemetry,
       resultTelemetry: entry.resultTelemetry,
+      ...(call.wireCall ? { bridgeWireCall: call.wireCall } : {}),
     });
 
-  const startEagerTool = (call) => {
+  const startEagerTool = (wireCall) => {
+    // Streamed call_tool requests are admitted, ordered and executed as their
+    // targets; a projection error is answered by the serial batch instead.
+    const call = resolveExecutionToolCall(wireCall, sessionRef);
     if (!call?.id || pending.has(call.id) || !isParallelDispatchable(call.name)) return null;
     const admitted = admission.admit(call);
     if (!admitted) return null;

package/src/runtime/agent/orchestrator/session/loop/compact-policy.mjs

@@ -7,6 +7,7 @@ import {
   contextMessagesSignature,
   estimateMessagesTokens,
   estimateRequestReserveTokens,
+  estimateToolSchemaTokens,
   providerTokenCalibration,
   resolveSessionCompactPolicy,
   toolSchemaSignature,
@@ -18,6 +19,7 @@ import { positiveInt } from '../../../../shared/numbers.mjs';
 import { isAgentOwner } from '../../agent-owner.mjs';
 import { providerInputExcludesCache, providerNativePdf } from '../../providers/registry.mjs';
 import { contentMediaBytes, contentMediaCount } from '../../providers/media-normalization.mjs';
+import { splitProtectedContext } from '../compact/messages.mjs';
 
