thinkpool-pair 0.7.356 → 0.7.358

package/bridge.mjs

@@ -47,7 +47,8 @@ import { createPermNotifier, shouldNotifyTurnDone, shouldRecordTurnDone, permiss
 // resolveProviderEnv(id) → {ANTHROPIC_BASE_URL,ANTHROPIC_AUTH_TOKEN,ANTHROPIC_MODEL} for a
 // registered custom provider, or null for the built-in/unknown (leave the default env intact).
 // Multi-provider BYOK slice 1: a lane spawned with a `provider` id runs on that endpoint.
-import { resolveProviderEnv, resolveProviderRef, providerNameMap, publicKeyB64, bridgeHostId, announceProviders, listProviders, effectiveLaneModel, sameProviderEnv, providerModel } from './providers.mjs'
+import { resolveProviderEnv, resolveProviderRef, resolveProviderResiliencePolicy, providerNameMap, publicKeyB64, bridgeHostId, announceProviders, listProviders, effectiveLaneModel, sameProviderEnv, providerModel } from './providers.mjs'
+import { createMemoryCircuit, providerResilienceCapAdmission } from './provider-resilience.mjs'
 import { validateProviderSwitch, providerSwitchPlan, BUILTIN_PROVIDER } from './switch-provider.mjs'
 import { createSdkMcpServer, tool } from '@anthropic-ai/claude-agent-sdk'
 import { z } from 'zod'
@@ -672,6 +673,10 @@ const BRIDGE_STARTED_AT = Date.now()
 // top-level only (one bridge per announce); older clients ignore the unknown key.
 const host = (os.hostname() || 'host').split('.')[0].slice(0, 24)
 const hostId = bridgeHostId()
+// Phase 1 circuit state is deliberately memory-only. Its primitive keys state
+// by bridge/provider/exact-model; a process restart clears it and no credential,
+// endpoint, prompt, or raw error ever enters the map.
+const providerResilienceCircuit = createMemoryCircuit()
 
 // Repo awareness — the room shows which project this machine is sharing.
 // Cheap reads, no subprocess: directory name + .git/HEAD.
@@ -1750,6 +1755,11 @@ const designArtifacts = new Map() // previewId → trusted source record
 const designQueues = new Map()    // producer term → validated requests
 const designActive = new Map()    // producer term → request awaiting result + proof
 const designRestore = new Map()   // current previewId → immediately previous verified record/edit
+// Realtime can carry the settled DOM for ordinary authored mockups. Including
+// that already-uploaded snapshot in the correlated verified-live event lets an
+// open Design lane advance revisions without a second auth/sign/download round
+// trip. Large artifacts keep the normal signed-storage path.
+const MAX_INLINE_DESIGN_REVISION_BYTES = 128 * 1024
 const designStatus = (payload) => designChannel.send({
   type: 'broadcast', event: 'design-status', payload: { ts: Date.now(), ...payload },
 })
@@ -1772,7 +1782,12 @@ const finishDesign = (term, state, extra = {}) => {
 const maybeVerifyDesign = (term) => {
   const active = designActive.get(term)
   if (!active?.resultOk || !active.proof) return
-  finishDesign(term, 'verified-live', { message: 'Verified at desktop and mobile.', artifact: active.proof, canRestore: active.record.sourceKind !== 'preview' })
+  finishDesign(term, 'verified-live', {
+    message: 'Verified at desktop and mobile.',
+    artifact: active.proof.artifact,
+    ...(active.proof.artifactHtml ? { artifactHtml: active.proof.artifactHtml } : {}),
+    canRestore: active.record.sourceKind !== 'preview',
+  })
 }
 
 function pumpDesign(term) {
@@ -1944,7 +1959,10 @@ const handleManifest = async ({ box, term, trustedDesignSource = false, slug, m
         : designRecord.sourcePath === active?.record?.sourcePath
       if (correlated && dual && sameTarget && revisionProvesChange) {
         if (active.record.sourceKind !== 'preview') designRestore.set(designRecord.previewId, { priorRecord: active.record, request: active.request })
-        active.proof = artifact
+        const artifactHtml = Buffer.byteLength(displaySource, 'utf8') <= MAX_INLINE_DESIGN_REVISION_BYTES
+          ? displaySource
+          : null
+        active.proof = { artifact, artifactHtml }
         maybeVerifyDesign(term)
       }
     }
@@ -2233,6 +2251,80 @@ function restoredTurnOpen(log) {
   return false
 }
 
