pi-observational-memory 3.0.4 → 3.1.3

package/README.md

@@ -173,6 +173,8 @@ This extension is especially useful when the session contains decisions that sho
 
 ## Install
 
+Requires Pi 0.81.0 or newer. Proactive compaction uses the `agent_settled` lifecycle event introduced in that release.
+
 ```bash
 pi install npm:pi-observational-memory
 ```
@@ -227,6 +229,8 @@ A typical config:
 
 Most users can start with the defaults and tune only if they have a specific reason.
 
+If your memory model is a local llama.cpp server, size `agentMaxTokens` so that a worst-case request (observer chunk + prior memory + system prompt + the full response budget) fits inside the server's context: slot KV is shared between the main session's retained cache and concurrent sub-agent requests, so an over-budget sub-agent request fails with `500 "Context size has been exceeded."` and the affected memory run aborts. For example, on a 64K-slot server, pairing `"agentMaxTokens": 8192` with a low `observerChunkMaxTokens` keeps sub-agent requests well inside the window.
+
 ### Scaling compaction to the model's context window
 
 By default `compactAfterTokensMode` is `"calibrated"`, so the proactive
@@ -280,6 +284,7 @@ on the `Next compaction` line regardless of mode.
 | `observationsPoolMaxTokens` | `20000`       | Observation-token budget used for compaction full-fold pressure.                                  |
 | `observationsPoolTargetTokens` | half of max | Active observation target used by post-reflection dropper maintenance.                            |
 | `agentMaxTurns`             | `16`          | Shared turn cap for background memory-agent loops.                                                |
+| `agentMaxTokens`            | `32000`       | Maximum output tokens requested for memory-agent loops (observer/reflector/dropper), clamped to the model's own `maxTokens` when available. Lower it for local servers with a modest context window, e.g. `8192`. |
 | `model`                     | session model | Optional memory-worker model override: `{ provider, id, thinking }`.                              |
 | `showWorkerNotifications`   | `true`        | Shows routine observer, reflector, and dropper progress notifications. Warnings and errors are unaffected. |
 | `passive`                   | `false`       | Disables proactive background observation, reflection, maintenance, and auto-compaction triggers. |
@@ -295,7 +300,7 @@ Valid `model.thinking` values are:
 * `xhigh`
 * `max`
 
-If no `model` is configured, memory workers use the session model.
+If no `model` is configured, memory workers use the session model, including custom `pi.registerProvider` APIs such as `cursor-sdk`. You do not need a second built-in provider (OpenAI, OpenRouter, …) for observational memory to run. Set `model` only when you want cheaper or faster workers than the coding agent.
 
 Set `showWorkerNotifications` to `false` to hide routine worker start and completion messages (including deliberate-empty observer info messages). Model fallback/unavailability, worker failures (including observer stream errors), compaction notifications, and explicit `/om:*` command output remain visible.
 
@@ -329,14 +334,14 @@ flowchart TD
     Turn[turn_end]
     Observe[Capture observations]
     Reflect[Distill reflections]
-    AgentEnd[agent_end]
+    AgentSettled[agent_settled]
     Trigger[auto-compaction trigger]
     Compact[session_before_compact]
     Summary[visible memory for Pi]
 
     Turn -->|observation due| Observe
     Turn -->|reflection due| Reflect
-    AgentEnd -->|compactAfterTokens and idle| Trigger --> Compact --> Summary
+    AgentSettled -->|compactAfterTokens and idle| Trigger --> Compact --> Summary
 ```
 
 The high-level lifecycle:
@@ -363,7 +368,7 @@ Current behavior:
 
 * **Observation-centered memory.** The extension records useful session observations while you work.
 * **Durable reflections.** The extension distills stable facts that help the agent stay oriented over time.
-* **Fast compaction.** `session_before_compact` does not call a model or wait for background workers. It renders the current prepared memory state.
+* **Fast compaction.** When prepared V3 memory exists, `session_before_compact` renders it without calling a model or waiting for background workers. An empty V3 projection delegates to Pi's native summarizer instead of replacing prior context with an empty summary.
 * **Background memory work.** Observation and reflection work run from `turn_end` when their token clocks are due; dropper work runs only after successful reflection and prunes the folded active observation ledger toward `observationsPoolTargetTokens`.
 * **Source-backed recall.** Observations and reflections can be traced back through the `recall` tool.
