muonroi-cli 1.8.4 → 1.9.0

package/dist/src/orchestrator/tool-engine.js

@@ -48,43 +48,52 @@
 //   - A4 (tool_call write-ahead)            — persistToolCallWriteAhead
 //   - A5 (message_seq write-ahead)          — persistMessageWriteAhead
 //   - O1 (providerOptions shape forensics)  — extractProviderOptionsShape
-//   - siliconflow reasoning-strip           — turnCaps.sanitizeHistory
+//   - reasoning-strip (provider quirk)       — turnCaps.sanitizeHistory
 import { generateText, stepCountIs, streamText } from "ai";
+import { getEffectiveCouncilRoleCount } from "../council/leader.js";
 import { recordArtifact } from "../ee/artifact-cache.js";
 import { routeFeedback } from "../ee/bridge.js";
 import { getDefaultEEClient } from "../ee/intercept.js";
+import { isGsdHardGateEnabled } from "../gsd/flags.js";
+import { evaluateMutationGate } from "../gsd/mutation-gate.js";
 import { acquireMcpTools } from "../mcp/client-pool.js";
 import { dropRedundantFsMcpTools, filterMcpServersByMessage } from "../mcp/smart-filter.js";
-import { getModelInfo } from "../models/registry.js";
+import { getModelInfo, isReasoningModel } from "../models/registry.js";
 import { cheapModelShellLine, injectCheapModelPlaybook, injectCheapModelShellDirective, shouldInjectCheapModelPlaybook, } from "../pil/cheap-model-playbook.js";
 import { injectCheapModelWorkbook, shouldInjectCheapModelWorkbook } from "../pil/cheap-model-workbooks.js";
 import { getResponseTaskType, isResponseTool, normalizeStructuredResponseTaskType, shouldHaltOnResponseTool, } from "../pil/index.js";
-import { isMetaAnalysisPrompt } from "../pil/layer6-output.js";
+import { isMetaAnalysisPrompt, isSprintPlanExecution } from "../pil/layer6-output.js";
 import { taskTypeToMaxTokens, taskTypeToReasoningEffort, taskTypeToTier } from "../pil/task-tier-map.js";
 import { mentionsEcosystemScope } from "../playbook/directives.js";
 import { getProviderCapabilities } from "../providers/capabilities.js";
 import { bridgeMcpToolResult, listCachedImages, scrubImagePayloadsInMessages, } from "../providers/mcp-vision-bridge.js";
 import { captureToolSchemas } from "../providers/patch-zod-schema.js";
-import { buildTurnProviderOptions, requireRuntimeProvider, shouldDropParam, } from "../providers/runtime.js";
+import { buildTurnProviderOptions, requireRuntimeProvider, resolveTemperatureParam, shouldDropParam, } from "../providers/runtime.js";
 import { wireDebug } from "../providers/wire-debug.js";
 import { reportRouteOutcome } from "../router/decide.js";
+import { statusBarStore } from "../state/status-bar-store.js";
+import { recordTurnTrace } from "../state/turn-trace.js";
 import { getNextMessageSequence, logInteraction, markMessageErrored, markToolCallErrored, persistToolCallWriteAhead, } from "../storage/index.js";
 import { persistSessionExperience } from "../storage/session-experience-store.js";
 import { createBuiltinTools } from "../tools/registry.js";
 import { snapshotFromTodoWriteArgs } from "../tools/todo-write-snapshot.js";
 import { visionToolsNeeded } from "../tools/vision-gate.js";
-import { recordTurnTrace } from "../ui/slash/debug.js";
-import { statusBarStore } from "../ui/status-bar/store.js";
 import { appendDecisionLog } from "../usage/decision-log.js";
+import { setLoopBreadcrumb } from "../utils/event-loop-monitor.js";
 import { logger } from "../utils/logger.js";
 import { openUrl } from "../utils/open-url.js";
 import { appendAudit, toolNeedsApproval } from "../utils/permission-mode.js";
-import { getAutoCouncilConfidence, getAutoCouncilMinRoles, getProviderStallRetries, getProviderStallTimeoutMs, getRoleModels, getSteerInjectionEnabled, getTopLevelCompactKeepLast, getTopLevelCompactThresholdChars, getTopLevelToolBudgetChars, isAutoCouncilEnabled, loadMcpServers, } from "../utils/settings.js";
+import { getAutoCouncilConfidence, getAutoCouncilMinRoles, getProviderProgressTimeoutMs, getProviderStallRetries, getProviderStallTimeoutMs, getSteerInjectionEnabled, getTopLevelCompactHysteresis, getTopLevelCompactKeepLast, getTopLevelCompactTailBudgetChars, getTopLevelCompactThresholdChars, getTopLevelToolBudgetChars, isAutoCouncilClarifyEnabled, isAutoCouncilEnabled, loadMcpServers, } from "../utils/settings.js";
+import { isAutoCouncilSkipReasoning } from "../utils/settings.js";
 import { resolveShell } from "../utils/shell.js";
+import { foldDynamicTailIntoUserMessage, splitFrontAndDynamicTail } from "./cache-prefix.js";
+import { consumeProactiveCompact } from "./compact-request.js";
 import { relaxCompactionSettings } from "./compaction.js";
+import { consumeCouncilConvene, hasPendingCouncilConvene, peekCouncilConveneToolCallId } from "./council-request.js";
 import { wrapToolSetWithDedup } from "./cross-turn-dedup.js";
 import { humanizeApiError, isAuthenticationError, isContextLimitError, summarizeApiErrorForLog } from "./error-utils.js";
 import { buildGroundingFootnote, findUnverifiedClaims } from "./grounding-check.js";
+import { isInteractivePaused } from "./interactive-pause.js";
 import { buildInterruptedTurnNote } from "./interrupted-turn.js";
 import { stableCallId } from "./pending-calls.js";
 import { buildMcpCapabilityBlock, MAX_LLM_CALLS_PER_TURN, } from "./prompts.js";
@@ -94,6 +103,7 @@ import { containsEncryptedReasoning, sanitizeModelMessages } from "./reasoning.j
 import { repairToolCallHook } from "./repair-tool-call.js";
 import { buildRepetitionReminder, recordAssistantBurst, shouldInjectRepetitionReminder, } from "./repetition-detector.js";
 import { classifyStreamError } from "./retry-classifier.js";
+import { parseSafetyBlock, shouldAutoAllowYolo } from "./safety-intercept.js";
 import { forcedFinalize, incSessionStep, } from "./scope-ceiling.js";
 import { attachReminderToMessages, buildCheckpointReminder, buildScopeReminder, cadenceForSize, shouldInjectCeilingCrossing, shouldInjectReminder, shouldInjectSoftWarn, shouldPreWarnCompaction, } from "./scope-reminder.js";
 import { formatElisionManifest, getSessionExperienceCounts, recordCompaction, recordElision, } from "./session-experience.js";
@@ -101,10 +111,35 @@ import { attemptStallRescue, pushStallToolResult } from "./stall-rescue.js";
 import { createStallWatchdog, STALL_ERROR_MESSAGE, shouldContinueAfterMidLoopStall, shouldRepromptStall, stallRepromptBackoffMs, } from "./stall-watchdog.js";
 import { planSteerInjection } from "./steer-inbox.js";
 import { wrapToolSetWithCap } from "./sub-agent-cap.js";
-import { applyAnthropicPromptCaching, compactSubAgentMessages, cumulativeMessageChars } from "./subagent-compactor.js";
+import { applyAnthropicPromptCaching, applyCompactionHysteresis, compactSubAgentMessages, cumulativeMessageChars, initCompactionHysteresisState, } from "./subagent-compactor.js";
 import { detectTextEmittedToolCall, parseDsmlToolCalls } from "./text-tool-call-detector.js";
+import { getToolLimitAutoRecoverCap, shouldAutoRecoverToolLimit } from "./tool-limit-auto-recover.js";
 import { createToolLoopCapPredicate } from "./tool-loop-cap.js";
 import { buildToolRepetitionAbortMessage, recordToolError as recordToolRepetitionError, recordToolSuccess as recordToolRepetitionSuccess, } from "./tool-repetition-detector.js";
+/**
+ * Resolve the per-turn `maxOutputTokens` budget.
+ *
+ * Normally the budget is derived from the PIL-classified `taskType`
+ * (`taskTypeToMaxTokens`). But a sprint IMPLEMENTATION turn — the /ideal
+ * loop's handoff into the host orchestrator via `processMessageFn`, marked
+ * with `SPRINT_EXECUTION_MARKER` — is a KNOWN code-writing task that must not
+ * be starved by a noisy classify. Observed live (2026-07-10, gsd-core
+ * migration): the impl prompt was classified `analyze`/default → capped at
+ * 4_096 output → the model spent the whole budget narrating its plan, hit
+ * `finishReason:"length"` mid-word, produced ZERO code, and the turn wedged.
