pi-observational-memory 3.0.3 → 3.1.1

package/src/hooks/compaction-trigger.ts

@@ -3,43 +3,20 @@ import { resolveCompactAfterTokens } from "../config.js";
 import { rawTokensSinceLastCompaction, type Entry } from "../session-ledger/index.js";
 import type { Runtime } from "../runtime.js";
 
-/**
- * Regex matching Pi's internal retryable error detection.
- * When the last assistant message in agent_end has stopReason "error" matching this pattern,
- * Pi will auto-retry — we must not trigger compaction between attempts.
- */
-const RETRYABLE_ERROR_RE =
-	/overloaded|provider.?returned.?error|rate.?limit|too many requests|429|500|502|503|504|service.?unavailable|server.?error|internal.?error|network.?error|connection.?error|connection.?refused|connection.?lost|websocket.?closed|websocket.?error|other side closed|fetch failed|upstream.?connect|reset before headers|socket hang up|ended without|http2 request did not get a response|timed? out|timeout|terminated|retry delay/i;
-
 export function registerCompactionTrigger(pi: ExtensionAPI, runtime: Runtime): void {
-	pi.on("agent_end", (event: any, ctx: any) => {
+	// Pi emits agent_settled only after retries, automatic compaction, and queued
+	// continuation have finished, so retry policy stays owned by Pi.
+	pi.on("agent_settled", (_event, ctx) => {
 		runtime.ensureConfig(ctx.cwd);
 		if (runtime.config.passive === true) return;
 		if (runtime.compactInFlight) return;
 
-		// Don't trigger compaction if Pi will auto-retry — the agent hasn't truly finished.
-		// Pi emits agent_end before its own retry check, so we must detect this ourselves.
-		// The next agent_end (after retry succeeds or exhausts attempts) will re-evaluate.
-		const lastAssistant = [...event.messages].reverse().find(
-			(m): m is Extract<typeof m, { role: "assistant" }> => m.role === "assistant",
-		);
-		if (
-			lastAssistant
-			&& lastAssistant.stopReason === "error"
-			&& lastAssistant.errorMessage
-			&& RETRYABLE_ERROR_RE.test(lastAssistant.errorMessage)
-		) {
-			return;
-		}
-
-		const entries = ctx.sessionManager.getBranch() as Entry[];
-		const tokens = rawTokensSinceLastCompaction(entries);
-		// Resolve the proactive-compaction threshold from the active model's context
-		// window when ratio mode is configured. ctx.model is the current session model
-		// (Model<any> | undefined per ExtensionContext).
+		const entries = ctx.sessionManager?.getBranch?.() as Entry[] | undefined;
+		if (!entries) return;
+		const progress = rawTokensSinceLastCompaction(entries);
 		const contextWindow = typeof ctx.model?.contextWindow === "number" ? ctx.model.contextWindow : undefined;
 		const threshold = resolveCompactAfterTokens(runtime.config, contextWindow);
-		if (tokens < threshold) return;
+		if (progress < threshold) return;
 
 		// Capture ctx properties synchronously — the setTimeout + async work below
 		// may outlive the extension ctx (stale after session replacement/reload).
@@ -47,7 +24,7 @@ export function registerCompactionTrigger(pi: ExtensionAPI, runtime: Runtime): v
 		const ui = ctx.ui;
 
 		if (hasUI) ui?.notify(
-			`Observational memory: compaction threshold reached (~${tokens.toLocaleString()} tokens); triggering compaction`,
+			`Observational memory: compaction threshold reached (~${progress.toLocaleString()} estimated source tokens); triggering compaction`,
 			"info",
 		);
 
@@ -62,9 +39,13 @@ export function registerCompactionTrigger(pi: ExtensionAPI, runtime: Runtime): v
 					);
 					return;
 				}
-				const currentEntries = ctx.sessionManager.getBranch() as Entry[];
-				const currentTokens = rawTokensSinceLastCompaction(currentEntries);
-				if (currentTokens < threshold) {
+				const currentEntries = ctx.sessionManager?.getBranch?.() as Entry[] | undefined;
+				if (!currentEntries) {
+					runtime.compactInFlight = false;
+					return;
+				}
+				const currentProgress = rawTokensSinceLastCompaction(currentEntries);
+				if (currentProgress < threshold) {
 					runtime.compactInFlight = false;
 					if (hasUI) ui?.notify(
 						"Observational memory: compaction skipped — another compaction already ran before deferred compaction",