 * **Visible/full views.** `/om:view` shows visible memory and `/om:view full` shows the full current memory state. Use `/om:status` for visible-vs-full drift and for the separate visible observation pool vs active observation pool.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-observational-memory",
-  "version": "3.0.4",
+  "version": "3.1.3",
   "description": "Observational memory extension for pi — cache-friendly tiered compaction with observations and reflections.",
   "type": "module",
   "license": "MIT",

package/src/agents/dropper/agent.ts

@@ -1,11 +1,11 @@
 import { agentLoop, type AgentContext, type AgentLoopConfig, type AgentTool } from "@earendil-works/pi-agent-core";
 import type { Message, Model, ModelThinkingLevel } from "@earendil-works/pi-ai";
 import { Type } from "@earendil-works/pi-ai";
-import { streamSimple } from "@earendil-works/pi-ai/compat";
 import type { Static } from "typebox";
 import { debugLog } from "../../debug-log.js";
 import { AGENT_LOOP_MAX_TOKENS, boundedMaxTokens } from "../../model-budget.js";
 import { logAgentStreamError } from "../stream-errors.js";
+import { resolveWorkerStreamSimple, type StreamableModelRegistry, type WorkerStreamSimple } from "../worker-stream.js";
 import { reflectionToSummaryLine, type Observation, type Reflection } from "../../session-ledger/index.js";
 import { DROPPER_SYSTEM } from "./prompts.js";
 import {
@@ -41,13 +41,18 @@ interface RunDropperArgs {
 	model: Model<any>;
 	apiKey?: string;
 	headers?: Record<string, string>;
+	env?: Record<string, string>;
 	reflections: Reflection[];
 	observations: Observation[];
 	targetTokens: number;
 	signal?: AbortSignal;
 	agentLoop?: typeof agentLoop;
 	maxTurns?: number;
+	/** Maximum output tokens for the loop (defaults to {@link AGENT_LOOP_MAX_TOKENS}). */
+	maxOutputTokens?: number;
 	thinkingLevel?: ModelThinkingLevel;
+	modelRegistry?: StreamableModelRegistry;
+	streamSimple?: WorkerStreamSimple;
 }
 
 const RELEVANCE_DROP_RANK: Record<Observation["relevance"], number> = {
@@ -131,7 +136,7 @@ export function selectDropCandidates(
 }
 
 export async function runDropper(args: RunDropperArgs): Promise<string[] | undefined> {
-	const { model, apiKey, headers, reflections, observations, targetTokens, signal } = args;
+	const { model, apiKey, headers, env, reflections, observations, targetTokens, signal } = args;
 	if (observations.length === 0) return undefined;
 
 	const metrics = observationPoolMetrics(observations, targetTokens);
@@ -243,7 +248,8 @@ export async function runDropper(args: RunDropperArgs): Promise<string[] | undef
 		model,
 		apiKey,
 		headers,
-		maxTokens: boundedMaxTokens(model, AGENT_LOOP_MAX_TOKENS),
+		env,
+		maxTokens: boundedMaxTokens(model, args.maxOutputTokens ?? AGENT_LOOP_MAX_TOKENS),
 		convertToLlm: (msgs) => msgs as Message[],
 		toolExecution: "sequential",
 		...(reasoning && thinkingLevel !== "off" ? { reasoning: thinkingLevel } : {}),
@@ -251,7 +257,13 @@ export async function runDropper(args: RunDropperArgs): Promise<string[] | undef
 	};
 
 	const loop = args.agentLoop ?? agentLoop;
-	const stream = loop(prompts, context, config, signal, streamSimple);
+	const stream = loop(
+		prompts,
+		context,
+		config,
+		signal,
+		resolveWorkerStreamSimple(model, args.modelRegistry, args.streamSimple),
+	);
 	for await (const event of stream) {
 		// Tool execution collects candidate ids.
 		logAgentStreamError("dropper", event);

package/src/agents/observer/agent.ts

@@ -1,10 +1,10 @@
 import { agentLoop, type AgentContext, type AgentLoopConfig, type AgentTool } from "@earendil-works/pi-agent-core";
 import type { Message, Model, ModelThinkingLevel } from "@earendil-works/pi-ai";
 import { Type } from "@earendil-works/pi-ai";
-import { streamSimple } from "@earendil-works/pi-ai/compat";
 import type { Static } from "typebox";
 import { hashId } from "../../ids.js";
 import { logAgentStreamError } from "../stream-errors.js";
+import { resolveWorkerStreamSimple, type StreamableModelRegistry, type WorkerStreamSimple } from "../worker-stream.js";
 import { AGENT_LOOP_MAX_TOKENS, boundedMaxTokens } from "../../model-budget.js";
 import { OBSERVER_SYSTEM } from "./prompts.js";
 import { nowTimestamp, truncateRecordContent } from "../../serialize.js";
@@ -15,6 +15,7 @@ interface RunObserverArgs {
 	model: Model<any>;
 	apiKey?: string;
 	headers?: Record<string, string>;
+	env?: Record<string, string>;
 	priorReflections: string[];
 	priorObservations: string[];
 	chunk: string;
@@ -22,7 +23,11 @@ interface RunObserverArgs {
 	signal?: AbortSignal;
 	agentLoop?: typeof agentLoop;
 	maxTurns?: number;
+	/** Maximum output tokens for the loop (defaults to {@link AGENT_LOOP_MAX_TOKENS}). */
+	maxOutputTokens?: number;
 	thinkingLevel?: ModelThinkingLevel;
