thincoder 0.12.58 → 0.12.60

package/src/agent/dispatch.mjs

@@ -1,13 +1,23 @@
 /**
  * agent/dispatch.mjs — two-phase tool call execution
  */
+import { logEvent, errText, headText } from "../log.mjs"
 import { offloadToolResult, FILE_MUTATORS } from "./helpers.mjs"
 import { runHooks } from "../hooks.mjs"
 import { snapshotForUndo } from "../tui/cmd-undo.mjs"
 import { isDocFile } from "../advisor/repos.mjs"
+// R10 L3 (MULTI-INSTANCE-COLLAB §2a.5 D-L3b)：写工具钩子——peerCollabNote（执行前冲突
+// 检测——软提示不阻止）+ recordPeerWrites（成功后累积本回合写足迹——回合末 flush）。
+import { PEER_WRITE_TOOLS, peerCollabNote, recordPeerWrites } from "../peer-domains.mjs"
 import { writeFileSync, mkdirSync, existsSync } from "node:fs"
-import { join } from "node:path"
+import { join, resolve } from "node:path"
 import { homedir } from "node:os"
+// §29 fix A（AGENT-LOOP.md §29——2026-09-07）：FILE_MUTATORS 的 mutation-seq 记账从
+// 批后提交（record-results noteMutations）移到执行成功即刻——唯一记账点（取代批后段
+// + agent.mjs 中断分支记账——不双计）——同消息 [写 + async advisor launch] 时 launch 前
+// 完成的写在 launchSeq 之前落地 → settle 不再误判 stale（§29 症状根因）。
+import { noteMutations } from "../agent-tools/advisor-async.mjs"
+import { anyLiveDesignSlot } from "../token-ttl.mjs"
 
 const ERRORS_DIR = join(homedir(), ".thincoder", "tool-errors")
 
