thinkpool-pair 0.7.154 → 0.7.156

package/README.md

@@ -153,5 +153,22 @@ Provider config is stored in `~/.thinkpool-pair/provider.json` (mode 0600) and
 applies to every bridge on the machine. Restart the bridge (or its launchd
 service) after changing it — the choice is read once at startup.
 
+### Context meter for non-Claude models
+
+The context-usage meter (`ctx N%` in the room) is computed by the Agent SDK from
+the model id it thinks it's talking to — for a non-Claude model bridged in over
+an Anthropic-compatible endpoint, that assumed window is wrong, so the meter can
+run past 100%. The bridge corrects it for common models automatically (GLM-4.5/4.6,
+DeepSeek V3.x, Kimi K2, Qwen3-Coder — matched by model id).
+
+For any model not in that list, set the real window explicitly per bridge:
+
+```bash
+export TP_CONTEXT_MAX=131072   # your model's context window, in tokens
+```
+
+`TP_CONTEXT_MAX` overrides the built-in map (and applies even to Claude ids if
+you set it). Unset it to fall back to the automatic correction.
+
 Public anon creds are embedded (the same ones the web app ships). Override with
 `TP_SUPABASE_URL` / `TP_SUPABASE_ANON` if needed. Set `TP_NAME` to label yourself.

package/bridge.mjs

@@ -39,7 +39,7 @@ import { randomUUID } from 'node:crypto'
 import { createClient } from '@supabase/supabase-js'
 import { createSdkMcpServer, tool } from '@anthropic-ai/claude-agent-sdk'
 import { z } from 'zod'
-import { startClaudeSession, oneShotSummary } from './claude-session.mjs'
+import { startClaudeSession } from './claude-session.mjs'
 import { FLOW_CONDUCTOR_PROMPT, FLOW_LANE_PROMPT, buildConductorEnv, assembleCrossWaveContext, buildLanePrompt } from './flow-conductor.mjs'
 import { normalizePlanOutput, laneModelFor } from './flow-task-graph.mjs'   // FL-B1 — validate the conductor's submit_flow_plan task-graph; laneModelFor — per-slice model tier (2026-07-03-flow-lane-model-tiers)
 // S1 (context-offload) — durable digest store. mark_flow_done digests a closed slice in;
@@ -57,8 +57,9 @@ function stopFlowPreviews (flowId, laneId = null) {
     if (laneId ? key === `lane:${flowId}:${laneId}` : key.startsWith(`lane:${flowId}:`)) { try { h.stop() } catch { /* noop */ } }
   }
 }
-import { FLOW_REVIEWER_PROMPT, revertLane, parseReviewVerdict } from './flow-review.mjs'
+import { FLOW_REVIEWER_PROMPT, revertLane, parseReviewVerdict, reviewVerdictToReflection } from './flow-review.mjs'
 import { reviewGateDecision } from './flow-review-gate.mjs'
+import { pairAdjudicationPrompt, reviewReflectionDecision, REVIEW_DEFAULTS } from './flow-review-reflect.mjs'
 import { mergeWorktrees, inlineSingleHtml, initRepo } from './flow-assembly.mjs'
 import { canDispatch, FLOW_LIMITS, makeBudget, recordSpend, killSwitchEnv } from './flow-budget.mjs'
 // S4 slice 2 — clean re-dispatch. When a lane is killed mid-tool-call (budget/review/restart)
@@ -83,8 +84,8 @@ const flowRedispatch = new Map()
 const flowBudgets = new Map()
 import { formatPeek, PEEK, siblingsOf, resolveSibling, crossPostDecision, CROSSPOST, spawnDecision, SPAWN, CROSSROOM, formatPairRoster, crossRoomPostDecision, formatRoomNow } from './cross-terminal.mjs'
 import { turnInFlight } from './update-gate.mjs'
-import { saveSession, flushSession, deleteSession, loadAll, canResume, loadPtyId, savePtyId, loadNames, saveNames, appendDurableEvents, seedDurableEvents, readDurablePage, readDurableOldestSeq, loadSummary, saveSummary } from './session-store.mjs'
-import { stampEvent, makeSeqCounter, maxSeq, seqable, capReplayEvents, chunkReplayEvents, boundEventForBroadcast, inlineImageBlocks } from './event-id.mjs'
+import { saveSession, flushSession, deleteSession, loadAll, canResume, loadPtyId, savePtyId, loadNames, saveNames, appendDurableEvents, seedDurableEvents, readDurablePage, readDurableOldestSeq } from './session-store.mjs'
+import { stampEvent, makeSeqCounter, maxSeq, seqable, capReplayEvents, chunkReplayEvents, boundEventForBroadcast, inlineImageBlocks, usageReportLine } from './event-id.mjs'
 import { makeThrottledTrack } from './presence.mjs'
 