+ *
+ * Fix: for a sprint-execution turn, floor the budget at the build/generate
+ * tier (12_288) regardless of the classified type. Scoped to the marker only
+ * (NOT the broad `isImplementationIntent`) so ordinary refactor/debug turns
+ * keep their intentionally tighter L6 budgets.
+ */
+export function resolveTurnMaxOutputTokens(pilCtx) {
+    const base = taskTypeToMaxTokens(pilCtx.taskType);
+    if (isSprintPlanExecution(pilCtx.raw ?? "")) {
+        return Math.max(base, taskTypeToMaxTokens("build"));
+    }
+    return base;
+}
 /**
  * F2 — approximate the char cost of the FIXED prompt envelope (system +
  * tools JSON-Schema) that streamText re-sends on every step. Used to feed
@@ -193,6 +228,38 @@ export function rewriteSafetyApprovedToolResults(messages) {
         return changed ? { ...m, content: newContent } : m;
     });
 }
+/**
+ * Replace the `result` value of a single tool-result part (matched by
+ * toolCallId) in an AI-SDK message history, in place, preserving the
+ * tool-call/tool-result pairing. Used by the convene_council path to splice the
+ * council synthesis into the placeholder tool_result the model saw, so on the
+ * restarted step the model reads the conclusion as that tool's result. Pure +
+ * exported for unit testing. Returns the same array reference untouched when the
+ * toolCallId is absent (with a caller-visible `replaced` flag).
+ */
+export function spliceConveneToolResult(messages, toolCallId, value) {
+    if (!toolCallId)
+        return { messages, replaced: false };
+    let replaced = false;
+    const out = messages.map((m) => {
+        if (m.role !== "tool" || !Array.isArray(m.content))
+            return m;
+        let changed = false;
+        const newContent = m.content.map((part) => {
+            if (part?.type === "tool-result" && part?.toolCallId === toolCallId) {
+                changed = true;
+                replaced = true;
+                // AI SDK v6 tool-result parts carry the value under `output` (typed) or
+                // `result` (legacy). Set both so whichever the provider serializer reads
+                // sees the synthesis, and clear any error flag.
+                return { ...part, isError: false, output: value, result: value };
+            }
+            return part;
+        });
+        return changed ? { ...m, content: newContent } : m;
+    });
+    return { messages: replaced ? out : messages, replaced };
+}
 export class SimpleMutex {
     queue = Promise.resolve();
     async run(fn) {
@@ -212,9 +279,57 @@ export class SimpleMutex {
     }
 }
 import { stripDsmlMarkup } from "./message-processor.js";
+/** Tools that produce zero side-effects — safe for Q&A-only (direct-answer) mode. */
+function stripWriteTools(tools) {
+    const readonly = new Set([
+        "read_file",
+        "grep",
+        "bash_output_get",
+        "process_list",
+        "delegation_read",
+        "delegation_list",
+        "ee_query",
+        "ee_health",
+        "usage_forensics",
+        "lsp_query",
+        "setup_guide",
+        "selfverify_status",
+        "selfverify_result",
+        "selfverify_list",
+        "list_vision_cache",
+        "ee_feedback",
+        "ee_write",
+    ]);
+    const result = {};
+    for (const [name, tool] of Object.entries(tools)) {
+        if (readonly.has(name) || name.startsWith("respond_") || name.startsWith("mcp_")) {
+            result[name] = tool;
+        }
+    }
+    return result;
+}
 export async function* executeToolEngine(args) {
     let { deps, stepRouterPhase, phase2Runtime, runtime, modelInfo, _debugSteps, _ceilingHit, userMessage, pilCtx, turnModelId, turnProvider, _stepCeiling, userModelMessage, userEnrichedMessage, signal, observer, taskHash, provider, system, routerStore, attemptedOverflowRecovery, patternLoopForceHalt, userWriteAheadSeq, streamRetryCount, MAX_STREAM_RETRIES, subagents, systemParts, toolTurnSystem, playwrightGuidance, _hasResponseTools, _pilResponseTools, patternLoopInjectCount, agentLoopDecisionCount, MAX_AGENT_LOOP_DECISIONS, _naturalCeiling, _ceilingTaskType, _ceilingSize, textToolReSteerCount, MAX_TEXT_TOOL_RESTEER, turnStartMs, _debugOn, _debugTurnId, _pilEnrichmentDeltaSnapshot, isChitchat, } = args;
     // Put all extracted code here:
+    // Auto-recover budget for "cap" (tool-round ceiling) halts: compact
+    // the history and keep going instead of stopping and asking the user
+    // to /compact. Turn-scoped (not per-stream-attempt) so a stream-error
+    // retry or stall reprompt (`continue streamAttempt`) cannot reset the
+    // counter and exceed the intended cap of auto-compactions per turn
+    // (default 6, env MUONROI_TOOL_LIMIT_AUTO_RECOVER_CAP).
+    let toolLimitAutoRecoverCount = 0;
+    const TOOL_LIMIT_AUTO_RECOVER_CAP = getToolLimitAutoRecoverCap();
+    // Convene-council loop guard. The agent may convene the council at most once
+    // per turn — a second convene_council call in the SAME turn does NOT re-run a
+    // full (5-10min) council; instead its tool-result is a non-binding suggestion
+    // to USE the synthesis already above (respond, or ask_user). Turn-scoped (not
+    // per-stream-attempt) so a `continue` restart cannot reset it. Live-caught:
+    // the model looped convene→synthesis→convene, burning a second council.
+    let conveneRunsThisTurn = 0;
+    const COUNCIL_MAX_CONVENES_PER_TURN = (() => {
+        const raw = Number.parseInt(process.env.MUONROI_MAX_CONVENES_PER_TURN ?? "", 10);
+        return Number.isFinite(raw) && raw >= 1 ? raw : 1;
+    })();
     let stallTriggered = false;
     // Time-to-first-byte stall RE-PROMPT: some providers (observed:
     // xai/grok-build-0.1) accept the request then never send the first byte —
@@ -243,6 +358,10 @@ export async function* executeToolEngine(args) {
     // the turn when exceeded.  Prevents the session 526a83cf22df pattern
     // where 3 user messages burnt 82% of 2.44M tokens in 36 LLM calls.
     let llmCallsThisTurn = 0;
+    // Reactive delegation signal: reference to the top-level cap's live state so
+    // this turn's cumulative tool-output load can be reported to the Agent at
+    // turn end (drives next-turn sub-session escalation). See reactive-delegation.ts.
+    let _topLevelCapState = null;
     // Live-queue steering: messages the user typed mid-turn are drained at a
     // prepareStep boundary and accumulated here, then re-appended (deduped) to
     // the messages returned for each subsequent step. Loop-persistent so they
@@ -269,11 +388,20 @@ export async function* executeToolEngine(args) {
     // and stay productive. `plan` keeps the old behaviour (architectural
     // decisions deserve debate regardless of length).
     const autoCouncilTypes = new Set(["plan", "analyze"]);
-    const councilRoles = getRoleModels();
-    const configuredRoleCount = Object.values(councilRoles).filter(Boolean).length;
-    const heavyTier = pilCtx.complexityTier === "heavy";
+    const configuredRoleCount = getEffectiveCouncilRoleCount();
+    // Task 8 Step 7: prefer the complexity assessor's own auto-council verdict
+    // (pilCtx.gsdAutoCouncil, set at message-processor.ts:685 when the assessor ran)
+    // over the raw heavy-tier heuristic below — the assessor already reasoned about
+    // depth + task shape, so its verdict is the more intelligent router. Fall back to
+    // the heuristic when the assessor didn't run (gsdAutoCouncil undefined).
+    const assessorAutoCouncil = pilCtx.gsdAutoCouncil;
+    const heavyTier = typeof assessorAutoCouncil === "boolean"
+        ? assessorAutoCouncil
+        : pilCtx.complexityTier === "heavy";
     const autoCouncilConfidence = getAutoCouncilConfidence();
     const autoCouncilMinRoles = getAutoCouncilMinRoles();
+    const sessionModelIsReasoning = isReasoningModel(deps.modelId);
+    const skipReasoningSetting = isAutoCouncilSkipReasoning();
     const _complexityFromTrace = pilCtx._intentTrace
         ?.complexity;
     const _complexityGatePassed = pilCtx.taskType === "plan" || _complexityFromTrace === undefined || _complexityFromTrace !== "low";
@@ -281,9 +409,13 @@ export async function* executeToolEngine(args) {
         autoCouncilTypes.has(pilCtx.taskType) &&
         pilCtx.confidence >= autoCouncilConfidence &&
         _complexityGatePassed;
+    // Skip reasoning-model skip for heavy/complex tasks — they benefit from
+    // multi-role diversity even when the session model already does extended thinking.
