pi-ui-extend 1.0.39 → 1.0.41

package/external/pi-tools-suite/src/dcp/index.ts

@@ -8,16 +8,18 @@ import {
 	createState,
 	resetState,
 	createInputFingerprint,
-	restoreState,
-	inheritCompressionBlocks,
 } from "./state.js"
 import {
-	cleanupStaleDcpStateFiles,
-	loadDcpState,
-	loadDcpStateFromSessionFile,
-	resetDcpPersistenceDedup,
-	saveDcpState,
-} from "./state-persistence.js"
+	appendDcpJournalDelta,
+	appendDcpJournalOperation,
+	buildDcpJournalDelta,
+	createDcpJournalInit,
+	createDcpJournalMirror,
+	DcpJournalError,
+	readDcpJournalBranch,
+	replayDcpJournal,
+	type DcpJournalMirror,
+} from "./journal.js"
 import {
 	SYSTEM_PROMPT,
 	MANUAL_MODE_SYSTEM_PROMPT,
@@ -28,9 +30,9 @@ import {
 } from "./prompts.js"
 import {
 	applyPruning,
-	injectNudge,
 	getNudgeType,
 	detectCompressionCandidate,
+	detectEmergencyCompressionCandidate,
 	detectMessageCompressionCandidates,
 	analyzeEmergencyCurrentTurn,
 	emergencyPressureState,
@@ -39,25 +41,37 @@ import {
 	appendConcreteNudgeGuidance,
 	applyAnchoredNudges,
 	clearDcpNudgeAnchors,
+	hasCacheSafeNudgeCarrier,
 	nudgeTypeLabel,
 	upsertNudgeAnchor,
 	getActiveSummaryTokenEstimate,
 	resolveContextThresholds,
 	estimateTokens,
 } from "./pruner.js"
-import { stripStaleDcpMetadataFromMessage } from "./pruner-metadata.js"
+import { estimateMessageTokens, stripStaleDcpMetadataFromMessage } from "./pruner-metadata.js"
 import { summarizeDcpState, writeDcpDebugLog } from "./debug-log.js"
 import type { DcpNudgeType } from "./pruner-types.js"
 import { registerCompressTool } from "./compress-tool.js"
-import { decideAutoCompress, createAutoCompressionBlock } from "./auto-compress.js"
+import {
+	AutoCompressionBlockedError,
+	decideAutoCompress,
+	createAutoCompressionBlock,
+} from "./auto-compress.js"
 import { DCP_STATS_MESSAGE_TYPE, registerCommands } from "./commands.js"
 import { normalizeDcpContextUsage } from "./ui.js"
 import { safeGetContextUsage } from "../context-usage.js"
 import {
 	collectProviderToolResultEvidence,
 	providerPayloadIncludesToolResult,
+	providerPayloadIncludesReminder,
+	providerPayloadRevision,
+	ProviderEvidenceTracker,
 } from "./provider-tool-results.js"
-import { reconcileInheritedCompressionBlocks } from "./pruner-compression-blocks.js"
+import { rehydrateToolRecordsFromMessages } from "./recovery.js"
+import { inferDcpBlockedReason, planDcpBudget } from "./progress-controller.js"
+import { createBudgetedAutoCompressionBlock } from "./auto-compress-budget.js"
+import { outstandingCompressionTokens, resetCompressionProgress, routineRecoveryTokens, trackCompressionProgress } from "./compression-progress.js"
+import { captureDcpTransactionGuard, cloneDcpTransactionState, runDcpStateTransaction, invalidateDcpStateOwner } from "./state-transaction.js"
 
 // ---------------------------------------------------------------------------
 // Helpers
@@ -103,10 +117,8 @@ function isUserVisibleOnlyMessage(message: any): boolean {
 	return message.details?.userVisibleOnly === true
 }
 
-// Control-plane custom message types filtered out of the transcript.
-// `dcp-message-ids` is retained only for backward-compat with logs written by
-// the removed inline control-message path.
-const DCP_CONTROL_PLANE_CUSTOM_TYPES = new Set(["dcp-state", "dcp-nudge", "dcp-message-ids"])
+// Diagnostic DCP custom messages are never provider context.
+const DCP_CONTROL_PLANE_CUSTOM_TYPES = new Set(["dcp-nudge"])
 const SUMMARY_BUFFER_MAX_CONTEXT_BONUS = 0.05
 
 function isDcpControlPlaneMessage(message: any): boolean {
@@ -117,9 +129,9 @@ function isDcpControlPlaneMessage(message: any): boolean {
 // Module export
 // ---------------------------------------------------------------------------
 
-export default async function dcpModule(pi: ExtensionAPI): Promise<void> {
+export default async function dcpModule(pi: ExtensionAPI, dependencies: { config?: ReturnType<typeof loadConfig>; state?: ReturnType<typeof createState> } = {}): Promise<void> {
 	// ── 1. Load config ────────────────────────────────────────────────────────
-	const config = loadConfig()
+	const config = dependencies.config ?? loadConfig()
 	const configForContext = (ctx: unknown) => resolveModelConfig(config, modelKeysFromContext(ctx))
 	const hasEnabledModelOverride = Object.values(config.modelOverrides).some(
 		(override) => override.enabled === true,
@@ -128,9 +140,123 @@ export default async function dcpModule(pi: ExtensionAPI): Promise<void> {
 	if (!config.enabled && !hasEnabledModelOverride) return
 