+	modelRegistry?: StreamableModelRegistry;
+	streamSimple?: WorkerStreamSimple;
 }
 
 const RelevanceSchema = Type.Union([
@@ -99,7 +104,7 @@ export function normalizeSourceEntryIds(
 }
 
 export async function runObserver(args: RunObserverArgs): Promise<Observation[] | undefined> {
-	const { model, apiKey, headers, priorReflections, priorObservations, chunk, allowedSourceEntryIds, signal } = args;
+	const { model, apiKey, headers, env, priorReflections, priorObservations, chunk, allowedSourceEntryIds, signal } = args;
 	const conversation = chunk.trim();
 	if (!conversation) return undefined;
 
@@ -193,7 +198,8 @@ ${conversation}`;
 		model,
 		apiKey,
 		headers,
-		maxTokens: boundedMaxTokens(model, AGENT_LOOP_MAX_TOKENS),
+		env,
+		maxTokens: boundedMaxTokens(model, args.maxOutputTokens ?? AGENT_LOOP_MAX_TOKENS),
 		convertToLlm: (msgs) => msgs as Message[],
 		toolExecution: "sequential",
 		...(reasoning && thinkingLevel !== "off" ? { reasoning: thinkingLevel } : {}),
@@ -208,7 +214,13 @@ ${conversation}`;
 	};
 
 	const loop = args.agentLoop ?? agentLoop;
-	const stream = loop(prompts, context, config, signal, streamSimple);
+	const stream = loop(
+		prompts,
+		context,
+		config,
+		signal,
+		resolveWorkerStreamSimple(model, args.modelRegistry, args.streamSimple),
+	);
 	let streamError: { stopReason: string; errorMessage?: string } | undefined;
 	for await (const event of stream) {
 		// Drain events; the tool's execute already collects records.

package/src/agents/reflector/agent.ts

@@ -1,11 +1,11 @@
 import { agentLoop, type AgentContext, type AgentLoopConfig, type AgentTool } from "@earendil-works/pi-agent-core";
 import type { Message, Model, ModelThinkingLevel } from "@earendil-works/pi-ai";
 import { Type } from "@earendil-works/pi-ai";
-import { streamSimple } from "@earendil-works/pi-ai/compat";
 import type { Static } from "typebox";
 import { debugLog } from "../../debug-log.js";
 import { hashId } from "../../ids.js";
 import { logAgentStreamError } from "../stream-errors.js";
+import { resolveWorkerStreamSimple, type StreamableModelRegistry, type WorkerStreamSimple } from "../worker-stream.js";
 import { AGENT_LOOP_MAX_TOKENS, boundedMaxTokens } from "../../model-budget.js";
 import { truncateRecordContent } from "../../serialize.js";
 import { REFLECTOR_SYSTEM } from "./prompts.js";
@@ -23,12 +23,17 @@ interface RunReflectorArgs {
 	model: Model<any>;
 	apiKey?: string;
 	headers?: Record<string, string>;
+	env?: Record<string, string>;
 	reflections: Reflection[];
 	observations: Observation[];
 	signal?: AbortSignal;
 	agentLoop?: typeof agentLoop;
 	maxTurns?: number;
+	/** Maximum output tokens for the loop (defaults to {@link AGENT_LOOP_MAX_TOKENS}). */
+	maxOutputTokens?: number;
 	thinkingLevel?: ModelThinkingLevel;
+	modelRegistry?: StreamableModelRegistry;
+	streamSimple?: WorkerStreamSimple;
 }
 
 const RecordReflectionsSchema = Type.Object({
@@ -105,7 +110,7 @@ function normalizeReflectionContent(content: string): string | undefined {
 }
 
 export async function runReflector(args: RunReflectorArgs): Promise<Reflection[] | undefined> {
-	const { model, apiKey, headers, reflections, observations, signal } = args;
+	const { model, apiKey, headers, env, reflections, observations, signal } = args;
 	if (observations.length === 0) return undefined;
 
 	const coverageById = reflectionCoverageMap(observations, reflections);
@@ -176,7 +181,8 @@ export async function runReflector(args: RunReflectorArgs): Promise<Reflection[]
 		model,
 		apiKey,
 		headers,
-		maxTokens: boundedMaxTokens(model, AGENT_LOOP_MAX_TOKENS),
+		env,
+		maxTokens: boundedMaxTokens(model, args.maxOutputTokens ?? AGENT_LOOP_MAX_TOKENS),
 		convertToLlm: (msgs) => msgs as Message[],
 		toolExecution: "sequential",
 		...(reasoning && thinkingLevel !== "off" ? { reasoning: thinkingLevel } : {}),
@@ -184,7 +190,13 @@ export async function runReflector(args: RunReflectorArgs): Promise<Reflection[]
 	};
 
 	const loop = args.agentLoop ?? agentLoop;
-	const stream = loop(prompts, context, config, signal, streamSimple);
+	const stream = loop(
+		prompts,
+		context,
+		config,
+		signal,
+		resolveWorkerStreamSimple(model, args.modelRegistry, args.streamSimple),
+	);
 	for await (const event of stream) {
 		// Tool execution collects records.
 		logAgentStreamError("reflector", event);

package/src/agents/worker-stream.ts

@@ -0,0 +1,57 @@
+import type { AssistantMessageEventStream, Context, Model, SimpleStreamOptions } from "@earendil-works/pi-ai";
+import { streamSimple as compatStreamSimple } from "@earendil-works/pi-ai/compat";
+
+export type WorkerStreamSimple = (
+	model: Model<any>,
+	context: Context,
+	options?: SimpleStreamOptions,
+) => AssistantMessageEventStream;
+
+/**
+ * Duck-typed subset of Pi's extension ModelRegistry.