+    const shouldSkipForReasoning = sessionModelIsReasoning && skipReasoningSetting && !heavyTier;
     const shouldAutoCouncil = !deps.councilManager.isContinuation &&
         isAutoCouncilEnabled() &&
         configuredRoleCount >= autoCouncilMinRoles &&
+        !shouldSkipForReasoning &&
         (taskTypeMatch || heavyTier);
     // Always log the auto-council decision (taken or skipped) with the gate
     // values that decided it. Lets reports answer "why did this turn cost
@@ -295,6 +427,8 @@ export async function* executeToolEngine(args) {
             return "feature-disabled";
         if (configuredRoleCount < autoCouncilMinRoles)
             return `role-count<${autoCouncilMinRoles} (have ${configuredRoleCount})`;
+        if (shouldSkipForReasoning)
+            return `reasoning-model=${deps.modelId} (internal self-debate active; skip with MUONROI_AUTOCOUNCIL_SKIP_REASONING=0)`;
         if (!taskTypeMatch && !heavyTier) {
             if (!pilCtx.taskType || !autoCouncilTypes.has(pilCtx.taskType))
                 return `taskType=${pilCtx.taskType ?? "null"} not in plan|analyze`;
@@ -322,6 +456,8 @@ export async function* executeToolEngine(args) {
             autoCouncilConfidence,
             autoCouncilMinRoles,
             heavyTier,
+            sessionModelIsReasoning,
+            skipReasoningSetting,
             isContinuation: deps.councilManager.isContinuation,
         },
     }).catch(() => undefined);
@@ -330,14 +466,40 @@ export async function* executeToolEngine(args) {
             ? `complexity=heavy${pilCtx.taskType ? ` task=${pilCtx.taskType}` : ""}`
             : `${pilCtx.taskType} task detected with ${(pilCtx.confidence * 100).toFixed(0)}% confidence`;
         yield { type: "content", content: `\n[Auto-council triggered: ${reason}]\n` };
-        yield* deps.runCouncilV2(userMessage, { skipClarification: true, observer, userModelMessage });
+        // Pre-debate interview: unless disabled, run the model-designed clarification
+        // askcards BEFORE the debate so a broadly-scoped "debate mode" request is
+        // chốt-ed first (each card's options carry a recommended default + per-option
+        // why — see runClarification/buildClarifyOptions). The clarifier is ROI-gated
+        // and yields 0 cards on already-detailed topics, so this stays quiet when the
+        // prompt is already specific. Skip only when the user turned it off. The
+        // clarifier reuses PIL gray-areas as seed questions (no hardcoded questions),
+        // and its models come from pickCouncilTaskModel (no hardcoded model/provider).
+        yield* deps.runCouncilV2(userMessage, {
+            skipClarification: !isAutoCouncilClarifyEnabled(),
+            observer,
+            userModelMessage,
+            // Suppress the CLI-hardcoded post-debate option card. The follow-up is
+            // decided by the agent's own intent via the neutral continuation below,
+            // not a fixed CLI menu. (Pre-debate clarification is orthogonal and still
+            // runs per skipClarification.)
+            convenePath: true,
+        });
         const synthesis = deps.councilManager.lastSynthesis;
+        const chosenAction = deps.councilManager.lastPostDebateAction;
         deps.councilManager.setLastSynthesis(null);
-        if (synthesis) {
+        deps.councilManager.setLastPostDebateAction(null);
+        // convenePath suppressed the hardcoded card, so there is no chosenAction to
+        // branch on. Hand the synthesis to a normal agent turn with a non-binding
+        // nudge and let the agent decide the next step (respond / ask_user /
+        // implement). Re-entry is guarded by setContinuation(true) below so
+        // shouldAutoCouncil (which checks !isContinuation) can't re-fire into a loop.
+        const { buildNeutralPostCouncilContinuation } = await import("../council/index.js");
+        const continuationPrompt = synthesis ? buildNeutralPostCouncilContinuation(synthesis) || null : null;
+        if (continuationPrompt) {
             yield { type: "content", content: "\n[Auto-continuing with council recommendations...]\n" };
             deps.councilManager.setContinuation(true);
             try {
-                yield* deps.processMessage(`Council debate completed. Synthesis:\n\n${synthesis}\n\nProceed with the recommended action items.`, observer);
+                yield* deps.processMessage(continuationPrompt, observer);
             }
             finally {
                 deps.councilManager.setContinuation(false);
@@ -345,6 +507,10 @@ export async function* executeToolEngine(args) {
         }
         return;
     }
+    // Skipping auto-council is the normal, expected path for a reasoning model —
+    // not an event the user needs narrated on every turn. The decision (and the
+    // gate values behind it) is still recorded via autoCouncilSkipReason above,
+    // so forensics keep the full story without the transcript noise.
     if (deps.batchApi) {
         try {
             yield* deps.processMessageBatchTurn({
@@ -482,14 +648,58 @@ export async function* executeToolEngine(args) {
                     cachedImageCount: listCachedImages().length,
                     priorTurnHadTools: deps.messages.some((m) => m?.role === "tool"),
                 });
+                const depthTier = pilCtx.modelDepthTier ??
+                    pilCtx.complexityTier ??
+                    "standard";
                 const baseToolsRaw = createBuiltinTools(deps.bash, deps.mode, {
                     runTask: (request, abortSignal) => deps.runTask(request, combineAbortSignals(signal, abortSignal)),
                     runDelegation: (request, abortSignal) => deps.runDelegation(request, combineAbortSignals(signal, abortSignal)),
                     readDelegation: (id) => deps.readDelegation(id),
                     listDelegations: () => deps.listDelegations(),
                     modelId: turnModelId,
+                    depthTier,
+                    sessionId: deps.session?.id,
                     includeVisionTools,
                     consultParentSession: deps.consultParentSession,
+                    // Register convene_council only when the council is actually usable
+                    // for this session (enough configured roles) — else the model could
+                    // call a council that can't convene.
+                    councilConfigured: configuredRoleCount >= autoCouncilMinRoles,
+                    askUser: deps.askUser,
+                    runDebate: async (topic) => {
+                        // Reset before draining so a generator that throws BEFORE setting
+                        // synthesis (orchestrator.setLastSynthesis) cannot return a STALE
+                        // synthesis from a prior council run.
+                        deps.councilManager.setLastSynthesis(null);
+                        const gen = deps.runCouncilV2(topic, {
+                            skipClarification: true,
+                            userModelMessage: { role: "user", content: `/council ${topic}` },
+                            // Model-callable debate: the synthesis is returned to the model as
+                            // the tool result and the model decides the follow-up — so suppress
+                            // the CLI-hardcoded post-debate card, same as convene_council.
+                            convenePath: true,
+                        });
+                        // Capture a tail of content chunks so an empty-synthesis failure
+                        // (provider unreachable / sub-phase fail-open / abort — all of which
+                        // yield a content hint then `return null`) surfaces a real reason in
+                        // the log instead of a silent "".
+                        let lastContentHint = "";
+                        for await (const chunk of gen) {
+                            const text = chunk?.content;
+                            if (chunk?.type === "content" && typeof text === "string" && text.trim()) {
+                                lastContentHint = text.trim().slice(-200);
+                            }
+                        }
+                        const synthesis = deps.councilManager.lastSynthesis ?? "";
+                        if (!synthesis.trim()) {
+                            // No-Silent-Catch: the debate produced no synthesis. plan-council
+                            // will retry then fall back to the perspective path — log why here
+                            // so the failure is diagnosable remotely.
+                            console.error(`[tool-engine] plan-review runDebate returned empty synthesis` +
+                                `${lastContentHint ? ` (last council chunk: ${lastContentHint})` : ""}`);
+                        }
+                        return synthesis;
+                    },
                 });
                 // Top-level cumulative cap state. We accumulate the raw tool set
                 // (base + MCP + PIL response tools) across the assembly below,
@@ -513,16 +723,23 @@ export async function* executeToolEngine(args) {
                 // history) is preserved.
                 const turnCaps = getProviderCapabilities(requireRuntimeProvider(runtime));
                 const _priorTurnHadTools = deps.messages.some((m) => m?.role === "tool");
+                // Direct-answer mode: purely informational Q&A (no code changes).
+                // Strip write tools (bash, edit_file, write_file) AND skip MCP;
+                // only readonly tools remain (read_file, grep, ee_query, etc.).