 	// ── 2. Create state ───────────────────────────────────────────────────────
-	const state = createState()
-	let pendingInheritedBlockReconciliation = false
-	const pendingProviderToolIds = new Set<string>()
+	const state = dependencies.state ?? createState()
+	let journalMirror: DcpJournalMirror | undefined
+	let journalSupported = false
+	let journalBlockedReason: string | undefined
+	let journalPersistent = false
+	const providerEvidenceTracker = new ProviderEvidenceTracker()
+	let providerEvidenceCommitQueue = Promise.resolve()
+	let latestProviderOpportunityAvailable = false
+	let latestProviderOpportunityKind: "routine" | "emergency" | undefined
+	let latestProviderReminder: string | undefined
+	const warnedProgress = new Set<string>()
+	const isJournalSessionSupported = () => journalSupported && journalBlockedReason === undefined
+	const persistJournalState = async (
+		ctx: ExtensionContext,
+		targetState: ReturnType<typeof createState>,
+		publication: { beforePublish?: () => void; onPublished?: () => void } = {},
+	): Promise<void> => {
+		if (!isJournalSessionSupported() || !journalMirror) {
+			throw new DcpJournalError(journalBlockedReason ?? "DCP journal is not initialized for this session")
+		}
+		if (!journalPersistent) {
+			const delta = buildDcpJournalDelta(targetState, journalMirror)
+			if (!delta) return
+			publication.beforePublish?.()
+			journalMirror = createDcpJournalMirror(targetState, delta.operationId)
+			publication.onPublished?.()
+			return
+		}
+		journalMirror = appendDcpJournalDelta(pi, ctx, targetState, journalMirror, publication)
+	}
+	const branchHasConversation = (branch: readonly any[]): boolean => branch.some((entry) =>
+		entry?.type === "message" || entry?.type === "custom_message" || entry?.type === "compaction" || entry?.type === "branch_summary",
+	)
+	const loadJournalState = async (ctx: ExtensionContext, allowInitialize: boolean): Promise<void> => {
+		journalMirror = undefined
+		journalSupported = false
+		journalBlockedReason = undefined
+		journalPersistent = false
+		const branch = await readDcpJournalBranch(ctx)
+		const manager = ctx.sessionManager as any
+		const persistentSession = (typeof manager.isPersisted === "function" && manager.isPersisted())
+			|| (typeof manager.getSessionFile === "function" && Boolean(manager.getSessionFile()))
+		try {
+			const replay = replayDcpJournal(branch, state)
+			if (replay.initialized && replay.lastOperationId) {
+				journalSupported = true
+				journalPersistent = persistentSession
+				journalMirror = createDcpJournalMirror(state, replay.lastOperationId)
+				return
+			}
+			if (allowInitialize && !branchHasConversation(branch)) {
+				const init = createDcpJournalInit()
+				if (persistentSession) appendDcpJournalOperation(pi, ctx, init)
+				journalSupported = true
+				journalPersistent = persistentSession
+				journalMirror = createDcpJournalMirror(state, init.operationId)
+				return
+			}
+			// Clean break: a pre-journal conversation is deliberately unsupported.
+			// Do not inspect external state, infer prior blocks, or create a
+			// compatibility checkpoint from existing history.
+			journalSupported = false
+		} catch (error) {
+			journalBlockedReason = error instanceof Error ? error.message : String(error)
+			journalSupported = false
+			journalMirror = undefined
+		}
+	}
+	const ensureEphemeralJournal = (ctx: ExtensionContext): void => {
+		if (journalSupported || journalBlockedReason) return
+		const manager = ctx.sessionManager as any
+		const persisted = typeof manager.isPersisted === "function" ? manager.isPersisted() : false
+		const sessionFile = typeof manager.getSessionFile === "function" ? manager.getSessionFile() : undefined
+		if (persisted || sessionFile) return
+		let branch: unknown[] = []
+		try {
+			const current = manager.getBranch?.()
+			branch = Array.isArray(current) ? current : []
+		} catch { return }
+		if (branch.length > 0) return
+		const init = createDcpJournalInit()
+		journalSupported = true
+		journalPersistent = false
+		journalMirror = createDcpJournalMirror(state, init.operationId)
+	}
+	const warnProgress = (ctx: ExtensionContext, reason: string, message: string) => {
+		const key = `${state.sessionEpoch}:${reason}`
+		if (warnedProgress.has(key)) return
+		warnedProgress.add(key)
+		writeDcpDebugLog(configForContext(ctx), "context.progress_warning", { reason, message }, ctx)
+		try {
+			pi.appendEntry("dcp-nudge", {
+				event: "progress-blocked", reason, message,
+				ignoredOpportunities: state.consecutiveIgnoredNudges,
+				remainingRecoveryTokens: state.compressionProgress?.remainingTokens,
+				createdAt: Date.now(),
+			})
+		} catch { /* Diagnostic only; do not turn an explicit blocked state into an extension failure. */ }
+		try { ctx.ui.notify(message, "warning") } catch { /* Headless/notification failure is not a persistence failure. */ }
+	}
+	const invalidateOwner = () => {
+			invalidateDcpStateOwner(state)
+			providerEvidenceTracker.reset()
+			latestProviderOpportunityAvailable = false
+			latestProviderOpportunityKind = undefined
+			latestProviderReminder = undefined
+			resetCompressionProgress(state)
+			warnedProgress.clear()
+	}
+	pi.on("model_select", invalidateOwner)
+	pi.on("session_tree", async (_event, ctx) => {
+		invalidateOwner()
+		resetState(state)
+		if (config.manualMode.enabled) state.manualMode = true
+		await loadJournalState(ctx, false)
+	})
+	pi.on("session_compact", invalidateOwner)
 	const appendNudgeTelemetry = (
 		event: "emitted" | "upgraded" | "reapplied",
 		type: DcpNudgeType,
@@ -164,72 +290,59 @@ export default async function dcpModule(pi: ExtensionAPI): Promise<void> {
 	}
 
 	// ── 3. Register compress tool ─────────────────────────────────────────────
-	registerCompressTool(pi, state, config)
+	registerCompressTool(pi, state, config, {
+		persistState: persistJournalState,
+		isSessionSupported: isJournalSessionSupported,
+	})
 
 	// ── 4. Register /dcp commands ─────────────────────────────────────────────
-	registerCommands(pi, state, config)
+	registerCommands(pi, state, config, {
+		persistState: persistJournalState,
+		isSessionSupported: isJournalSessionSupported,
+	})
 
 	// ── 5. session_start: restore state from session entries ──────────────────
 	pi.on("session_start", async (event, ctx) => {
-		// Reset to a clean slate first.
 		resetState(state)
-		pendingInheritedBlockReconciliation = false
-
-		// Reset dedup hash before loading the sidecar state for this session.
-		resetDcpPersistenceDedup()
-
-		// Re-apply config baseline so manual mode survives a session_start reset.
-		if (config.manualMode.enabled) {
-			state.manualMode = true
-		}
-
-		// Restore from an overwrite sidecar file keyed by session id. Legacy
-		// append-only custom `dcp-state` entries are intentionally ignored.
-		void cleanupStaleDcpStateFiles(ctx).catch(() => {
-			// Cleanup is opportunistic; stale sidecars must not block session startup.
-		})
-		restoreState(state, await loadDcpState(ctx))
-		pendingInheritedBlockReconciliation = state.compressionBlocks.length > 0
-
-		// fork/resume/new sessions inherit the source conversation but get a fresh
-		// sidecar; inherit the previous session's compression blocks so they are
-		// not silently lost (which previously forced re-compressing all history).
-		if (state.compressionBlocks.length === 0 && event.previousSessionFile) {
+		providerEvidenceTracker.reset()
+		latestProviderOpportunityAvailable = false
+		latestProviderOpportunityKind = undefined
+		latestProviderReminder = undefined
+		warnedProgress.clear()
+		if (config.manualMode.enabled) state.manualMode = true
+		await loadJournalState(ctx, event.reason === "new" || event.reason === "startup")
+		writeDcpDebugLog(configForContext(ctx), "session_start.journal", {
+			reason: event.reason,
+			supported: journalSupported,
+			blockedReason: journalBlockedReason,
+			operations: journalMirror ? "replayed" : "none",
+		}, ctx)
+		if (!journalSupported && !journalBlockedReason) {
 			try {
-				const inherited = await loadDcpStateFromSessionFile(event.previousSessionFile)
-				const added = inheritCompressionBlocks(state, inherited)
-				if (added > 0) {
-					pendingInheritedBlockReconciliation = true
-					writeDcpDebugLog(configForContext(ctx), "session_start.inherited_blocks", {
-						reason: event.reason,
-						previousSessionFile: event.previousSessionFile,
-						added,
-						totalBlocks: state.compressionBlocks.length,
-					}, ctx)
-					// Persist inherited state into this session's own sidecar so a later
-					// reload restores it directly.
-					await saveDcpState(ctx, state)
-				}
-			} catch {
-				// Inheritance is best-effort; never block session startup.
-			}
+				ctx.ui.notify(
+					"DCP is disabled for this pre-journal session. Start a new session to use the current DCP implementation.",
+					"warning",
+				)
+			} catch { /* Headless mode. */ }
 		}
-
-		// Headless by design: no extension status/footer/widgets are rendered.
 	})
 