 // Public client creds (the same anon values the web app ships — safe to embed).
@@ -1376,14 +1377,71 @@ function openStructured({ id, model, resume, log, commands, mode, spawnedBy, rol
     } catch (e) {
       return { ok: false, message: `Review verdict REJECTED: ${e?.message || e}. Re-Write FLOW_REVIEW.json with {"pass":<boolean>,"reasons":["<specific finding>"],"taskKey":"<the slice you reviewed>"}.` }
     }
-    if (!v.pass && target) {
+    // E1 A1/A2 — the BOUNDED reviewer loop, live side. Each FLOW_REVIEW.json write is ONE
+    // hunt round; the governor decides continue-vs-stop from the round count + the lane's
+    // REAL budget (flowBudgets ledger). A bare pass:true (happy path held, not yet exhausted)
+    // under both ceilings → dig ONE more round instead of concluding; a concrete failure, an
+    // exhausted pass, or a ceiling (rounds OR budget) → terminal, surfaced to the pair (P3).
+    // Fail-closed: a lane at/over its cap concludes (surface) and is never re-prompted. Held
+    // for live-room verification (bridge is inert until published); the decision logic is
+    // unit-proven in flow-review.loop.test.mjs + flow-review-reflect.test.mjs.
+    const round = (entry.flowReviewRound = (entry.flowReviewRound || 0) + 1)
+    const b = flowBudgets.get(entry.flowSessionId) || null
+    const decision = reviewReflectionDecision({
+      round,
+      maxRounds: REVIEW_DEFAULTS.maxRounds,
+      spentTokens: b ? b.spentTokens : 0,
+      budgetCap: b ? b.capTokens : null,
+      ...reviewVerdictToReflection(v),
+    })
+
+    // Not concluded, under both ceilings → send the reviewer back for another bounded round.
+    // No revert, no verdict broadcast, no markFlowDone — the loop stays open.
+    if (!decision.stop) {
+      const next = round + 1
+      try {
+        entry.session?.sendTurn(
+          `[Flow review — round ${next}/${REVIEW_DEFAULTS.maxRounds}] The happy path held, but you have NOT reported your checks exhausted and you are under both the round and budget ceilings. Dig one more round: hunt the edge cases, the reload, the second click, concurrent use, the error path — the places the builder didn't. Then re-Write FLOW_REVIEW.json — pass:false with a specific reason if you break it, or pass:true AND exhausted:true if you genuinely have nothing left to check.`,
+        )
+      } catch { /* lane may have closed mid-verdict */ }
+      process.stderr.write(`\n  ${A.dim}◆ review round ${round} inconclusive — digging again (${next}/${REVIEW_DEFAULTS.maxRounds}) on ${target || entry.flowTaskKey}${A.rst}\n`)
+      return { ok: true, message: `Round ${round} recorded (pass, not yet exhausted). Keep hunting — asked you for round ${next}/${REVIEW_DEFAULTS.maxRounds}.` }
+    }
+
+    // Terminal outcome. reject → revert the reviewed slice; surface → hand the inconclusive
+    // result to the pair WITHOUT reverting (no failure was reproduced); pass → accept.
+    if (decision.action === 'reject' && target) {
       bcast('flow-revert', { term: id, flowId: entry.flowSessionId, taskKey: target }, flowChannel)
-      process.stderr.write(`\n  ${A.yel}◆ review FAIL — reverting ${target}: ${v.reasons.join('; ').slice(0, 120)}${A.rst}\n`)
+      process.stderr.write(`\n  ${A.yel}◆ review REJECT (round ${round}) — reverting ${target}: ${v.reasons.join('; ').slice(0, 120)}${A.rst}\n`)
     } else {
-      process.stderr.write(`\n  ${A.cyan}◆ review PASS — ${target || entry.flowTaskKey}${A.rst}\n`)
+      process.stderr.write(`\n  ${A.cyan}◆ review ${decision.action.toUpperCase()} (round ${round}) — ${target || entry.flowTaskKey}${A.rst}\n`)
     }
+    // P3 (pair co-adjudication) — surface the TERMINAL verdict into the ROOM as a
+    // challengeable prompt, ALONGSIDE the gate action above. A solo Bugbot's verdict is
+    // final; ours is a prompt for the two humans + Pool to argue. Additive: an extra
+    // broadcast, does NOT change the revert/gate flow.
+    bcast('flow-review-verdict', {
+      term: id, flowId: entry.flowSessionId,
+      taskKey: target || entry.flowTaskKey,
+      pass: v.pass,
+      reasons: v.reasons,
+      action: decision.action,
+      rounds: round,
+      surfaceToPair: decision.surfaceToPair,
+      prompt: pairAdjudicationPrompt({
+        action: decision.action,
+        reason: decision.reason,
+        taskKey: target || entry.flowTaskKey,
+        findings: v.reasons,
+      }),
+    }, flowChannel)
     const doneMsg = await markFlowDone()
-    return { ok: true, message: `Review verdict recorded: ${v.pass ? 'PASS' : `FAIL — reverting ${target || '(no target)'} (${v.reasons.join('; ').slice(0, 160)})`}. ${doneMsg}` }
+    const label = decision.action === 'reject'
+      ? `REJECT (round ${round}) — reverting ${target || '(no target)'} (${v.reasons.join('; ').slice(0, 140)})`
+      : decision.action === 'surface'
+        ? `SURFACED to the pair after ${round} round${round === 1 ? '' : 's'} — ${decision.reason}`
+        : `PASS (round ${round})`
+    return { ok: true, message: `Review verdict recorded: ${label}. ${doneMsg}` }
   }
   // Identity for the durable archive — pushLog appends every new transcript event to
   // <room>/<id>.events.jsonl keyed off these. Seed the archive once from the restored
@@ -2334,6 +2392,13 @@ channel
       s.session.sendTurn(text)
       return
     }
+    // /usage → report this session's token + cost totals WITHOUT burning an agent turn.
+    // Computed by REPLAYING the session's own retained result events (each completed turn
+    // persists kind:'result' with usage + costUsd + model — see onEvent). No new accumulator
+    // state: the log is durable, so this survives a bridge restart for free. Reported as ◆
+    // control lines (like /model) so both members AND late-joiners see it. Scope is honest —