+                const isDirectAnswer = pilCtx.directAnswer === true;
                 let rawToolSet = !turnCaps.supportsClientTools(runtime.modelInfo)
                     ? {}
                     : isChitchat && !_priorTurnHadTools
                         ? {}
-                        : baseToolsRaw;
-                // MCP skip: chitchat / greeting inputs don't need 7 MCP servers'
+                        : isDirectAnswer && !_priorTurnHadTools
+                            ? stripWriteTools(baseToolsRaw)
+                            : baseToolsRaw;
+                // MCP skip: chitchat / direct-answer / greeting inputs don't need 7 MCP servers'
                 // worth of tool schemas (~20K input tokens). PIL Layer 1 already
                 // gates this conservatively (≤10 chars + ≤2 words OR brain "none").
                 if (deps.mode === "agent" &&
                     (!isChitchat || _priorTurnHadTools) &&
+                    !isDirectAnswer &&
                     turnCaps.supportsClientTools(runtime.modelInfo)) {
                     // Smart MCP filter: drop OPTIONAL MCP servers whose category the
                     // current message gives no signal for. Browser/vision servers
@@ -629,11 +846,14 @@ export async function* executeToolEngine(args) {
                 // Apply the top-level cumulative cap once over the fully-assembled
                 // raw tool set. State is per-turn; each turn gets a fresh budget.
                 const topLevelCap = wrapToolSetWithCap(rawToolSet, {
-                    maxCumulativeChars: getTopLevelToolBudgetChars(deps.maxToolRounds),
+                    maxCumulativeChars: getTopLevelToolBudgetChars(deps.maxToolRounds, contextWindow),
                     midTierRatio: 0.5,
                     highTierRatio: 0.8,
                     label: "top-level",
                 });
+                // Expose the cap state so the reactive-delegation signal can read this
+                // turn's cumulative tool load at turn end (see report at success exit).
+                _topLevelCapState = topLevelCap.state;
                 // Phase C3: layer cross-turn dedup on top of the top-level cap.
                 const tools = wrapToolSetWithReadBudget(wrapToolSetWithDedup(topLevelCap.tools, deps.crossTurnDedup), deps.readBudget);
                 // Wrap non-read-only tools in a turn-scoped mutex to prevent race conditions during parallel execution.
@@ -654,18 +874,56 @@ export async function* executeToolEngine(args) {
                     "selfverify_result",
                     "selfverify_list",
                     "list_vision_cache",
+                    "ee_feedback",
+                    "ee_write",
                 ]);
+                /**
+                 * Tools that perform mutations (writes, edits, side-effects).
+                 * MUTATION_TOOLS are read from this set to route them through the mutation
+                 * gate and prevent accidental execution when GSD hard gate is active.
+                 * Registration: add the tool name string to this set and ensure the tool
+                 * itself is wired in the tool assembly step.
+                 */
+                const MUTATION_TOOLS = new Set(["lsp_mutation_preview"]);
+                // Task 8: native GSD mutation gate. Read once per turn (not per call) since
+                // hardGateEnabled/directAnswer don't change mid-turn; the gate itself
+                // re-reads STATE.md per call (cheap fs read) so it stays live if the
+                // model advances phase/verdict mid-turn via gsd_* tools.
+                const gsdHardGateEnabled = isGsdHardGateEnabled();
+                const gsdDirectAnswer = pilCtx.directAnswer;
                 for (const name of Object.keys(tools)) {
                     const tool = tools[name];
-                    if (tool &&
-                        typeof tool.execute === "function" &&
-                        !READ_ONLY_TOOLS.has(name) &&
-                        !name.startsWith("respond_")) {
-                        const originalExecute = tool.execute;
-                        tool.execute = async (input, context) => {
-                            return writeMutex.run(() => originalExecute(input, context));
-                        };
-                    }
+                    if (!tool || typeof tool.execute !== "function")
+                        continue;
+                    const originalExecute = tool.execute;
+                    // Read-only tools skip the mutation gate and the write mutex, but ALL
+                    // tools get a breadcrumb: a freeze can start under any of them, and a
+                    // block report that cannot name a suspect is much weaker evidence.
+                    const guarded = !READ_ONLY_TOOLS.has(name) && !name.startsWith("respond_");
+                    tool.execute = async (input, context) => {
+                        // Never cleared, only overwritten — a block often starts just AFTER
+                        // a tool returns (the 2026-07-16 freeze began on the tick after a
+                        // bash result), so "after:bash" is exactly the clue we want. Also
+                        // why this is not a stack: with parallel tool calls, last-writer-
+                        // wins is the honest summary; the CPU profile is the real evidence.
+                        setLoopBreadcrumb(`tool:${name}`);
+                        try {
+                            if (!guarded)
+                                return await originalExecute(input, context);
+                            const gate = evaluateMutationGate(deps.bash.getCwd(), {
+                                toolName: name,
+                                hardGateEnabled: gsdHardGateEnabled,
+                                directAnswer: gsdDirectAnswer,
+                            });
+                            if (gate.blocked) {
+                                return { success: false, output: gate.reason, error: gate.reason };
+                            }
+                            return await writeMutex.run(() => originalExecute(input, context));
+                        }
+                        finally {
+                            setLoopBreadcrumb(`after-tool:${name}`);
+                        }
+                    };
                 }
                 captureToolSchemas(tools);
                 let responseToolCalled = false;
@@ -761,7 +1019,40 @@ export async function* executeToolEngine(args) {
                 // (non-cached) system message via the slice below.
                 const mcpCapabilityBlock = buildMcpCapabilityBlock(Object.keys(tools));
                 const systemWithCaps = mcpCapabilityBlock ? `${systemWithShell}${mcpCapabilityBlock}` : systemWithShell;
-                const systemForModel = runtime.modelId.startsWith("claude")
+                // Task 3 — non-Claude prompt-cache prefix stability. On non-Claude the
+                // system is a single string; per-turn-dynamic content (dynamicSuffix +
+                // PIL suffix + MCP roster) that sits AFTER the byte-stable staticPrefix
+                // but BEFORE the conversation shifts the cached prefix and nukes the
+                // cache on PIL-active turns (session 47a774d272da: pil_active=1 ⟺
+                // cache_read=0). We keep the front byte-stable and relocate the dynamic
+                // tail into the trailing user message (variant b) — NOT a mid-conversation
+                // system-role message, which OpenAI-compatible providers (DeepSeek/GLM)
+                // do not reliably accept. Claude keeps its untouched two-block split.
+                const _isClaudeModel = runtime.modelId.startsWith("claude");
+                const { front: _nonClaudeFront, dynamicTail: _nonClaudeDynamicTail } = _isClaudeModel
+                    ? { front: systemWithCaps, dynamicTail: "" }
+                    : splitFrontAndDynamicTail({
+                        modelId: runtime.modelId,
+                        systemWithCaps,
+                        staticPrefix: systemParts.staticPrefix,
+                    });
+                // Only relocate when the enriched user message is actually present to
+                // receive the tail; otherwise fall back to the original single string so
+                // no instruction content is dropped.
+                const _willFoldDynamicTail = !_isClaudeModel &&
+                    _nonClaudeDynamicTail.trim().length > 0 &&
+                    deps.messages.includes(userModelMessage);
+                if (process.env.MUONROI_DEBUG_CACHE_PREFIX === "1") {
+                    try {
+                        console.error(`[cache-prefix] model=${runtime.modelId} staticPrefixLen=${systemParts.staticPrefix.length} ` +
+                            `frontLen=${_nonClaudeFront.length} dynTailLen=${_nonClaudeDynamicTail.length} ` +
+                            `fold=${_willFoldDynamicTail} msgCount=${deps.messages.length}`);
+                    }
+                    catch (err) {
+                        console.error(`[cache-prefix] log failed: ${err?.message}`);
+                    }
+                }
+                const systemForModel = _isClaudeModel
                     ? [
                         {
                             role: "system",
@@ -773,7 +1064,9 @@ export async function* executeToolEngine(args) {
                             content: systemWithCaps.slice(systemParts.staticPrefix.length),
                         },
                     ]
-                    : systemWithCaps;
+                    : _willFoldDynamicTail
+                        ? _nonClaudeFront
+                        : systemWithCaps;
                 // Capture prompt-size breakdown so recordUsage can attach it to the
                 // cost-log entry. Without this, "system prompt is huge" is unfalsifiable.
                 // chars/4 ≈ tokens for English; reported as chars to keep math obvious.
@@ -837,13 +1130,27 @@ export async function* executeToolEngine(args) {
                 // stubs. Symmetric to the B3 sub-agent path; reuses the same module
                 // with `label: "top-level"` so the stub text reflects which loop
                 // elided the content.
-                const topLevelCompactThreshold = getTopLevelCompactThresholdChars();
-                const topLevelCompactKeepLast = getTopLevelCompactKeepLast();
+                const topLevelCompactThreshold = getTopLevelCompactThresholdChars(contextWindow);
+                const topLevelCompactKeepLast = getTopLevelCompactKeepLast(contextWindow);
+                // O2 — byte budget for the verbatim tail; shrinks keepLast on read-heavy
+                // turns that stay large at low fill (the 60-80k-per-call bucket).
+                const topLevelCompactTailBudget = getTopLevelCompactTailBudgetChars(contextWindow);
+                // O3 — compaction hysteresis state (per-turn; this scope runs once per
+                // streamText turn). Once we compact, freeze the compacted prefix and
+                // only append new messages until size grows past the hysteresis ceiling,
+                // so the provider prompt-cache prefix stays byte-stable across steps
+                // instead of breaking every step as the keepLast boundary slides.