+function emitCodexCompactionControl(entry, text, by = null) {
+  const evt = { kind: 'control', text, by }
+  pushLog(entry, evt)
+  bcast('code-event', { term: entry.id, evt })
+}
+
+async function runCodexCompaction(entry, request = {}) {
+  const recap = buildRecapFromLog(entry.log, RECAP_CAP, { reason: 'compact' })
+  if (!recap) {
+    emitCodexCompactionControl(entry, 'nothing to compact — context unchanged', request.by)
+    return
+  }
+  const preTokens = entry.lastUsage?.ctx?.used || null
+  bcast('code-event', { term: entry.id, evt: { kind: 'compact', status: 'start', ts: Date.now() } })
+  let nativeCompacted = false
+  try {
+    nativeCompacted = await entry.session.compactContext?.()
+  } catch {
+    // compactContext classifies delivery certainty. A truly unexpected throw
+    // remains non-replayable here; resetting after an unknown native request can
+    // execute compaction twice against two different threads.
+    nativeCompacted = null
+  } finally {
+    // Native compaction emits usage while compactActive=true, so onEvent
+    // legitimately announces a busy edge. It has no ordinary result event;
+    // close that borrowed edge after compactContext clears compactActive.
+    if (!entry.session.turnActive && settleLaneControl(entry)) announce()
+  }
+  if (nativeCompacted === true) {
+    const evt = { kind: 'compaction', trigger: 'manual', preTokens, by: request.by, native: true }
+    pushLog(entry, evt)
+    bcast('code-event', { term: entry.id, evt })
+    bcast('code-event', { term: entry.id, evt: { kind: 'compact', status: 'done', ts: Date.now() } })
+    entry.flush?.()
+    return
+  }
+  if (nativeCompacted == null) {
+    bcast('code-event', { term: entry.id, evt: { kind: 'compact', status: 'done', ts: Date.now() } })
+    emitCodexCompactionControl(entry, 'Native compaction is still settling; existing context was preserved.', request.by)
+    entry.flush?.()
+    return
+  }
+  if (entry.session.clearContext?.() === false) {
+    bcast('code-event', { term: entry.id, evt: { kind: 'compact', status: 'done', ts: Date.now() } })
+    emitCodexCompactionControl(entry, 'Codex context compaction unavailable right now', request.by)
+    return
+  }
+  entry.pendingRecap = recap
+  const evt = { kind: 'compaction', trigger: 'manual', preTokens, by: request.by }
+  pushLog(entry, evt)
+  bcast('code-event', { term: entry.id, evt })
+  // The new native thread has only the bounded recap queued for the next human
+  // turn. Reset the visible meter to that conservative text estimate.
+  if (entry.lastUsage?.ctx?.max) {
+    const used = Math.ceil(recap.length / 4)
+    const max = entry.lastUsage.ctx.max
+    const usage = { kind: 'usage', ctx: { ...entry.lastUsage.ctx, used, max, pct: Math.min(100, Math.round((used / max) * 100)), over: used > max } }
+    entry.lastUsage = usage
+    bcast('code-event', { term: entry.id, evt: usage })
+  }
+  bcast('code-event', { term: entry.id, evt: { kind: 'compact', status: 'done', ts: Date.now() } })
+  entry.flush?.()
+}
+
+function startCodexCompaction(entry, request = {}) {
+  if (!entry || entry.runtime !== 'codex' || entry.codexCompactionPromise) return false
+  const job = runCodexCompaction(entry, request)
+  entry.codexCompactionPromise = job
+  void job.finally(() => {
+    if (entry.codexCompactionPromise === job) entry.codexCompactionPromise = null
+  }).catch(() => { /* runCodexCompaction already surfaced classified failures */ })
+  return true
+}
+
 // Active-worktree snapshot for the per-turn ROOM NOW tail. Cached ~60s per cwd —
 // a subprocess on every turn of every lane would be waste, and worktrees change on
 // minutes-scale. Plain `git worktree list` output (path · sha · [branch]) is the
@@ -3254,6 +3346,33 @@ function openStructured({ id, runtime = 'claude', model, models, effort, resume,
     flowRole: entry.flowRole,
     sideParent: entry.sideParent,
   }), canSpawnWorkers ? HERMES_VISIBLE_WORKER_FALLBACK_RULE : ''].filter(Boolean).join('\n\n')
+  const resolvedProviderResilience = runtime === 'claude'
+    ? resolveProviderResiliencePolicy(provider)
+    : null
+  let resilienceCapAbsenceLogged = false
+  const providerResilience = resolvedProviderResilience?.policy?.enabled === true
+    ? {
+        policy: resolvedProviderResilience.policy,
+        providers: listProviders(),
+        providerId: resolvedProviderResilience.target.providerId,
+        model: resolvedProviderResilience.target.actualConfiguredModel,
+        requestedModel: laneModel || resolvedProviderResilience.target.actualConfiguredModel,
+        bridgeHostId: hostId,
+        circuit: providerResilienceCircuit,
+        // sendTurn creates the controller immediately before the bridge advances
+        // its public turn revision, so project the revision that admission owns.
+        turnRev: () => (Number(entry._turnRev) || 0) + 1,
+        capGate: () => {
+          const budget = entry.flowSessionId ? flowBudgets.get(entry.flowSessionId) : null
+          const admission = providerResilienceCapAdmission(budget)
+          if (!admission.configured && !resilienceCapAbsenceLogged) {
+            resilienceCapAbsenceLogged = true
+            process.stderr.write(`\n  ${A.dim}◇ provider resilience cap_not_configured (${String(id).slice(0, 8)})${A.rst}\n`)
+          }
+          return admission
+        },
+      }
+    : null
   entry.session = startStructuredSession(runtime, {
     // laneModel, NOT the raw `model` param: the SDK's `model` option OVERRIDES the
     // ANTHROPIC_MODEL supplied by resolveProviderEnv() in `env` below, so an inherited
@@ -3360,6 +3479,10 @@ function openStructured({ id, runtime = 'claude', model, models, effort, resume,
     // per-machine default (provider.mjs/applyProviderEnv). null for built-in/unknown → the
     // default Claude env is left exactly as-is (unchanged path).
     env: { ...process.env, ...buildConductorEnv({ flowSessionId, mode }), ...(resolveProviderEnv(provider) || {}), TP_MOCKUP_OUTBOX: mockupOutbox },
+    // Same-target custom-provider resilience is a host-local dark-launch
+    // primitive. Missing/disabled policy, built-in Anthropic, Codex, and Hermes
+    // receive null and preserve their established transport behavior exactly.
+    resilience: providerResilience,
     onTurnStart: (options = {}) => {
       // Hermes promotes /queue items internally, without a second code-turn.
       // Advance the lifecycle before its first output and publish the deferred
@@ -3620,6 +3743,15 @@ function openStructured({ id, runtime = 'claude', model, models, effort, resume,
         pushLog(entry, ce)
         bcast('code-event', { term: id, evt: ce })
       }
+      // A busy Codex lane accepts one deferred /compact intent. Claim the
+      // compaction synchronously at the terminal result boundary so a new human
+      // turn cannot slip into the gap, and coalesce every repeated tap into this
+      // one job.
+      if ((evt.kind === 'result' || evt.kind === 'error') && entry.runtime === 'codex' && entry.pendingCodexCompaction) {
+        const request = entry.pendingCodexCompaction
+        entry.pendingCodexCompaction = null
+        startCodexCompaction(entry, request)
+      }
       // ── Slice 3: the turn settled. Two things happen, in this order.
       //   1. Every outstanding permission card on this lane is now dead (the SDK
       //      won't ask again for a turn that ended) — clearAll retracts any
@@ -4642,6 +4774,7 @@ channel
     }
     if (/^\/clear\s*$/.test(text)) {
       s.pendingRecap = null   // /clear means forget context — drop any un-fired carry recap
+      s.pendingCodexCompaction = null // explicit clear supersedes a deferred compact
       if (s.runtime === 'codex' || s.runtime === 'hermes') s.session.clearContext?.()
       else s.session.sendTurn(text)
       // The seq reset is load-bearing on BOTH ends: the client's clear handler sets
@@ -4662,61 +4795,16 @@ channel
     // No persisted ctl line — the live indicator + the CompactionCard are the record.
     if (/^\/compact\s*$/.test(text)) {
       if (s.runtime === 'codex') {
+        // One lifecycle owns every distinct press. During an ordinary turn the
+        // first request is queued and truthfully runs at its result boundary;
+        // later taps, including taps during native compaction, coalesce silently.
+        if (s.codexCompactionPromise || s.pendingCodexCompaction) return
         if (s.session.turnActive) {
-          ctlLine('Compact after this turn ends.', { tone: 'caution' })
+          s.pendingCodexCompaction = { by: payload.by, cid: payload.cid }
+          ctlLine('Compaction queued for after this turn.', { tone: 'caution' })
           return
         }
-        const recap = buildRecapFromLog(s.log, RECAP_CAP, { reason: 'compact' })
-        if (!recap) {
-          ctlLine('nothing to compact — context unchanged')
-          return
-        }
-        const preTokens = s.lastUsage?.ctx?.used || null
-        bcast('code-event', { term: payload.term, evt: { kind: 'compact', status: 'start', ts: Date.now() } })
-        let nativeCompacted = false
-        try {
-          nativeCompacted = await s.session.compactContext?.()
-        } catch {
-          // The bounded recap below is the safe fallback for a native transport
-          // failure. The roster edge is still settled in finally.
-        } finally {
-          // Native compaction emits usage while compactActive=true, so onEvent
-          // legitimately announces a busy edge. It has no ordinary result event;
-          // close that borrowed edge here after compactContext's finally clears
-          // compactActive, or "Compacting…" degrades into stale "Thinking…".
-          // A browser turn may have arrived while compactContext awaited App
-          // Server readiness. Never let control cleanup settle that ordinary
-          // turn's busy edge; the normal result boundary owns it.
-          if (!s.session.turnActive && settleLaneControl(s)) announce()
-        }
-        if (nativeCompacted) {
-          const ce = { kind: 'compaction', trigger: 'manual', preTokens, by: payload.by, native: true }
-          pushLog(s, ce)
-          bcast('code-event', { term: payload.term, evt: ce })
-          bcast('code-event', { term: payload.term, evt: { kind: 'compact', status: 'done', ts: Date.now() } })
-          s.flush?.()
-          return
-        }
-        if (s.session.clearContext?.() === false) {
-          bcast('code-event', { term: payload.term, evt: { kind: 'compact', status: 'done', ts: Date.now() } })
-          ctlLine('Codex context compaction unavailable right now')
-          return
-        }
-        s.pendingRecap = recap
-        const ce = { kind: 'compaction', trigger: 'manual', preTokens, by: payload.by }
-        pushLog(s, ce)
-        bcast('code-event', { term: payload.term, evt: ce })
-        // The new native thread has only the bounded recap queued for the next
-        // human turn. Reset the visible meter to that conservative text estimate.
-        if (s.lastUsage?.ctx?.max) {
-          const used = Math.ceil(recap.length / 4)
-          const max = s.lastUsage.ctx.max
-          const usage = { kind: 'usage', ctx: { ...s.lastUsage.ctx, used, max, pct: Math.min(100, Math.round((used / max) * 100)), over: used > max } }
-          s.lastUsage = usage
-          bcast('code-event', { term: payload.term, evt: usage })
-        }
-        bcast('code-event', { term: payload.term, evt: { kind: 'compact', status: 'done', ts: Date.now() } })
-        s.flush?.()
+        startCodexCompaction(s, { by: payload.by, cid: payload.cid })
         return
       }
       s.compacting = true

package/claude-session.mjs

@@ -25,6 +25,7 @@ import { normalizeClaudeCommandCatalog } from './claude-command-catalog.mjs'
 import { evidenceForToolResult } from './evidence-citations.mjs'
 import { THINKPOOL_CASCADE_RULE, THINKPOOL_REMOTE_DELIVERY_RULES, THINKPOOL_RUNTIME_AUTHORITY_RULE, THINKPOOL_RUNTIME_TURN_REMINDER, buildThinkPoolTurnGuidance, createRoomContextSelector, usesFullThinkPoolReminder } from './thinkpool-room-prompt.mjs'
 import { stallDecision, stallEvent, isCompactTurn } from './turn-stall.mjs'
+import { createSameTargetResilienceController, formatResilienceTrace } from './provider-resilience.mjs'
 