+    // the Agent SDK exposes tokens + cost, not plan/rate-limit meters, and the card says so.
+    if (/^\/usage\s*$/.test(text)) { ctlLine(usageReportLine(s.model, s.log)); return }
     // Pre-flight budget gate (room scope) — refuse the billable agent turn if the room hit
     // its cap. The slash controls above (/model, /clear, /compact) are intentionally exempt:
     // they let a user manage or REDUCE spend even when capped. Legible refusal, no silent stall.
@@ -2400,94 +2465,6 @@ channel
     saveNames(room, termNames)
     announce()
   })
-  // Session Info panel (2026-07-02, plain-English recap 2026-07-02) — a cheap one-shot
-  // recap on demand. Writes a plain-English "Done so far" / "Working on now" bullet
-  // summary (Markdown) of what the whole session accomplished + what's live — NOT a
-  // per-terminal technical list (Max's ask: clean, readable, no jargon/terminal names).
-  // Runs on the room's own subscription auth via oneShotSummary (cheap haiku →
-  // provider-default fallback). Never auto — only on the panel button. The web caches
-  // the result in React state (no re-charge on re-open within a page load).
-  .on('broadcast', { event: 'code-summarize' }, async ({ payload }) => {
-    const by = payload?.by || null
-    // Peek — any device opening the panel fetches the cached recap (cross-device +
-    // cross-restart persistence) WITHOUT spending a model call. No cache → silent.
-    if (payload?.peek) {
-      const cached = loadSummary(room)
-      if (cached && cached.text) bcast('code-summary', { status: 'done', ...cached })
-      return
-    }
-    bcast('code-summary', { status: 'generating', by })
-    try {
-      // Pull assistant/user text out of a transcript-event array, keep the tail.
-      const logDigest = (events, max = 1200) => {
-        const parts = []
-        for (const e of (events || [])) {
-          if (e?.kind === 'assistant') { for (const b of (e.blocks || [])) if (b?.type === 'text' && b.text) parts.push(b.text) }
-          else if (e?.kind === 'you' && e.text) parts.push(`user: ${e.text}`)
-        }
-        return parts.join('\n').replace(/\n{3,}/g, '\n\n').slice(-max)
-      }
-      // LIVE structured terminals — named, doing/done, with a recent digest.
-      const live = []
-      let env = null, cwd = null
-      for (const [id, e] of sessions) {
-        if (e.kind !== 'structured') continue
-        live.push({ name: termNames[id] || 'Terminal', status: e.session?.turnActive ? 'working' : 'done', digest: logDigest(e.log, 1100) })
-        if (!env) { env = { ...process.env }; cwd = e.cwd || process.cwd() }
-      }
-      // CLOSED terminals — named but not live. Aggregate only; cap the read to bound cost.
-      const liveIdSet = new Set(sessions.keys())
-      const closedIds = Object.keys(termNames).filter(id => !liveIdSet.has(id))
-      const closedDigests = []
-      for (const id of closedIds.slice(0, 4)) {
-        try {
-          const page = readDurablePage(room, id, Number.MAX_SAFE_INTEGER, 30)
-          const evs = Array.isArray(page) ? page : (Array.isArray(page?.events) ? page.events : [])
-          const d = logDigest(evs, 450)
-          if (d) closedDigests.push(d)
-        } catch { /* no retained detail for this closed lane */ }
-      }
-      if (!live.length && !closedIds.length) { bcast('code-summary', { status: 'error', error: 'Nothing to summarize yet.', by }); return }
-
-      const liveBlock = live.length
-        ? live.map(t => `LIVE TERMINAL "${t.name}" [${t.status}]:\n${t.digest || '(no recent activity)'}`).join('\n\n')
-        : '(no live terminals)'
-      const closedBlock = closedIds.length
-        ? `\n\nThere are also ${closedIds.length} CLOSED terminal(s). Recent excerpts (do NOT name them individually):\n${(closedDigests.join('\n---\n') || '(no retained detail)').slice(0, 1400)}`
-        : ''
-
-      const prompt = `Write a short, friendly recap of this coding session for someone non-technical who just wants to know what's going on. Plain English only — no jargon, no file names, no branch names, no terminal names or IDs, no code, no counts of terminals. Explain what the work MEANS and why it matters, not the mechanics.
-
-Output ONLY this Markdown shape, nothing else:
-
-**Done so far**
-- <one plain-English thing that got finished>
-- <another>
-
-**Working on now**
-- <what's actively being worked on, in plain English>
-
-Rules:
-- Merge ALL the finished work — live and closed terminals alike — into "Done so far". Combine similar items; do NOT organise by terminal or list them. Aim for 3–6 bullets.
-- Put only genuinely in-progress work under "Working on now". If nothing is active, write exactly: "- Nothing in progress right now — everything's wrapped up."
-- Each bullet is one clear sentence, ~16 words max, no trailing period, and no technical term a normal person wouldn't understand.
-
-Here's the raw session activity to summarize:
-
-${liveBlock}${closedBlock}
-
-Recap:`
-
-      const res = await oneShotSummary({ prompt, env: env || process.env, cwd: cwd || process.cwd() })
-      if (!res || !res.text) { bcast('code-summary', { status: 'error', error: 'Summary model unavailable on this provider.', by }); return }
-      const summary = { text: res.text, model: res.model, generatedAt: Date.now() }
-      try { saveSummary(room, summary) } catch { /* cache is best-effort */ }
-      bcast('code-summary', { status: 'done', ...summary, by })
-      process.stderr.write(`\n  ◆ session summary generated (${res.model}) for ${by || 'someone'}.\n`)
-    } catch (e) {
-      bcast('code-summary', { status: 'error', error: String(e?.message || e).slice(0, 140), by })
-    }
-  })
   .on('broadcast', { event: 'who' }, announce)
   .subscribe(status => {
     if (status === 'SUBSCRIBED') {