+                const compactHysteresis = getTopLevelCompactHysteresis();
+                let hysteresisState = initCompactionHysteresisState();
                 // Phase O1 — capture providerOptions SHAPE (types only) for forensics.
                 deps.setLastProviderOptionsShape(Object.keys(providerOpts).length > 0 ? extractProviderOptionsShape(providerOpts) : null);
                 // Substitute the enriched user message for the current turn so the LLM sees PIL additions,
                 // while leaving the DB-persisted `deps.messages` clean for future turns.
-                const _messagesForCall = deps.messages.map((m) => m === userModelMessage ? userEnrichedMessage : m);
+                const _messagesForCall = deps.messages.map((m) => m === userModelMessage
+                    ? _willFoldDynamicTail
+                        ? foldDynamicTailIntoUserMessage(userEnrichedMessage, _nonClaudeDynamicTail)
+                        : userEnrichedMessage
+                    : m);
                 if (wireDebug.enabled) {
                     wireDebug.logRequest({
                         providerId: runtime.modelInfo?.provider ?? "unknown",
@@ -865,6 +1172,37 @@ export async function* executeToolEngine(args) {
                 const _baseDynamicStopWhen = createToolLoopCapPredicate({
                     initialCap: deps.maxToolRounds,
                     ask: async (info) => {
+                        // Auto-recover a "cap" (tool-round ceiling) halt: compact the history and keep
+                        // going, instead of stopping and telling the user to /compact
+                        // (prompts.ts). Capped so a runaway turn still terminates;
+                        // pattern-loop halts are excluded (agent is stuck).
+                        if (shouldAutoRecoverToolLimit(info, toolLimitAutoRecoverCount, TOOL_LIMIT_AUTO_RECOVER_CAP)) {
+                            toolLimitAutoRecoverCount++;
+                            try {
+                                const _cw = runtime.modelInfo?.contextWindow ?? 0;
+                                if (_cw > 0) {
+                                    await deps.compactForContext(provider, system, _cw, signal, deps.getCompactionSettings(_cw), false);
+                                    // A compacted round resets context to O(N) input (cheap), so the
+                                    // hard-cap's cost-runaway purpose is served — grant the turn more
+                                    // headroom instead of letting the 1.5× hard ceiling strand a
+                                    // genuinely productive long task. Bounded inside the Agent.
+                                    deps.extendHardCeilingForAutoCompaction?.();
+                                }
+                            }
+                            catch (err) {
+                                logger.error("orchestrator", "tool-limit auto-recover compaction failed", {
+                                    message: err instanceof Error ? err.message : String(err),
+                                });
+                            }
+                            const _ar2 = globalThis.__muonroiAgentRuntime;
+                            _ar2?.emitEvent({
+                                t: "event",
+                                kind: "toast",
+                                level: "info",
+                                text: `đạt giới hạn bước — đã tự nén ngữ cảnh và tiếp tục (lần ${toolLimitAutoRecoverCount}/${TOOL_LIMIT_AUTO_RECOVER_CAP})`,
+                            });
+                            return "continue";
+                        }
                         if (info.kind === "pattern") {
                             if (patternLoopInjectCount < 1) {
                                 patternLoopInjectCount++;
@@ -987,6 +1325,14 @@ export async function* executeToolEngine(args) {
                         _hardCapHit = true;
                         return true;
                     }
+                    // convene_council fast-path: if the model queued a council convening
+                    // during this step, STOP now so the outer loop runs the council and
+                    // splices the synthesis BEFORE the model consumes the placeholder
+                    // tool_result. This is a fast-path only — the authoritative
+                    // consumption is the outer-loop check after the stream drains (a
+                    // phase-1 SAMR step ends on stepCountIs(1) and never reaches here).
+                    if (hasPendingCouncilConvene())
+                        return true;
                     // Terminal response tool: a `respond_*` call IS the model's final
                     // structured answer (its `execute` is identity — the payload lives
                     // in the tool-call args). `shouldHaltOnResponseTool` decides if the
@@ -1081,9 +1427,27 @@ export async function* executeToolEngine(args) {
                 // on every chunk via stall.pet(), so it never kills an actively
                 // streaming call. Disposed when the stream ends or errors.
                 stallTriggered = false;
+                // Second timer (progressTimeoutMs) is the no-forward-progress guard.
+                // stall.pet() re-arms the any-activity timer on EVERY chunk — including
+                // a reasoning model's reasoning-delta — so an endless chain-of-thought
+                // keeps it alive and it never fires (observed live 2026-07-10: a
+                // deepseek-v4-flash sub-SESSION churned reasoning 30+ min, 1.4M input
+                // tokens, ZERO text/tool output; the 2-min stall watchdog never tripped).
+                // The progress timer is reset ONLY by stall.petProgress() on real output
+                // (text-delta / tool-call), aborting a runaway-reasoning loop while a
+                // legitimately long reasoning burst that DOES emit output survives.
                 const stall = createStallWatchdog(getProviderStallTimeoutMs(), () => {
                     stallTriggered = true;
-                });
+                }, {
+                    progressTimeoutMs: getProviderProgressTimeoutMs(),
+                    onProgressFire: () => {
+                        stallTriggered = true;
+                        console.error(`[tool-engine] stream aborted: no text/tool output for ${getProviderProgressTimeoutMs()}ms ` +
+                            `(runaway reasoning / no forward progress) model=${runtime.modelId}`);
+                    },
+                }, 
+                // Hold the stream open while a blocking `ask_user` card awaits a human.
+                isInteractivePaused);
                 // F3c — hard-cap LLM calls per turn before this streamText()
                 if (++llmCallsThisTurn > MAX_LLM_CALLS_PER_TURN) {
                     stall.dispose();
@@ -1260,10 +1624,17 @@ export async function* executeToolEngine(args) {
                         };
                         // T1.1 + T1.2 — reasoning models (DeepSeek V4 Flash, R1) emit 2K-5K
                         // CoT tokens per turn that accumulate across the multi-step loop.
-                        // Strip old reasoning and compact earlier (ratio 0.3 vs 0.5) to
-                        // cut ~40-60% of cumulative input tokens.
+                        // Strip old reasoning and compact earlier to cut cumulative input.
+                        // Small-context reasoning models (< 100K) use ratio 0.2 (fire at
+                        // 20% fill) because their per-step overhead (system + tools + CoT)
+                        // already consumes ~30-40% of the window, leaving little headroom.
                         const isReasoningModel = runtime.modelInfo?.reasoning === true;
-                        const compacted = compactSubAgentMessages(stripped, {
+                        const reasoningFillRatio = isReasoningModel
+                            ? contextWindowTokens > 0 && contextWindowTokens < 100_000
+                                ? 0.2
+                                : 0.3
+                            : undefined;
+                        const runCompaction = () => compactSubAgentMessages(stripped, {
                             thresholdChars: topLevelCompactThreshold,
                             // Rec #1 (cheap part): on meta/self-eval turns keep a couple more
                             // trailing tool turns verbatim — those carry the reasoning the
@@ -1274,28 +1645,120 @@ export async function* executeToolEngine(args) {
                             label: "top-level",
                             envelopeChars,
                             contextWindowTokens,
-                            contextFillRatio: isReasoningModel ? 0.3 : undefined,
+                            contextFillRatio: reasoningFillRatio,
                             keepToolIds: keepToolIds.length ? keepToolIds : undefined,
                             persistArtifact,
                             stripOldReasoning: isReasoningModel,
+                            tailBudgetChars: topLevelCompactTailBudget,
                         });
-                        if (compacted !== stripped)
-                            recordCompaction(sn);
+                        // O3 — compaction hysteresis (holds the frozen compacted prefix
+                        // between compactions so the provider prompt-cache prefix stays
+                        // byte-stable across steps instead of breaking as the keepLast
+                        // boundary slides). See applyCompactionHysteresis.
+                        const currChars = cumulativeMessageChars(stripped) + envelopeChars;
+                        // Proactive compaction (agent called the `compact` tool). Consume the
+                        // one-shot request and FORCE a compaction this step, bypassing the
+                        // hysteresis threshold — the agent explicitly asked to shed context,
+                        // so a one-time cache-prefix break is the intended trade. Re-seed the
+                        // hysteresis state to the fresh compacted prefix so the following
+                        // steps hold it steady (no per-step churn) until it grows again.