@@ -37,6 +47,88 @@ function logToolError(toolName, args, error) {
   }
 }
 
+/**
+ * §19 action-level classification (AGENT-LOOP.md §19 D-M1): the merged subagent
+ * tool expresses spawn (side effect) and status (read-only query) through
+ * its `action` parameter — the tool-level readonly flag can no longer express both.
+ * dispatch Phase-1/Phase-2 classifies per action: status behaves as readonly
+ * (planMode pass / no permission ask / batchable), spawn keeps its non-readonly
+ * gates, escalate runs non-readonly AND serially (the retired escalate tool had no
+ * parallel flag — zero behavior change under the merged surface).
+ * §19.5 cancel (19.5.2b round2 #4): CONTROL-class exemption — cancel only
+ * stops, never starts. isSubagentControlAction feeds the SAME two gate sites as
+ * readonly (planMode pass / no permission ask — never joins a batch approval
+ * group / no handler → not denied — digest 内 cancel 放行).
+ * §19.6 panel (round1 #5): view 面归只读类（同 status——planMode 放行、免
+ * 审批、可批并行）；freeze 面归控制类（同 cancel——planMode 放行、免权限审批、
+ * 批审批不入组、digest 内放行）。freeze 存在（非空 key）即控制类——否则只读类。
+ */
+function isSubagentReadonlyAction(toolName, args) {
+  // §6 memory 工具面重构（MEMORY.md §6 D-M5）：memory search/list 是只读动作——与
+  // subagent status 同分类（planMode 放行/免审批——Phase-2 批并行只认工具级
+  // readonly/parallel，memory 无 parallel → 按非只读串行，见 MEMORY.md §6.4 实现注）。
+  // 动作级判定——不能按工具名（同一 memory 工具的 put/delete/clear 保持侧效门）。
+  if (toolName === "memory") {
+    const action = args?.action
+    return action === "search" || action === "list"
+  }
+  // SETTINGS-TOOL.md（2026-09-05）：settings list/get 是只读动作（memory search/list 同分类——
+  // planMode 放行/免审批）；set 保持侧效门。
+  if (toolName === "settings") {
+    const action = args?.action
+    return action === "list" || action === "get"
+  }
+  if (toolName !== "subagent" || !args || typeof args !== "object") return false
+  const action = args.action
+  // §19.8: check 动作已删除——只读面仅剩 status（planMode 放行/免权限审批/可批并行）
+  if (action === "status") return true
+  // SUBAGENT-OBSERVE-SEND：observe = readonly 查询（同 status——digest/planMode 放行）
+  if (action === "observe") return true
+  // §19.6 panel view 面（freeze 缺省/空 = 视图请求——readonly；非空 freeze 归控制类）
+  if (action === "panel" && (args.freeze === undefined || args.freeze === null || String(args.freeze) === "")) return true
+  return false
+}
+function isSubagentControlAction(toolName, args) {
+  if (toolName !== "subagent") return false
+  if (args?.action === "cancel") return true
+  // SUBAGENT-OBSERVE-SEND：send = 控制类豁免（同 cancel——父回合内显式调用即授权——
+  // 写子输入队列属父对子轻量引导，非产品代码写——免审批、planMode 放行、digest 内放行）
+  if (args?.action === "send") return true
+  // §19.6 panel freeze 面（D-P3 门控在 executor——只读/控制分类在此）
+  if (args?.action === "panel" && args.freeze !== undefined && args.freeze !== null && String(args.freeze) !== "") return true
+  return false
+}
+/**
+ * §2.6 token 链终消费制（2026-09-07——评审 #7d dispatch 分类）：consume-design =
+ * 非只读控制动作——planMode 拒绝（不入 readonly/control 豁免——与其他非只读动作同门）、
+ * 免权限审批、不入批审批分组（无文件写——控制类直行——只停既有状态不起新副作用）。
+ * 与 cancel 的不同：cancel 是控制类豁免（planMode 放行），consume-design 按设计
+ * planMode 拒绝——故不并入 isSubagentControlAction，单独谓词只接权限豁免位。
+ */
+function isSubagentConsumeDesignAction(toolName, args) {
+  return toolName === "subagent" && args?.action === "consume-design"
+}
+function isSubagentEscalateAction(toolName, args) {
+  return toolName === "subagent" && args?.action === "escalate"
+}
+
+/**
+ * §29 fix A — 唯一记账点：FILE_MUTATORS 工具执行成功即刻记 mutation seq（abs 路径）。
+ * 取代 record-results 批后段 + agent.mjs 中断分支的 noteMutations（不双计——中断+同批
+ * launch 场景 seq 单计，AGENT-LOOP.md §29 T-A1i）。调用时机 = 写执行成功（非 Error 前缀
+ * 结果——recordPeerWrites 同款门）；routed（M2 ACP 客户端执行）成功同样记账。
+ */
+function noteExecutedMutation(agent, tool, args) { 
+  let paths
+  try {
+    paths = tool.touchedPaths ? tool.touchedPaths(args ?? {}) : [args?.path]
+  } catch { return }
+  const abs = (paths ?? [])
+    .filter((p) => typeof p === "string" && p)
+    .map((p) => resolve(agent.cwd, p))
+  if (abs.length > 0) noteMutations(agent, abs)
+}
+
 /**
  * Two-phase execution:
  * Phase 1 (serial): parse args one by one + planMode check + permission confirmation (side-effecting tools)
@@ -69,7 +161,7 @@ export async function executeToolCalls(agent, toolByName, toolCalls, callbacks,
       continue
     }
 
-    if (agent.planMode && !tool.readonly) {
+    if (agent.planMode && !tool.readonly && !isSubagentReadonlyAction(toolCall.name, args) && !isSubagentControlAction(toolCall.name, args)) {
       prepared.push({ toolCall, tool, denied: true, reason: "plan mode" })
       continue
     }
@@ -88,14 +180,18 @@ export async function executeToolCalls(agent, toolByName, toolCalls, callbacks,
     }
 