package/claude-session.mjs

@@ -17,6 +17,7 @@ import { query } from '@anthropic-ai/claude-agent-sdk'
 import { sanitizeSession } from './transcript-sanitize.mjs'
 import { reviewGatePreToolDecision } from './flow-review-gate.mjs'
 import { crossPostNeedsCard } from './cross-terminal.mjs'
+import { correctContext } from './context-windows.mjs'
 
 // ── risk classification — the accent/danger tier of the permission card ──
 // low (read-only) · medium (writes/runs) · network (leaves the machine) ·
@@ -145,48 +146,6 @@ const TP_ROOM_REMINDER = [
   'Verify before claiming done — show runtime evidence you produced, not "should work, go test it".',
 ].join(' ')
 
-// ── One-shot summary (2026-07-02, Session Info panel) ────────────────────────
-// A bare, cheap, cold model call — same shape as the haikuSuggest fallback: runs
-// on the room's own subscription auth (env carries the OAuth — no API key), NO
-// settingSources / MCP / tools, maxTurns 1. Used by the bridge's code-summarize
-// handler to write a session recap on demand. Model fallback (Max's ask): prefer a
-// cheap haiku-class model; if the provider (GLM / OpenRouter / custom base-url) has
-// no such model, retry with the provider default. Returns { text, model } or null.
-export async function oneShotSummary({ prompt, env, cwd, timeoutMs = 25000 }) {
-  const attempt = async (model) => {
-    const ac = new AbortController()
-    const t = setTimeout(() => { try { ac.abort() } catch { /* noop */ } }, timeoutMs)
-    try {
-      const hq = query({
-        prompt,
-        options: {
-          ...(model ? { model } : {}),
-          ...(cwd ? { cwd } : {}),
-          env,
-          maxTurns: 1,
-          permissionMode: 'bypassPermissions',
-          settingSources: [],
-          strictMcpConfig: true,
-          mcpServers: {},
-          abortController: ac,
-        },
-      })
-      let out = ''
-      for await (const mm of hq) {
-        if (mm.type === 'assistant') for (const b of (mm.message?.content || [])) if (b.type === 'text') out += b.text
-        if (mm.type === 'result') break
-      }
-      return out.trim()
-    } finally { clearTimeout(t) }
-  }
-  // Prefer cheap haiku; fall back to the provider's default model if it's absent.
-  try { const out = await attempt('claude-haiku-4-5'); if (out) return { text: out, model: 'claude-haiku-4-5' } }
-  catch { /* provider has no haiku — fall through to default */ }
-  try { const out = await attempt(undefined); if (out) return { text: out, model: 'default' } }
-  catch { /* provider default also failed */ }
-  return null
-}
-
 export function startClaudeSession({ cwd, model, resume, env, mode: initialMode = 'default', onEvent, requestPermission, mcpServers, crossPostGate, crossRoomPostGate, didSpawnTarget = null, rolePrompt, blockSubagents = false, onSubmitPlan = null, onLaneDone = null, onReviewVerdict = null, reviewGate = null, lazy = false, roomContext = null }) {
   // Per-turn reminder + live ROOM NOW tail. roomContext (bridge-supplied) returns the
   // room's CURRENT state — sibling lanes, active git worktrees — or null. The static
@@ -788,7 +747,7 @@ export function startClaudeSession({ cwd, model, resume, env, mode: initialMode
               ;(async () => {
                 try {
                   const c = await q?.getContextUsage?.()
-                  if (c) { emit({ kind: 'usage', ctx: { used: c.totalTokens, max: c.maxTokens, pct: Math.round(c.percentage), model: c.model } }); if (c.model) curModel = c.model }
+                  if (c) { emit({ kind: 'usage', ctx: correctContext({ used: c.totalTokens, max: c.maxTokens, pct: Math.round(c.percentage), model: c.model }) }); if (c.model) curModel = c.model }
                 } catch { /* control req may be unavailable */ }
               })()
               break
@@ -932,7 +891,7 @@ export function startClaudeSession({ cwd, model, resume, env, mode: initialMode
               let ctx = null
               try {
                 const c = await q?.getContextUsage?.()
-                if (c) { ctx = { used: c.totalTokens, max: c.maxTokens, pct: Math.round(c.percentage), model: c.model }; if (c.model) curModel = c.model }
+                if (c) { ctx = correctContext({ used: c.totalTokens, max: c.maxTokens, pct: Math.round(c.percentage), model: c.model }); if (c.model) curModel = c.model }
               } catch { /* control req may be unavailable */ }
               const u = m.usage || {}
               emit({ kind: 'usage', costUsd: m.total_cost_usd ?? null, tokens: (u.input_tokens || 0) + (u.output_tokens || 0), ctx })