package/src/hooks/consolidation-trigger.ts

@@ -1,10 +1,11 @@
 import type { ExtensionAPI } from "@earendil-works/pi-coding-agent";
 import { runDropper } from "../agents/dropper/agent.js";
 import { observationPoolMetrics } from "../agents/dropper/pool.js";
-import { runObserver } from "../agents/observer/agent.js";
+import { ObserverStreamError, runObserver } from "../agents/observer/agent.js";
 import { runReflector } from "../agents/reflector/agent.js";
 import { debugLog, withDebugLogContext } from "../debug-log.js";
-import { type ResolveResult, type Runtime } from "../runtime.js";
+import { resolveObserverChunkMaxTokens } from "../config.js";
+import type { ResolveResult, Runtime } from "../runtime.js";
 import { serializeSourceAddressedBranchEntries } from "../serialize.js";
 import {
 	OM_OBSERVATIONS_DROPPED,
@@ -20,11 +21,14 @@ import {
 	latestCoverageIndex,
 	latestCoverageMarkerId,
 	observationToSummaryLine,
+	realTokensSinceAnchor,
 	rawTokensSinceObservationCoverage,
 	rawTokensSinceReflectionCoverage,
 	reflectionToSummaryLine,
 	type Entry,
+	type Observation,
 	type Reflection,
+	type V3MemoryCustomType,
 } from "../session-ledger/index.js";
 
 type ResolvedModel = Extract<ResolveResult, { ok: true }>;
@@ -35,6 +39,7 @@ type ConsolidationCtx = {
 	ui?: { notify: (message: string, type?: "warning" | "info" | "error") => void };
 	model: unknown;
 	modelRegistry: any;
+	getContextUsage?: () => { tokens?: number | null; contextWindow?: number } | undefined;
 	sessionManager: {
 		getBranch: () => unknown;
 		getSessionId?: () => string;
@@ -69,9 +74,43 @@ function mergeReflections(existing: Reflection[], additional: Reflection[]): Ref
 	return merged;
 }
 
-function anyStageDue(entries: Entry[], runtime: Runtime): boolean {
-	return rawTokensSinceObservationCoverage(entries) >= runtime.config.observeAfterTokens
-		|| rawTokensSinceReflectionCoverage(entries) >= runtime.config.reflectAfterTokens;
+/**
+ * Real current context tokens from the session (provider-reported usage, the
+ * same basis the footer percentage uses). Falls back to undefined when the
+ * host pi lacks getContextUsage or the count is unknown (e.g. right after a
+ * compaction, before the next valid assistant response).
+ */
+function realContextTokens(ctx: ConsolidationCtx): number | undefined {
+	const usage = typeof ctx.getContextUsage === "function" ? ctx.getContextUsage() : undefined;
+	const tokens = usage?.tokens;
+	return typeof tokens === "number" && Number.isFinite(tokens) ? tokens : undefined;
+}
+
+function stageDue(
+	entries: Entry[],
+	runtime: Runtime,
+	currentTokens: number | undefined,
+	customType: V3MemoryCustomType,
+	rawEstimateFn: (entries: Entry[]) => number,
+	threshold: number,
+): boolean {
+	if (currentTokens !== undefined) {
+		const real = realTokensSinceAnchor(entries, customType, currentTokens);
+		if (real !== undefined) return real >= threshold;
+	}
+	// Real delta unmeasurable (no usage baseline, or accounting basis changed) or
+	// old pi host without getContextUsage — fall back to the raw estimate, which
+	// self-limits after coverage and cannot over-fire or starve.
+	return rawEstimateFn(entries) >= threshold;
+}
+
+function anyStageDue(entries: Entry[], runtime: Runtime, currentTokens: number | undefined): boolean {
+	return stageDue(entries, runtime, currentTokens, OM_OBSERVATIONS_RECORDED, rawTokensSinceObservationCoverage, runtime.config.observeAfterTokens)
+		|| stageDue(entries, runtime, currentTokens, OM_REFLECTIONS_RECORDED, rawTokensSinceReflectionCoverage, runtime.config.reflectAfterTokens);
+}
+
+function shouldNotifyWorker(runtime: Runtime, ctx: ConsolidationCtx): boolean {
+	return runtime.config.showWorkerNotifications && ctx.hasUI;
 }
 