     // Engineering mode PARENT gate: the parent agent must not touch code files
-    // before the design review passed. Signaled by _engDesignToken — set on
-    // design-review approval, survives across turns (_engDesignReviewed is
-    // eng-coder-only and reset per run). Exemptions cover ONLY design artifacts
+    // before the design review passed. Signaled by a live design slot (design-review
+    // approval — persists in the session slot, survives across turns; _engDesignReviewed
+    // is eng-coder-only and reset per run). Exemptions cover ONLY design artifacts
     // (docs/** and root-level docs like METHODOLOGY.md/README.md/AGENTS.md/
     // LICENSE) — writing them IS the design/methodology step. Everything under
     // src/ (incl. src/prompts/*.md) is product code, not documentation, and
     // needs a design token. Mechanically blocks "talk then code".
-    if (agent.config?.agent?.engineering && depth === 0 && !agent._engDesignToken
+    // DESIGN-TOKEN-SETTLEMENT D3（2026-09-08）：资格判据 = 权威槽"任一活槽存在"
+    // （anyLiveDesignSlot——查内存 Map，miss 回读槽文件——单值镜像 `_engDesignToken`
+    // 已退役，门禁不再读镜像——AC4）。
+    if (agent.config?.agent?.engineering && depth === 0
+        && !anyLiveDesignSlot(agent)
         && FILE_MUTATORS.has(toolCall.name)) {
       const paths = tool.touchedPaths ? tool.touchedPaths(args) : [args.path]
       // Unknown/missing paths (non-string, e.g. no path argument) are treated
@@ -113,7 +209,15 @@ export async function executeToolCalls(agent, toolByName, toolCalls, callbacks,
 