package/context-windows.mjs

@@ -0,0 +1,101 @@
+/* ─────────────────────────────────────────────────────────────
+   context-windows — correct the /code context meter for non-Claude BYOK models.
+
+   The Claude Agent SDK computes its context-usage meter
+   (getContextUsage → { totalTokens, maxTokens, percentage }) from the model
+   STRING it believes it is talking to. When a user bridges a NON-Claude model
+   in over an Anthropic-compatible endpoint (ANTHROPIC_BASE_URL — GLM, DeepSeek,
+   Kimi, Qwen, … via OpenRouter or a provider's own compat endpoint), the SDK's
+   maxTokens is for the WRONG model, so the meter fills at the wrong rate and can
+   shoot past 100% (Max, 2026-07-04: GLM-4.6 "runs up to 100 and goes past pretty
+   fast").
+
+   This is a DISPLAY-ONLY correction applied on the bridge's EMIT path: we
+   override the emitted { max, pct, over } using the real window for the reported
+   model id. The SDK's own context management is untouched — no behavior change,
+   no racy control request (H42-safe by construction).
+
+   Numbers are the provider-HEADLINED context windows (verified per row below).
+   The meter is inherently approximate, so we match what each provider's own docs
+   advertise rather than power-of-two token counts.
+   ───────────────────────────────────────────────────────────── */
+
+// id substring (case-insensitive) → context window in tokens.
+// Ordered MOST-SPECIFIC first (glm-4.6 before glm-4.5) — first hit wins.
+// Sources verified 2026-07-04:
+//   glm-4.6      200K — https://openrouter.ai/z-ai/glm-4.6  ·  https://docs.z.ai
+//   glm-4.5      128K — https://github.com/zai-org/GLM-4.5 (README)
+//   deepseek v3.x 128K — https://api-docs.deepseek.com (deepseek-chat/-reasoner, V3.1)
+//   kimi-k2      256K — https://huggingface.co/moonshotai/Kimi-K2-Instruct-0905
+//   qwen3-coder  256K — https://huggingface.co/Qwen/Qwen3-Coder-Next (native)
+const KNOWN_WINDOWS = [
+  { match: 'glm-4.6',     max: 200_000 },
+  { match: 'glm-4.5',     max: 128_000 },
+  { match: 'deepseek',    max: 128_000 },
+  { match: 'kimi-k2',     max: 256_000 },
+  { match: 'qwen3-coder', max: 256_000 },
+]
+
+// A Claude model id — the ONLY ids whose SDK-reported window we trust verbatim.
+// Everything else is a candidate for correction. (Kept broad on purpose: any
+// real Claude id matches, so the 1M/200k Claude paths never regress.)
+export function isClaudeModel(id) {
+  return /claude|anthropic|opus|sonnet|haiku/i.test(String(id || ''))
+}
+
+// Look up a corrected window (tokens) for a model id. Returns null if unknown.
+export function windowForModel(modelId) {
+  const id = String(modelId || '').toLowerCase()
+  if (!id) return null
+  for (const w of KNOWN_WINDOWS) {
+    if (id.includes(w.match)) return w.max
+  }
+  return null
+}
+
+// Parse TP_CONTEXT_MAX (a positive integer token count) from the environment.
+// Per-bridge override for models not in the map. null if unset/non-numeric/<=0.
+export function envContextMax(env = process.env) {
+  const raw = env?.TP_CONTEXT_MAX
+  if (raw == null || raw === '') return null
+  const n = Number(raw)
+  return Number.isFinite(n) && n > 0 ? Math.floor(n) : null
+}
+
+// Correct a raw ctx object from the SDK's getContextUsage().
+//
+//   raw: { used, max, pct, model }   (any field may be missing)
+//   env: process.env-like            (for the TP_CONTEXT_MAX override)
+//
+// Returns a NEW ctx object. Precedence:
+//   1. TP_CONTEXT_MAX override — wins for ANY model (incl. ids not in the map).
+//   2. A known non-Claude window from the map.
+//   3. Otherwise passthrough — Claude models and unknown ids keep the SDK's max.
+// When a correction applies, max is replaced, pct is recomputed and clamped to
+// 0..100, and `over: true` is set when used exceeds the corrected window.
+// In every case pct is clamped so a lying >100% never reaches the UI.
+export function correctContext(raw, env = process.env) {
+  if (!raw || typeof raw !== 'object') return raw
+  const used = Number(raw.used)
+  const override = envContextMax(env)
+  // The map fires only for non-Claude ids (point 4: Claude untouched); the
+  // env override is explicit and deliberate, so it applies even to Claude.
+  const mapped = override == null && !isClaudeModel(raw.model)
+    ? windowForModel(raw.model)
+    : null
+  const correctedMax = override ?? mapped
+
+  if (correctedMax == null) {
+    // No correction available — but never ship a >100% pct.
+    const pct = Number(raw.pct)
+    if (Number.isFinite(pct) && pct > 100) return { ...raw, pct: 100, over: true }
+    return raw
+  }
+
+  const max = correctedMax
+  const pct = Number.isFinite(used) && max > 0
+    ? Math.min(100, Math.max(0, Math.round((used / max) * 100)))
+    : raw.pct
+  const over = Number.isFinite(used) && used > max
+  return { ...raw, max, pct, over }
+}