-	// ── 6. session_shutdown: save state ───────────────────────────────────────
-	pi.on("session_shutdown", async (_event, ctx) => {
-		// Force-flush: bypass the dedup hash so the final snapshot is always
-		// written, guaranteeing the next session_start can restore it.
-		resetDcpPersistenceDedup()
-		await saveDcpState(ctx, state)
+	// Journal operations are committed at the mutation boundary; shutdown does
+	// not write a full runtime snapshot.
+	pi.on("session_shutdown", async () => {
+		journalMirror = undefined
+		journalSupported = false
+		journalBlockedReason = undefined
+		journalPersistent = false
 	})
 
 	// ── 7. before_agent_start: inject system prompt ───────────────────────────
 	pi.on("before_agent_start", async (event, _ctx) => {
 		const effectiveConfig = configForContext(_ctx)
 		if (!effectiveConfig.enabled) return { systemPrompt: event.systemPrompt }
+		ensureEphemeralJournal(_ctx)
+		if (journalBlockedReason) throw new DcpJournalError(`DCP journal is blocked: ${journalBlockedReason}`)
+		if (!journalSupported) return { systemPrompt: event.systemPrompt }
 
 		const promptAddition = state.manualMode
 			? MANUAL_MODE_SYSTEM_PROMPT
@@ -295,7 +408,9 @@ export default async function dcpModule(pi: ExtensionAPI): Promise<void> {
 
 	// ── 10. context: apply pruning and inject nudges ──────────────────────────
 	pi.on("context", async (event, ctx) => {
+		const contextEpoch = state.sessionEpoch
 		const effectiveConfig = configForContext(ctx)
+		ensureEphemeralJournal(ctx)
 		const contextMessages = event.messages
 			.filter((message: any) => !isUserVisibleOnlyMessage(message) && !isDcpControlPlaneMessage(message))
 			.map((message: any) => stripStaleDcpMetadataFromMessage(message))
@@ -306,7 +421,7 @@ export default async function dcpModule(pi: ExtensionAPI): Promise<void> {
 				filteredMessages: contextMessages.length,
 				outputMessages: messages.length,
 				messageIdControl: "distributed-carriers",
-				state: summarizeDcpState(state),
+				state: summarizeDcpState(state, effectiveConfig),
 				...details,
 			}, ctx)
 			return { messages }
@@ -317,6 +432,7 @@ export default async function dcpModule(pi: ExtensionAPI): Promise<void> {
 			filteredMessages: contextMessages.length,
 			filteredDcpControlPlaneMessages: event.messages.length - contextMessages.length,
 		}, ctx)
+		latestProviderOpportunityAvailable = false
 		if (!effectiveConfig.enabled) {
 			writeDcpDebugLog(effectiveConfig, "context.disabled", {
 				inputMessages: event.messages.length,
@@ -324,59 +440,47 @@ export default async function dcpModule(pi: ExtensionAPI): Promise<void> {
 			}, ctx)
 			return { messages: contextMessages }
 		}
+		if (journalBlockedReason) {
+			throw new DcpJournalError(`DCP journal is blocked: ${journalBlockedReason}`)
+		}
+		if (!journalSupported) {
+			return { messages: event.messages.filter((message: any) => !isUserVisibleOnlyMessage(message)) }
+		}
+		latestProviderOpportunityKind = undefined
+		latestProviderReminder = undefined
 		annotateMessagesWithBranchEntryIds(contextMessages, ctx)
-		if (pendingInheritedBlockReconciliation) {
-			pendingInheritedBlockReconciliation = false
-			const reconciliation = reconcileInheritedCompressionBlocks(contextMessages, state)
-			writeDcpDebugLog(
-				effectiveConfig,
-				"context.reconciled_inherited_blocks",
-				{ ...reconciliation },
-				ctx,
-			)
-			if (
-				reconciliation.activatedBlockIds.length > 0 ||
-				reconciliation.deactivatedBlockIds.length > 0
-			) {
-				await saveDcpState(ctx, state)
-			}
+		const rehydration = rehydrateToolRecordsFromMessages(contextMessages, state)
+		if (rehydration.recordsUpdated > 0) {
+			writeDcpDebugLog(effectiveConfig, "context.rehydrated_tool_records", { ...rehydration }, ctx)
 		}
-		const prunedToolCountBeforeCheckpoint = state.prunedToolIds.size
 		let prunedMessages = applyPruning(contextMessages, state, effectiveConfig)
-		const automaticPrunesCommitted = state.prunedToolIds.size - prunedToolCountBeforeCheckpoint
-		if (automaticPrunesCommitted > 0) {
-			const clearedAnchors = clearDcpNudgeAnchors(state)
-			await saveDcpState(ctx, state)
-			writeDcpDebugLog(effectiveConfig, "prune.tool_checkpoint", {
-				committed: automaticPrunesCommitted,
-				clearedAnchors,
-				turn: state.currentTurn,
-				blockId: state.lastAutomaticPruneBlockId,
-				state: summarizeDcpState(state),
-			}, ctx)
-		}
+		// Stable IDs and any pruning decisions that affect this provider-visible
+		// projection must be committed before the request can use them.
+		await persistJournalState(ctx, state)
 		let candidate = null as ReturnType<typeof detectCompressionCandidate>
+		let emergencyCompressionCandidate = null as ReturnType<typeof detectEmergencyCompressionCandidate>
 		let messageCandidates = [] as ReturnType<typeof detectMessageCompressionCandidates>
 		let emergencySelection = null as ReturnType<typeof analyzeEmergencyCurrentTurn> | null
 		let emergencyPruneResult = null as ReturnType<typeof pruneEmergencyCurrentTurn> | null
 