+ *
+ * `streamSimple` is the host-composed path (Pi #8964). Until that lands on the
+ * facade, `getRegisteredProviderConfig` exposes each `registerProvider`
+ * `streamSimple` handler by provider id. Use only the model's exact provider
+ * and require matching API metadata as a consistency check.
+ */
+export type StreamableModelRegistry = {
+	streamSimple?: WorkerStreamSimple;
+	getRegisteredProviderConfig?: (providerId: string) => {
+		api?: string;
+		streamSimple?: WorkerStreamSimple;
+	} | undefined;
+};
+
+/**
+ * Resolve the stream function background workers must pass to `agentLoop`.
+ *
+ * Direct `@earendil-works/pi-ai/compat` `streamSimple` only knows built-in API
+ * ids. Custom providers (`cursor-sdk`, `cliproxyapi-*`, commandcode, …) live on
+ * Pi's composed runtime. Using compat after a successful foreground turn is
+ * what crashes Pi with `No API provider registered for api: …` (#30).
+ */
+export function resolveWorkerStreamSimple(
+	model: Model<any>,
+	modelRegistry?: StreamableModelRegistry | null,
+	override?: WorkerStreamSimple,
+): WorkerStreamSimple {
+	if (override) return override;
+
+	const registryStream = modelRegistry?.streamSimple;
+	if (typeof registryStream === "function") {
+		return (nextModel, context, options) => registryStream(nextModel, context, options);
+	}
+
+	try {
+		const config = modelRegistry?.getRegisteredProviderConfig?.(model.provider);
+		const composed = config?.streamSimple;
+		if (config?.api === model.api && typeof composed === "function") {
+			return composed;
+		}
+	} catch {
+		// Incomplete host/test doubles still use the built-in compat dispatcher.
+	}
+
+	return compatStreamSimple;
+}

package/src/config.ts

@@ -45,6 +45,14 @@ export interface Config {
 	observationsPoolMaxTokens: number;
 	observationsPoolTargetTokens: number;
 	agentMaxTurns: number;
+	/**
+	 * Maximum output tokens requested for background memory-agent loops
+	 * (observer/reflector/dropper). Always clamped to the model's own
+	 * `maxTokens` when available. Lower it for local servers with a modest
+	 * context window, where concurrent sub-agent requests share KV with the
+	 * main session and the default 32K response budget can overflow the slot.
+	 */
+	agentMaxTokens: number;
 	model?: ConfiguredModel;
 	showWorkerNotifications: boolean;
 	passive: boolean;
@@ -60,6 +68,7 @@ export const DEFAULTS: Config = {
 	observationsPoolMaxTokens: 20_000,
 	observationsPoolTargetTokens: 10_000,
 	agentMaxTurns: 16,
+	agentMaxTokens: 32_000,
 	showWorkerNotifications: true,
 	passive: false,
 	debugLog: false,
@@ -189,6 +198,7 @@ function normalizeSettingsConfig(value: Record<string, unknown>): Partial<Config
 		"observationsPoolMaxTokens",
 		"observationsPoolTargetTokens",
 		"agentMaxTurns",
+		"agentMaxTokens",
 	] as const;
 	for (const key of numberKeys) {
 		const normalizedValue = positiveIntegerOrUndefined(value[key]);

package/src/hooks/compaction-hook.ts

@@ -1,4 +1,8 @@
-import type { ExtensionAPI } from "@earendil-works/pi-coding-agent";
+import type {
+	ExtensionAPI,
+	ExtensionContext,
+	SessionBeforeCompactEvent,
+} from "@earendil-works/pi-coding-agent";
 
 import type { Runtime } from "../runtime.js";
 import { buildCompactionProjection, renderSummary, type Entry } from "../session-ledger/index.js";
@@ -13,7 +17,7 @@ function observationsPoolMaxTokens(runtime: Runtime): number {
 }
 
 export function registerCompactionHook(pi: ExtensionAPI, runtime: Runtime): void {
-	pi.on("session_before_compact", async (event: any, ctx: any) => {
+	pi.on("session_before_compact", async (event: SessionBeforeCompactEvent, ctx: ExtensionContext) => {
 		if (runtime.compactHookInFlight) {
 			if (ctx.hasUI) {
 				ctx.ui.notify(
@@ -35,6 +39,10 @@ export function registerCompactionHook(pi: ExtensionAPI, runtime: Runtime): void
 				{ observationsPoolMaxTokens: observationsPoolMaxTokens(runtime) },
 			);
 			const summary = renderSummary(projection.reflections, projection.observations);
+			if (summary.length === 0) {
+				// Decline ownership so Pi's native summarizer preserves the pre-cut context.