package/event-id.mjs

@@ -191,3 +191,60 @@ export function inlineImageBlocks(evt) {
   })
   return out
 }
+
+// Pure aggregation for the /usage report — replay a session's retained log events and
+// fold every completed turn (kind:'result' with usage) into per-model + total token/cost
+// sums. No side effects, import-safe (bridge/test-usage-summary.mjs exercises it), so the
+// bridge computes /usage by replaying its own durable log — no separate accumulator that a
+// restart would drop. `costUsd` is the SDK's total_cost_usd per turn (BYOK estimate).
+export function summarizeUsage(logEvents) {
+  const results = (Array.isArray(logEvents) ? logEvents : []).filter((e) => e && e.kind === 'result' && e.usage)
+  const per = new Map()
+  let totalIn = 0, totalOut = 0, totalCost = 0, haveCost = false
+  for (const e of results) {
+    const u = e.usage || {}
+    const inTok = (u.input_tokens || 0) + (u.cache_creation_input_tokens || 0) + (u.cache_read_input_tokens || 0)
+    const out = u.output_tokens || 0
+    const cached = u.cache_read_input_tokens || 0
+    const mid = e.model || 'unknown'
+    const r = per.get(mid) || { model: mid, in: 0, out: 0, cached: 0 }
+    r.in += inTok; r.out += out; r.cached += cached; per.set(mid, r)
+    totalIn += inTok; totalOut += out
+    if (typeof e.costUsd === 'number') { totalCost += e.costUsd; haveCost = true }
+  }
+  return { turns: results.length, per: [...per.values()], totalIn, totalOut, totalCost, haveCost }
+}
+
+// model id → friendly label for the /usage report: claude-opus-4-8 → "Opus 4.8".
+// Bridge-local twin of the web's prettyModel (structured.jsx); falls back to the raw id.
+export function prettyModelId (m) {
+  if (!m) return 'unknown'
+  const mm = String(m).match(/(opus|sonnet|haiku|fable)-(\d+)(?:-(\d+))?/i)
+  return mm ? `${mm[1][0].toUpperCase()}${mm[1].slice(1)} ${mm[2]}${mm[3] ? '.' + mm[3] : ''}` : String(m)
+}
+
+// Build the ONE ◆ control line the /usage command emits, from the session's model +
+// retained log. Pure so the whole command — gate, empty-state, and per-model/total/cost
+// formatting — is exercised deterministically (bridge/test-usage-summary.mjs). The bridge
+// handler is a thin wrapper: ctlLine(usageReportLine(s.model, s.log)). `sessionModel` is
+// the resolved model id the /model state tracks; `logEvents` the session's retained log.
+export function usageReportLine (sessionModel, logEvents) {
+  const claudeish = (m) => /claude|anthropic|opus|sonnet|haiku|fable/i.test(String(m || ''))
+  const sum = summarizeUsage(logEvents)
+  // Gate (Max's ask: "make /usage work if users bridge is on claude llms"). The Code bridge
+  // runs the Claude Agent SDK, so a normal lane IS a Claude model — but a session pointed at a
+  // non-Claude base URL/model gets a legible line, not a bogus token report. Only assert this
+  // when we actually know a model (else a fresh empty session would wrongly trip the gate).
+  const anyClaude = claudeish(sessionModel) || sum.per.some((r) => claudeish(r.model))
+  if (!anyClaude && (sessionModel || sum.turns)) return 'usage reporting is available on Claude models only'
+  if (!sum.turns) return 'usage · no completed turns yet this session'
+  const fmtTok = (n) => n >= 1e6 ? (n / 1e6).toFixed(1) + 'M' : n >= 1e3 ? (n / 1e3).toFixed(1) + 'k' : String(n)
+  const perStr = sum.per.map((r) => {
+    const cch = r.cached ? ` (${fmtTok(r.cached)} cached)` : ''
+    return `${prettyModelId(r.model)}: ${fmtTok(r.in)} in${cch} / ${fmtTok(r.out)} out`
+  }).join(' · ')
+  const total = sum.per.length > 1 ? ` · total ${fmtTok(sum.totalIn)} in / ${fmtTok(sum.totalOut)} out` : ''
+  const cost = sum.haveCost ? ` · ~$${sum.totalCost.toFixed(2)} est` : ''
+  const turns = `${sum.turns} turn${sum.turns === 1 ? '' : 's'}`
+  return `usage · ${turns} · ${perStr}${total}${cost} · tokens + cost only (no plan/rate-limit meters)`
+}

package/flow-review-reflect.mjs

@@ -0,0 +1,115 @@
+/* ─────────────────────────────────────────────────────────────
+   flow-review-reflect.mjs — the BOUNDED reflection governor for the
+   verifying reviewer lane (heist E1 + P3).
+   Spec: docs/specs/2026-07-02-e1p3-verifying-reviewer.md
+   Parents: Emergent steal E1 (self-test loop) + Cursor steal P3 (Bugbot).
+
+   The existing adversarial reviewer (bridge/flow-review.mjs) runs the slice
+   once and emits a verdict. E1 makes that a bounded, budget-capped SELF-TEST
+   loop: the reviewer may dig across several rounds (re-run, hit edge cases,
+   reproduce the acceptance proof harder) — but it MUST stop at a hard ceiling
+   and hand off to the humans, never loop unbounded. That unbounded self-heal
+   loop is exactly Emergent's most-hated wound (billing a runaway fix-loop back
+   to the user); this governor is the structural guarantee we never have it.
+
+   Two independent stop conditions, both enforced here (not prompted):
+     • ROUND ceiling  — never more than maxRounds hunt rounds (anti-Emergent).
+     • BUDGET ceiling — never spend past the room/lane cap (nexos steal #1 /
+       cost-guard; the review lane SPENDS inference, so it inherits N1).
+
+   Pure + deterministic — the whole loop-control decision in one function so it
+   is unit-testable without a live Flow room (the reviewable seam; the live
+   wiring into flow-review.mjs + bridge.mjs is the held integration slice,
+   same split that shipped S5's reviewGateDecision).
+
+   P3 (pair co-adjudication): when the loop stops, the outcome is not the end —
+   `surfaceToPair` says the verdict/findings must go to the ROOM for the two
+   humans + Pool to challenge, rather than silently auto-driving the gate. A
+   solo Bugbot's verdict is final; ours is a prompt for the pair to argue.
+   ───────────────────────────────────────────────────────────── */
+
+export const REVIEW_DEFAULTS = Object.freeze({
+  maxRounds: 3,          // hard hunt ceiling — bounded, never unbounded (anti-Emergent)
+})
+
+/**
+ * Decide whether the reviewer's self-test loop continues or stops, and why.
+ *
+ * @param {object}  s
+ * @param {number}  s.round            1-based current hunt round (1 = first pass)
+ * @param {number} [s.maxRounds]       hard ceiling (default REVIEW_DEFAULTS.maxRounds)
+ * @param {number} [s.spentTokens]     tokens the review lane has spent so far
+ * @param {number|null} [s.budgetCap]  the room/lane token cap (null = uncapped)
+ * @param {boolean} s.foundFailure     this round produced a CONCRETE, reproduced failure
+ * @param {boolean} [s.exhausted]      the reviewer reports it has nothing left to check
+ * @returns {{ stop: boolean, action: 'reject'|'pass'|'surface'|'continue',
+ *             surfaceToPair: boolean, reason: string }}
+ *   action:
+ *     'reject'   — a concrete failure was found; stop, verdict = REJECT
+ *     'pass'     — checks exhausted with no failure; stop, verdict = PASS
+ *     'surface'  — a ceiling (budget or rounds) was hit inconclusively; stop,
+ *                  hand the partial findings to the humans (no guess, no loop)
+ *     'continue' — keep hunting (still under both ceilings, not yet concluded)
+ *   surfaceToPair — true whenever the loop STOPS (P3: every terminal outcome is
+ *                   a prompt for the pair, not an automatic gate action).
+ */
+export function reviewReflectionDecision ({
+  round,
+  maxRounds = REVIEW_DEFAULTS.maxRounds,
+  spentTokens = 0,
+  budgetCap = null,
+  foundFailure = false,
+  exhausted = false,
+} = {}) {
+  const r = Number.isFinite(round) ? round : 1
+  const cap = Number.isFinite(maxRounds) && maxRounds > 0 ? maxRounds : REVIEW_DEFAULTS.maxRounds
+
+  // 1. A concrete, reproduced failure ends the hunt immediately — default-to-
+  //    reject is the whole point; no value in more rounds once it's broken.
+  if (foundFailure) {
+    return { stop: true, action: 'reject', surfaceToPair: true,
+      reason: 'concrete failure reproduced — verdict REJECT' }
+  }
+
+  // 2. BUDGET ceiling (nexos #1 / cost-guard). Fail-closed: the moment spend
+  //    reaches the cap, STOP and hand off — never spend the next unit. Checked
+  //    before the round ceiling because money is the harder limit.
+  if (budgetCap != null && Number.isFinite(budgetCap) && spentTokens >= budgetCap) {
+    return { stop: true, action: 'surface', surfaceToPair: true,
+      reason: `review budget cap reached (${spentTokens}/${budgetCap} tokens) — surfacing partial findings to the pair` }
+  }
+
+  // 3. Reviewer says it has checked everything and found nothing — verdict PASS.
+  if (exhausted) {
+    return { stop: true, action: 'pass', surfaceToPair: true,
+      reason: 'checks exhausted, no failure reproduced — verdict PASS' }
+  }
+
+  // 4. ROUND ceiling (anti-Emergent). Reached the last allowed round without a
+  //    conclusion → surface to the humans rather than guess or loop forever.
+  if (r >= cap) {
+    return { stop: true, action: 'surface', surfaceToPair: true,
+      reason: `reached the ${cap}-round hunt ceiling without a conclusion — surfacing to the pair (not looping)` }
+  }
+
+  // 5. Under both ceilings, not yet concluded → dig another round.
+  return { stop: false, action: 'continue', surfaceToPair: false,
+    reason: `round ${r}/${cap}, under budget — continue hunting` }
+}
+
+/**
+ * Format a stopped review outcome as the room-facing co-adjudication prompt
+ * (P3). Not the gate action itself — a message that invites the two humans +
+ * Pool to challenge the reviewer before the verdict is treated as final.
+ */
+export function pairAdjudicationPrompt ({ action, reason, findings = [], taskKey = '' } = {}) {
+  const head = {
+    reject:  `The reviewer REJECTED ${taskKey || 'this slice'}.`,
+    pass:    `The reviewer PASSED ${taskKey || 'this slice'}.`,
+    surface: `The reviewer could not conclude on ${taskKey || 'this slice'}.`,
+  }[action] || `Review outcome for ${taskKey || 'this slice'}.`
+  const body = findings.length
+    ? '\n' + findings.map((f) => `  • ${f}`).join('\n')
+    : (reason ? `\n  ${reason}` : '')
+  return `${head}${body}\n\nYou two decide — do you agree? Challenge it, or accept.`
+}