     // Readonly tools (and autoApprove — the short-circuit, unchanged for the
     // whole batch too) skip the permission stage entirely.
-    if (tool.readonly || agent.autoApprove) {
+    // §18 D-E3 task-domain authorization (spawn-time): an eng-coder child's
+    // tools skip the permission ASK stage exactly like autoApprove — granted by
+    // the parent spawn (approved design + task = authorization; subagent.mjs
+    // sets _engTaskAuthorized on the child). Everything EARLIER in Phase 1
+    // (JSON parse / unknown tool / planMode / design-token gates) ran unchanged
+    // — the exemption never widens what reaches this stage (round4 #3, T-E14).
+    // PreToolUse hooks still run below. Non-eng-coder children keep the manual
+    // parent ask (human in the loop).
+    if (tool.readonly || isSubagentReadonlyAction(toolCall.name, args) || isSubagentControlAction(toolCall.name, args) || isSubagentConsumeDesignAction(toolCall.name, args) || agent.autoApprove || agent._engTaskAuthorized) {
       if (!(await runHooks("PreToolUse", { agent, toolName: toolCall.name, toolArgs: args }))) {
         prepared.push({ toolCall, tool, denied: true, reason: "blocked by PreToolUse hook" })
         continue
@@ -203,7 +307,17 @@ export async function executeToolCalls(agent, toolByName, toolCalls, callbacks,
     // 捕获分离（父恢复原始后子的拦截期间父捕获停止、子恢复后父继续）——正确。
     // 声明在 try 之外：catch 块（异常路径）也要访问（报错前的探查输出回显）。
     const capturedConsole = []
+    // LOGGING（LOGGING.md）：tool:* 事件——仅真实执行（pre-gate 拦截项在下方早退分支不入事件）。
+    // 参数值永不落盘（NF-L3——工具事件不记 args）；child=子代理 id（agent._logId，spawn 时 stamp）。
+    const toolT0 = Date.now()
+    const toolName = item.toolCall.name
+    logEvent("tool:call", { tool: toolName, child: agent?._logId })
     try {
+      // R10 L3 (MULTI-INSTANCE-COLLAB §2a.5 D-L3b)：结构化写工具执行前查 conflicts
+      // （命中他实例 hot 域 → 结果附软提示——决策⑥ A 不阻止；一次目录 stat——N3 度量）；
+      // 足迹累积（D-L3a——"检测+记录一次完成"）延后到执行成功（实际写过的文件）。
+      const isPeerWriteTool = PEER_WRITE_TOOLS.has(toolName)
+      const peerNote = isPeerWriteTool ? peerCollabNote(agent.cwd, item.tool, item.args) : null
       // Snapshot for undo before side-effect tools (setupOutputPanel already fired in Phase 1)
       if (!item.tool?.readonly && item.args) {
         snapshotForUndo(agent, item.toolCall.name, item.args, agent.cwd)
@@ -213,8 +327,14 @@ export async function executeToolCalls(agent, toolByName, toolCalls, callbacks,
       if (callbacks.toolRouter) {
         const routed = await callbacks.toolRouter(item.toolCall.name, item.args)
         if (routed?.handled) {
-          callbacks.onToolResult?.(item.toolCall.name, routed.result, item.toolCall.id)
-          return { ...item, result: routed.result, ok: true }
+          const routedOk = !String(routed.result).startsWith("Error:")
+          const routedResult = peerNote && routedOk ? `${routed.result}\n${peerNote}` : routed.result
+          if (isPeerWriteTool && routedOk) recordPeerWrites(agent, item.tool, item.args)
+          // §29 fix A：routed 写成功（客户端执行）同样执行期即刻记账（唯一记账点）
+          if (routedOk && FILE_MUTATORS.has(toolName)) noteExecutedMutation(agent, item.tool, item.args)
+          callbacks.onToolResult?.(item.toolCall.name, routedResult, item.toolCall.id)
+          logEvent("tool:done", { tool: toolName, ms: Date.now() - toolT0, head: headText(routedResult, 200), child: agent?._logId })
+          return { ...item, result: routedResult, ok: true }
         }
       }
       const origConsoleLog = console.log
@@ -222,23 +342,51 @@ export async function executeToolCalls(agent, toolByName, toolCalls, callbacks,
       console.log = (...a) => capturedConsole.push(a.map(String).join(" "))
       console.error = (...a) => capturedConsole.push("[err] " + a.map(String).join(" "))
       let rawResult
+      // ctx 对象提升为变量（§7.2.3）：subagent 阻塞 execute 返回前在 ctx 上留
+      // _subagentKey（relayPrefix 去尾）——runOne 在 execute 返回后读它作 onToolResult
+      // 第 4 参（普通工具/错误路径无此字段——undefined 兼容既有签名）。每次工具调用
+      // 独立 ctx——并行同名工具（批并行 runOne）各自带自己的 key，互不串扰。
+      const toolCtx = {
+        cwd: agent.cwd,
+        agent,
+        depth,
+        signal,
+        callbacks,
+        // §24 D-24b: per-call id — the advisor tool marker-keys its launch so
+        // recordToolResults can split async-ack accounting from sync settles.
+        _toolCallId: item.toolCall.id,
+        onOutput: (chunk) => callbacks.onToolOutput?.(item.toolCall.name, chunk, item.toolCall.id),
+        onQuestion: callbacks.onQuestion,
+        onPermissionRequest: callbacks.onPermissionRequest,
+      }
       try {
-        rawResult = await item.tool.execute(item.args, {
-          cwd: agent.cwd,