 // The caret-pulled SDK's real version (^0.3.x auto-upgrades on restart). Resolved
 // once at import by walking up from the package entry to its own package.json.
@@ -245,7 +246,7 @@ const TP_ROOM_REMINDER = [
   'BUILD WORKFLOW (default, no magic word): right-size within your TERMINAL ROLE — a trivial ask or delegated slice you just do; a conductor-capable role with a genuinely decomposable build FIRST writes a short plan in chat, THEN fans worker slices into visible spawn_terminal lanes and verifies them. Worker/leaf/Side/managed Flow roles do not fan out. A person-requested new or separate terminal uses open_main_terminal. Never plan-mode/ExitPlanMode; plans live in chat and lanes in the existing list.',
 ].join(' ')
 
-export function startClaudeSession({ cwd, model, effort: initialEffort = 'high', resume, env, mode: initialMode = 'default', onEvent, requestPermission, mcpServers, crossPostGate, crossRoomPostGate, didSpawnTarget = null, terminalRolePrompt, rolePrompt, blockSubagents = false, onSubmitPlan = null, onLaneDone = null, onReviewVerdict = null, reviewGate = null, lazy = false, roomContext = null, suggest = true, prepareCwd = null, admitStart = null, resilienceObserver = null }) {
+export function startClaudeSession({ cwd, model, effort: initialEffort = 'high', resume, env, mode: initialMode = 'default', onEvent, requestPermission, mcpServers, crossPostGate, crossRoomPostGate, didSpawnTarget = null, terminalRolePrompt, rolePrompt, blockSubagents = false, onSubmitPlan = null, onLaneDone = null, onReviewVerdict = null, reviewGate = null, lazy = false, roomContext = null, suggest = true, prepareCwd = null, admitStart = null, resilienceObserver = null, resilience = null }) {
   // Per-turn reminder + live ROOM NOW tail. roomContext (bridge-supplied) returns the
   // room's CURRENT state — sibling lanes, active git worktrees — or null. The static
   // rules keep the agent aware of the room's FEATURES; the live tail keeps it aware of
@@ -272,6 +273,7 @@ export function startClaudeSession({ cwd, model, effort: initialEffort = 'high',
   let persistedSessionId = resume || null
   let lastTurnText = null   // the most recent turn text, so a bad-resume recovery can re-deliver it
   let lastTurnReminder = null
+  let lastTurnBlocks = null // exact current prompt blocks; same-target retry must replay byte-for-byte
   let closed = false
   // Lazy boot (2026-07-02): a RESTORED-IDLE terminal returns a full session object but
   // defers the expensive query() cold-start (MCP + settingSources, ~50s each) until its
@@ -352,6 +354,14 @@ export function startClaudeSession({ cwd, model, effort: initialEffort = 'high',
   // Phase 0 measurement seam. The observer receives only a coarse recovery
   // reason/count; it cannot alter this session's existing retry behavior.
   const observeRecovery = (reason, detail = {}) => { try { resilienceObserver?.({ reason, restartCount, ...detail }) } catch { /* observer is strictly read-only */ } }
+  // Phase 1 is opt-in and applies only to a named non-Anthropic custom target. Keep
+  // disabled/built-in sessions on the established RESTART_MAX recovery path exactly.
+  const resilienceEnabled = !!(resilience?.policy?.enabled && resilience?.providerId && resilience.providerId !== 'anthropic')
+  let turnResilience = null
+  let resilienceDeadlineTimer = null
+  let resilienceRetryPending = false
+  let resilienceTurnRevision = 0
+  let abortPending = false
   let restartTimer = null   // the pending auto-restart backoff — cancelled by end()
   // Force-stop a true wedge (item 3): no result, no error, just silence past
   // FORCE_STOP_MS. As of the 2026-07-08 hardening we no longer just surface an error
@@ -400,6 +410,7 @@ export function startClaudeSession({ cwd, model, effort: initialEffort = 'high',
   // cleared on the next result — "all teardown has arrived" isn't observable. `success`
   // results are never swallowed, so the flushed steer's completion always surfaces.
   let interrupting = false
+  let interruptingRevision = null
   let interruptTimer = null
   const INTERRUPT_SWALLOW_MS = 6000
   // ── Haiku suggestion fallback ──
@@ -423,6 +434,59 @@ export function startClaudeSession({ cwd, model, effort: initialEffort = 'high',
   // (`result`/`error` — covers a no-op "Not enough messages to compact" and a Stop). After
   // that the normal wedge timeline applies again.
   const emit = (evt) => { lastEvtTs = Date.now(); if (evt && evt.kind !== 'stalled') stalledSent = false; if (evt && (evt.kind === 'compaction' || evt.kind === 'result' || evt.kind === 'error')) compacting = false; emitRaw(evt) }
+  // The controller only receives its own allowlisted records. Room notes are likewise
+  // rendered from that projection, never from an SDK error, URL, credential, or prompt.
+  const resilienceRecord = (record) => {
+    try { resilience?.onRecord?.(record) } catch { /* observer is never control flow */ }
+    if (record?.outcome === 'retrying' || record?.outcome === 'cap_blocked' || record?.outcome === 'circuit_open') {
+      emit({ kind: 'note', text: formatResilienceTrace(record) })
+    }
+  }
+  const clearResilienceDeadline = () => {
+    if (resilienceDeadlineTimer == null) return
+    try { (resilience?.clearTimer || clearTimeout)(resilienceDeadlineTimer) } catch { /* deadline cleanup is best-effort */ }
+    resilienceDeadlineTimer = null
+  }
+  const armResilienceDeadline = () => {
+    clearResilienceDeadline()
+    if (!turnResilience) return
+    const timeoutMs = Number(resilience?.policy?.timeoutMs)
+    if (!Number.isFinite(timeoutMs) || timeoutMs <= 0) return
+    const schedule = resilience?.setTimer || setTimeout
+    resilienceDeadlineTimer = schedule(() => {
+      resilienceDeadlineTimer = null
+      if (closed || !turnResilience || !turnActive) return
+      // This is a bridge-authored timeout classification, never a raw provider
+      // error. Abort the wedged iterator, then reuse the same controller budget.
+      turnResilience.failure({ message: 'timeout' })
+      turnActive = false
+      try { qAc?.abort() } catch { /* the disposal wait below still fails closed */ }
+      retryResilientTurn()
+    }, timeoutMs)
+  }
+  const createTurnResilience = () => {
+    if (!resilienceEnabled) return null
+    try {
+      const controller = createSameTargetResilienceController({
+        runtime: 'claude', providers: resilience.providers || [], providerId: resilience.providerId,
+        model: resilience.model || opts.model || model,
+        requestedModel: resilience.requestedModel || resilience.model || opts.model || model,
+        policy: resilience.policy, bridgeHostId: resilience.bridgeHostId,
+        circuit: resilience.circuit, capGate: resilience.capGate,
+        traceId: resilience.traceId,
+        turnRev: typeof resilience.turnRev === 'function' ? resilience.turnRev() : resilience.turnRev,
+        onRecord: resilienceRecord,
+      })
+      controller.start()
+      return controller
+    } catch { return null }
+  }
+  const admitResilientSubmission = async () => {
+    if (!turnResilience) return true
+    let admission = null
+    try { admission = await turnResilience.preflight() } catch { return false }
+    return admission?.admitted === true
+  }
   const stallTimer = setInterval(() => {
     const quiet = Date.now() - lastEvtTs
     const action = stallDecision({ turnActive, awaitingUser, quietMs: quiet, stallMs: STALL_MS, forceStopMs: FORCE_STOP_MS, stalledSent, stallRetried, compacting, compactForceStopMs: COMPACT_FORCE_STOP_MS })
@@ -432,7 +496,23 @@ export function startClaudeSession({ cwd, model, effort: initialEffort = 'high',
     const ev = stallEvent(action, quiet)
     if (ev) emitRaw(ev)
     if (action === 'status') { stalledSent = true; return }
-    if (action === 'retry') { observeRecovery('stall_replay', { quietMs: quiet }); forceStopped = true; retryStalledTurn(quiet); return }
+    if (action === 'retry') {
+      forceStopped = true
+      if (turnResilience) {
+        // The legacy watchdog must never create a second retry ledger. Route
+        // its terminal timeout through the same controller; visible output or
+        // an exhausted attempt budget makes the following preflight fail closed.
+        observeRecovery('resilience_stall', { quietMs: quiet })
+        turnResilience.failure({ message: 'timeout' })
+        turnActive = false
+        try { qAc?.abort() } catch { /* disposal is awaited by the shared retry path */ }
+        retryResilientTurn()
+        return
+      }
+      observeRecovery('stall_replay', { quietMs: quiet })
+      retryStalledTurn(quiet)
+      return
+    }
     // 'giveup' — the one auto-retry ALSO stalled past FORCE_STOP_MS. Fall back to the
     // pre-2026-07-08 behavior: force-stop the turn so between-turns updates unblock, and
     // let the human resend. The wedged loop is left in place; if it later throws, the