-		// In manual mode we still apply pruning strategies (if
-		// automaticStrategies is on) but skip routine autonomous nudges. Emergency
-		// max-context nudges are still allowed, matching the manual-mode prompt.
-		const usage = normalizeDcpContextUsage(safeGetContextUsage(ctx))
+		// Manual mode skips routine autonomous nudges and automatic summary
+		// creation. The bounded emergency safety path remains separate, matching
+		// the manual-mode prompt.
+		const nativeUsage = normalizeDcpContextUsage(safeGetContextUsage(ctx))
+		const ctxModel = (ctx as any).model
+		const fallbackContextWindow = nativeUsage?.contextWindow ?? (
+			typeof ctxModel?.contextWindow === "number" && Number.isFinite(ctxModel.contextWindow) && ctxModel.contextWindow > 0
+				? ctxModel.contextWindow
+				: undefined
+		)
+		const repoProjectedTokens = prunedMessages.reduce(
+			(sum, message) => sum + estimateMessageTokens(message),
+			0,
+		)
+		const usage = nativeUsage ?? (fallbackContextWindow
+			? { tokens: null, contextWindow: fallbackContextWindow, percent: null }
+			: undefined)
 		if (usage) {
-			const contextPercent = typeof usage.percent === "number" && Number.isFinite(usage.percent)
-				? usage.percent / 100
-				: typeof usage.tokens === "number"
-					? usage.tokens / usage.contextWindow
-					: undefined
-
-			if (contextPercent === undefined) {
-				const clearedAnchors = clearDcpNudgeAnchors(state)
-				if (clearedAnchors > 0) await saveDcpState(ctx, state)
-				return finishContext("unknown-context-percent", prunedMessages, { clearedAnchors })
-			}
-
 			// Record the observed context window on EVERY context event (before
 			// any early return) so a mid-session model/window downgrade is
 			// detectable even when earlier passes were below threshold. We
@@ -392,34 +496,49 @@ export default async function dcpModule(pi: ExtensionAPI): Promise<void> {
 				state.lastContextWindow = currentContextWindow
 			}
 
-			const ctxModel = (ctx as any).model
 			const provider = ctxModel?.provider ?? ctxModel?.providerId ?? ctxModel?.providerID
 			const model = ctxModel?.id ?? ctxModel?.model ?? ctxModel?.modelId ?? ctxModel?.modelID
 			const thresholds = resolveContextThresholds(effectiveConfig, [
 				provider && model ? `${provider}/${model}` : undefined,
 				model,
 			], usage.contextWindow)
-			if (effectiveConfig.compress.summaryBuffer) {
-				const summaryBonus = getActiveSummaryTokenEstimate(state) / usage.contextWindow
-				thresholds.maxContextPercent += Math.min(summaryBonus, SUMMARY_BUFFER_MAX_CONTEXT_BONUS)
-			}
-
 			const emergencySettings = effectiveConfig.strategies.emergencyCurrentTurnPruning
-			const {
-				hardEmergencyReached,
-				contextLimitReached,
-				emergencyPressureReached,
-			} = emergencyPressureState(
+			const estimatorMarginTokens = Math.max(256, Math.ceil(usage.contextWindow * 0.0025))
+			const budget = planDcpBudget({
+				providerUsageTokens: nativeUsage?.tokens,
+				repoProjectedTokens,
+				contextWindow: usage.contextWindow,
+				reservedOutputTokens: typeof ctxModel?.maxTokens === "number" ? ctxModel.maxTokens : 0,
+				reservedToolTokens: 0,
+				maxContextPercent: thresholds.maxContextPercent,
+				hardContextPercent: emergencySettings.hardContextPercent,
+				targetContextPercent: Math.min(
+					Math.max(0, emergencySettings.targetContextPercent),
+					Math.max(0, thresholds.maxContextPercent * 0.9),
+				),
+				summaryBufferEnabled: effectiveConfig.compress.summaryBuffer,
+				activeSummaryTokens: getActiveSummaryTokenEstimate(state),
+				summaryBufferMaxBonusRatio: SUMMARY_BUFFER_MAX_CONTEXT_BONUS,
+				estimatorMarginTokens,
+			})
+			thresholds.maxContextPercent = budget.softHeadroomTokens / usage.contextWindow
+			const contextPercent = budget.projectedBeforeTokens / usage.contextWindow
+			const nativePressure = emergencyPressureState(
 				contextPercent,
 				thresholds.maxContextPercent,
 				emergencySettings.hardContextPercent,
 			)
+			const hardEmergencyReached = nativePressure.hardEmergencyReached || budget.hardPressure
+			const contextLimitReached = nativePressure.contextLimitReached || budget.pressured
+			const emergencyPressureReached = nativePressure.emergencyPressureReached || budget.pressured
 			const routineNudgesAllowed = contextPercent > thresholds.minContextPercent
+			if (!budget.capacityExceeded && state.progressRecovery) state.progressRecovery = undefined
 			if (!emergencyPressureReached && !routineNudgesAllowed) {
 				const clearedAnchors = clearDcpNudgeAnchors(state)
-				const resetEmergencyPasses = state.consecutiveIgnoredStrongNudges > 0
-				state.consecutiveIgnoredStrongNudges = 0
-				if (clearedAnchors > 0 || resetEmergencyPasses) await saveDcpState(ctx, state)
+				const resetEmergencyPasses = state.consecutiveIgnoredStrongNudges > 0 || state.consecutiveIgnoredNudges > 0 || !!state.compressionProgress
+				resetCompressionProgress(state)
+				warnedProgress.clear()
+				if (clearedAnchors > 0) await persistJournalState(ctx, state)
 				return finishContext("below-threshold", prunedMessages, {
 					contextPercent,
 					thresholds,
@@ -455,9 +574,40 @@ export default async function dcpModule(pi: ExtensionAPI): Promise<void> {
 				typeof currentContextWindow === "number" &&
 				Number.isFinite(currentContextWindow) &&
 				currentContextWindow !== previousContextWindow
-			if (contextWindowChanged) state.consecutiveIgnoredStrongNudges = 0
+			if (contextWindowChanged) resetCompressionProgress(state)
+
+			const requestedRecoveryTokens = emergencyPressureReached
+				? budget.requiredSavingsTokens
+				: routineRecoveryTokens(budget.projectedBeforeTokens, usage.contextWindow, thresholds.minContextPercent)
+			const progressInput = {
+				projectedTokens: repoProjectedTokens,
+				observedTokens: budget.projectedBeforeTokens,
+				contextWindow: usage.contextWindow,
+				requiredTokens: requestedRecoveryTokens,
+				kind: emergencyPressureReached ? "emergency" as const : "routine" as const,
+				targetHeadroomTokens: emergencyPressureReached ? budget.targetHeadroomTokens : undefined,
+			}
+			const remainingRecoveryTokens = outstandingCompressionTokens(state, progressInput)
+			if (remainingRecoveryTokens === 0) {
+				resetCompressionProgress(state)
+				warnedProgress.clear()
+			}
+			const planningRecoveryTokens = remainingRecoveryTokens !== undefined && remainingRecoveryTokens > 0
+				? state.compressionProgress?.kind === progressInput.kind ? remainingRecoveryTokens : Math.max(remainingRecoveryTokens, requestedRecoveryTokens)
+				: requestedRecoveryTokens
+			const routineEscalated = !state.manualMode && routineNudgesAllowed &&
+				state.consecutiveIgnoredNudges > Math.max(0, Math.floor(effectiveConfig.compress.autoCompress.patience))
+			const progressPressureReached = emergencyPressureReached || routineEscalated
+			// A marathon's first useful reminder must not depend on already having
+			// ignored a reminder. Plan a closed, provider-seen same-turn prefix in
+			// the routine zone too; only automatic publication waits for patience.
+			const routineSameTurnPlanning = !state.manualMode && routineNudgesAllowed && effectiveConfig.compress.autoCandidates.enabled
+			const sameTurnPlanningAllowed = emergencyPressureReached || routineSameTurnPlanning
+			const planningThreshold = emergencyPressureReached
+				? Math.min(thresholds.maxContextPercent, emergencySettings.hardContextPercent)
+				: thresholds.minContextPercent
 