-          agent,
-          depth,
-          signal,
-          callbacks,
-          onOutput: (chunk) => callbacks.onToolOutput?.(item.toolCall.name, chunk, item.toolCall.id),
-          onQuestion: callbacks.onQuestion,
-          onPermissionRequest: callbacks.onPermissionRequest,
-        })
+        // SUBAGENT-OBSERVE-SEND D1（评审 #1）：in-flight 当前工具记账——工具执行期间在
+        // agent 上留 _inflightTools Set（子代理 observe 从 dispatch 状态读——卡在长工具
+        // 调用时 history 无新回合、恰需此信号）；finally 清除。批并行工具同入 Set（observe
+        // 如实返回多个在跑工具）。主会话同样记账——无害（无人读）。
+        const inflight = agent._inflightTools ?? (agent._inflightTools = new Set())
+        inflight.add(toolName)
+        try {
+          rawResult = await item.tool.execute(item.args, toolCtx)
+        } finally {
+          inflight.delete(toolName)
+        }
       } finally {
         console.log = origConsoleLog
         console.error = origConsoleErr
       }
       if (rawResult === undefined) throw new Error(`Tool "${item.toolCall.name}" returned undefined — all tools must return a string value`)
       const raw = String(rawResult)
+      // 写成功（非 "Error:" 字符串结果）→ 足迹计入本回合集合（flush 在 finalizeAgentTurn）
+      if (isPeerWriteTool && !raw.startsWith("Error:")) {
+        recordPeerWrites(agent, item.tool, item.args)
+      }
+      // §29 fix A：FILE_MUTATORS 执行成功即刻记账（唯一记账点——取代 record-results 批后
+      // 段 + agent.mjs 中断分支——不双计）——同批 launch 前的写在 launchSeq 之前落地 →
+      // async advisor settle 不误判 stale（同批 launch 后写仍保守 stale——T-A2/T-24b9）。
+      if (FILE_MUTATORS.has(toolName) && !raw.startsWith("Error:")) {
+        noteExecutedMutation(agent, item.tool, item.args)
+      }
       // Multimodal tools keep the raw result (base64 images ride the multimodal
     // channel); everything else offloads oversized text to disk. Flag-driven, not
     // name-driven (consult P3, 2026-08-30).
@@ -247,10 +395,15 @@ export async function executeToolCalls(agent, toolByName, toolCalls, callbacks,
       const resultWithConsole = capturedConsole.length > 0
         ? `${result}\n[console during ${item.toolCall.name}]\n${capturedConsole.join("\n")}`
         : result
-      callbacks.onToolResult?.(item.toolCall.name, resultWithConsole, item.toolCall.id)
+      // R10 L3：冲突软提示附在工具结果末尾（模型可见——不阻止写）
+      const resultForModel = peerNote && !raw.startsWith("Error:")
+        ? `${resultWithConsole}\n${peerNote}`
+        : resultWithConsole
+      callbacks.onToolResult?.(item.toolCall.name, resultForModel, item.toolCall.id, toolCtx._subagentKey)
       // PostToolUse hooks: fire-and-forget (result not awaited on hook failure)
       runHooks("PostToolUse", { agent, toolName: item.toolCall.name, toolArgs: item.args, result: raw }).catch(() => {})
-      return { ...item, result: resultWithConsole, ok: true }
+      logEvent("tool:done", { tool: toolName, ms: Date.now() - toolT0, head: headText(resultForModel, 200), child: agent?._logId })
+      return { ...item, result: resultForModel, ok: true }
     } catch (error) {
       // Persist to ~/.thincoder/tool-errors/ for post-mortem; only pass message to the model (stack traces confuse LLMs and may leak paths)
       logToolError(item.toolCall.name, item.args, error)
@@ -259,6 +412,9 @@ export async function executeToolCalls(agent, toolByName, toolCalls, callbacks,
       // asked to stop — worst case with subagents, where the child runs its
       // whole turn budget and the interrupt appears to do nothing.
       if (signal?.aborted) throw error
+      // LOGGING（2026-09-03 code review #4）：中止先于事件——用户停不落 tool:error
+      //（vscode execute-tools parity；阻塞子代理 child:error 同款抑制）
+      logEvent("tool:error", { tool: toolName, ms: Date.now() - toolT0, err: errText(error, 200), child: agent?._logId })
       runHooks("PostToolUseFailure", { agent, toolName: item.toolCall.name, toolArgs: item.args, error }).catch(() => {})
       // Build contextual error: tool name + key args so the model can reason about what went wrong
       const ctxParts = []
@@ -282,7 +438,11 @@ export async function executeToolCalls(agent, toolByName, toolCalls, callbacks,
     batch = []
   }
   for (const item of prepared) {
-    if (item.tool && !item.tool.readonly && !item.tool.parallel) {
+    // escalate action keeps the retired escalate tool's serial placement (no
+    // parallel flag): it flushes the batch and runs alone in call order (§19 —
+    // spawn stays parallel; status classifies as readonly and batch freely).
+    if (item.tool && !item.tool.readonly
+        && (!item.tool.parallel || isSubagentEscalateAction(item.tool.name, item.args))) {
       await flush()
       results.push(await runOne(item))
     } else {