@@ -686,6 +766,7 @@ export function startClaudeSession({ cwd, model, effort: initialEffort = 'high',
     // On deny, permissionDecisionReason IS what the model receives as the
     // tool error — make it a real instruction, not an opaque tag.
     const denied = decision === 'deny'
+    if (denied && turnResilience) turnResilience.failure({ permissionDenied: true })
     return {
       continue: true,
       hookSpecificOutput: {
@@ -951,6 +1032,10 @@ export function startClaudeSession({ cwd, model, effort: initialEffort = 'high',
             }
             break
           case 'assistant':
+            clearResilienceDeadline()
+            // Any assistant block (including a tool_use) has crossed the replay
+            // boundary. A same-target retry is only safe before visible output.
+            turnResilience?.visibleOutput()
             // Stamp tool-call start times so tool_result can report a duration.
             for (const b of (m.message?.content || [])) {
               if (b?.type === 'tool_use' && b.id) toolStart.set(b.id, { at: Date.now(), name: b.name, input: b.input })
@@ -966,6 +1051,8 @@ export function startClaudeSession({ cwd, model, effort: initialEffort = 'high',
             // tool_result blocks arrive on the user-role echo
             for (const b of (m.message?.content || [])) {
               if (b?.type === 'tool_result') {
+                clearResilienceDeadline()
+                turnResilience?.visibleOutput({ tool: true })
                 const start = toolStart.get(b.tool_use_id)
                 if (start != null) toolStart.delete(b.tool_use_id)
                 const evidence = evidenceForToolResult(start?.name, b.content)
@@ -990,6 +1077,7 @@ export function startClaudeSession({ cwd, model, effort: initialEffort = 'high',
             break
           }
           case 'result':
+            clearResilienceDeadline()
             if (m.session_id) sessionId = m.session_id
             // Bad resume target: the CLI can't find the session we tried to resume — a forked
             // id that was never persisted, or a pruned transcript. It surfaces as an is_error
@@ -1019,7 +1107,26 @@ export function startClaudeSession({ cwd, model, effort: initialEffort = 'high',
             // abort() already emitted the one canonical aborted boundary. `success` (and any
             // non-teardown subtype) always emits; only the aborted/error_during_execution pair
             // the interrupt churns out is dropped, and only inside the timer-bounded window.
-            if (interrupting && (m.subtype === 'aborted' || m.subtype === 'error_during_execution')) { turnActive = false; break }
+            // This guard MUST precede resilient `is_error` handling: the second teardown echo
+            // is itself an is_error result and may arrive after the next turn has installed a
+            // new controller. Letting it reach that controller would retry the wrong prompt.
+            if (interrupting && (m.subtype === 'aborted' || m.subtype === 'error_during_execution')) {
+              // A late teardown echo from the stopped turn may arrive after the
+              // next turn is accepted. Swallow the echo, but only mutate liveness
+              // while the stopped revision still owns the lane.
+              if (resilienceTurnRevision === interruptingRevision) turnActive = false
+              break
+            }
+            // Some SDK transport failures arrive as an error result instead of a
+            // thrown iterator error. Treat them identically, without serializing
+            // `m.errors` or `m.result` into the room event stream.
+            if (m.is_error && turnResilience) {
+              if (resilienceRetryPending) break
+              turnResilience.failure({ message: Array.isArray(m.errors) ? m.errors.join(' ') : m.result, status: m.status ?? m.statusCode, code: m.code })
+              turnActive = false
+              retryResilientTurn()
+              break
+            }
             turnBaseOut = 0; curMsgOut = 0   // reset the live token count for the next turn
             turnActive = false               // turn settled → stall watchdog stands down
             // A model switch requested mid-turn was deferred — apply it now the turn is done.
@@ -1027,6 +1134,7 @@ export function startClaudeSession({ cwd, model, effort: initialEffort = 'high',
             // doesn't await itself; the setTimeout runs after this iterator yields.
             if (pendingSwitch) { pendingSwitch = false; setTimeout(() => { if (!closed) recreateForSwitch() }, 0) }
             if (m.subtype === 'success') { restartCount = 0; if (sessionId) persistedSessionId = sessionId }   // ONLY a real success refills the
+            if (m.subtype === 'success') { turnResilience?.success(); turnResilience = null }
             // auto-restart budget (else a flapping connection that lands one aborted turn between
             // drops refills every cycle past RESTART_MAX) — and marks this session id durably
             // persisted so a later model-switch re-create can safely resume it.
@@ -1080,11 +1188,22 @@ export function startClaudeSession({ cwd, model, effort: initialEffort = 'high',
         }
       }
     } catch (e) {
+      clearResilienceDeadline()
       if (closed) return
       // This query was intentionally aborted (a model switch superseded it, or the
       // session is ending) — not a real error. Stay silent; the re-create owns what's next.
       if (myAc.signal.aborted) return
       const msg = e?.message || String(e)
+      // Enabled custom-provider turns have a strict, per-turn controller. It
+      // classifies the raw transport error locally, then either admits one exact
+      // replay before any output or terminates without putting provider details in
+      // the room. The legacy path below is intentionally untouched when disabled.
+      if (turnResilience && turnActive) {
+        turnResilience.failure({ message: msg, status: e?.status ?? e?.statusCode, code: e?.code })
+        turnActive = false
+        retryResilientTurn()
+        return
+      }
       // onEvent is also the bridge's synchronous busy-edge sampling point. The
       // query has already ended here, so publish the failure only after clearing
       // the turn. Otherwise a non-recoverable SDK error leaves the roster on its
@@ -1192,12 +1311,63 @@ export function startClaudeSession({ cwd, model, effort: initialEffort = 'high',
       emitRaw({ kind: 'note', text: 'retrying the stalled turn on a fresh connection' })
     }
   }
-  if (!lazy) runQuery()
+  // A resilience retry has to wait for the failed Query's disposal: otherwise the
+  // replay races its session-file lock. Admission is deliberately before runQuery(),
+  // so a refused cap/circuit sends no second provider submission.
+  const retryResilientTurn = () => {
+    if (closed || abortPending || resilienceRetryPending) return
+    const retryingTurn = turnResilience
+    const retryingRevision = resilienceTurnRevision
+    const retryingBlocks = lastTurnBlocks
+    resilienceRetryPending = true
+    const dying = qDone
+    const oldInput = input
+    input = makeInputStream()
+    try { oldInput.end() } catch { /* noop */ }
+    restartTimer = setTimeout(async () => {
+      restartTimer = null
+      try { await dying } catch { /* disposal failure still fails closed below */ }
+      if (closed || !resilienceRetryPending || turnResilience !== retryingTurn || resilienceTurnRevision !== retryingRevision) return
+      if (!(await admitResilientSubmission())) {
+        resilienceRetryPending = false
+        finishResilientFailure()
+        return
+      }
+      if (closed || !resilienceRetryPending || turnResilience !== retryingTurn || resilienceTurnRevision !== retryingRevision) return
+      resilienceRetryPending = false
+      turnActive = true
+      lastEvtTs = Date.now()
+      stalledSent = false
+      runQuery()
+      // This is the exact previously accepted prompt block array, not a rebuilt
+      // string/reminder. It is only reached before assistant or tool output.
+      if (retryingBlocks) input.push(retryingBlocks)
+      armResilienceDeadline()
+    }, 0)
+  }
+  const finishResilientFailure = () => {
+    clearResilienceDeadline()
+    turnActive = false
+    turnResilience = null
+    // The failed Query is gone, but the lane remains recoverable for a later
+    // human turn. `started=false` ensures that turn creates a fresh Query rather
+    // than pushing into the ended stream.
+    started = false
+    emit({
+      kind: 'error',
+      message: 'The configured provider could not complete this turn. Nothing else was sent.',
+      recoverable: true,
+    })
+  }
+  // A custom resilient session defers its otherwise-eager query creation until a
+  // turn clears the injected admission gate. Disabled and built-in sessions retain
+  // their existing eager start and RESTART_MAX behavior.
+  if (!lazy && !resilienceEnabled) runQuery()
 