 function makeModelResolver(runtime: Runtime, ctx: ConsolidationCtx): (stage: "observer" | "reflector" | "dropper") => Promise<ResolvedModel | undefined> {
@@ -85,6 +124,22 @@ function makeModelResolver(runtime: Runtime, ctx: ConsolidationCtx): (stage: "ob
 		});
 		if (cached.ok) {
 			runtime.resolveFailureNotified = false;
+			// Console Go (opencode.ai) rejects requests without x-opencode-session
+			// (400 MissingSessionID). Mirror pi's own session headers on worker calls.
+			const model = (cached.model ?? {}) as { provider?: string; baseUrl?: string };
+			if (model.provider === "opencode" || model.provider === "opencode-go" || (typeof model.baseUrl === "string" && model.baseUrl.includes("opencode.ai"))) {
+				const sessionId = ctx.sessionManager.getSessionId?.();
+				if (sessionId) {
+					return {
+						...cached,
+						headers: {
+							...(cached.headers ?? {}),
+							"x-opencode-session": sessionId,
+							"x-opencode-client": "pi",
+						},
+					};
+				}
+			}
 			return cached;
 		}
 		debugLog(`${stage}.model_unavailable`, { reason: cached.reason });
@@ -121,7 +176,7 @@ function maybeLaunchConsolidation(pi: ExtensionAPI, runtime: Runtime, ctx: Conso
 	if (runtime.consolidationInFlight) return;
 
 	const entries = ctx.sessionManager.getBranch() as Entry[];
-	if (!anyStageDue(entries, runtime)) return;
+	if (!anyStageDue(entries, runtime, realContextTokens(ctx))) return;
 
 	const runId = `consolidation-${Date.now().toString(36)}-${Math.random().toString(16).slice(2, 8)}`;
 	const consolidationCtx: ConsolidationCtx = {
@@ -130,6 +185,7 @@ function maybeLaunchConsolidation(pi: ExtensionAPI, runtime: Runtime, ctx: Conso
 		ui: ctx.ui,
 		model: ctx.model,
 		modelRegistry: ctx.modelRegistry,
+		getContextUsage: ctx.getContextUsage,
 		sessionManager: ctx.sessionManager,
 	};
 
@@ -185,27 +241,79 @@ async function runObserverStage(
 	resolveModel: (stage: "observer") => Promise<ResolvedModel | undefined>,
 ): Promise<StageOutcome> {
 	const entries = ctx.sessionManager.getBranch() as Entry[];
-	const tokens = rawTokensSinceObservationCoverage(entries);
+	const currentTokens = realContextTokens(ctx);
+	const real = currentTokens !== undefined ? realTokensSinceAnchor(entries, OM_OBSERVATIONS_RECORDED, currentTokens) : undefined;
+	const tokens = real !== undefined ? real : rawTokensSinceObservationCoverage(entries); // fallback: no usage baseline / basis change
 	if (tokens < runtime.config.observeAfterTokens) return "continue";
 
+	const sessionMetadata = debugSessionMetadata(ctx);
+	const sessionIdentity = sessionMetadata.sessionId ?? sessionMetadata.sessionFile;
+	const coverageId = latestCoverageMarkerId(entries, OM_OBSERVATIONS_RECORDED);
+
+	// Deliberate-empty backoff (#23): an intentional "nothing to record" verdict
+	// must not re-fire the observer every turn over the same span. Retry only
+	// after another observeAfterTokens worth of new source tokens arrives, and
+	// drop the backoff as soon as coverage advances.
+	const backoff = runtime.observerEmptyBackoff;
+	if (backoff) {
+		if (
+			sessionIdentity !== backoff.sessionIdentity
+			|| coverageId !== backoff.coverageId
+			|| tokens >= backoff.tokensAtEmpty + runtime.config.observeAfterTokens
+		) {
+			runtime.observerEmptyBackoff = undefined;
+		} else {
+			debugLog("observer.empty_backoff", { tokens, resumeAtTokens: backoff.tokensAtEmpty + runtime.config.observeAfterTokens });
+			return "continue";
+		}
+	}
+
+	// Resolve the model before building the chunk: the default chunk cap
+	// derives from the resolved model's context window.
+	const resolved = await resolveModel("observer");
+	if (!resolved) return "abort";
+
 	const lastCoverageIdx = latestCoverageIndex(entries, OM_OBSERVATIONS_RECORDED);
-	const chunkEntries = sourceEntriesAfter(entries, lastCoverageIdx);
-	const coversUpToId = chunkEntries.at(-1)?.id;
+	const backlogEntries = sourceEntriesAfter(entries, lastCoverageIdx);
+
+	// Budget the text that is actually sent to the observer, including source
+	// labels and rendered message content. Complete entries are kept intact.
+	// Only a first entry that cannot fit by itself is represented by a clearly
+	// marked head/tail excerpt; the original ledger entry remains untouched.
+	const contextWindow = (resolved.model as { contextWindow?: number }).contextWindow;
+	const maxChunkTokens = resolveObserverChunkMaxTokens(runtime.config, contextWindow);
+	const {
+		text: chunk,
+		sourceEntryIds,
+		estimatedTokens: chunkTokens,
+		truncatedSourceEntryIds,
+	} = serializeSourceAddressedBranchEntries(backlogEntries, { maxTokens: maxChunkTokens });
+	if (!chunk.trim() || sourceEntryIds.length === 0) return "continue";
+	const coversUpToId = sourceEntryIds.at(-1);
 	if (!coversUpToId) return "continue";
 