package/src/agent/helpers.mjs

@@ -33,7 +33,9 @@ export const REPORT_CONTINUATION =
   "4. Anything left undone or worth follow-up"
 
 const TOOL_RESULT_OFFLOAD_LIMIT = 64 * 1024 // 65536 chars — offload only above 64K (2026-08-24)
-const TOOL_RESULT_PREVIEW = 64 * 1024 // chars shown inline when offloaded (aligns with CLI/VS Code webview)
+const TOOL_RESULT_PREVIEW = 64 * 1024 // total preview budget: head + middle note + tail ≤ 65536 (aligns with CLI/VS Code webview)
+const TOOL_RESULT_PREVIEW_HEAD = 16 * 1024 // head slice preserved (2026-09-04 §5 — dual-end preview)
+const TOOL_RESULT_PREVIEW_TAIL = 48 * 1024 // nominal tail slice (results/errors/stats live here — actual tail = budget remainder, see buildDualEndPreview)
 
 /** UTF-16 安全截断（2026-09-02 deepseek 400 根因）：slice(0, N) 按码元切会把 emoji 代理对切成孤立
  *  高代理（如 🔴=U+D83D+DD34 只剩 D83D）——deepseek 解析器严格 UTF-16 报 400
@@ -46,6 +48,33 @@ function safeSliceUTF16(text, max) {
   return text.slice(0, max)
 }
 
+/** UTF-16 safe END slice (2026-09-04 §5 dual-end preview — review #5: both boundaries must not split
+ *  a surrogate pair). Same rule as safeSliceUTF16, mirrored: if the slice START lands on a LOW
+ *  surrogate (DC00-DFFF — the second half of a pair whose high half sits just before the boundary),
+ *  advance one code unit so the slice never begins with an orphan low surrogate. */
+function safeSliceUTF16End(text, max) {
+  if (text.length <= max) return text
+  const start = text.length - max
+  const cp = text.charCodeAt(start)
+  if (cp >= 0xdc00 && cp <= 0xdfff) return text.slice(start + 1)
+  return text.slice(start)
+}
+
+/** Dual-end preview (design §5 D-4.1): head + middle-omitted note + tail — the tail carries
+ *  results/errors/stats that a pure-head truncation would cut off.
+ *  Budget (round1 review #2, fixed): head + note + tail ≤ TOOL_RESULT_PREVIEW (65536) — tail is
+ *  computed from constants (tail = TOOL_RESULT_PREVIEW − head − noteLen), never hardcoded.
+ *  The note length depends on the omitted digit count; text.length's digit count is an upper bound
+ *  for omitted (< text.length), so budgeting with it keeps the total ≤ 65536 while the printed
+ *  note reports the actual omitted count. Both boundaries run surrogate-safe slices (review #5). */
+function buildDualEndPreview(text) {
+  const head = safeSliceUTF16(text, TOOL_RESULT_PREVIEW_HEAD)
+  const noteFn = (omitted) => `\n\n… [middle omitted: ${omitted} chars] …\n\n`
+  const tailLen = Math.min(TOOL_RESULT_PREVIEW_TAIL, TOOL_RESULT_PREVIEW - TOOL_RESULT_PREVIEW_HEAD - noteFn(text.length).length)
+  const tail = safeSliceUTF16End(text, tailLen)
+  return head + noteFn(Math.max(0, text.length - head.length - tail.length)) + tail
+}
+
 /** Offload-dir write-time self-cleanup retention window (2026-08-21): files older than 3 days are deleted on the next offload. */
 export const TMP_RETENTION_MS = 3 * 24 * 3600 * 1000
 
