Sub-agent tool exposure had inverted from fail-closed to fail-open after
the TinyAgents migration: the registration predicate
`allowed.is_empty() || allowed.contains(name)` treated an EMPTY allowlist
as "register every tool", so a tool-less sub-agent (`ToolScope::Named([])`,
a zero-match `skill_filter`, or a `named` list that resolved to nothing)
silently inherited the parent's full tool surface — shell, file-write, and
spawn/delegate — a prompt-injection privilege-escalation path.

Change the plumbed allowlist type to `Option<HashSet<String>>` through the
shared seam (`run_turn_via_tinyagents_shared` -> `assemble_turn_harness`):
`None` = no filter (register all visible tools); `Some(set)` = register
exactly those tools, so `Some(empty)` is a genuine deny-all. The sub-agent
path now passes `Some(allowed_names)` (always a concrete, resolved set), so
an empty resolution denies all instead of inheriting everything. The
chat/channel paths keep their historical "empty = all" convention by
mapping an empty/absent set to `None`. A warn is logged when the allowlist
resolves empty so misconfigured agents are diagnosable.

Also re-assert the "sub-agents never spawn" invariant at registration time:
spawn/delegate/worker-thread tool names are stripped from any sub-agent run
regardless of allowlist contents (defense-in-depth beyond the caller-side
`allowed_indices` strip). The tool-exposure shadow middleware is updated to
the same fail-closed `Option` semantics so its divergence reference matches
what is actually registered.

Claude-Session: https://claude.ai/code/session_019j5TLsRLHsM3kqAYFyH4hR

…uts (tinyhumansai#4453)

The legacy engine scrubbed every tool output before it entered model
context; the tinyagents path dropped that call site and scrub_credentials
had zero production callers. Secrets in tool output reached model context,
on-disk transcripts, worker-thread mirrors, and the tool-outcome sink.

Re-introduce scrubbing as CredentialScrubMiddleware, a wrap_tool middleware
registered as the innermost tool wrap on the shared assemble_turn_harness
seam, so it scrubs the RAW tool result before the after_tool chain
(summarization/caps), the transcript push, and the tool-outcome capture
sink — covering parent, subagent, persisted transcript, and ToolCallOutcome
by construction. Extend the scrub patterns to catch bare AKIA/ASIA AWS keys,
sk- OpenAI keys, and space-separated Bearer tokens; also scrub JSON raw
payloads recursively. Update the adapter-inventory assertion (3 -> 4).

Claude-Session: https://claude.ai/code/session_019j5TLsRLHsM3kqAYFyH4hR

…age (tinyhumansai#4454)

The trace exporter attached the user prompt and model reply to the turn span
unconditionally, so spans_to_ndjson/export_spans serialized plaintext to the
NDJSON file (or printed it at info level to the app log) even with the default
capture_content=false. Gate content at the span-STORAGE level instead: the
SpanCollector now carries a capture_content flag and drops TurnContent unless
opted in, so no exporter — NDJSON, app log, or Langfuse push — can ever
serialize prompt/reply text. The web progress bridge wires the flag from
config; the TurnContent emit in session/turn/core.rs also respects the gate as
defense in depth; and export_spans no longer logs span content at info (metadata
at info, NDJSON body at debug only).

Separately fix Langfuse usageDetails double-counting: input_tokens is inclusive
of cached tokens (cost.rs treats cached as a subset of input), but Langfuse sums
usageDetails components as disjoint buckets. Emit input = input_tokens -
cached_input_tokens so non_cached_input + cache_read + output reconcile to the
explicit total.

Claude-Session: https://claude.ai/code/session_019j5TLsRLHsM3kqAYFyH4hR

…rs (tinyhumansai#4455)

Mid-turn steer/collect messages are injected as `Message::user(...)` and
appended to the harness working transcript. Post-run persistence sliced the
returned conversation with the "suffix after the last user message" convention
(`messages_since_last_user`), so an injected steer MOVED that boundary — every
pre-steer assistant/tool round plus the steer text itself vanished from
persisted history, the next-turn KV-cache prefix, and subagent checkpoints.