-	const { text: chunk, sourceEntryIds } = serializeSourceAddressedBranchEntries(chunkEntries);
-	if (!chunk.trim() || sourceEntryIds.length === 0) return "continue";
+	if (sourceEntryIds.length < backlogEntries.length || truncatedSourceEntryIds.length > 0) {
+		debugLog("observer.chunk_capped", {
+			maxChunkTokens,
+			backlogEntries: backlogEntries.length,
+			backlogTokens: tokens,
+			chunkEntries: sourceEntryIds.length,
+			chunkTokens,
+			truncatedSourceEntryIds,
+		});
+	}
 
 	const memory = fullProjection(entries);
 	const priorReflections = memory.reflections.map(reflectionToSummaryLine);
 	const priorObservations = memory.observations.map(observationToSummaryLine);
 
-	if (ctx.hasUI) ctx.ui?.notify(
-		`Observational memory: observer running on ~${tokens.toLocaleString()}-token chunk`,
+	if (shouldNotifyWorker(runtime, ctx)) ctx.ui?.notify(
+		`Observational memory: observer running on ~${chunkTokens.toLocaleString()}-token chunk`,
 		"info",
 	);
 	debugLog("observer.start", {
 		tokens,
+		chunkTokens,
 		coversUpToId,
 		sourceEntryIds,
 		sourceEntryCount: sourceEntryIds.length,
@@ -213,28 +321,43 @@ async function runObserverStage(
 		priorObservations: priorObservations.length,
 	});
 
-	const resolved = await resolveModel("observer");
-	if (!resolved) return "abort";
-
-	const observations = await runObserver({
-		model: resolved.model as any,
-		apiKey: resolved.apiKey,
-		headers: resolved.headers,
-		priorReflections,
-		priorObservations,
-		chunk,
-		allowedSourceEntryIds: sourceEntryIds,
-		maxTurns: runtime.config.agentMaxTurns,
-		thinkingLevel: runtime.config.model?.thinking ?? "low",
-	});
+	let observations: Observation[] | undefined;
+	try {
+		observations = await runObserver({
+			model: resolved.model as any,
+			apiKey: resolved.apiKey,
+			headers: resolved.headers,
+			env: resolved.env,
+			priorReflections,
+			priorObservations,
+			chunk,
+			allowedSourceEntryIds: sourceEntryIds,
+			maxTurns: runtime.config.agentMaxTurns,
+			maxOutputTokens: runtime.config.agentMaxTokens,
+			thinkingLevel: runtime.config.model?.thinking ?? "low",
+			modelRegistry: ctx.modelRegistry,
+		});
+	} catch (error) {
+		if (error instanceof ObserverStreamError) {
+			// API/stream failure is not a clean empty (#32): surface it as a real
+			// failure instead of the "no observations" path. Coverage stays put.
+			runtime.recordConsolidationStageError(ctx, "observer", error);
+			return "abort";
+		}
+		throw error;
+	}
 	if (!observations || observations.length === 0) {
+		// Deliberate empty: routine info, not a warning, and back off re-fires
+		// over the same span (#23).
 		debugLog("observer.empty", { coversUpToId });
-		if (ctx.hasUI) ctx.ui?.notify(
-			"Observational memory: observer returned no observations",
-			"warning",
+		runtime.observerEmptyBackoff = { sessionIdentity, coverageId, tokensAtEmpty: tokens };
+		if (shouldNotifyWorker(runtime, ctx)) ctx.ui?.notify(
+			"Observational memory: observer found nothing new in this chunk (coverage unchanged; will retry later)",
+			"info",
 		);
 		return "continue";
 	}
+	runtime.observerEmptyBackoff = undefined;
 