+                        const _proactiveCompact = consumeProactiveCompact();
+                        let compacted;
+                        if (_proactiveCompact) {
+                            const _forced = runCompaction();
+                            const _didForce = _forced !== stripped;
+                            compacted = _forced;
+                            hysteresisState = _didForce
+                                ? { frozenCompacted: _forced, frozenStrippedLen: stripped.length, lastCompactTriggerChars: currChars }
+                                : hysteresisState;
+                            if (_didForce)
+                                recordCompaction(sn);
+                            try {
+                                const _arPc = globalThis.__muonroiAgentRuntime;
+                                _arPc?.emitEvent({
+                                    t: "event",
+                                    kind: "toast",
+                                    level: "info",
+                                    text: _didForce
+                                        ? "đã nén ngữ cảnh theo yêu cầu của agent — tiếp tục tác vụ"
+                                        : "agent yêu cầu nén nhưng chưa có gì để nén — tiếp tục",
+                                });
+                            }
+                            catch {
+                                /* toast best-effort */
+                            }
+                        }
+                        else {
+                            const _hyst = applyCompactionHysteresis({
+                                stripped,
+                                currChars,
+                                hysteresis: compactHysteresis,
+                                state: hysteresisState,
+                                runCompaction,
+                            });
+                            compacted = _hyst.compacted;
+                            hysteresisState = _hyst.state;
+                            // Count only ACTUAL (re)compactions, not held-boundary steps — the
+                            // compaction counter drives the cache-churn telemetry this fixes.
+                            if (_hyst.didRecompact)
+                                recordCompaction(sn);
+                        }
+                        const coalesced = coalesceReadOnlyMessages(compacted);
+                        // (recordCompaction already handled per-branch above.)
                         // Pre-compaction visibility: give the agent one step of notice
                         // before B4 actually rewrites history into stubs. This is the
                         // advance warning that was missing — agent can now decide to
                         // summarize, finish, or request preservation. Fires when we did
                         // NOT compact this step (compacted === stripped, restored by the
-                        // compactSubAgentMessages no-op ref contract) AND the prompt is
-                        // approaching the threshold. Must compare CHARS (messages +
-                        // envelope), not stripped.length (a message count that never
-                        // exceeds a char-scaled threshold) — session 2b7a10219499.
                         const _preWarnChars = cumulativeMessageChars(stripped) + envelopeChars;
-                        if (compacted === stripped && shouldPreWarnCompaction(_preWarnChars, topLevelCompactThreshold)) {
+                        if (coalesced === stripped && shouldPreWarnCompaction(_preWarnChars, topLevelCompactThreshold)) {
                             const _cp = buildCheckpointReminder(sn, true);
                             const _pre = `[pre-compaction warning at step ${sn} — next step(s) will likely rewrite older tool results to stubs (threshold ${topLevelCompactThreshold}, keepLast=${topLevelCompactKeepLast}). ${_cp} Summarize or finish if possible, or warn the user they can run the "/compact" command if they want a clean compressed history.]`;
                             return withSteers({ messages: attachReminderToMessages(stripped, _pre) });
                         }
+                        // ---- Read-only tool batching interceptor ----
+                        // The system prompt already instructs batching (BATCH ALL TOOL
+                        // CALLS — HARD RULE), but models like DeepSeek frequently ignore
+                        // it and emit 1 read-only call per step. This injects a concrete,
+                        // in-context reminder right before the next LLM call when the
+                        // previous step had ≤2 all-read-only tool calls. Cost: ~0 extra
+                        // context. Effect: reduces tool rounds 2-3x on the same work.
+                        if (sn >= 1) {
+                            let _lastAsst = null;
+                            for (let _i = stepMessages.length - 1; _i >= 0; _i--) {
+                                if (stepMessages[_i].role === "assistant") {
+                                    _lastAsst = stepMessages[_i];
+                                    break;
+                                }
+                            }
+                            if (_lastAsst && Array.isArray(_lastAsst.content)) {
+                                let _total = 0, _ro = 0;
+                                for (const _p of _lastAsst.content) {
+                                    if (_p.type === "tool-call") {
+                                        _total++;
+                                        if (READ_ONLY_TOOLS.has(_p.toolName))
+                                            _ro++;
+                                    }
+                                }
+                                if (_total > 0 && _ro === _total && _total <= 2) {
+                                    // Prefer the SINGLE-CALL multi-path form (read_file file_paths=[…])
+                                    // over "parallel tool_calls": a batch of parallel tool_calls is
+                                    // reshaped into sequential single-call turns for the kimi/glm/
+                                    // deepseek-go cohort (splitParallelToolCalls) — which re-inflates
+                                    // history and defeats the batching win. One read_file carrying N
+                                    // paths is ONE tool_call → never split → the token cut holds on
+                                    // every provider.
+                                    const _b = `[Tool batching: you called ${_total} read-only tool(s) one-at-a-time — each extra call re-sends the whole conversation, so N single reads cost O(N²) tokens. To read MULTIPLE files, call read_file ONCE with file_paths=["a","b","c"] — a SINGLE tool_call that no provider splits. For other read-only tools (grep, bash_output_get), emit all pending calls in ONE assistant turn. Do NOT sequence reads across steps.]`;
+                                    // Attach to `coalesced` (the B4-compacted history), NOT `stripped`:
+                                    // read-only tools (read_file/grep/…) are exactly what triggers this
+                                    // reminder, and returning `stripped` here silently discarded the
+                                    // compaction computed above — so on any loop where the model emits
+                                    // ≤2 read-only calls per step (DeepSeek does this constantly) older
+                                    // tool results were never elided and cumulative input grew unbounded.
+                                    return withSteers({ messages: attachReminderToMessages(coalesced, _b) });
+                                }
+                            }
+                        }
                         // Phase 4A — scope reminder injection (REQ-005).
                         // Cadence K = 3/5/8 for small/medium/large. Soft-warn fires
                         // ONCE per session at floor(ceiling*0.7). Reminder lives in
@@ -1355,10 +1818,10 @@ export async function* executeToolEngine(args) {
                                     ? `${buildRepetitionReminder(_ceilingSessionId)}\n${_scopePart}`
                                     : buildRepetitionReminder(_ceilingSessionId)
                                 : _scopePart;
-                            const withReminder = attachReminderToMessages(compacted, _reminder);
+                            const withReminder = attachReminderToMessages(coalesced, _reminder);
                             return withSteers({ messages: withReminder });
                         }
-                        if (compacted === stripped && stripped === stepMessages)
+                        if (coalesced === stripped && stripped === stepMessages)
                             return withSteers({});
                         // Self-awareness note: tell the model compaction happened so it
                         // knows earlier context was elided and can adjust its behavior.
@@ -1377,12 +1840,12 @@ export async function* executeToolEngine(args) {
                             })()
                             : null;
                         if (_compactNote) {
-                            return withSteers({ messages: attachReminderToMessages(compacted, _compactNote) });
+                            return withSteers({ messages: attachReminderToMessages(coalesced, _compactNote) });
                         }
-                        return withSteers({ messages: compacted });
+                        return withSteers({ messages: coalesced });
                     },
-                    ...(dropParam("temperature") ? {} : { temperature: 0.7 }),
-                    ...(dropParam("maxOutputTokens") ? {} : { maxOutputTokens: taskTypeToMaxTokens(pilCtx.taskType) }),
+                    ...resolveTemperatureParam(runtime, 0.7),
+                    ...(dropParam("maxOutputTokens") ? {} : { maxOutputTokens: resolveTurnMaxOutputTokens(pilCtx) }),
                     ...(Object.keys(providerOpts).length > 0 ? { providerOptions: providerOpts } : {}),
                     experimental_onStepStart: (event) => {
                         stepNumber = getStepNumber(event, stepNumber + 1);
@@ -1401,6 +1864,10 @@ export async function* executeToolEngine(args) {
                             finishReason: getFinishReason(event),
                             usage: stepUsage,
                         });
+                        // Pull any completed background delegations so their results can be
+                        // injected (as system messages) for the *next* LLM step in this same turn.
+                        // This improves "self wake" for background jobs without waiting for a new user turn.
+                        void deps.consumeBackgroundNotifications?.().catch(() => { });
                         // Realtime status bar update per step
                         if (stepUsage.inputTokens || stepUsage.outputTokens) {
                             // O1 — thread THIS turn's providerOptions shape per step so every
@@ -1451,6 +1918,9 @@ export async function* executeToolEngine(args) {
                 const _wireProviderIdTop = runtime.modelInfo?.provider ?? "unknown";
                 for await (const part of result.fullStream) {
                     stall.pet(); // chunk arrived — reset the stall watchdog
+                    // Breadcrumb the chunk type: if the loop blocks while draining the
+                    // stream, this says which part kind we were handling when it froze.
+                    setLoopBreadcrumb(`stream:${String(part.type ?? "unknown")}`);
                     // Count only real content parts. The watchdog abort itself surfaces
                     // as an "abort" part — counting it would defeat the TTFB-stall gate
                     // (a frozen-before-first-byte stall yields ONLY the abort part).
@@ -1475,8 +1945,23 @@ export async function* executeToolEngine(args) {
                             wireDebug.logError(_wireProviderIdTop, part.error);
                         }
                     }
+                    // Terminal part of the ENTIRE multi-step turn (AI SDK v6 emits exactly
+                    // one `finish` after every step's `finish-step`; it carries the final
+                    // finishReason/totalUsage). onFinish has already run by now (usage
+                    // recorded + llm-done emitted, and result.response is resolved), so
+                    // there is nothing left to drain. Some providers — observed live:
+                    // xai/grok-composer-2.5-fast — emit `finish` but then never CLOSE the
+                    // fullStream async iterator, so `for await` would block on the next
+                    // `.next()` until the turn watchdog fires (up to MUONROI_TURN_IDLE_MS).