   return {
     // A lazy (restored-idle) session cold-boots the query on its first turn. input.push
     // is queue-backed, so the pushed turn buffers and runs once the query is ready.
-    sendTurn(text) { if (!closed) { if (!started && !admitColdStart()) return false; if (!started && prepareCwd) { try { const next = prepareCwd(); if (next) { cwd = next; opts.cwd = next } } catch { /* keep original cwd */ } } if (!started) runQuery({ admitted: true }); turnActive = true; sawSuggestion = false; lastTurnText = String(text); if (sugTimer) { clearTimeout(sugTimer); sugTimer = null } lastEvtTs = Date.now(); stalledSent = false; stallRetried = false; forceStopped = false;
+    sendTurn(text) { if (closed || abortPending || resilienceRetryPending) return false; if (!started && !admitColdStart()) return false; if (!started && prepareCwd) { try { const next = prepareCwd(); if (next) { cwd = next; opts.cwd = next } } catch { /* keep original cwd */ } } turnActive = true; sawSuggestion = false; lastTurnText = String(text); if (sugTimer) { clearTimeout(sugTimer); sugTimer = null } lastEvtTs = Date.now(); stalledSent = false; stallRetried = false; forceStopped = false;
       const t = String(text)
       const promptIndex = userPromptNo++
       const thisTurnForceFull = forceFullReminder
@@ -1216,11 +1386,34 @@ export function startClaudeSession({ cwd, model, effort: initialEffort = 'high',
       // recognized). So a slash command goes CLEAN; conversational turns keep the reminder.
       // Normal turns never start with "/" (composeAgentStdin prepends the preamble), and the
       // web already routes "/"-prefixed input as a command (pane.jsx), so this matches intent.
-      input.push(/^\s*\//.test(t) ? [{ type: 'text', text: t }] : [{ type: 'text', text: t }, { type: 'text', text: lastTurnReminder }])
-    } },
+      lastTurnBlocks = /^\s*\//.test(t) ? [{ type: 'text', text: t }] : [{ type: 'text', text: t }, { type: 'text', text: lastTurnReminder }]
+      resilienceTurnRevision++
+      turnResilience = createTurnResilience()
+      if (turnResilience) {
+        const submittingTurn = turnResilience
+        const submittingRevision = resilienceTurnRevision
+        const submittingBlocks = lastTurnBlocks
+        // Keep the public sendTurn edge synchronous. The prompt is held locally until
+        // the asynchronous bridge cap admits it; a rejection never reaches the SDK.
+        void admitResilientSubmission().then((admitted) => {
+          // Stop or a newer human turn can land while cap admission is pending.
+          // In either case this exact turn no longer owns the submission edge.
+          if (closed || !turnActive || turnResilience !== submittingTurn || resilienceTurnRevision !== submittingRevision) return
+          if (!admitted) { finishResilientFailure(); return }
+          if (!started) runQuery({ admitted: true })
+          input.push(submittingBlocks)
+          armResilienceDeadline()
+        }).catch(() => {
+          if (!closed && turnActive && turnResilience === submittingTurn && resilienceTurnRevision === submittingRevision) finishResilientFailure()
+        })
+      } else {
+        if (!started) runQuery({ admitted: true })
+        input.push(lastTurnBlocks)
+      }
+    },
     // Cold-boot the query WITHOUT sending a turn — the background warmer calls this on
     // lazily-restored idle terminals so they're ready before the user clicks them.
-    warm() { if (!started && !closed) runQuery() },
+    warm() { if (!resilienceEnabled && !started && !closed) runQuery() },
     get started() { return started },
     // Set the permission mode — Claude Code's ⇧⇥ cycle. setPermissionMode is a
     // streaming control request (drives plan-mode behaviour SDK-side); the local
@@ -1274,25 +1467,51 @@ export function startClaudeSession({ cwd, model, effort: initialEffort = 'high',
     // Graceful interrupt (Esc / Stop) — stops the current turn but keeps the
     // session alive for the next one. ac.abort() is teardown only (end()).
     async abort() {
+      if (abortPending) return
+      abortPending = true
+      try {
       // Swallow the SDK's redundant interrupt teardown (aborted + error_during_execution +
       // re-init) — we emit the one canonical boundary below. Set BEFORE interrupt so the
       // teardown results, which arrive async on the query loop, are caught; the timer bounds
       // the window so a genuine later turn failure still surfaces.
-      if (turnActive) {
+      const retryWasPending = resilienceRetryPending
+      const retryDisposal = retryWasPending ? qDone : null
+      if (turnActive || retryWasPending) {
+        resilienceTurnRevision++
+        // Keep the retry-pending ingress guard armed while Stop awaits the old
+        // process. The revision invalidates the retry itself; the flag prevents
+        // a new human turn from entering its reader-less replacement stream.
+        if (!retryWasPending) resilienceRetryPending = false
+        clearResilienceDeadline()
+        turnResilience?.failure({ aborted: true })
+        if (retryWasPending) {
+          clearTimeout(restartTimer)
+          restartTimer = null
+          started = false
+        }
         interrupting = true
+        interruptingRevision = resilienceTurnRevision
         clearTimeout(interruptTimer)
-        interruptTimer = setTimeout(() => { interrupting = false }, INTERRUPT_SWALLOW_MS)
+        interruptTimer = setTimeout(() => { interrupting = false; interruptingRevision = null }, INTERRUPT_SWALLOW_MS)
       }
       try { await q?.interrupt?.() } catch { /* noop */ }
+      // A failed query may already be inside its bounded disposal while its
+      // retry owns no live SDK turn. Keep Stop's barrier open until that process
+      // is actually gone so a later human turn cannot race its session lock.
+      if (retryDisposal) { try { await retryDisposal } catch { /* already disposed */ } }
+      if (retryWasPending) resilienceRetryPending = false
       // interrupt() stops the turn but emits NO terminal message. Without one the
       // struct stream ends on a non-terminal event, so on resume the SDK treats the
       // turn as INCOMPLETE and auto-continues it — the 2026-06-22 "zombie turn that
       // resumes itself" storm. Emit a terminal result so the turn is marked DONE +
       // persists across refresh. Guarded on turnActive to avoid a double-emit if the
       // SDK already surfaced one for the interrupt. (restored from 0.7.49)
-      if (turnActive) { turnActive = false; emit({ kind: 'result', subtype: 'aborted', sessionId }) }
+      if (turnActive || retryWasPending) { turnActive = false; emit({ kind: 'result', subtype: 'aborted', sessionId }) }
+      } finally {
+        abortPending = false
+      }
     },
-    end() { closed = true; clearInterval(stallTimer); clearTimeout(interruptTimer); clearTimeout(restartTimer); if (sugTimer) clearTimeout(sugTimer); input.end(); try { ac.abort() } catch { /* noop */ } },
+    end() { closed = true; clearResilienceDeadline(); clearInterval(stallTimer); clearTimeout(interruptTimer); clearTimeout(restartTimer); if (sugTimer) clearTimeout(sugTimer); input.end(); try { ac.abort() } catch { /* noop */ } },
     get sessionId() { return sessionId },
     get mode() { return mode },
     get turnActive() { return turnActive },   // a turn is in flight (gates between-turns update restart — Slice 3 Contract #1)