 	const data = buildObservationsRecordedData(observations, coversUpToId);
 	if (!data) return "continue";
@@ -245,7 +368,7 @@ async function runObserverStage(
 	});
 	appendEntry(pi, OM_OBSERVATIONS_RECORDED, data);
 	debugLog("observer.appended", { count: observations.length, coversUpToId });
-	if (ctx.hasUI) ctx.ui?.notify(
+	if (shouldNotifyWorker(runtime, ctx)) ctx.ui?.notify(
 		`Observational memory: ${observations.length} observation${observations.length === 1 ? "" : "s"} recorded`,
 		"info",
 	);
@@ -259,13 +382,15 @@ async function runReflectorStage(
 	resolveModel: (stage: "reflector") => Promise<ResolvedModel | undefined>,
 ): Promise<ReflectorStageResult> {
 	const entries = ctx.sessionManager.getBranch() as Entry[];
-	const reflectionTokens = rawTokensSinceReflectionCoverage(entries);
+	const currentTokens = realContextTokens(ctx);
+	const real = currentTokens !== undefined ? realTokensSinceAnchor(entries, OM_REFLECTIONS_RECORDED, currentTokens) : undefined;
+	const reflectionTokens = real !== undefined ? real : rawTokensSinceReflectionCoverage(entries); // fallback: no usage baseline / basis change
 	if (reflectionTokens < runtime.config.reflectAfterTokens) return { outcome: "continue", sameRunReflections: [] };
 
 	const observationCoverageId = latestCoverageMarkerId(entries, OM_OBSERVATIONS_RECORDED);
 	if (!observationCoverageId) return { outcome: "continue", sameRunReflections: [] };
 
-	if (ctx.hasUI) ctx.ui?.notify(
+	if (shouldNotifyWorker(runtime, ctx)) ctx.ui?.notify(
 		`Observational memory: reflector running (~${reflectionTokens.toLocaleString()} tokens)`,
 		"info",
 	);
@@ -277,10 +402,13 @@ async function runReflectorStage(
 		model: resolved.model as any,
 		apiKey: resolved.apiKey,
 		headers: resolved.headers,
+		env: resolved.env,
 		reflections: folded.reflections,
 		observations: folded.activeObservations,
 		maxTurns: runtime.config.agentMaxTurns,
+		maxOutputTokens: runtime.config.agentMaxTokens,
 		thinkingLevel: runtime.config.model?.thinking ?? "low",
+		modelRegistry: ctx.modelRegistry,
 	});
 	if (!reflections) return { outcome: "continue", sameRunReflections: [] };
 
@@ -337,7 +465,7 @@ async function runDropperStage(
 		maxDropsAllowed: metrics.maxDropsAllowed,
 	});
 
-	if (ctx.hasUI) ctx.ui?.notify(
+	if (shouldNotifyWorker(runtime, ctx)) ctx.ui?.notify(
 		`Observational memory: dropper running after reflection — active observation pool ~${metrics.observationTokens.toLocaleString()} / ${metrics.targetTokens.toLocaleString()} target tokens (${Math.round(metrics.fullness * 100).toLocaleString()}%)`,
 		"info",
 	);
@@ -349,11 +477,14 @@ async function runDropperStage(
 		model: resolved.model as any,
 		apiKey: resolved.apiKey,
 		headers: resolved.headers,
+		env: resolved.env,
 		reflections: reflectionsForDropper,
 		observations: folded.activeObservations,
 		targetTokens: runtime.config.observationsPoolTargetTokens,
 		maxTurns: runtime.config.agentMaxTurns,
+		maxOutputTokens: runtime.config.agentMaxTokens,
 		thinkingLevel: runtime.config.model?.thinking ?? "low",
+		modelRegistry: ctx.modelRegistry,
 	});
 	const coversUpToId = earlierCoverageMarkerId(entries, observationCoverageId, sameRunReflectionCoverageId);
 	const data = coversUpToId && droppedIds ? buildObservationsDroppedData(droppedIds, coversUpToId) : undefined;

package/src/runtime.ts

@@ -1,13 +1,89 @@
 import { type Config, DEFAULTS, loadConfig } from "./config.js";
+import { debugLog } from "./debug-log.js";
 
 export type ResolveResult =
-	| { ok: true; model: unknown; apiKey: string; headers?: Record<string, string> }
+	| { ok: true; model: unknown; apiKey?: string; headers?: Record<string, string>; env?: Record<string, string>; baseUrl?: string }
 	| { ok: false; reason: string };
 