-			const nudgeType = hardEmergencyReached && !contextLimitReached
+			const nudgeType = routineEscalated || (hardEmergencyReached && !contextLimitReached)
 				? "context-strong"
 				: windowDowngraded
 				? "context-strong"
@@ -479,6 +629,9 @@ export default async function dcpModule(pi: ExtensionAPI): Promise<void> {
 					state,
 					effectiveConfig,
 					contextPercent,
+					progressPressureReached
+						? { requiredSavingsTokens: planningRecoveryTokens }
+						: undefined,
 				)
 				messageCandidates = detectMessageCompressionCandidates(
 					prunedMessages,
@@ -489,10 +642,11 @@ export default async function dcpModule(pi: ExtensionAPI): Promise<void> {
 				writeDcpDebugLog(effectiveConfig, "context.candidates", {
 					contextPercent,
 					thresholds,
+					budget,
 					nudgeType,
 					candidate,
 					messageCandidates,
-					state: summarizeDcpState(state),
+					state: summarizeDcpState(state, effectiveConfig),
 				}, ctx)
 			}
 
@@ -500,7 +654,7 @@ export default async function dcpModule(pi: ExtensionAPI): Promise<void> {
 				candidate !== null || messageCandidates.length > 0
 			if (
 				emergencySettings.enabled &&
-				emergencyPressureReached &&
+				sameTurnPlanningAllowed &&
 				!manualEmergencyOnly &&
 				!hasNormalCompressionSuggestion
 			) {
@@ -513,79 +667,184 @@ export default async function dcpModule(pi: ExtensionAPI): Promise<void> {
 					emergencySelection,
 					effectiveConfig,
 				)
+			}
+
+			if (sameTurnPlanningAllowed && !manualEmergencyOnly && candidate === null) {
+				emergencyCompressionCandidate = detectEmergencyCompressionCandidate(
+					prunedMessages,
+					state,
+					effectiveConfig,
+					contextPercent,
+					planningThreshold,
+					{ requiredSavingsTokens: planningRecoveryTokens },
+				)
+				if (emergencyCompressionCandidate) {
+					writeDcpDebugLog(effectiveConfig, "context.emergency_compression_candidate", {
+						contextPercent,
+						thresholds,
+						candidate: emergencyCompressionCandidate,
+						...(emergencySelection?.stats ?? {}),
+						state: summarizeDcpState(state, effectiveConfig),
+					}, ctx)
+				}
+			}
+
+			if (
+				emergencySelection &&
+				candidate === null &&
+				emergencyCompressionCandidate === null
+			) {
 				writeDcpDebugLog(effectiveConfig, "context.strong_nudge_without_candidate", {
 					contextPercent,
 					thresholds,
 					nudgeType,
 					emergencyCandidates: messageCandidates.length,
 					...emergencySelection.stats,
-					state: summarizeDcpState(state),
+					state: summarizeDcpState(state, effectiveConfig),
 				}, ctx)
 			}
 
 			let hasCompressionSuggestion =
-				candidate !== null || messageCandidates.length > 0
+				candidate !== null || emergencyCompressionCandidate !== null || messageCandidates.length > 0
+			if (!manualEmergencyOnly && (hasCompressionSuggestion || emergencyPressureReached)) {
+				trackCompressionProgress(state, progressInput)
+				latestProviderOpportunityKind = emergencyPressureReached ? "emergency" : !state.manualMode ? "routine" : undefined
+			}
+			const blockedReason = inferDcpBlockedReason({
+				pressured: progressPressureReached,
+				candidateAvailable: candidate !== null || emergencyCompressionCandidate !== null,
+				messageCandidateCount: messageCandidates.length,
+				requiredSavingsTokens: planningRecoveryTokens,
+				capacityExceeded: budget.capacityExceeded,
+				emergencyStats: emergencySelection?.stats,
+			})
+			if (blockedReason) {
+				writeDcpDebugLog(effectiveConfig, "context.progress_blocked", {
+					phase: "blocked",
+					blocked_reason: blockedReason,
+					contextPercent,
+					thresholds,
+					budget,
+					...(emergencySelection?.stats ?? {}),
+					state: summarizeDcpState(state, effectiveConfig),
+				}, ctx)
+				if (routineEscalated) warnProgress(ctx, blockedReason,
+					`DCP cannot safely meet its compression goal: ${blockedReason}. Context has not been recovered.`)
+			}
+			if (blockedReason && budget.capacityExceeded) {
+				state.progressRecovery = {
+					blockedReason,
+					projectedBeforeTokens: budget.projectedBeforeTokens,
+					inputCapacityTokens: budget.inputCapacityTokens,
+					requiredSavingsTokens: budget.requiredSavingsTokens,
+					contextWindow: budget.contextWindow,
+					createdAt: Date.now(),
+				}
+				clearDcpNudgeAnchors(state)
+				await persistJournalState(ctx, state)
+				const abortSupported = typeof (ctx as any).abort === "function"
+				if (abortSupported) (ctx as any).abort()
+				writeDcpDebugLog(effectiveConfig, "context.progress_handoff", {
+					phase: "blocked",
+					blocked_reason: blockedReason,
+					handoff: abortSupported ? "abort-current-agent-operation" : "abort-unavailable",
+					budget,
+					state: summarizeDcpState(state, effectiveConfig),
+				}, ctx)
+				return finishContext("progress.blocked_handoff", prunedMessages, {
+					blocked_reason: blockedReason,
+					handoff: abortSupported ? "abort-current-agent-operation" : "abort-unavailable",
+					budget,
+				})
+			}
 			if (!manualEmergencyOnly && !emergencyPressureReached && !hasCompressionSuggestion) {
 				const clearedAnchors = clearDcpNudgeAnchors(state)
-				if (clearedAnchors > 0) await saveDcpState(ctx, state)
+				if (clearedAnchors > 0) await persistJournalState(ctx, state)
 				if (nudgeType || clearedAnchors > 0) {
 					writeDcpDebugLog(effectiveConfig, "context.no_compression_candidate", {
 						contextPercent,
 						thresholds,
 						nudgeType,
 						clearedAnchors,
-						state: summarizeDcpState(state),
+						state: summarizeDcpState(state, effectiveConfig),
 					}, ctx)
 				}
 			}
 
-			// Emergency pressure must advance even when normal candidates are
-			// absent; otherwise the current-turn fallback can never reach patience.
-			if (emergencyPressureReached) {
-				state.consecutiveIgnoredStrongNudges += 1
-			} else {
-				state.consecutiveIgnoredStrongNudges = 0
-			}
+			// E05 patience advances only after a correlated main-provider response
+			// completes. Repeated context transforms merely make the reminder
+			// available; they do not consume another model opportunity.
+			if (!emergencyPressureReached) state.consecutiveIgnoredStrongNudges = 0
 