package/flow-review.mjs

@@ -12,6 +12,7 @@
 import { execFileSync } from 'node:child_process'
 import { TASK_STATUS } from './flow-task-graph.mjs'
 import { removeFlowWorktree } from './flow-worktree.mjs'
+import { reviewReflectionDecision, REVIEW_DEFAULTS } from './flow-review-reflect.mjs'
 
 // The reviewer lane's rolePrompt (via startClaudeSession). Mirrors FLOW_LANE_PROMPT's
 // join('  ') style. This lane is ADVERSARIAL — its job is to disprove "done", not to build.
@@ -26,7 +27,9 @@ export const FLOW_REVIEWER_PROMPT = [
 
   'BE SPECIFIC. Your reasons must name exactly WHAT failed and HOW you found it — the command you ran, the output you got, the acceptance criterion it violated. "Doesn\'t work" is useless. "GET /api/todos returned 500 with `column todos.user_id does not exist`; acceptance required 200 + []" is a usable verdict.',
 
-  'EMIT YOUR VERDICT BY WRITING FLOW_REVIEW.json. Do NOT call mark_flow_done or ExitPlanMode (they hang here). As your LAST action, use the Write tool with file_path "FLOW_REVIEW.json" and content = a single JSON object { "pass": <boolean>, "reasons": ["<specific finding>", ...], "taskKey": "<the slice you reviewed>" }. `pass: false` reverts the reviewed slice so it rebuilds. The content of FLOW_REVIEW.json must be ONLY that JSON object (no prose, no markdown fences). Do not edit the slice — you review, you do not fix.',
+  'YOU GET BOUNDED HUNT ROUNDS, NOT ONE GLANCE. You may be asked to dig again — up to a hard ceiling of rounds. A green happy-path on round 1 is NOT a pass; use the next round to hunt harder (edge cases, the reload, the second click, concurrent use, the error path). You only stop early two ways: you reproduce a concrete FAILURE (emit pass:false — that ends it, the slice reverts), OR you have genuinely EXHAUSTED your checks and found nothing (emit pass:true AND exhausted:true — that ends it, the slice passes). If you still have angles left to try, emit pass:true and leave exhausted false/absent — you will be asked to dig one more round until the ceiling, at which point the inconclusive result is handed to the two humans to decide (never an unbounded self-loop).',
+
+  'EMIT YOUR VERDICT BY WRITING FLOW_REVIEW.json. Do NOT call mark_flow_done or ExitPlanMode (they hang here). As your LAST action, use the Write tool with file_path "FLOW_REVIEW.json" and content = a single JSON object { "pass": <boolean>, "reasons": ["<specific finding>", ...], "taskKey": "<the slice you reviewed>", "exhausted": <boolean, optional — true only when you have nothing left to check> }. `pass: false` reverts the reviewed slice so it rebuilds. The content of FLOW_REVIEW.json must be ONLY that JSON object (no prose, no markdown fences). Do not edit the slice — you review, you do not fix.',
 ].join('  ')
 