package/codex-session.mjs

@@ -1153,7 +1153,11 @@ export function startCodexSession({ cwd, model, effort: initialEffort = 'high',
       // synchronously after sendTurn(), so this is the edge that makes Thinking,
       // Stop, and the tab spinner appear at dispatch time rather than at the
       // first provider event many seconds later.
-      if (!turnActive) {
+      // Native compaction already owns that public busy edge. A human turn
+      // accepted during it stays queued without flipping the ordinary-turn
+      // latch; otherwise compactContext's post-bootstrap recheck mistakes the
+      // queued turn for an active one and abandons a compaction it already owns.
+      if (!turnActive && !compactActive) {
         aborted = false
         armTurnLiveness()
       }
@@ -1229,13 +1233,20 @@ export function startCodexSession({ cwd, model, effort: initialEffort = 'high',
     },
     async compactContext() {
       if (turnActive || compactActive) return false
-      const readyAppServer = await ensureAppServer()
-      // ensureAppServer may need to boot the transport. Re-check after that
-      // await so a normal turn that began meanwhile owns the lane exclusively.
-      if (!readyAppServer || turnActive || compactActive) return false
+      // A Stop latch belongs to the turn it cancelled. sendTurn clears it when
+      // accepting new work, but /compact enters through this direct control path.
+      // Leaving it set makes appServerNotification discard the real
+      // turn/started event, then the five-second waiter falsely declares failure
+      // while Codex continues compacting the old thread in the background.
+      aborted = false
       compactActive = true
       let startTimer = null
+      let compactAccepted = false
       try {
+        const readyAppServer = await ensureAppServer()
+        // compactActive claims the lane before bootstrap, so sendTurn queues
+        // behind us. An independently active ordinary turn still wins safely.
+        if (!readyAppServer || turnActive) return false
         const compactTurn = new Promise((resolve, reject) => {
           startTimer = setTimeout(() => {
             compactStartWaiter = null
@@ -1244,6 +1255,7 @@ export function startCodexSession({ cwd, model, effort: initialEffort = 'high',
           compactStartWaiter = { resolve, reject }
         })
         await appServer.compact({ threadId: sessionId })
+        compactAccepted = true
         const turnId = await compactTurn
         if (startTimer) clearTimeout(startTimer)
         const completed = await appServer.waitForTurn(turnId)
@@ -1252,6 +1264,14 @@ export function startCodexSession({ cwd, model, effort: initialEffort = 'high',
         if (status === 'completed') return true
         throw new Error(completed?.turn?.error?.message || `compaction ${status || 'failed'}`)
       } catch (error) {
+        // Once thread/compact/start was accepted, replaying via a bounded-recap
+        // reset is unsafe: the native compaction may still complete (the exact
+        // production failure this guard closes). Preserve the existing thread
+        // and report uncertainty instead of executing a second compaction path.
+        if (compactAccepted || !['rejected', 'not_sent'].includes(error?.delivery)) {
+          note(`Native Codex compaction status is uncertain; existing context was preserved: ${error?.message || error}`)
+          return null
+        }
         note(`Native Codex compaction unavailable; using bounded recap fallback: ${error?.message || error}`)
         return false
       } finally {

package/event-bounds.mjs

@@ -1,4 +1,4 @@
-import { compactEvidenceEnvelope } from './evidence-citations.mjs'
+import { compactEvidenceEnvelope } from './evidence-compact.mjs'
 
 /* Browser-safe structured-event bounding shared by the bridge broadcast path and
    the web client's persisted reload snapshot. Large Codex/Claude tool payloads

package/evidence-citations.mjs

@@ -1,10 +1,12 @@
 // Strict, runtime-neutral EvidenceEnvelopeV1 parsing. Only an actual
 // project-context evidence tool result can create room evidence in S1.
 import { createHash } from 'node:crypto'
+import { EVIDENCE_CAP, compactEvidenceEnvelope } from './evidence-compact.mjs'
+
+export { EVIDENCE_CAP, compactEvidenceEnvelope }
 
 export const EVIDENCE_START = '<<<TP_EVIDENCE_V1>>>'
 export const EVIDENCE_END = '<<<END_TP_EVIDENCE_V1>>>'
-export const EVIDENCE_CAP = 8
 const LEVELS = new Set(['exact', 'section', 'source', 'unavailable'])
 const WARNINGS = new Set(['NO_MATCH', 'LOW_LEXICAL_MATCH', 'UNCALIBRATED_RELEVANCE', 'SECTION_ONLY', 'SOURCE_ONLY', 'SOURCE_UNAVAILABLE', 'SPAN_ANCHOR_MISMATCH', 'TRANSCRIPT_BOUNDED'])
 const safeText = (value, max) => typeof value === 'string' && value.length <= max && !/(?:https?:\/\/|file:|bearer\s|token=|signature=|x-amz-|\.\.[\\/]|^\/|[A-Za-z]:[\\/])/i.test(value)
@@ -46,11 +48,3 @@ export function parseEvidenceEnvelope(toolName, content) {
 }
 
 export function evidenceForToolResult(toolName, content) { return parseEvidenceEnvelope(toolName, content) || undefined }
-
-export function compactEvidenceEnvelope(envelope, maxExcerpt = 600) {
-  if (!envelope?.citations?.length) return envelope
-  return { ...envelope, citations: envelope.citations.slice(0, EVIDENCE_CAP).map((citation) => {
-    if (typeof citation.excerpt !== 'string' || citation.excerpt.length <= maxExcerpt) return citation
-    return { ...citation, excerpt: undefined, excerptSha256: undefined, locator: { ...citation.locator, level: 'unavailable' }, assessment: { ...citation.assessment, confidence: 'unavailable', warnings: [...new Set([...citation.assessment.warnings, 'TRANSCRIPT_BOUNDED', 'SOURCE_UNAVAILABLE'])].slice(0, 8) } }
-  }) }
-}