-			// Auto-compress fallback: if the model has ignored enough strong
-			// nudges while above the emergency threshold, DCP creates a
-			// compression block itself instead of nudging again.
+			// Completed actionable routine opportunities also have a bound. Never
+			// silently enable automatic summarization when the user disabled it.
+			if (routineEscalated && !effectiveConfig.compress.autoCompress.enabled) {
+				warnProgress(ctx, "auto-disabled", "DCP compression has not made enough progress. Automatic compression is disabled; use compress or enable compress.autoCompress explicitly.")
+			}
 			if (!manualEmergencyOnly) {
+				const autoCandidate = candidate ?? emergencyCompressionCandidate
+				const cacheSafeReminderAvailable = hasCacheSafeNudgeCarrier(prunedMessages)
 				const autoDecision = decideAutoCompress(
 					state,
 					effectiveConfig,
 					contextPercent,
 					thresholds.maxContextPercent,
-					candidate,
+					autoCandidate,
+					{
+						routinePressure: routineEscalated,
+						hardPressure: hardEmergencyReached,
+						reminderUnavailable: !cacheSafeReminderAvailable,
+					},
 				)
-				if (contextLimitReached && candidate === null) {
+				if (contextLimitReached && autoCandidate === null) {
 					writeDcpDebugLog(effectiveConfig, "compress.auto_blocked_no_candidate", {
 						autoCompressEnabled: effectiveConfig.compress.autoCompress.enabled,
 						decisionReason: autoDecision.reason,
+						blocked_reason: blockedReason,
 						contextPercent,
 						thresholds,
 						consecutiveEmergencyPasses: state.consecutiveIgnoredStrongNudges,
 						...(emergencySelection?.stats ?? {}),
-						state: summarizeDcpState(state),
+						state: summarizeDcpState(state, effectiveConfig),
 					}, ctx)
 				}
-				if (autoDecision.shouldFire && candidate) {
+				if (autoDecision.shouldFire && autoCandidate) {
 					try {
-						const autoResult = await createAutoCompressionBlock({
-							candidate,
+						const autoOperationEpoch = state.sessionEpoch
+						const largestSafeCandidate = candidate
+							? detectCompressionCandidate(prunedMessages, state, effectiveConfig, contextPercent)
+							: detectEmergencyCompressionCandidate(prunedMessages, state, effectiveConfig, contextPercent, planningThreshold)
+						let preparedProjection: any[] | undefined
+						const autoResult = await createBudgetedAutoCompressionBlock({
+							candidate: autoCandidate,
 							topic: "Auto-compressed slice",
 							state,
 							config: effectiveConfig,
 							messages: prunedMessages,
 							modelRegistry: (ctx as any).modelRegistry,
 							signal: (ctx as any).signal,
-						})
+							cwd: (ctx as any).cwd,
+							requiredGainTokens: state.compressionProgress?.remainingTokens ?? planningRecoveryTokens,
+							allowPartialGain: true,
+							persistState: (preparedState, publication) => persistJournalState(ctx, preparedState, publication),
+							prepareProjection: (preparedState) => {
+								clearDcpNudgeAnchors(preparedState)
+								preparedState.progressRecovery = undefined
+								preparedProjection = applyPruning(contextMessages, preparedState, effectiveConfig)
+								return preparedProjection
+							},
+						}, largestSafeCandidate)
+						if (autoResult.ownerChangedAfterPublication || state.sessionEpoch !== autoOperationEpoch) {
+							// The captured owner was durably committed; do not label it
+							// failed or mutate/nudge the replacement session.
+							return { messages: contextMessages }
+						}
 						// Re-apply pruning so the new block takes effect on this
 						// same context pass instead of the next one.
-						prunedMessages = applyPruning(prunedMessages, state, effectiveConfig)
+						prunedMessages = preparedProjection ?? applyPruning(contextMessages, state, effectiveConfig)
 						const clearedAnchors = clearDcpNudgeAnchors(state)
-						state.consecutiveIgnoredStrongNudges = 0
-						await saveDcpState(ctx, state)
+						warnedProgress.clear()
+						state.progressRecovery = undefined
 						writeDcpDebugLog(effectiveConfig, "compress.auto", {
 							trigger: autoDecision.reason,
 							blockId: `b${autoResult.blockId}`,
@@ -594,25 +853,54 @@ export default async function dcpModule(pi: ExtensionAPI): Promise<void> {
 							summarizerAttempts: autoResult.summarizerAttempts,
 							summaryTokens: autoResult.summaryTokens,
 							removedTokenEstimate: autoResult.removedTokenEstimate,
-							candidate,
+							fullProjectionGain: autoResult.fullProjectionGain,
+							pressureRelieved: autoResult.pressureRelieved,
+							candidate: autoResult.effectiveCandidate,
 							clearedAnchors,
-							state: summarizeDcpState(state),
+							state: summarizeDcpState(state, effectiveConfig),
 						}, ctx)
 						return finishContext("compress.auto", prunedMessages, {
-							candidate,
+							candidate: autoResult.effectiveCandidate,
 							messageCandidates,
 							contextPercent,
 							thresholds,
 							clearedAnchors,
 						})
 					} catch (error) {
+						if (state.sessionEpoch !== contextEpoch || ctx.signal?.aborted) return { messages: contextMessages }
+						const autoBlockedReason = error instanceof AutoCompressionBlockedError
+							? error.blockedReason
+							: undefined
 						writeDcpDebugLog(effectiveConfig, "compress.auto_failed", {
 							trigger: autoDecision.reason,
+							phase: autoBlockedReason ? "blocked" : "degraded",
+							blocked_reason: autoBlockedReason,
 							error: error instanceof Error ? error.message : String(error),
-							candidate,
-							state: summarizeDcpState(state),
+							candidate: autoCandidate,
+							state: summarizeDcpState(state, effectiveConfig),
 						}, ctx)
-						// Fall through to normal nudge emission on failure.
+						if (routineEscalated) warnProgress(ctx, autoBlockedReason ?? "auto-failed",
+							`DCP automatic compression did not recover the context: ${autoBlockedReason ?? "preparation failed"}. The existing context was preserved.`)
+						if (autoBlockedReason && budget.capacityExceeded) {
+							state.progressRecovery = {
+								blockedReason: autoBlockedReason,
+								projectedBeforeTokens: budget.projectedBeforeTokens,
+								inputCapacityTokens: budget.inputCapacityTokens,
+								requiredSavingsTokens: budget.requiredSavingsTokens,
+								contextWindow: budget.contextWindow,
+								createdAt: Date.now(),
+							}
+							clearDcpNudgeAnchors(state)
+							await persistJournalState(ctx, state)
+							const abortSupported = typeof (ctx as any).abort === "function"
+							if (abortSupported) (ctx as any).abort()
+							return finishContext("progress.blocked_handoff", prunedMessages, {
+								blocked_reason: autoBlockedReason,
+								handoff: abortSupported ? "abort-current-agent-operation" : "abort-unavailable",
+								budget,
+							})
+						}
+						// Recoverable failures fall through to normal nudge emission.
 					}
 				}
 			}
@@ -648,10 +936,20 @@ export default async function dcpModule(pi: ExtensionAPI): Promise<void> {
 					prunedMessages = applyPruning(contextMessages, state, effectiveConfig)
 					const clearedAnchors = clearDcpNudgeAnchors(state)
 					state.consecutiveIgnoredStrongNudges = 0
+					state.progressRecovery = undefined
 					emergencySelection = analyzeEmergencyCurrentTurn(prunedMessages, state, effectiveConfig)
 					messageCandidates = emergencyCurrentTurnMessageCandidates(emergencySelection, effectiveConfig)
-					hasCompressionSuggestion = candidate !== null || messageCandidates.length > 0
-					await saveDcpState(ctx, state)
+					emergencyCompressionCandidate = detectEmergencyCompressionCandidate(
+						prunedMessages,
+						state,
+						effectiveConfig,
+						contextPercent,
+						thresholds.maxContextPercent,
+						{ requiredSavingsTokens: budget.requiredSavingsTokens },
+					)
+					hasCompressionSuggestion =
+						candidate !== null || emergencyCompressionCandidate !== null || messageCandidates.length > 0
+					await persistJournalState(ctx, state)
 					writeDcpDebugLog(effectiveConfig, "prune.emergency_current_turn", {
 						trigger: hardEmergencyReached ? "hard-context-percent" : "ignored-emergency-reminders",
 						contextPercent,
@@ -671,15 +969,16 @@ export default async function dcpModule(pi: ExtensionAPI): Promise<void> {
 						eligibleExhausted:
 							emergencyPruneResult.prunedToolCallIds.length >= selectionStatsBeforePrune.eligiblePairs,
 						...selectionStatsBeforePrune,
-						state: summarizeDcpState(state),
+						state: summarizeDcpState(state, effectiveConfig),
 					}, ctx)
 				}
 			}
 