 // Parse a reviewer's raw verdict. Accepts an object OR a JSON string (optionally
@@ -43,7 +46,57 @@ export function parseReviewVerdict (raw) {
   if (!obj || typeof obj !== 'object') throw new Error('review verdict is not an object')
   if (typeof obj.pass !== 'boolean') throw new Error('review verdict missing boolean `pass`')
   const reasons = Array.isArray(obj.reasons) ? obj.reasons.map(String) : []
-  return { pass: obj.pass, reasons }
+  // E1 (bounded self-test): `exhausted` is an OPTIONAL third signal — true only when the
+  // reviewer reports it has nothing left to check. Absent/non-boolean → false (keep hunting
+  // until the round ceiling). Never throws on its absence; it's additive to the old contract.
+  const exhausted = obj.exhausted === true
+  return { pass: obj.pass, reasons, exhausted }
+}
+
+// E1 — map a parsed review verdict into the two governor inputs. A concrete FAILURE
+// (pass:false) is a reproduced break → foundFailure. A pass is only conclusive when the
+// reviewer says it EXHAUSTED its checks; a bare pass:true means "happy path held, more to
+// hunt" → keep going until the round ceiling. Pure; the seam the loop drives on.
+export function reviewVerdictToReflection (verdict) {
+  const v = verdict || {}
+  return {
+    foundFailure: v.pass === false,
+    exhausted: v.pass === true && v.exhausted === true,
+  }
+}
+
+// E1+A1/A2 — the BOUNDED reviewer loop. Drives the adversarial reviewer across up to
+// `maxRounds` hunt rounds, consulting reviewReflectionDecision between rounds, and stops at
+// the FIRST terminal outcome (reject on a concrete failure, pass on exhaustion, or SURFACE
+// when a ceiling — rounds or budget — is hit inconclusively). Pure over two injected effects
+// so it's unit-testable without a live Flow room (the S5 split):
+//   • runRound(round)  → Promise<parsed verdict {pass,reasons,exhausted}> — spend one round
+//   • getSpent()       → number — the review lane's tokens spent so far (flow-budget ledger)
+// N1 fail-closed: the budget is checked BEFORE each round is spent, so a review lane at/over
+// its cap SURFACES without ever spending the next round (never runs the bill up, anti-Emergent).
+// Returns { action, surfaceToPair, reason, rounds, verdict } — `rounds` = rounds actually run.
+export async function runBoundedReview ({ maxRounds, budgetCap = null, getSpent = () => 0, runRound }) {
+  if (typeof runRound !== 'function') throw new Error('runBoundedReview needs a runRound(round) function')
+  const cap = Number.isFinite(maxRounds) && maxRounds > 0 ? maxRounds : REVIEW_DEFAULTS.maxRounds
+  const capped = budgetCap != null && Number.isFinite(budgetCap)
+  for (let round = 1; ; round++) {
+    // N1 fail-closed pre-gate: never SPEND another review round once the cap is reached.
+    const spentBefore = getSpent()
+    if (capped && spentBefore >= budgetCap) {
+      const d = reviewReflectionDecision({
+        round, maxRounds: cap, spentTokens: spentBefore, budgetCap,
+        foundFailure: false, exhausted: false,
+      })
+      return { ...d, rounds: round - 1, verdict: null }
+    }
+    const verdict = await runRound(round)
+    const decision = reviewReflectionDecision({
+      round, maxRounds: cap, spentTokens: getSpent(), budgetCap,
+      ...reviewVerdictToReflection(verdict),
+    })
+    if (decision.stop) return { ...decision, rounds: round, verdict }
+    // else action==='continue' — under both ceilings, not yet concluded → dig another round.
+  }
 }
 
 // Gate decision over a task's verdicts (≥1 reviewer). Accept iff EVERY verdict passes;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "thinkpool-pair",
-  "version": "0.7.154",
+  "version": "0.7.156",
   "description": "Share a local coding-agent CLI (Claude Code, Codex, Gemini, Aider, …) into a ThinkPool Code room, live.",
   "type": "module",
   "bin": {
@@ -11,6 +11,7 @@
     "sdk-smoke.mjs",
     "launcher.mjs",
     "byok-detect.mjs",
+    "context-windows.mjs",
     "claude-session.mjs",
     "update-gate.mjs",
     "event-id.mjs",
@@ -23,6 +24,7 @@
     "flow-preview.mjs",
     "flow-review.mjs",
     "flow-review-gate.mjs",
+    "flow-review-reflect.mjs",
     "flow-assembly.mjs",
     "flow-budget.mjs",
     "flow-context-store.mjs",

package/session-store.mjs

@@ -215,14 +215,3 @@ export function loadNames(room) {
 export function saveNames(room, names) {
   try { ensureDir(room); fs.writeFileSync(namesFile(room), JSON.stringify(names || {})) } catch { /* noop */ }
 }
-
-// Session recap cache (2026-07-02, Session Info panel). The last on-demand summary,
-// stored as a dotfile (NOT *.json → never in loadAll) so it survives a bridge restart
-// and any device that opens the panel can fetch it (persists across devices). One per room.
-const summaryFile = (room) => path.join(dir(room), '.summary')
-export function loadSummary(room) {
-  try { return JSON.parse(fs.readFileSync(summaryFile(room), 'utf8')) || null } catch { return null }
-}
-export function saveSummary(room, summary) {
-  try { ensureDir(room); fs.writeFileSync(summaryFile(room), JSON.stringify(summary || null)) } catch { /* noop */ }
-}