+				return;
+			}
 
 			return {
 				compaction: {

package/src/hooks/compaction-trigger.ts

@@ -3,35 +3,14 @@ import { resolveCompactAfterTokens } from "../config.js";
 import { rawTokensSinceLastCompaction, type Entry } from "../session-ledger/index.js";
 import type { Runtime } from "../runtime.js";
 
-/**
- * Regex matching Pi's internal retryable error detection.
- * When the last assistant message in agent_end has stopReason "error" matching this pattern,
- * Pi will auto-retry — we must not trigger compaction between attempts.
- */
-const RETRYABLE_ERROR_RE =
-	/overloaded|provider.?returned.?error|rate.?limit|too many requests|429|500|502|503|504|service.?unavailable|server.?error|internal.?error|network.?error|connection.?error|connection.?refused|connection.?lost|websocket.?closed|websocket.?error|other side closed|fetch failed|upstream.?connect|reset before headers|socket hang up|ended without|http2 request did not get a response|timed? out|timeout|terminated|retry delay/i;
-
 export function registerCompactionTrigger(pi: ExtensionAPI, runtime: Runtime): void {
-	pi.on("agent_end", (event: any, ctx: any) => {
+	// Pi emits agent_settled only after retries, automatic compaction, and queued
+	// continuation have finished, so retry policy stays owned by Pi.
+	pi.on("agent_settled", (_event, ctx) => {
 		runtime.ensureConfig(ctx.cwd);
 		if (runtime.config.passive === true) return;
 		if (runtime.compactInFlight) return;
 
-		// Don't trigger compaction if Pi will auto-retry — the agent hasn't truly finished.
-		// Pi emits agent_end before its own retry check, so we must detect this ourselves.
-		// The next agent_end (after retry succeeds or exhausts attempts) will re-evaluate.
-		const lastAssistant = [...event.messages].reverse().find(
-			(m): m is Extract<typeof m, { role: "assistant" }> => m.role === "assistant",
-		);
-		if (
-			lastAssistant
-			&& lastAssistant.stopReason === "error"
-			&& lastAssistant.errorMessage
-			&& RETRYABLE_ERROR_RE.test(lastAssistant.errorMessage)
-		) {
-			return;
-		}
-
 		const entries = ctx.sessionManager?.getBranch?.() as Entry[] | undefined;
 		if (!entries) return;
 		const progress = rawTokensSinceLastCompaction(entries);

package/src/hooks/consolidation-trigger.ts

@@ -124,6 +124,22 @@ function makeModelResolver(runtime: Runtime, ctx: ConsolidationCtx): (stage: "ob
 		});
 		if (cached.ok) {
 			runtime.resolveFailureNotified = false;
+			// Console Go (opencode.ai) rejects requests without x-opencode-session
+			// (400 MissingSessionID). Mirror pi's own session headers on worker calls.
+			const model = (cached.model ?? {}) as { provider?: string; baseUrl?: string };
+			if (model.provider === "opencode" || model.provider === "opencode-go" || (typeof model.baseUrl === "string" && model.baseUrl.includes("opencode.ai"))) {
+				const sessionId = ctx.sessionManager.getSessionId?.();
+				if (sessionId) {
+					return {
+						...cached,
+						headers: {
+							...(cached.headers ?? {}),
+							"x-opencode-session": sessionId,
+							"x-opencode-client": "pi",
+						},
+					};
+				}
+			}
 			return cached;
 		}
 		debugLog(`${stage}.model_unavailable`, { reason: cached.reason });
@@ -311,12 +327,15 @@ async function runObserverStage(
 			model: resolved.model as any,
 			apiKey: resolved.apiKey,
 			headers: resolved.headers,
+			env: resolved.env,
 			priorReflections,
 			priorObservations,
 			chunk,
 			allowedSourceEntryIds: sourceEntryIds,
 			maxTurns: runtime.config.agentMaxTurns,
+			maxOutputTokens: runtime.config.agentMaxTokens,
 			thinkingLevel: runtime.config.model?.thinking ?? "low",
+			modelRegistry: ctx.modelRegistry,
 		});
 	} catch (error) {
 		if (error instanceof ObserverStreamError) {
@@ -383,10 +402,13 @@ async function runReflectorStage(
 		model: resolved.model as any,
 		apiKey: resolved.apiKey,
 		headers: resolved.headers,
+		env: resolved.env,
 		reflections: folded.reflections,
 		observations: folded.activeObservations,
 		maxTurns: runtime.config.agentMaxTurns,
+		maxOutputTokens: runtime.config.agentMaxTokens,
 		thinkingLevel: runtime.config.model?.thinking ?? "low",
+		modelRegistry: ctx.modelRegistry,
 	});
 	if (!reflections) return { outcome: "continue", sameRunReflections: [] };
 