+/**
+ * Mirrors pi's own request-auth acceptance rule (`AgentSession._getRequiredRequestAuth`):
+ * resolved auth is usable when it carries an apiKey OR at least one header value.
+ * OAuth providers (kimi-coding, xai, openai-codex, anthropic OAuth, …) authenticate via
+ * `toAuth()` returning `{ headers: { Authorization: "Bearer …" } }` with no apiKey, and
+ * pi-ai providers accept a caller-supplied Authorization header in place of an apiKey.
+ *
+ * NOTE: a `false` result does NOT mean "unauthenticated" — see `resolveModel`. Providers
+ * that authenticate at request time (Amazon Bedrock SigV4 from AWS_PROFILE/SSO, Google
+ * Vertex ADC) legitimately expose neither an apiKey nor a header, because pi signs their
+ * requests itself.
+ */
+function hasUsableAuth(auth: { apiKey?: unknown; headers?: unknown }): boolean {
+	if (typeof auth.apiKey === "string" && auth.apiKey.length > 0) return true;
+	return countUsableHeaders(auth.headers) > 0;
+}
+
+/** How many headers the auth payload carries at all (diagnostics only, never values). */
+function countHeaders(headers: unknown): number {
+	return headers && typeof headers === "object" ? Object.keys(headers as Record<string, unknown>).length : 0;
+}
+
+/** How many headers carry a non-empty string value — the ones pi could actually send. */
+function countUsableHeaders(headers: unknown): number {
+	if (!headers || typeof headers !== "object") return 0;
+	return Object.values(headers as Record<string, unknown>).filter(
+		(value) => typeof value === "string" && value.length > 0,
+	).length;
+}
+
+/**
+ * How long to wait for the availability re-check in `recheckProviderCredential`, and how
+ * long before the same provider may be re-checked again.
+ *
+ * The re-check is network-free and measured at ~1ms on a warm Bedrock/SSO host, but
+ * `checkAuth` can block on a provider's own credential resolution, so it is bounded. The
+ * re-arm interval keeps an unauthenticated host from paying the cost on every
+ * consolidation while still recovering within a session when credentials are renewed out
+ * of band (`aws sso login` in another terminal, `gcloud auth application-default login`).
+ */
+const AVAILABILITY_RECHECK_TIMEOUT_MS = 5_000;
+const AVAILABILITY_RECHECK_REARM_MS = 60_000;
+
 type NotifyLevel = "warning" | "info" | "error";
 type Notify = (message: string, type?: NotifyLevel) => void;
 export type ConsolidationPhase = "observer" | "reflector" | "dropper";
 
+/**
+ * Whether pi positively reports a working credential source for this model's provider.
+ *
+ * `ModelRegistry.hasConfiguredAuth(model)` is true when pi's availability check
+ * (`ModelRuntime.checkAuth`) resolved *something* for the provider — an API key, a
+ * stored credential, or an ambient source such as `AWS_PROFILE` / `AWS_ACCESS_KEY_ID`
+ * / gcloud ADC. Combined with `auth.ok === true` and an auth payload that carries
+ * nothing, that is the signature of a provider pi signs at request time:
+ *
+ *   pi has a credential source, and deliberately hands the caller nothing to attach.
+ *
+ * Measured on a Bedrock/SSO host (pi 0.84.2), with `AWS_PROFILE` exported:
+ *   checkAuth("amazon-bedrock") -> { source: "AWS_PROFILE", type: "api_key" }
+ *   hasConfiguredAuth(model)    -> true
+ *   getApiKeyAndHeaders(model)  -> { ok: true, apiKey: undefined, headers: undefined }
+ * `googleVertexProvider`'s ADC branch returns the same empty-auth resolution.
+ *
+ * The inverse case — `hasConfiguredAuth === false` with an empty auth payload — is a
+ * provider pi could not authenticate at all (no key, no ambient source). That must
+ * keep failing: it is the ordinary "not logged in" state, not ambient auth.
+ *
+ * Defensive: older pi versions and partial test doubles may not expose this, and an
+ * unknown answer must not be read as "authenticated".
+ */
+function hasConfiguredProviderCredential(registry: unknown, model: unknown): boolean {
+	try {
+		return (registry as { hasConfiguredAuth?: (m: unknown) => unknown }).hasConfiguredAuth?.(model) === true;
+	} catch {
+		return false;
+	}
+}
+
 export interface ResolveCtx {
 	model: unknown;
 	modelRegistry: any;
@@ -32,6 +108,14 @@ export class Runtime {
 	lastObserverError: string | undefined;
 	lastReflectorError: string | undefined;
 	lastDropperError: string | undefined;
+	/** provider -> epoch ms of the last availability re-check (see `recheckProviderCredential`). */
+	availabilityRecheckedAt = new Map<string, number>();
+	/** Deliberate-empty backoff (#23): skip observer re-fires over the same span until enough new tokens arrive. */
+	observerEmptyBackoff: {
+		sessionIdentity: string | undefined;
+		coverageId: string | undefined;
+		tokensAtEmpty: number;
+	} | undefined;
 