@@ -88,7 +117,8 @@ export async function cleanupOldToolResults(dir) {
   }
 }
 
-/** Offload oversized tool results (>64K chars) to disk, returning a preview + file path.
+/** Offload oversized tool results (>64K chars) to disk, returning a head+tail preview + file path
+ *  (2026-09-04 §5 — dual-end preview; the failed-offload fallback uses the same dual-end slice).
  *  Writes trigger write-time self-cleanup of the offload dir first (dir param overridable for tests). */
 export async function offloadToolResult(text, callId, dir = join(configDir, "tool-results")) {
   if (text.length <= TOOL_RESULT_OFFLOAD_LIMIT) return text
@@ -98,12 +128,13 @@ export async function offloadToolResult(text, callId, dir = join(configDir, "too
     const file = join(dir, `${Date.now()}-${String(callId).replace(/[^a-zA-Z0-9_-]/g, "_")}.log`)
     await writeFile(file, text, "utf8")
     return (
-      safeSliceUTF16(text, TOOL_RESULT_PREVIEW) +
+      buildDualEndPreview(text) +
       `\n\n[... output too large (${text.length} chars total), full content saved to: ${file}\n` +
       `Page through it with the read tool (offset/limit) or sed -n 'START,ENDp' — do NOT re-run the tool blindly.]`
     )
   } catch {
-    return safeSliceUTF16(text, TOOL_RESULT_OFFLOAD_LIMIT) + `\n\n[... truncated: ${text.length} chars total, offload to disk failed]`
+    // review #3: fallback uses the same dual-end slice (head + omitted note + tail, no path hint)
+    return buildDualEndPreview(text) + `\n\n[... truncated: ${text.length} chars total, offload to disk failed]`
   }
 }
 
@@ -257,3 +288,39 @@ export async function loadProjectInstructions(cwd) {
     merged
   )
 }
+
+// Engineering mode reminders + auto-turn digest domain + mode injector
+// （2026-09-05 module-split：自 agent.mjs 迁入——agent.mjs 530 > 500 硬限——agent.mjs
+// re-export 保 import 面：eng.mjs / cmd-eng.mjs / 测试从 agent.mjs import）
+
+/** Engineering mode reminder — shared with eng.mjs tool. */
+export const ENG_ON_REMINDER =
+  "[System reminder: engineering mode is ON — design-before-code enforced. " +
+  "Workflow: Requirements doc → Design doc → advisor(type='design') → " +
+  "user approval → eng-coder implementation. Code changes go through eng-coder " +
+  "subagents only. Advisor calls are NOT per-turn-mandatory — call only at " +
+  "flow nodes or when the user asks.]"
+
+/** Engineering mode OFF reminder — shared with the eng tool and the injector. */
+export const ENG_OFF_REMINDER =
+  "[System reminder: engineering mode is now OFF — standard discipline applies. " +
+  "Changes go through the normal workflow: you may edit files directly, advisor/verify " +
+  "guards apply per config.]"
+
+/** Manual-tier auto-turn digest domain (AGENT-LOOP.md §17 D-S6): organize-only.
+ *  Injected per manual auto-turn run — writes/execute/spawns/questions are also
+ *  mechanically denied (no permission handler + spawn gate); this steers first. */
+export const AUTO_TURN_DIGEST_DOMAIN =
+  "[System reminder: auto-turn — background async subagents finished while there was no user message, and this turn runs automatically to digest their reports (the finished-report reminders above). No one is waiting for this reply, so organize only: 1) summarize each finished report's key points into this conversation for the user to read later; 2) update the task list with the task tool (allowed) to mark finished work done; 3) write decision points with a suggested next step as text — do not execute it. FORBIDDEN this turn (mechanically enforced): modifying files, bash/execute/verify, spawning subagents, asking questions — those need a real user message. End the turn once the summaries are written.]"
+
+/** Engineering-mode status injection — one reminder on EVERY transition (2026-08-25:
+ *  OFF is announced too — the model must know the gates lifted; silence after /eng-off
+ *  left it guessing. Covers TUI /eng, resume, and any path bypassing the eng tool.) */
+export function injectEngineeringReminder(agent) {
+  const eng = agent.config?.agent?.engineering ?? false
+  if (eng !== agent._lastEngState) {
+    agent.history.push({ role: "user", content: eng ? ENG_ON_REMINDER : ENG_OFF_REMINDER, transient: true })
+  }
+  agent._lastEngState = eng
+}
+

package/src/agent/record-results.mjs

@@ -22,7 +22,9 @@
 import { pushReal } from "../context.mjs"
 import { specForModel } from "../config.mjs"
 import { FILE_MUTATORS } from "./helpers.mjs"
-import { join } from "node:path"
+import { resolve } from "node:path"
+import { advisorRuns, stripApprovedSuffix } from "../agent-tools/advisor-async.mjs"
+import { looksLikeReviewOutput } from "../advisor/run.mjs"
 