@@ -455,11 +477,14 @@ async function runDropperStage(
 		model: resolved.model as any,
 		apiKey: resolved.apiKey,
 		headers: resolved.headers,
+		env: resolved.env,
 		reflections: reflectionsForDropper,
 		observations: folded.activeObservations,
 		targetTokens: runtime.config.observationsPoolTargetTokens,
 		maxTurns: runtime.config.agentMaxTurns,
+		maxOutputTokens: runtime.config.agentMaxTokens,
 		thinkingLevel: runtime.config.model?.thinking ?? "low",
+		modelRegistry: ctx.modelRegistry,
 	});
 	const coversUpToId = earlierCoverageMarkerId(entries, observationCoverageId, sameRunReflectionCoverageId);
 	const data = coversUpToId && droppedIds ? buildObservationsDroppedData(droppedIds, coversUpToId) : undefined;

package/src/runtime.ts

@@ -1,7 +1,8 @@
 import { type Config, DEFAULTS, loadConfig } from "./config.js";
+import { debugLog } from "./debug-log.js";
 
 export type ResolveResult =
-	| { ok: true; model: unknown; apiKey?: string; headers?: Record<string, string> }
+	| { ok: true; model: unknown; apiKey?: string; headers?: Record<string, string>; env?: Record<string, string>; baseUrl?: string }
 	| { ok: false; reason: string };
 
 /**
@@ -10,21 +11,79 @@ export type ResolveResult =
  * OAuth providers (kimi-coding, xai, openai-codex, anthropic OAuth, …) authenticate via
  * `toAuth()` returning `{ headers: { Authorization: "Bearer …" } }` with no apiKey, and
  * pi-ai providers accept a caller-supplied Authorization header in place of an apiKey.
+ *
+ * NOTE: a `false` result does NOT mean "unauthenticated" — see `resolveModel`. Providers
+ * that authenticate at request time (Amazon Bedrock SigV4 from AWS_PROFILE/SSO, Google
+ * Vertex ADC) legitimately expose neither an apiKey nor a header, because pi signs their
+ * requests itself.
  */
 function hasUsableAuth(auth: { apiKey?: unknown; headers?: unknown }): boolean {
 	if (typeof auth.apiKey === "string" && auth.apiKey.length > 0) return true;
-	if (auth.headers && typeof auth.headers === "object") {
-		return Object.values(auth.headers as Record<string, unknown>).some(
-			(value) => typeof value === "string" && value.length > 0,
-		);
-	}
-	return false;
+	return countUsableHeaders(auth.headers) > 0;
+}
+
+/** How many headers the auth payload carries at all (diagnostics only, never values). */
+function countHeaders(headers: unknown): number {
+	return headers && typeof headers === "object" ? Object.keys(headers as Record<string, unknown>).length : 0;
 }
 
+/** How many headers carry a non-empty string value — the ones pi could actually send. */
+function countUsableHeaders(headers: unknown): number {
+	if (!headers || typeof headers !== "object") return 0;
+	return Object.values(headers as Record<string, unknown>).filter(
+		(value) => typeof value === "string" && value.length > 0,
+	).length;
+}
+
+/**
+ * How long to wait for the availability re-check in `recheckProviderCredential`, and how
+ * long before the same provider may be re-checked again.
+ *
+ * The re-check is network-free and measured at ~1ms on a warm Bedrock/SSO host, but
+ * `checkAuth` can block on a provider's own credential resolution, so it is bounded. The
+ * re-arm interval keeps an unauthenticated host from paying the cost on every
+ * consolidation while still recovering within a session when credentials are renewed out
+ * of band (`aws sso login` in another terminal, `gcloud auth application-default login`).
+ */
+const AVAILABILITY_RECHECK_TIMEOUT_MS = 5_000;
+const AVAILABILITY_RECHECK_REARM_MS = 60_000;
+
 type NotifyLevel = "warning" | "info" | "error";
 type Notify = (message: string, type?: NotifyLevel) => void;
 export type ConsolidationPhase = "observer" | "reflector" | "dropper";
 
+/**
+ * Whether pi positively reports a working credential source for this model's provider.
+ *
+ * `ModelRegistry.hasConfiguredAuth(model)` is true when pi's availability check
+ * (`ModelRuntime.checkAuth`) resolved *something* for the provider — an API key, a
+ * stored credential, or an ambient source such as `AWS_PROFILE` / `AWS_ACCESS_KEY_ID`
+ * / gcloud ADC. Combined with `auth.ok === true` and an auth payload that carries
+ * nothing, that is the signature of a provider pi signs at request time:
+ *
+ *   pi has a credential source, and deliberately hands the caller nothing to attach.