 	ensureConfig(cwd: string): void {
 		if (this.configLoaded) return;
@@ -54,11 +138,149 @@ export class Runtime {
 		}
 		if (!model) return { ok: false, reason: "no model available (session has no model and no observational-memory model configured)" };
 		const auth = await ctx.modelRegistry.getApiKeyAndHeaders(model);
-		if (!auth.ok || !auth.apiKey) {
-			const provider = (model as { provider?: string }).provider ?? "unknown";
-			return { ok: false, reason: `no API key for provider "${provider}"` };
+		const provider = (model as { provider?: string }).provider ?? "unknown";
+		const isOAuth = ctx.modelRegistry.isUsingOAuth?.(model) === true;
+		// `auth.ok === false` is the only unambiguous failure: pi returns it when a
+		// provider requires a request auth header and no credential resolved.
+		//
+		// `auth.ok === true` with neither apiKey nor headers, for a provider pi DOES
+		// report a credential source for, is not a failure — it is how pi describes a
+		// provider that authenticates at request time: Amazon Bedrock signing SigV4 from
+		// ambient AWS credentials (`bedrockAuth.resolve` returns `{ auth: {}, source:
+		// "AWS_PROFILE" }`), Google Vertex using ADC (same empty resolution). pi's own
+		// native streaming path forwards no apiKey either, and its pre-prompt gate is
+		// merely `hasConfiguredAuth(provider) || checkAuth(provider) !== undefined` —
+		// om's pre-flight check must not be stricter than pi's own. Treating it as "no
+		// auth" aborted consolidation before the model was ever called, disabling
+		// observational memory silently — no error, no cost, no latency — on such hosts.
+		//
+		// Three cases deliberately keep failing: OAuth providers, where an empty
+		// resolution means the credentials no longer resolve and the user must log in
+		// again; a credential that resolved to an empty *string* key, which is a
+		// misconfiguration rather than ambient auth; and a provider pi reports no
+		// credential source for at all, which is simply unauthenticated.
+		const usable = hasUsableAuth(auth);
+		const resolvedEmptyApiKey = typeof auth.apiKey === "string" && auth.apiKey.length === 0;
+		let providerCredentialConfigured = hasConfiguredProviderCredential(ctx.modelRegistry, model);
+		// pi's gate has TWO halves and never trusts the snapshot alone (agent-session.js):
+		//
+		//   hasConfiguredAuth(provider) || (await checkAuth(provider)) !== undefined
+		//
+		// `hasConfiguredAuth` reads `snapshot.configuredProviders`, which is populated by an
+		// availability pass — and left untouched when that pass is skipped
+		// (`refreshOnCreate: false`), aborted, or FAILS (its catch records `availabilityError`
+		// and returns). A provider whose credential could not be checked at startup — an
+		// expired SSO token, say — is therefore absent from the snapshot for the rest of the
+		// session, even after the user renews it out of band. pi recovers on the next turn
+		// because its second half re-checks live; reading only the snapshot half would leave
+		// consolidation dead for the whole session, which is the same silent-failure class as
+		// the bug this gate was fixed for.
+		//
+		// The facade exposes no `checkAuth`, but `refresh({ providers })` performs the same
+		// live check and then updates the snapshot, so re-reading afterwards is equivalent.
+		// Only attempted when everything else already looks like the ambient shape, so an
+		// ordinary unauthenticated provider still fails on the first call.
+		if (auth.ok === true && !usable && !isOAuth && !resolvedEmptyApiKey && !providerCredentialConfigured) {
+			providerCredentialConfigured = await this.recheckProviderCredential(ctx.modelRegistry, model, provider);
 		}
-		return { ok: true, model, apiKey: auth.apiKey as string, headers: auth.headers as Record<string, string> | undefined };
+		const signsAtRequestTime =
+			auth.ok === true && !isOAuth && !resolvedEmptyApiKey && providerCredentialConfigured;
+		if (!auth.ok || (!usable && !signsAtRequestTime)) {
+			const reason = isOAuth
+				? `authentication failed for provider "${provider}" — OAuth credentials may have expired; run '/login ${provider}' to re-authenticate`