package/evidence-compact.mjs

@@ -0,0 +1,11 @@
+// Browser-safe evidence bounding shared by the bridge and replay client.
+// Parsing and digest verification stay in evidence-citations.mjs (Node-only).
+export const EVIDENCE_CAP = 8
+
+export function compactEvidenceEnvelope(envelope, maxExcerpt = 600) {
+  if (!envelope?.citations?.length) return envelope
+  return { ...envelope, citations: envelope.citations.slice(0, EVIDENCE_CAP).map((citation) => {
+    if (typeof citation.excerpt !== 'string' || citation.excerpt.length <= maxExcerpt) return citation
+    return { ...citation, excerpt: undefined, excerptSha256: undefined, locator: { ...citation.locator, level: 'unavailable' }, assessment: { ...citation.assessment, confidence: 'unavailable', warnings: [...new Set([...citation.assessment.warnings, 'TRANSCRIPT_BOUNDED', 'SOURCE_UNAVAILABLE'])].slice(0, 8) } }
+  }) }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "thinkpool-pair",
-  "version": "0.7.356",
+  "version": "0.7.358",
   "description": "Connect Claude Code, Codex, or Hermes on your computer to a Thinkpool Code room.",
   "type": "module",
   "bin": {
@@ -59,6 +59,7 @@
     "agent-notify.mjs",
     "agent-detect.mjs",
     "code-event-contract.mjs",
+    "evidence-compact.mjs",
     "evidence-citations.mjs",
     "error-recovery.mjs",
     "pair-control-authority.mjs",

package/provider-resilience.mjs

@@ -1,15 +1,15 @@
 /*
  * Provider resilience policy primitives.
  *
- * Phase 0 is deliberately policy-only: this module never makes a network call,
- * never reads provider credentials, and never persists circuit or attempt state.
- * The Claude session may observe its pre-existing recovery paths through the
- * attempt ledger, but enabling this module cannot add a retry or fallback.
+ * This module never makes a network call or reads provider credentials. Phase 1
+ * adds an injected same-target controller, but transport remains owned by the
+ * Claude session and fallback remains unavailable.
  */
 import { isSecretFreeRoomPayload } from './runtime-contract.mjs'
 
 export const RESILIENCE_VERSION = 1
 export const MAX_NETWORK_ATTEMPTS = 3
+export const MAX_SAME_TARGET_ATTEMPTS = 2
 export const TRANSIENT_FAILURES = new Set(['timeout', 'network', 'rate_limit', 'overload', 'upstream_5xx'])
 const RETRYABLE = [...TRANSIENT_FAILURES]
 const TRACE_FIELDS = new Set(['traceId', 'turnRev', 'attempt', 'targetProviderId', 'targetProviderName', 'requestedModel', 'actualConfiguredModel', 'phase', 'outcome', 'failureClass', 'elapsedMs', 'retryAfterMs', 'fallbackFrom'])
@@ -183,6 +183,147 @@ export function createMemoryCircuit({ now = () => Date.now() } = {}) {
   }
 }
 
+/**
+ * Apply the only authoritative provider-work cap currently available at the
+ * bridge boundary. Ordinary/uncapped lanes remain admissible, but the result
+ * names that absence explicitly so the host can record `cap_not_configured`
+ * rather than pretending an approval occurred.
+ */
+export function providerResilienceCapAdmission(budget) {
+  if (!budget || budget.capTokens == null) {
+    return { allowed: true, configured: false, reason: 'cap_not_configured' }
+  }
+  const capTokens = Number(budget.capTokens)
+  const spentTokens = Number(budget.spentTokens)
+  const allowed = Number.isFinite(capTokens)
+    && capTokens >= 0
+    && Number.isFinite(spentTokens)
+    && spentTokens >= 0
+    && budget.killed !== true
+    && spentTokens < capTokens
+  return { allowed, configured: true, reason: allowed ? 'within_cap' : 'cap_blocked' }
+}
+
+/**
+ * Pure, injected Phase-1 controller for a single exact custom Claude target.
+ *
+ * The bridge/session integration owns transport and invokes this controller at
+ * turn start, before each submission, after visible output, and at terminal
+ * success/failure. It intentionally has no fallback path and cannot resolve a
+ * built-in Anthropic target. A caller must inject both the authoritative cap
+ * admission gate and the bridge-scoped memory circuit; missing or broken gates
+ * deny the submission rather than guessing that it is safe.
+ */
+export function createSameTargetResilienceController({
+  runtime = 'claude', providers = [], providerId, model, requestedModel = model,
+  policy, bridgeHostId = null, circuit, capGate, traceId = 'local', turnRev = null,
+  onRecord = null,
+} = {}) {
+  let checked
+  try { checked = validateResiliencePolicy(policy, { providers, primaryProviderId: providerId }) } catch { checked = { ok: false } }
+  let target = null
+  try { target = resolveAttemptTarget({ runtime, providers, providerId, model }) } catch { /* malformed registry is not retryable */ }
+  const configured = checked?.ok && checked.value.enabled && target && runtime === 'claude'
+  const circuitReady = !!circuit && typeof circuit.preflight === 'function' && typeof circuit.failure === 'function' && typeof circuit.success === 'function'
+  const ceiling = configured ? Math.min(checked.value.maxAttempts, MAX_SAME_TARGET_ATTEMPTS) : 0
+  const targetKey = target && { bridgeHostId, providerId: target.providerId, model: target.actualConfiguredModel }
+  const base = target && {
+    traceId,
+    turnRev,
+    targetProviderId: target.providerId,
+    targetProviderName: target.targetProviderName,
+    requestedModel,
+    actualConfiguredModel: target.actualConfiguredModel,
+    phase: 'same_target',
+  }
+  let started = false
+  let submissions = 0
+  let awaitingOutcome = false
+  let retryEligible = false
+  let outputVisible = false
+  let toolOutputVisible = false
+  let aborted = false
+  let permissionDenied = false
+  let finished = false
+
+  const makeRecord = (outcome, extra = {}, attempt = submissions) => safeTraceRecord({
+    ...base,
+    attempt: Math.max(1, attempt),
+    outcome,
+    ...extra,
+  })
+  const emit = (outcome, extra) => {
+    const record = makeRecord(outcome, extra)
+    try { onRecord?.(record) } catch { /* trace observers are never control flow */ }
+    return record
+  }
+  const blocked = (outcome = 'failed', extra) => ({ admitted: false, record: emit(outcome, extra) })
+  const replaySafe = () => isReplaySafe({ outputVisible, toolOutputVisible, aborted, permissionDenied })
+
+  return {
+    /** Mark the controller as belonging to this turn; no provider work occurs here. */
+    start() { started = true },
+
+    /** Once any assistant/tool output is visible, automatic replay is permanently disabled. */
+    visibleOutput({ tool = false } = {}) {
+      outputVisible = true
+      if (tool) toolOutputVisible = true
+      retryEligible = false
+    },
+
+    /**
+     * Admit exactly one upcoming submission. The cap gate is awaited before
+     * transport, and any false/unknown/throwing result denies the attempt.
+     */
+    async preflight() {
+      if (!started) started = true
+      if (!configured || !circuitReady || finished || awaitingOutcome || submissions >= ceiling) return blocked()
+      if (submissions > 0 && (!retryEligible || !replaySafe())) return blocked()
+      const pending = makeRecord(submissions === 0 ? 'started' : 'retrying', {}, submissions + 1)
+      let admitted = false
+      try {
+        const result = await capGate?.(pending)
+        admitted = result === true || result?.allowed === true
+      } catch { admitted = false }
+      if (!admitted) return blocked('cap_blocked')
+      let circuitState
+      try { circuitState = circuit.preflight(targetKey) } catch { return blocked() }
+      if (!circuitState?.ok) return blocked('circuit_open')
+      submissions += 1
+      awaitingOutcome = true
+      retryEligible = false
+      return { admitted: true, record: emit(submissions === 1 ? 'started' : 'retrying') }
+    },
+
+    /** Classify a raw transport failure locally and expose only a coarse trace. */
+    failure(input = {}) {
+      if (!awaitingOutcome || finished) return null
+      awaitingOutcome = false
+      const failureClass = classifyProviderFailure(input)
+      if (failureClass === 'user_abort') aborted = true
+      if (failureClass === 'permission_denied') permissionDenied = true
+      let circuitUsable = true
+      if (TRANSIENT_FAILURES.has(failureClass)) {
+        try {
+          const state = circuit.failure(targetKey, checked.value, failureClass)
+          if (state?.state === 'open') circuitUsable = false
+        } catch { circuitUsable = false }
+      }
+      retryEligible = circuitUsable && checked.value.retryOn.includes(failureClass) && replaySafe() && submissions < ceiling
+      return emit('failed', { failureClass })
+    },
+
+    /** Close/reset the injected circuit after a completed provider response. */
+    success() {
+      if (!awaitingOutcome || finished) return null
+      awaitingOutcome = false
+      finished = true
+      try { circuit.success(targetKey) } catch { /* a completed response is never replayed */ }
+      return emit('succeeded')
+    },
+  }
+}
+
 export function safeTraceRecord(input = {}) {
   const out = {}
   for (const key of TRACE_FIELDS) {
@@ -190,6 +331,8 @@ export function safeTraceRecord(input = {}) {
     if (TRACE_TEXT_FIELDS.has(key)) {
       const value = safeTraceText(input[key])
       if (value) out[key] = value
+    } else if (key === 'turnRev') {
+      if (Number.isSafeInteger(input[key]) && input[key] >= 0) out[key] = input[key]
     } else out[key] = input[key]
   }
   out.attempt = Math.max(1, Math.min(Number(out.attempt) || 1, MAX_NETWORK_ATTEMPTS))
@@ -204,7 +347,7 @@ export function formatResilienceTrace(input) {
   const r = safeTraceRecord(input)
   const target = [r.targetProviderName || r.targetProviderId, r.actualConfiguredModel].filter(Boolean).join(' / ') || 'configured provider'
   const failure = r.failureClass ? ` (${r.failureClass.replaceAll('_', ' ')})` : ''
-  if (r.outcome === 'retrying') return `${target} unavailable${failure} — existing session recovery is retrying (attempt ${r.attempt}).`
+  if (r.outcome === 'retrying') return `${target} unavailable${failure} — retrying once before output (attempt ${r.attempt} of ${MAX_SAME_TARGET_ATTEMPTS}).`
   if (r.outcome === 'circuit_open') return `${target} is temporarily unavailable; its local circuit is open.`
   if (r.outcome === 'cap_blocked') return `Additional provider work was blocked by the applicable cap.`
   if (r.outcome === 'succeeded') return `${target} completed.`