+                    // Breaking on `finish` finalizes the turn immediately instead. Safe:
+                    // `finish` is strictly last, so this can never truncate a multi-step
+                    // turn (per-step boundaries are `finish-step`, handled by fall-through).
+                    if (part.type === "finish") {
+                        break;
+                    }
                     switch (part.type) {
                         case "text-delta":
+                            stall.petProgress(); // real forward progress — reset the no-progress guard
                             assistantText += part.text;
                             // Task 2.6b — emit llm-token (agent-mode only; high-volume, default-off per Phase 4).
                             try {
@@ -1508,6 +1993,7 @@ export async function* executeToolEngine(args) {
                             yield { type: "reasoning", content: part.text };
                             break;
                         case "tool-call": {
+                            stall.petProgress(); // real forward progress — reset the no-progress guard
                             const tc = toToolCall(part);
                             activeToolCalls.push(tc);
                             // SAMR: track that Phase 1 produced tool calls → transition to Phase 2
@@ -1728,10 +2214,10 @@ export async function* executeToolEngine(args) {
                             // the global __muonroiSafetyApproved map so registry.ts's
                             // bash.execute bypasses the block on the retry.
                             const _outputText = [tr.output, tr.error].filter((x) => typeof x === "string").join("\n");
-                            const _blockMatch = _outputText.match(/^BLOCKED \(([^)]+)\):\s*(.*)/);
-                            if (_blockMatch && part.toolName === "bash") {
-                                const _blockKind = _blockMatch[1];
-                                const _blockReason = _blockMatch[2];
+                            const _parsedBlock = parseSafetyBlock(_outputText);
+                            if (_parsedBlock && part.toolName === "bash") {
+                                const _blockKind = _parsedBlock.kind;
+                                const _blockReason = _parsedBlock.reason;
                                 const _command = typeof part.input === "object" && part.input != null
                                     ? String(part.input.command ?? "")
                                     : "";
@@ -1744,15 +2230,33 @@ export async function* executeToolEngine(args) {
                                     tr = { ...tr, success: false, error: _outputText, output: _outputText };
                                 }
                                 else {
-                                    const _verdict = deps.askSafetyOverride
-                                        ? await deps.askSafetyOverride({
-                                            kind: _blockKind,
-                                            toolName: part.toolName,
-                                            blockedItem: _command,
-                                            reason: _blockReason,
-                                            source: "bash.execute",
-                                        })
-                                        : { action: "block" };
+                                    // yolo mode auto-approves lower-severity blocks (git-safety /
+                                    // dangerous) so "don't ask me" actually stops asking — but a
+                                    // catastrophic, irreversible command STILL shows the askcard,
+                                    // even in yolo. Everything else surfaces the interactive
+                                    // safety-override card via deps.askSafetyOverride (registered
+                                    // by the TUI); when no handler is wired (headless / batch),
+                                    // that resolves to { action: "block" }, preserving the
+                                    // backward-compatible hard-stop for non-interactive runs.
+                                    let _verdict;
+                                    if (shouldAutoAllowYolo(_blockKind, deps.permissionMode)) {
+                                        _verdict = { action: "allow-once" };
+                                        yield {
+                                            type: "content",
+                                            content: `[yolo: auto-approved blocked command: ${_blockKind}]\n`,
+                                        };
+                                    }
+                                    else {
+                                        _verdict = deps.askSafetyOverride
+                                            ? await deps.askSafetyOverride({
+                                                kind: _blockKind,
+                                                toolName: part.toolName,
+                                                blockedItem: _command,
+                                                reason: _blockReason,
+                                                source: "bash.execute",
+                                            })
+                                            : { action: "block" };
+                                    }
                                     if (_verdict.action === "allow-once" || _verdict.action === "allow-session") {
                                         // Store approval so registry.ts can bypass the block on retry.
                                         const _globalSafety = globalThis;
@@ -1886,10 +2390,26 @@ export async function* executeToolEngine(args) {
                             // dedicated chunk so the sticky checklist panel can re-render
                             // without parsing tool args itself. Skipped when the snapshot
                             // doesn't parse (malformed args) so the UI is never poisoned.
-                            if (tc.function.name === "todo_write" && tr.success) {
-                                const snap = snapshotFromTodoWriteArgs(tc.function.arguments);
-                                if (snap)
-                                    yield { type: "task_list_update", taskListSnapshot: snap };
+                            if (tr.success && (tc.function.name === "todo_write" || tc.function.name.startsWith("gsd_"))) {
+                                try {
+                                    const { getTaskListSnapshotFromGsd } = require("../gsd/phase-sync.js");
+                                    const snap = getTaskListSnapshotFromGsd(deps.bash.getCwd());
+                                    if (snap) {
+                                        yield { type: "task_list_update", taskListSnapshot: snap };
+                                    }
+                                    else if (tc.function.name === "todo_write") {
+                                        const snapLegacy = snapshotFromTodoWriteArgs(tc.function.arguments);
+                                        if (snapLegacy)
+                                            yield { type: "task_list_update", taskListSnapshot: snapLegacy };
+                                    }
+                                }
+                                catch (err) {
+                                    if (tc.function.name === "todo_write") {
+                                        const snapLegacy = snapshotFromTodoWriteArgs(tc.function.arguments);
+                                        if (snapLegacy)
+                                            yield { type: "task_list_update", taskListSnapshot: snapLegacy };
+                                    }
+                                }
                             }
                             break;
                         }
@@ -2454,6 +2974,109 @@ export async function* executeToolEngine(args) {
                     }
                 }
                 stall.dispose(); // stream drained normally — stop the stall watchdog
+                // ─── convene_council consumption ───────────────────────────────
+                // The convene_council tool queued a request during THIS step's execute().
+                // Consume it here in the OUTER loop after every stream drain — NOT solely
+                // via dynamicStopWhen, because a phase-1 SAMR step ends on stepCountIs(1)
+                // and never evaluates the stop hook (design-debate BUG 2). Runs the
+                // council autonomously (convenePath suppresses ALL post-debate decision
+                // surface — no card, no continuation), splices the synthesis into the
+                // convene tool_result, grafts into deps.messages, and restarts the step
+                // so the model reads the conclusion as the tool result and continues.
+                if (hasPendingCouncilConvene()) {
+                    if (responseToolCalled) {
+                        // The same step also emitted a terminal respond_* answer — the model
+                        // is done; discard the convene request rather than override the
+                        // answer (design-debate BUG 1: never let the flag leak across turns).
+                        consumeCouncilConvene();
+                        logger.warn("orchestrator", "convene: discarded — step also emitted a terminal response tool");
+                    }
+                    else {
+                        const pendingId = peekCouncilConveneToolCallId();
+                        let conveneResponse = null;
+                        try {
+                            conveneResponse = await result.response;
+                        }
+                        catch (err) {
+                            logger.error("orchestrator", "convene: failed to read response.messages", {
+                                error: err?.message,
+                            });
+                        }
+                        // BUG 3 guard: only run council when the pending convene toolCallId is
+                        // a recorded tool-result in THIS drain's messages — else a nested
+                        // frame's convene call would be wrongly consumed by this loop.
+                        const belongsHere = !!conveneResponse &&
+                            !!pendingId &&
+                            conveneResponse.messages.some((m) => m?.role === "tool" &&
+                                Array.isArray(m.content) &&
+                                m.content.some((p) => p?.type === "tool-result" && p?.toolCallId === pendingId));
+                        if (belongsHere && conveneResponse) {
+                            const req = consumeCouncilConvene();
+                            // Loop guard: a second convene in the SAME turn short-circuits —
+                            // do NOT pay for another council. Splice a non-binding suggestion
+                            // pointing the model at the synthesis already in the transcript so
+                            // it responds (or asks the user) instead of re-convening forever.