 let _reindexFile = null
 
@@ -72,6 +74,9 @@ export async function recordToolResults(agent, toolByName, results) {
         // Direct file edit — code was changed. The prior advisor review and
         // verify are stale: a review that ran before the edit no longer
         // covers the current file state.
+        // §29 fix A（AGENT-LOOP.md §29——2026-09-07）：mutation-seq 记账已移到 dispatch
+        // runOne 执行成功即刻（唯一记账点——取代本批后段 + agent.mjs 中断分支——不双计）——
+        // 此处仅剩 guard 标志失效（顺序语义：批内同消息的 sync advisor 提交仍在其后置位）。
         agent._mutatedThisRun = true
         agent._calledAdvisorThisRun = false
         agent._verifiedThisRun = false
@@ -91,20 +96,51 @@ export async function recordToolResults(agent, toolByName, results) {
       }
       if (toolCall.name === "verify") agent._verifiedThisRun = true
       if (toolCall.name === "advisor") {
-        agent._calledAdvisorThisRun = true
-        // All advisor calls (code and design) share the 5-round convergence
-        // budget — each advances _advisorRound toward MAX_ADVISOR_ROUNDS.
-        // Always advance the round — the convergence protocol cares about
-        // how many reviews have run (round 1→2→3→4→5), not how many succeeded.
-        // A failed/interrupted review is still a review attempt and should use
-        // the next round's prompt on retry.
-        agent._advisorRound++
+        // §24 D-24b (settle accounting split — fix #2): an ASYNC launch returns an
+        // ack and settles later — the settle callback owns its called/round/token
+        // accounting. Only the SYNC path (depth>0 / explicit async:false) accounts
+        // here — per-review instance round++ (marker-keyed by tool call id) + the
+        // legacy mirror._advisorRound_ counter stays for display/back-compat.
+        // REFUSED launches (pool full / per-review cap) count as neither a call
+        // nor a completion: no called-mark (the guard must keep pushing until a
+        // review really runs), no round advance.
+        const refused = agent._advisorRefusals?.has(toolCall.id)
+        const asyncAck = agent._advisorAsyncAcks?.has(toolCall.id)
+        if (refused) {
+          agent._advisorRefusals.delete(toolCall.id)
+        } else if (asyncAck) {
+          agent._advisorAsyncAcks.delete(toolCall.id)
+        } else {
+          agent._calledAdvisorThisRun = true
+          const reviewId = agent._advisorSyncCalls?.get(toolCall.id)
+          if (reviewId !== undefined) {
+            const run = advisorRuns(agent).get(reviewId)
+            if (run) {
+              run.round++
+              agent._advisorRound = run.round
+              // Prior of round 2+ = the last REVIEW-LOOKING output (run.mjs parity).
+              // F2e (§29.1): the sync settle's engine-approved suffix (stored on the
+              // run by settleDesignReview) is stripped with exact truncation — the
+              // prior never carries the raw token / designId.
+              if (looksLikeReviewOutput(result)) {
+                run.priorOutput = stripApprovedSuffix(result, run.approvedSuffix)
+              }
+            } else {
+              agent._advisorRound++
+            }
+            agent._advisorSyncCalls.delete(toolCall.id)
+          } else {
+            // Direct/legacy callers without a resolution marker — plain mirror
+            // increment (the per-review registry never saw this call).
+            agent._advisorRound++
+          }
+        }
       }
       if (FILE_MUTATORS.has(toolCall.name)) {
         const args = JSON.parse(toolCall.arguments)
         const paths = tool.touchedPaths ? tool.touchedPaths(args) : [args.path]
         for (const p of paths) {
-          const abs = join(agent.cwd, p)
+          const abs = resolve(agent.cwd, p)
           if (!agent._touchedFiles.includes(abs)) agent._touchedFiles.push(abs)
           if (agent.memory) {
             // Fire-and-forget: don't block the agent loop on indexing.