 // Unified context-share rule (compact/constants.mjs CONTEXT_SHARE_RATIO): the
 // post-compaction target is 25% of the boundary/context window. One
@@ -589,6 +591,95 @@ export function compactTargetBudget(policy) {
   const singleShot = policy?.singleShot === true || (rawTrigger > 0 && reserve >= rawTrigger);
   return compactTargetBudgetForTrigger(rawBoundary, rawTarget, reserve, rawTrigger, singleShot, policy?.force === true);
 }
+const OVERHEAD_TOP_TOOLS = 5;
+
+/**
+ * The per-request overhead no compaction can shrink — the finalized wire tool
+ * schemas (policy.requestReserveTokens), the protected system/fixed prompt
+ * every compaction keeps verbatim, and the configured operator headroom — in
+ * the provider-scale units of the compact boundary (calibrated estimates, the
+ * configured headroom as configured). Only that fixed estimate can justify a
+ * refusal; a provider reading aligned to this prefix and these tool schemas
+ * can only withdraw one (it includes compactable history). Null unless the
+ * fixed part reaches the boundary: kind 'fixed_overhead' when schemas +
+ * system alone do, 'configured_reserve' when the configured headroom pushes
+ * the fixed part there.
+ */
+export function fixedRequestOverhead(policy, messages, tools, sessionRef = null) {
+  if (!policy?.auto) return null;
+  const boundary = positiveInt(policy.boundaryTokens);
+  if (!boundary) return null;
+  const calibration = policyTokenCalibration(policy);
+  const toProviderScale = (raw) => Math.ceil(Math.max(0, raw) * calibration);
+  const toolTokens = toProviderScale(policyRequestReserveTokens(policy));
+  const systemTokens = toProviderScale(
+    estimateMessagesTokens(splitProtectedContext(messages || []).protectedPrefix)
+  );
+  const configuredReserve = Math.max(0, Number(policy.configuredReserveTokens) || 0);
+  const fixed = toolTokens + systemTokens;
+  // A provider reading of this very prefix with these very tools measured
+  // the whole request, compactable history included: an upper bound of the
+  // fixed part, never proof of it. When it is not above the estimate, the
+  // estimate is known to overstate the fixed part by an unknown amount, so
+  // nothing here can show that compaction is futile.
+  const measuredRequestTokens = measuredFixedRequestTokens(sessionRef, messages, policy);
+  if (measuredRequestTokens !== null && measuredRequestTokens <= fixed) return null;
+  // Refuse only when the fixed part itself (plus the headroom, for the
+  // reserve kind) reaches the boundary — never on a near miss of a heuristic
+  // estimate: those requests compact or go out, and the provider's own
+  // overflow handling decides.
+  let kind = null;
+  if (fixed >= boundary) kind = 'fixed_overhead';
+  else if (configuredReserve > 0 && fixed + configuredReserve >= boundary) kind = 'configured_reserve';
+  if (!kind) return null;
+  const counted = (Array.isArray(tools) ? tools : []).filter(
+    (tool) => tool?.deferLoading !== true && tool?.defer_loading !== true
+  );
+  const largestTools = counted
+    .map((tool) => ({
+      name: String(tool?.name || tool?.type || 'tool'),
+      tokens: toProviderScale(estimateToolSchemaTokens([tool])),
+    }))
+    .sort((a, b) => b.tokens - a.tokens || a.name.localeCompare(b.name))
+    .slice(0, OVERHEAD_TOP_TOOLS);
+  return {
+    kind,
+    contextWindowTokens: positiveInt(policy.contextWindow) || boundary,
+    boundaryTokens: boundary,
+    toolCount: counted.length,
+    toolTokens,
+    systemTokens,
+    configuredReserveTokens: configuredReserve,
+    measuredRequestTokens,
+    largestTools,
+  };
+}
+
+/**
+ * Identity of the fixed inputs fixedRequestOverhead judges: the wire tool
+ * schemas, the protected system context, the configured headroom and the
+ * boundary. A verdict holds while this is unchanged; the provider reading is
+ * deliberately not part of it (compaction clears it, fixed overhead stays).
+ */
+export function fixedRequestOverheadInputs(policy, messages) {
+  if (!policy?.auto) return null;
+  return JSON.stringify([
+    policy.toolSchemaSignature || '',
+    contextMessagesSignature(splitProtectedContext(messages || []).protectedPrefix),
+    Math.max(0, Number(policy.configuredReserveTokens) || 0),
+    positiveInt(policy.boundaryTokens) || 0,
+  ]);
+}
+
+// The provider-measured size of the last request when it still describes
+// this transcript prefix and was sent with the same tool schemas; else null.
+function measuredFixedRequestTokens(sessionRef, messages, policy) {
+  if (!sessionRef || !Array.isArray(messages)) return null;
+  const aligned = providerBaselineCoverage(sessionRef, messages);
+  if (!aligned || !aligned.toolSignature || aligned.toolSignature !== policy?.toolSchemaSignature) return null;
+  return aligned.tokens;
+}
+
 // Anthropic refuses a request body over 32 MB (HTTP 413) however few tokens it
 // holds, and inline media is what gets there: an image is priced at no more
 // than ~1.6k tokens yet carries up to 5 MB of base64. Tool-result media is the
@@ -707,7 +798,6 @@ function compactionTelemetryRecord(sessionRef, policy, meta, prev) {
   return {
     ...prev,
     auto: policy.auto !== false,
-    reservedTokens: policy.configuredReserveTokens || prev.reservedTokens || null,
     requestReserveTokens: policy.requestReserveTokens || 0,
     reserveTokens: policy.reserveTokens || 0,
     boundaryTokens: policy.boundaryTokens || null,

package/src/runtime/agent/orchestrator/session/loop/completion-guards.mjs

@@ -37,7 +37,7 @@ export function crossTurnSignature(name, args) {
 // they must not reset the escalation ladder's "zero edit" condition. Skill /
 // recall / agent / task / cwd / load_tool are exploration/meta plumbing.
 // (tool_search kept as legacy alias for old transcripts.)
-const NON_PROGRESS_TOOLS = new Set(['Skill', 'recall', 'agent', 'task', 'cwd', 'load_tool', 'tool_search']);
+const NON_PROGRESS_TOOLS = new Set(['Skill', 'recall', 'agent', 'task', 'cwd', 'session', 'load_tool', 'tool_search']);
 
 // True when a successfully-executed tool represents real edit/progress. A tool
 // counts as progress only if its def lacks readOnlyHint (not eager) AND it is