+ *
+ * Measured on a Bedrock/SSO host (pi 0.84.2), with `AWS_PROFILE` exported:
+ *   checkAuth("amazon-bedrock") -> { source: "AWS_PROFILE", type: "api_key" }
+ *   hasConfiguredAuth(model)    -> true
+ *   getApiKeyAndHeaders(model)  -> { ok: true, apiKey: undefined, headers: undefined }
+ * `googleVertexProvider`'s ADC branch returns the same empty-auth resolution.
+ *
+ * The inverse case — `hasConfiguredAuth === false` with an empty auth payload — is a
+ * provider pi could not authenticate at all (no key, no ambient source). That must
+ * keep failing: it is the ordinary "not logged in" state, not ambient auth.
+ *
+ * Defensive: older pi versions and partial test doubles may not expose this, and an
+ * unknown answer must not be read as "authenticated".
+ */
+function hasConfiguredProviderCredential(registry: unknown, model: unknown): boolean {
+	try {
+		return (registry as { hasConfiguredAuth?: (m: unknown) => unknown }).hasConfiguredAuth?.(model) === true;
+	} catch {
+		return false;
+	}
+}
+
 export interface ResolveCtx {
 	model: unknown;
 	modelRegistry: any;
@@ -49,6 +108,8 @@ export class Runtime {
 	lastObserverError: string | undefined;
 	lastReflectorError: string | undefined;
 	lastDropperError: string | undefined;
+	/** provider -> epoch ms of the last availability re-check (see `recheckProviderCredential`). */
+	availabilityRecheckedAt = new Map<string, number>();
 	/** Deliberate-empty backoff (#23): skip observer re-fires over the same span until enough new tokens arrive. */
 	observerEmptyBackoff: {
 		sessionIdentity: string | undefined;
@@ -78,14 +139,148 @@ export class Runtime {
 		if (!model) return { ok: false, reason: "no model available (session has no model and no observational-memory model configured)" };
 		const auth = await ctx.modelRegistry.getApiKeyAndHeaders(model);
 		const provider = (model as { provider?: string }).provider ?? "unknown";
-		if (!auth.ok || !hasUsableAuth(auth)) {
-			const isOAuth = ctx.modelRegistry.isUsingOAuth?.(model) === true;
+		const isOAuth = ctx.modelRegistry.isUsingOAuth?.(model) === true;
+		// `auth.ok === false` is the only unambiguous failure: pi returns it when a
+		// provider requires a request auth header and no credential resolved.
+		//
+		// `auth.ok === true` with neither apiKey nor headers, for a provider pi DOES
+		// report a credential source for, is not a failure — it is how pi describes a
+		// provider that authenticates at request time: Amazon Bedrock signing SigV4 from
+		// ambient AWS credentials (`bedrockAuth.resolve` returns `{ auth: {}, source:
+		// "AWS_PROFILE" }`), Google Vertex using ADC (same empty resolution). pi's own
+		// native streaming path forwards no apiKey either, and its pre-prompt gate is
+		// merely `hasConfiguredAuth(provider) || checkAuth(provider) !== undefined` —
+		// om's pre-flight check must not be stricter than pi's own. Treating it as "no
+		// auth" aborted consolidation before the model was ever called, disabling
+		// observational memory silently — no error, no cost, no latency — on such hosts.
+		//
+		// Three cases deliberately keep failing: OAuth providers, where an empty
+		// resolution means the credentials no longer resolve and the user must log in
+		// again; a credential that resolved to an empty *string* key, which is a
+		// misconfiguration rather than ambient auth; and a provider pi reports no
+		// credential source for at all, which is simply unauthenticated.
+		const usable = hasUsableAuth(auth);
+		const resolvedEmptyApiKey = typeof auth.apiKey === "string" && auth.apiKey.length === 0;
+		let providerCredentialConfigured = hasConfiguredProviderCredential(ctx.modelRegistry, model);
+		// pi's gate has TWO halves and never trusts the snapshot alone (agent-session.js):
+		//
+		//   hasConfiguredAuth(provider) || (await checkAuth(provider)) !== undefined
+		//
+		// `hasConfiguredAuth` reads `snapshot.configuredProviders`, which is populated by an
+		// availability pass — and left untouched when that pass is skipped
+		// (`refreshOnCreate: false`), aborted, or FAILS (its catch records `availabilityError`
+		// and returns). A provider whose credential could not be checked at startup — an
+		// expired SSO token, say — is therefore absent from the snapshot for the rest of the
+		// session, even after the user renews it out of band. pi recovers on the next turn
+		// because its second half re-checks live; reading only the snapshot half would leave
+		// consolidation dead for the whole session, which is the same silent-failure class as
+		// the bug this gate was fixed for.
+		//
+		// The facade exposes no `checkAuth`, but `refresh({ providers })` performs the same
+		// live check and then updates the snapshot, so re-reading afterwards is equivalent.
+		// Only attempted when everything else already looks like the ambient shape, so an
+		// ordinary unauthenticated provider still fails on the first call.