 			if (nudgeType && !manualEmergencyOnly && (hasCompressionSuggestion || emergencyPressureReached)) {
+				latestProviderOpportunityAvailable = latestProviderOpportunityKind !== undefined
 				const nudgeText = appendConcreteNudgeGuidance(
 					baseNudgeText(nudgeType),
-					candidate,
+					candidate ?? emergencyCompressionCandidate,
 					messageCandidates,
 					state,
 				)
@@ -699,7 +998,7 @@ export default async function dcpModule(pi: ExtensionAPI): Promise<void> {
 							usage,
 							toolCallsSinceLastUser,
 						)
-						await saveDcpState(ctx, state)
+						await persistJournalState(ctx, state)
 					} else {
 						// Anchor already exists at >= priority; the reminder text is
 						// re-applied below via applyAnchoredNudges on every context
@@ -717,9 +1016,15 @@ export default async function dcpModule(pi: ExtensionAPI): Promise<void> {
 						)
 					}
 				} else {
-					// No safe existing message could be anchored (rare); keep the older
-					// synthetic reminder fallback so DCP never silently drops a nudge.
-					injectNudge(prunedMessages, nudgeText)
+					// Do not rewrite an already-sent user message and do not create an
+					// ephemeral synthetic tail that disappears from the next provider
+					// continuation. The reminder is deferred until a fresh user tail; hard
+					// pressure is handled by the bounded emergency path above.
+					writeDcpDebugLog(effectiveConfig, "nudge.deferred_for_cache", {
+						type: nudgeType,
+						contextPercent,
+						toolCallsSinceLastUser,
+					}, ctx)
 				}
 				state.nudgeCounter = 0
 				state.lastNudgeTurn = state.currentTurn
@@ -729,7 +1034,7 @@ export default async function dcpModule(pi: ExtensionAPI): Promise<void> {
 
 			// Persist patience/window changes even when an existing anchor was only
 			// re-applied (that path intentionally emits telemetry without updating it).
-			await saveDcpState(ctx, state)
+			await persistJournalState(ctx, state)
 		}
 
 		const anchorsBeforeFinalization = state.nudgeAnchors.length
@@ -739,10 +1044,19 @@ export default async function dcpModule(pi: ExtensionAPI): Promise<void> {
 			)
 		}
 		const nudgeApplication = applyAnchoredNudges(prunedMessages, state, (anchor) =>
-			appendConcreteNudgeGuidance(baseNudgeText(anchor.type), candidate, messageCandidates, state),
+			appendConcreteNudgeGuidance(
+				baseNudgeText(anchor.type),
+				candidate ?? emergencyCompressionCandidate,
+				messageCandidates,
+				state,
+			),
 		)
+		if (nudgeApplication.rendered && latestProviderOpportunityKind) {
+			latestProviderOpportunityAvailable = true
+			latestProviderReminder = state.nudgeAnchors[0]?.renderedReminder
+		}
 		if (state.nudgeAnchors.length !== anchorsBeforeFinalization || nudgeApplication.stateChanged) {
-			await saveDcpState(ctx, state)
+			await persistJournalState(ctx, state)
 		}
 
 		return finishContext("complete", prunedMessages, {
@@ -753,28 +1067,50 @@ export default async function dcpModule(pi: ExtensionAPI): Promise<void> {
 		})
 	})
 
-	// ── 10b. before_provider_request: observe accepted tool-result payloads ────
+	// ── 10b. provider lifecycle evidence ─────────────────────────────────────
 	pi.on("before_provider_request", async (event, ctx) => {
 		const effectiveConfig = configForContext(ctx)
-		pendingProviderToolIds.clear()
-		if (!effectiveConfig.enabled) return undefined
+		if (!effectiveConfig.enabled) {
+			providerEvidenceTracker.reset()
+			return undefined
+		}
 
 		const providerEvidence = collectProviderToolResultEvidence(event.payload)
+		const pendingToolIds = new Set<string>()
 		for (const meta of state.messageMetaSnapshot.values()) {
 			if (meta.role !== "toolResult") continue
 			if (!meta.toolCallId || state.prunedToolIds.has(meta.toolCallId)) continue
 			if (state.providerSeenToolIds.has(meta.toolCallId)) continue
 			const record = state.toolCalls.get(meta.toolCallId)
 			if (record && providerPayloadIncludesToolResult(providerEvidence, record)) {
-				pendingProviderToolIds.add(meta.toolCallId)
+				pendingToolIds.add(meta.toolCallId)
 			}
 		}
 