package/providers.mjs

@@ -43,6 +43,12 @@ import fs from 'node:fs'
 import path from 'node:path'
 import crypto from 'node:crypto'
 import { claudeish } from './event-id.mjs'
+import {
+  DEFAULT_RESILIENCE_POLICY,
+  resilienceProjection,
+  resolveAttemptTarget,
+  validateResiliencePolicy,
+} from './provider-resilience.mjs'
 
 const DIR       = path.join(os.homedir(), '.thinkpool-pair')
 const REG_FILE  = path.join(DIR, 'providers.json')
@@ -54,7 +60,7 @@ export const BUILTIN_ID = 'anthropic'
 function ensureDir() { try { fs.mkdirSync(DIR, { recursive: true, mode: 0o700 }) } catch { /* noop */ } }
 
 // ── registry load / save ───────────────────────────────────────────────
-/** @returns {Array<{id:string,name:string,baseUrl:string,model?:string,key:string,addedAt:number}>} */
+/** @returns {Array<{id:string,name:string,baseUrl:string,model?:string,key:string,addedAt:number,resilience?:object}>} */
 export function loadProviders() {
   try {
     const arr = JSON.parse(fs.readFileSync(REG_FILE, 'utf8'))
@@ -244,6 +250,9 @@ export function addProviderModel({ id, model, name } = {}) {
     baseUrl: src.baseUrl,   // copied host-side
     model: nextModel,
     key: src.key,           // copied host-side — never re-sent by the client
+    // A cloned credential is not consent to retry it. Each row needs its own
+    // explicit Phase-1 opt-in, even when both rows share the same endpoint/key.
+    resilience: { ...DEFAULT_RESILIENCE_POLICY, retryOn: [...DEFAULT_RESILIENCE_POLICY.retryOn], circuit: { ...DEFAULT_RESILIENCE_POLICY.circuit }, fallback: [] },
     addedAt: Date.now(),
   })
   saveProviders(arr)
@@ -322,6 +331,55 @@ export function providerModel(id) {
   return loadProviders().find((x) => x.id === id)?.model || null
 }
 
+/**
+ * Persist one custom provider row's Phase-1 same-target policy. This is a
+ * host-local primitive: account RPC/UI wiring deliberately lives elsewhere.
+ *
+ * `policy` may be a complete v1 policy, or a boolean for the conservative
+ * Phase-1 preset. Fallback declarations are rejected here: alternate targets
+ * require the later explicit-consent flow, so this API can never turn one on.
+ */
+export function setProviderResiliencePolicy(id, policy) {
+  if (!id || id === BUILTIN_ID) return { ok: false, error: 'the built-in Anthropic provider cannot use resilience policy' }
+  const arr = loadProviders()
+  const provider = arr.find((p) => p.id === id)
+  if (!provider) return { ok: false, error: 'no such provider' }
+
+  const input = typeof policy === 'boolean'
+    ? { ...DEFAULT_RESILIENCE_POLICY, enabled: policy, retryOn: [...DEFAULT_RESILIENCE_POLICY.retryOn], circuit: { ...DEFAULT_RESILIENCE_POLICY.circuit }, fallback: [] }
+    : policy
+  const checked = validateResiliencePolicy(input, { providers: arr, primaryProviderId: id })
+  if (!checked.ok) return { ok: false, error: checked.error }
+  if (checked.value.fallback.length) return { ok: false, error: 'fallback is not available in Phase 1' }
+  // An enabled controller must have a configured exact model for its safe
+  // target record. A disabled policy remains valid for legacy/no-model rows.
+  if (checked.value.enabled && !resolveAttemptTarget({ providers: arr, providerId: id, model: provider.model })) {
+    return { ok: false, error: 'an enabled resilience policy requires an exact configured model' }
+  }
+
+  const next = arr.map((p) => p.id === id ? { ...p, resilience: checked.value } : p)
+  saveProviders(next)
+  return { ok: true, resilience: resilienceProjection(checked.value) }
+}
+
+/**
+ * Resolve a custom provider's persisted policy for bridge wiring without ever
+ * returning host credentials or endpoint data. Missing policy is safely
+ * disabled; malformed stored policy, built-in, unknown, and model-less targets
+ * fail closed with null.
+ */
+export function resolveProviderResiliencePolicy(id) {
+  if (!id || id === BUILTIN_ID) return null
+  const providers = loadProviders()
+  const provider = providers.find((p) => p.id === id)
+  if (!provider) return null
+  const checked = validateResiliencePolicy(provider.resilience, { providers, primaryProviderId: id })
+  if (!checked.ok) return null
+  const target = resolveAttemptTarget({ providers, providerId: id, model: provider.model })
+  if (!target) return null
+  return { policy: resilienceProjection(checked.value), target }
+}
+
 // ── read-only projections (never expose the raw key) ────────────────────
 /** Masked list for the dashboard: keyHint = last 4 chars only. Built-in first. */
 export function listProviders() {
@@ -331,8 +389,9 @@ export function listProviders() {
     model: p.model || null,
     group: providerGroup(p),
     keyHint: keyHint(p.key),
+    resilience: resilienceProjection(p.resilience),
   }))
-  return [{ id: BUILTIN_ID, name: 'Anthropic (Claude)', model: null, group: BUILTIN_ID, keyHint: null }, ...custom]
+  return [{ id: BUILTIN_ID, name: 'Anthropic (Claude)', model: null, group: BUILTIN_ID, keyHint: null, resilience: null }, ...custom]
 }
 
 /** Name-only projection for the announce/presence payload — NO key, NO baseUrl. */