+                            if (conveneRunsThisTurn >= COUNCIL_MAX_CONVENES_PER_TURN) {
+                                logger.warn("orchestrator", "convene: loop guard hit — suppressing re-convene", {
+                                    conveneRunsThisTurn,
+                                    cap: COUNCIL_MAX_CONVENES_PER_TURN,
+                                });
+                                const suggestion = "[The council already convened this turn — its synthesis is in the transcript above. " +
+                                    "Do NOT convene again for the same question. Use that synthesis now: give the user your " +
+                                    "recommendation, or call ask_user if you need their go-ahead before implementing.]";
+                                const { messages: guardSpliced, replaced: guardReplaced } = spliceConveneToolResult(conveneResponse.messages, req?.toolCallId ?? null, suggestion);
+                                if (!guardReplaced) {
+                                    logger.warn("orchestrator", "convene: loop-guard splice found no matching toolCallId", {
+                                        toolCallId: req?.toolCallId ?? null,
+                                    });
+                                }
+                                const guardNewMsgs = guardSpliced.slice(deps.messages.length);
+                                for (const msg of guardNewMsgs)
+                                    deps.messages.push(msg);
+                                continue; // re-enter with the suggestion as the tool result
+                            }
+                            conveneRunsThisTurn++;
+                            yield { type: "content", content: "\n[Convening the council…]\n" };
+                            // Filter the terminal `done` runCouncilV2 emits on its
+                            // non-continuation path (orchestrator.ts ~2274): letting it through
+                            // would finalize the UI turn BEFORE we restart streamText below, so
+                            // the model's post-council continuation would be orphaned/invisible
+                            // (live-caught: council ran, synthesis produced, but no final answer
+                            // rendered). We continue the SAME turn ourselves via the splice +
+                            // `continue` restart, so the council's `done` must not propagate.
+                            for await (const chunk of deps.runCouncilV2(userMessage, {
+                                convenePath: true,
+                                skipClarification: true,
+                                observer,
+                                userModelMessage,
+                            })) {
+                                if (chunk.type === "done")
+                                    continue;
+                                yield chunk;
+                            }
+                            const synthesis = deps.councilManager.lastSynthesis;
+                            const spliceValue = synthesis && synthesis.trim().length > 0
+                                ? synthesis
+                                : `[Council could not produce a conclusion${req?.reason ? ` for: ${req.reason}` : ""}. Proceed using your own judgment.]`;
+                            if (!synthesis || synthesis.trim().length === 0) {
+                                logger.warn("orchestrator", "convene: council returned no synthesis", { reason: req?.reason ?? null });
+                            }
+                            const { messages: spliced, replaced } = spliceConveneToolResult(conveneResponse.messages, req?.toolCallId ?? null, spliceValue);
+                            if (!replaced) {
+                                logger.warn("orchestrator", "convene: tool_result splice found no matching toolCallId", {
+                                    toolCallId: req?.toolCallId ?? null,
+                                });
+                            }
+                            // Graft the new messages (assistant tool-call + spliced tool-result)
+                            // into deps.messages, then restart the step so the model reads the
+                            // synthesis as the convene tool's result (SAMR restart precedent).
+                            const newMsgs = spliced.slice(deps.messages.length);
+                            for (const msg of newMsgs)
+                                deps.messages.push(msg);
+                            continue; // re-enter the loop with the spliced history
+                        }
+                    }
+                }
                 // ─── SAMR Phase 1 → Phase 2 transition ─────────────────────────
                 // Phase 1 (premium model) produced tool calls but the SDK stopped
                 // before executing them (stopWhen: stepCountIs(1)). Append the
@@ -3021,6 +3644,10 @@ export async function* executeToolEngine(args) {
                 if (modelInfo?.contextWindow) {
                     void deps.postTurnCompact(provider, system, modelInfo.contextWindow, signal).catch(() => { });
                 }
+                // Reactive delegation: report this turn's observed tool-output load so
+                // the next turn can escalate to an isolated sub-session when it proves
+                // heavy — independent of the fragile upfront router. See reactive-delegation.ts.
+                deps.reportTurnToolLoad?.(_topLevelCapState?.cumulative ?? 0);
                 yield { type: "done" };
                 return;
             }
@@ -3167,6 +3794,10 @@ export async function* executeToolEngine(args) {
                 if (modelInfo?.contextWindow) {
                     void deps.postTurnCompact(provider, system, modelInfo.contextWindow, signal).catch(() => { });
                 }
+                // Reactive delegation: report this turn's observed tool-output load so
+                // the next turn can escalate to an isolated sub-session when it proves
+                // heavy — independent of the fragile upfront router. See reactive-delegation.ts.
+                deps.reportTurnToolLoad?.(_topLevelCapState?.cumulative ?? 0);
                 yield { type: "done" };
                 return;
             }
@@ -3184,4 +3815,153 @@ export async function* executeToolEngine(args) {
         }
     }
 }
+export function coalesceReadOnlyMessages(messages) {
+    if (!messages || messages.length === 0)
+        return messages;
+    const READ_ONLY_TOOLS = new Set([
+        "read_file",
+        "grep",
+        "bash_output_get",
+        "process_list",
+        "delegation_read",
+        "delegation_list",
+        "ee_query",
+        "ee_health",
+        "usage_forensics",
+        "lsp_query",
+        "setup_guide",
+        "selfverify_status",
+        "selfverify_result",
+        "selfverify_list",
+        "list_vision_cache",
+        "ee_feedback",
+        "ee_write",
+    ]);
+    const result = [];
+    let lastUserIdx = -1;
+    for (let k = messages.length - 1; k >= 0; k--) {
+        if (messages[k].role === "user") {
+            lastUserIdx = k;
+            break;
+        }
+    }
+    if (lastUserIdx === -1)
+        return messages;
+    for (let k = 0; k <= lastUserIdx; k++) {
+        result.push(messages[k]);
+    }
+    const postUser = messages.slice(lastUserIdx + 1);
+    const groups = [];
+    let currentAsst = null;
+    for (const msg of postUser) {
+        if (msg.role === "assistant") {
+            if (currentAsst) {
+                groups.push({ assistant: currentAsst, tool: null });
+            }
+            currentAsst = msg;
+        }
+        else if (msg.role === "tool") {
+            if (currentAsst) {
+                groups.push({ assistant: currentAsst, tool: msg });
+                currentAsst = null;
+            }
+            else {
+                result.push(msg);
+            }
+        }
+        else {
+            if (currentAsst) {
+                groups.push({ assistant: currentAsst, tool: null });
+                currentAsst = null;
+            }
+            result.push(msg);
+        }
+    }
+    if (currentAsst) {
+        groups.push({ assistant: currentAsst, tool: null });
+    }
+    const coalescedGroups = [];
+    for (const group of groups) {
+        const isReadOnly = (() => {
+            if (!group.tool || !group.assistant)
+                return false;
+            const toolCalls = getToolCalls(group.assistant);
+            if (toolCalls.length === 0)
+                return false;
+            return toolCalls.every((tc) => {
+                const name = tc.toolName || tc.function?.name;
+                return name && READ_ONLY_TOOLS.has(name);
+            });
+        })();
+        if (isReadOnly) {
+            const prev = coalescedGroups[coalescedGroups.length - 1];
+            const prevIsReadOnly = prev &&
+                (() => {
+                    if (!prev.tool || !prev.assistant)
+                        return false;
+                    const toolCalls = getToolCalls(prev.assistant);
+                    if (toolCalls.length === 0)
+                        return false;
+                    return toolCalls.every((tc) => {
+                        const name = tc.toolName || tc.function?.name;
+                        return name && READ_ONLY_TOOLS.has(name);
+                    });
+                })();
+            if (prevIsReadOnly) {
+                prev.assistant = mergeAssistantMessages(prev.assistant, group.assistant);
+                prev.tool = mergeToolMessages(prev.tool, group.tool);
+            }
+            else {
+                coalescedGroups.push({ ...group });
+            }
+        }
+        else {
+            coalescedGroups.push(group);
+        }
+    }
+    for (const group of coalescedGroups) {
+        if (group.assistant)
+            result.push(group.assistant);
+        if (group.tool)
+            result.push(group.tool);
+    }
+    return result;
+}
+function getToolCalls(msg) {
+    if (Array.isArray(msg.toolCalls))
+        return msg.toolCalls;
+    if (Array.isArray(msg.content)) {
+        return msg.content.filter((p) => p && p.type === "tool-call");
+    }
+    return [];
+}
+function mergeAssistantMessages(msg1, msg2) {
+    const parts1 = Array.isArray(msg1.content)
+        ? msg1.content
+        : typeof msg1.content === "string" && msg1.content
+            ? [{ type: "text", text: msg1.content }]
+            : [];
+    const parts2 = Array.isArray(msg2.content)
+        ? msg2.content
+        : typeof msg2.content === "string" && msg2.content
+            ? [{ type: "text", text: msg2.content }]
+            : [];
+    const mergedContent = [...parts1, ...parts2];
+    const res = {
+        role: "assistant",
+        content: mergedContent,
+    };
+    if (Array.isArray(msg1.toolCalls) || Array.isArray(msg2.toolCalls)) {
+        res.toolCalls = [...(msg1.toolCalls ?? []), ...(msg2.toolCalls ?? [])];
+    }
+    return res;
+}
+function mergeToolMessages(msg1, msg2) {
+    const parts1 = Array.isArray(msg1.content) ? msg1.content : [];
+    const parts2 = Array.isArray(msg2.content) ? msg2.content : [];
+    return {
+        role: "tool",
+        content: [...parts1, ...parts2],
+    };
+}
 //# sourceMappingURL=tool-engine.js.map