+		const model = (ctx as any)?.model
+		const reminderDelivered = latestProviderOpportunityAvailable &&
+			providerPayloadIncludesReminder(event.payload, latestProviderReminder)
+		const pending = providerEvidenceTracker.begin({
+			sessionEpoch: state.sessionEpoch,
+			provider: typeof model?.provider === "string" ? model.provider : undefined,
+			model: typeof model?.id === "string" ? model.id : undefined,
+			contentRevision: providerPayloadRevision(event.payload),
+			toolIds: pendingToolIds,
+			opportunityAvailable: reminderDelivered,
+			opportunityKind: reminderDelivered ? latestProviderOpportunityKind : undefined,
+		})
+
 		writeDcpDebugLog(effectiveConfig, "provider_payload.message_ids", {
 			injected: false,
 			delivery: "distributed-carriers",
-			pendingToolResults: pendingProviderToolIds.size,
-			state: summarizeDcpState(state),
+			pendingToolResults: pendingToolIds.size,
+			attempts: pending.attempts,
+			ambiguous: pending.ambiguous,
+			opportunityAvailable: pending.opportunityAvailable,
+			opportunityKind: pending.opportunityKind,
+			provider: pending.provider,
+			model: pending.model,
+			state: summarizeDcpState(state, effectiveConfig),
 		}, ctx)
 		// IDs are already attached to deterministic user/tool-result context
 		// carriers. Replacing the payload here would move metadata from the old
@@ -782,33 +1118,111 @@ export default async function dcpModule(pi: ExtensionAPI): Promise<void> {
 		return undefined
 	})
 
-	// Promote pending IDs only after the provider accepted the exact payload.
-	// Failed/aborted requests leave results fresh and therefore ineligible.
+	// HTTP acceptance is deliberately diagnostic only. The SDK fires this hook
+	// before consuming the response body, so 2xx cannot prove that the provider
+	// actually completed the assistant stream.
 	pi.on("after_provider_response", async (event, ctx) => {
 		const effectiveConfig = configForContext(ctx)
-		const accepted = event.status >= 200 && event.status < 300
-		let newlySeenToolResults = 0
-		if (effectiveConfig.enabled && accepted) {
-			for (const toolCallId of pendingProviderToolIds) {
-				if (!state.providerSeenToolIds.has(toolCallId)) {
-					state.providerSeenToolIds.add(toolCallId)
-					newlySeenToolResults++
-				}
-			}
-			if (newlySeenToolResults > 0) await saveDcpState(ctx, state)
-		}
-		writeDcpDebugLog(effectiveConfig, "provider_payload.tool_results_seen", {
+		const pending = providerEvidenceTracker.snapshot()
+		writeDcpDebugLog(effectiveConfig, "provider_payload.http_response", {
 			status: event.status,
-			accepted,
-			pendingToolResults: pendingProviderToolIds.size,
-			newlySeenToolResults,
-			state: summarizeDcpState(state),
+			accepted: event.status >= 200 && event.status < 300,
+			pendingToolResults: pending?.toolIds.size ?? 0,
+			attempts: pending?.attempts ?? 0,
+			ambiguous: pending?.ambiguous ?? false,
+			state: summarizeDcpState(state, effectiveConfig),
 		}, ctx)
-		pendingProviderToolIds.clear()
 	})
 
-	// ── 11. agent_end: persist state after each agent run ────────────────────
-	pi.on("agent_end", async (_event, ctx) => {
-		await saveDcpState(ctx, state)
+	// message_end is emitted for the finalized assistant message after the
+	// response stream settles. Without a provider request ID in SDK 0.85.1, only
+	// one unambiguous request shape (or identical retries) is safe to promote.
+	pi.on("message_end", async (event, ctx) => {
+		if (event.message?.role !== "assistant") return
+		const effectiveConfig = configForContext(ctx)
+		if (!effectiveConfig.enabled) {
+			providerEvidenceTracker.reset()
+			return
+		}
+
+		const message = event.message as any
+		const completion = providerEvidenceTracker.complete({
+			sessionEpoch: state.sessionEpoch,
+			provider: typeof message.provider === "string" ? message.provider : undefined,
+			model: typeof message.model === "string" ? message.model : undefined,
+			stopReason: typeof message.stopReason === "string" ? message.stopReason : undefined,
+		})
+		latestProviderOpportunityAvailable = false
+
+		if (completion.status !== "promote") {
+			writeDcpDebugLog(effectiveConfig, "provider_payload.tool_results_not_promoted", {
+				reason: completion.reason,
+				attempts: completion.attempts,
+				stopReason: message.stopReason,
+				state: summarizeDcpState(state, effectiveConfig),
+			}, ctx)
+			return
+		}
+
+		// Charge the completed opportunity before tool execution. A failed or
+		// insufficient compress call cannot erase it; only a sufficient durable
+		// commit settles the savings goal and resets patience.
+		const ignoredCompressionOpportunity =
+			completion.opportunityAvailable && message.stopReason !== "deferred"
+
+		const commit = providerEvidenceCommitQueue
+			.catch(() => {
+				// Keep later evidence commits moving after a prior transaction failure.
+			})
+			.then(() => runDcpStateTransaction(state, async () => {
+				if (state.sessionEpoch !== completion.sessionEpoch) {
+					writeDcpDebugLog(effectiveConfig, "provider_payload.tool_results_not_promoted", {
+						reason: "stale-session",
+						attempts: completion.attempts,
+						state: summarizeDcpState(state, effectiveConfig),
+					}, ctx)
+					return
+				}
+
+				const newlySeen = [...completion.toolIds].filter((toolCallId) => !state.providerSeenToolIds.has(toolCallId))
+				if (newlySeen.length === 0 && !ignoredCompressionOpportunity) return
+				const assertCurrent = captureDcpTransactionGuard(state, effectiveConfig, undefined, ctx)
+				const workingState = cloneDcpTransactionState(state)
+				for (const toolCallId of newlySeen) workingState.providerSeenToolIds.add(toolCallId)
+				if (ignoredCompressionOpportunity) {
+					workingState.consecutiveIgnoredNudges = state.consecutiveIgnoredNudges + 1
+					if (completion.opportunityKind !== "routine") {
+						workingState.consecutiveIgnoredStrongNudges = state.consecutiveIgnoredStrongNudges + 1
+					}
+				}
+
+				// Provider-delivery evidence is intentionally runtime-only. After a
+				// restart absence means unknown, never "seen". Persisting it would add
+				// high-frequency journal churn without changing the durable projection.
+				assertCurrent()
+
+				if (state.sessionEpoch !== completion.sessionEpoch) {
+					writeDcpDebugLog(effectiveConfig, "provider_payload.tool_results_not_promoted", {
+						reason: "stale-session",
+						attempts: completion.attempts,
+						state: summarizeDcpState(state, effectiveConfig),
+					}, ctx)
+					return
+				}
+
+				state.providerSeenToolIds = workingState.providerSeenToolIds
+				state.consecutiveIgnoredStrongNudges = workingState.consecutiveIgnoredStrongNudges
+				state.consecutiveIgnoredNudges = workingState.consecutiveIgnoredNudges
+				writeDcpDebugLog(effectiveConfig, "provider_payload.tool_results_seen", {
+					attempts: completion.attempts,
+					newlySeenToolResults: newlySeen.length,
+					ignoredCompressionOpportunity,
+					ignoredOpportunities: state.consecutiveIgnoredStrongNudges,
+					allIgnoredOpportunities: state.consecutiveIgnoredNudges,
+					state: summarizeDcpState(state, effectiveConfig),
+				}, ctx)
+			}))
+		providerEvidenceCommitQueue = commit
+		await commit
 	})
 }