+		if (auth.ok === true && !usable && !isOAuth && !resolvedEmptyApiKey && !providerCredentialConfigured) {
+			providerCredentialConfigured = await this.recheckProviderCredential(ctx.modelRegistry, model, provider);
+		}
+		const signsAtRequestTime =
+			auth.ok === true && !isOAuth && !resolvedEmptyApiKey && providerCredentialConfigured;
+		if (!auth.ok || (!usable && !signsAtRequestTime)) {
 			const reason = isOAuth
 				? `authentication failed for provider "${provider}" — OAuth credentials may have expired; run '/login ${provider}' to re-authenticate`
 				: `no API key or auth headers for provider "${provider}"`;
+			// The reason string alone cannot tell `ok: false` from `ok: true` with nothing to
+			// carry, which is what made the ambient-credential outage un-diagnosable from the
+			// debug log. Record the decision inputs — booleans and counts only, never values.
+			debugLog("resolve.rejected", {
+				provider,
+				reason,
+				authOk: auth.ok === true,
+				hasApiKey: typeof auth.apiKey === "string" && auth.apiKey.length > 0,
+				resolvedEmptyApiKey,
+				headerCount: countHeaders(auth.headers),
+				usableHeaderCount: countUsableHeaders(auth.headers),
+				isOAuth,
+				providerCredentialConfigured,
+				signsAtRequestTime,
+			});
 			return { ok: false, reason };
 		}
-		return { ok: true, model, apiKey: auth.apiKey as string | undefined, headers: auth.headers as Record<string, string> | undefined };
+		if (!usable) {
+			debugLog("resolve.request_time_signing", { provider, providerCredentialConfigured });
+		}
+		// Match pi's request model: OAuth may route to an account-specific endpoint
+		// (e.g. Copilot Business). Do not mutate the shared session/registry model.
+		const requestModel = auth.baseUrl ? { ...(model as object), baseUrl: auth.baseUrl } : model;
+		return {
+			ok: true,
+			model: requestModel,
+			apiKey: auth.apiKey as string | undefined,
+			headers: auth.headers as Record<string, string> | undefined,
+			env: auth.env as Record<string, string> | undefined,
+			baseUrl: auth.baseUrl as string | undefined,
+		};
+	}
+
+	/**
+	 * Re-check one provider's credential live, then re-read pi's snapshot.
+	 *
+	 * Implements the second half of pi's own auth gate for the only case that needs it: an
+	 * otherwise-ambient-looking resolution whose provider is missing from a stale or never
+	 * populated availability snapshot. Bounded and rate-limited; never throws.
+	 */
+	private async recheckProviderCredential(registry: unknown, model: unknown, provider: string): Promise<boolean> {
+		const last = this.availabilityRecheckedAt.get(provider);
+		const now = Date.now();
+		if (last !== undefined && now - last < AVAILABILITY_RECHECK_REARM_MS) return false;
+		this.availabilityRecheckedAt.set(provider, now);
+
+		const refresh = (registry as { refresh?: (options?: unknown) => Promise<unknown> }).refresh;
+		if (typeof refresh !== "function") {
+			debugLog("resolve.availability_recheck", { provider, refreshed: false, reason: "registry exposes no refresh()" });
+			return false;
+		}
+
+		const controller = new AbortController();
+		const timer = setTimeout(() => controller.abort(), AVAILABILITY_RECHECK_TIMEOUT_MS);
+		let refreshError: string | undefined;
+		let timedOut = false;
+		try {
+			// allowNetwork:false — a credential re-check must not wait on a model-catalog fetch.
+			// providers:[provider] — scope the work, and the snapshot writes, to the one provider.
+			//
+			// Both are honoured from pi 0.84; on pi 0.81 the facade is `refresh()` with no
+			// parameters, delegating to `runtime.reloadConfig()`, which reloads models.json and
+			// then runs a FULL, network-permitted availability pass. Passing the options is
+			// harmless there, but the work is wider and slower — hence the race below rather
+			// than relying on the abort signal, which that version never sees.
+			await Promise.race([
+				refresh.call(registry, { allowNetwork: false, providers: [provider], signal: controller.signal }),
+				new Promise<void>((resolve) => {
+					controller.signal.addEventListener("abort", () => {
+						timedOut = true;
+						resolve();
+					});
+				}),
+			]);
+		} catch (error) {
+			refreshError = error instanceof Error ? error.message : String(error);
+		} finally {
+			clearTimeout(timer);
+		}
+
+		// Re-read even when the refresh reported an error or timed out: a scoped pass can
+		// update the snapshot for this provider and still fail elsewhere.
+		const recovered = hasConfiguredProviderCredential(registry, model);
+		debugLog("resolve.availability_recheck", {
+			provider,
+			refreshed: refreshError === undefined && !timedOut,
+			recovered,
+			elapsedMs: Date.now() - now,
+			timedOut,
+			...(refreshError === undefined ? {} : { refreshError }),
+		});
+		return recovered;
 	}
 
 	launchConsolidationTask(ctx: LaunchCtx, work: () => Promise<void>): Promise<void> {