+				: `no API key or auth headers for provider "${provider}"`;
+			// The reason string alone cannot tell `ok: false` from `ok: true` with nothing to
+			// carry, which is what made the ambient-credential outage un-diagnosable from the
+			// debug log. Record the decision inputs — booleans and counts only, never values.
+			debugLog("resolve.rejected", {
+				provider,
+				reason,
+				authOk: auth.ok === true,
+				hasApiKey: typeof auth.apiKey === "string" && auth.apiKey.length > 0,
+				resolvedEmptyApiKey,
+				headerCount: countHeaders(auth.headers),
+				usableHeaderCount: countUsableHeaders(auth.headers),
+				isOAuth,
+				providerCredentialConfigured,
+				signsAtRequestTime,
+			});
+			return { ok: false, reason };
+		}
+		if (!usable) {
+			debugLog("resolve.request_time_signing", { provider, providerCredentialConfigured });
+		}
+		// Match pi's request model: OAuth may route to an account-specific endpoint
+		// (e.g. Copilot Business). Do not mutate the shared session/registry model.
+		const requestModel = auth.baseUrl ? { ...(model as object), baseUrl: auth.baseUrl } : model;
+		return {
+			ok: true,
+			model: requestModel,
+			apiKey: auth.apiKey as string | undefined,
+			headers: auth.headers as Record<string, string> | undefined,
+			env: auth.env as Record<string, string> | undefined,
+			baseUrl: auth.baseUrl as string | undefined,
+		};
+	}
+
+	/**
+	 * Re-check one provider's credential live, then re-read pi's snapshot.
+	 *
+	 * Implements the second half of pi's own auth gate for the only case that needs it: an
+	 * otherwise-ambient-looking resolution whose provider is missing from a stale or never
+	 * populated availability snapshot. Bounded and rate-limited; never throws.
+	 */
+	private async recheckProviderCredential(registry: unknown, model: unknown, provider: string): Promise<boolean> {
+		const last = this.availabilityRecheckedAt.get(provider);
+		const now = Date.now();
+		if (last !== undefined && now - last < AVAILABILITY_RECHECK_REARM_MS) return false;
+		this.availabilityRecheckedAt.set(provider, now);
+
+		const refresh = (registry as { refresh?: (options?: unknown) => Promise<unknown> }).refresh;
+		if (typeof refresh !== "function") {
+			debugLog("resolve.availability_recheck", { provider, refreshed: false, reason: "registry exposes no refresh()" });
+			return false;
+		}
+
+		const controller = new AbortController();
+		const timer = setTimeout(() => controller.abort(), AVAILABILITY_RECHECK_TIMEOUT_MS);
+		let refreshError: string | undefined;
+		let timedOut = false;
+		try {
+			// allowNetwork:false — a credential re-check must not wait on a model-catalog fetch.
+			// providers:[provider] — scope the work, and the snapshot writes, to the one provider.
+			//
+			// Both are honoured from pi 0.84; on pi 0.81 the facade is `refresh()` with no
+			// parameters, delegating to `runtime.reloadConfig()`, which reloads models.json and
+			// then runs a FULL, network-permitted availability pass. Passing the options is
+			// harmless there, but the work is wider and slower — hence the race below rather
+			// than relying on the abort signal, which that version never sees.
+			await Promise.race([
+				refresh.call(registry, { allowNetwork: false, providers: [provider], signal: controller.signal }),
+				new Promise<void>((resolve) => {
+					controller.signal.addEventListener("abort", () => {
+						timedOut = true;
+						resolve();
+					});
+				}),
+			]);
+		} catch (error) {
+			refreshError = error instanceof Error ? error.message : String(error);
+		} finally {
+			clearTimeout(timer);
+		}
+
+		// Re-read even when the refresh reported an error or timed out: a scoped pass can
+		// update the snapshot for this provider and still fail elsewhere.
+		const recovered = hasConfiguredProviderCredential(registry, model);
+		debugLog("resolve.availability_recheck", {
+			provider,
+			refreshed: refreshError === undefined && !timedOut,
+			recovered,
+			elapsedMs: Date.now() - now,
+			timedOut,
+			...(refreshError === undefined ? {} : { refreshError }),
+		});
+		return recovered;
 	}
 
 	launchConsolidationTask(ctx: LaunchCtx, work: () => Promise<void>): Promise<void> {