Replace the last-user-suffix convention on the persistence path with an
explicit boundary: capture `base_len = input.len()` (the request transcript
length) BEFORE `run_loop` consumes it, then persist `run.messages[base_len..]`
via the new `convert::messages_since_request`. The crate returns the full
transcript in `run.messages` (the loop seeds `messages = input` and only
appends; the compression/trim middleware rewrites only the per-call
`request.messages.clone()`), so slicing at `base_len` yields the complete
post-request transcript — pre-steer rounds, the framed steer messages, and
post-steer rounds, in execution order. Applied to both the thin
`run_turn_via_tinyagents` and the shared `run_turn_via_tinyagents_shared` used
by the parent (`session/turn/core.rs`) and subagent
(`subagent_runner/ops/graph.rs`) paths, so checkpoints, cap digests, and worker
mirrors see the full transcript. Steer framing (`[User steering message]:` /
`[Additional context from user]:`) is preserved automatically since the
injected user messages now fall inside the persisted slice.

`messages_since_last_user` is retained (test-covered) but gated
`#[cfg_attr(not(test), allow(dead_code))]` as it no longer has a production
caller.

Claude-Session: https://claude.ai/code/session_019j5TLsRLHsM3kqAYFyH4hR

…inyhumansai#4456)

run_turn_via_tinyagents_shared spawned a 50ms steering-forwarder poll
loop whose cleanup (abort + steering-registry deregister) only ran on
normal return. Cancellation here is drop-based (web select! cancel token;
sub-agent AbortHandle), so a cancelled turn detached the task to loop
forever, pinning the session-owned Arc<RunQueue> + SteeringHandle and
racing the next turn's forwarder into a dead handle. Aborted sub-agent
registry entries were also never removed.

Wrap the forwarder in an abort-on-drop RAII guard
(SteeringForwarderGuard) held across the drive future: its Drop aborts
the poll task, deregisters the sub-agent steering handle, and drains
residual delivered-but-unapplied steers back into the session RunQueue
so a late steer becomes the next turn's input instead of vanishing.
Cleanup now runs identically on normal return, error, and
drop-cancellation. A process-wide ACTIVE_FORWARDERS counter
(active_steering_forwarders()) lets tests assert zero live tasks after a
cancel. Re-emit delivery/requeue observability via new
RunQueueMessageDelivered + RunQueueSteerRequeued DomainEvents.

Claude-Session: https://claude.ai/code/session_019j5TLsRLHsM3kqAYFyH4hR

…le error_slot (tinyhumansai#4457)

Turn-finalization audit fixes for the TinyAgents migration:

A. EmptyProviderResponse no longer leaves a blank assistant row. On the
   tool_calls==0 empty-completion path, turn/core.rs returned Err with the
   empty Chat(assistant("")) still folded into history (via history.extend),
   so the next request carried an empty-content assistant message and
   strict providers (Anthropic) 400'd the whole thread. Pop the trailing
   empty assistant row before returning, matching the tinyhumansai#4093 branch.

B. Stale provider error no longer masks the real run failure. ProviderModel
   now clears error_slot on every successful (incl. fallback-recovered)
   model call (buffered + streaming), and the runner maps the model-call cap
   / spawn-depth failures BEFORE consulting error_slot, so a run that failed
   over successfully then failed for an unrelated reason surfaces the real
   classification instead of a leftover provider error.

C. Exactly one TurnCompleted per turn, after the wrap-up streams. The seam
   emitted TurnCompleted per parent turn AND the chat session emitted it
   again after summarize_turn_wrapup — the web bridge recorded two ledger
   events + two Completed upserts and turn_active=false landed before the
   cap/tinyhumansai#4093 checkpoint finished streaming. New defer_turn_completed_to_caller
   seam param suppresses the seam emit on the chat path (core.rs is the single
   post-wrap-up emitter); channel/CLI keeps the seam emit.

Claude-Session: https://claude.ai/code/session_019j5TLsRLHsM3kqAYFyH4hR

…rovider calls (tinyhumansai#4460)

ProviderModel::stream ran every streamed provider call in a detached
tokio::spawn producer, which lost the caller's task-locals and left the
call running after cancellation:

- thread_id task-local was None inside the spawn, so the managed backend's
  thread_id extension was omitted on every streamed request.
- the resolved-route audit slot was out of scope, so record_resolved_provider_route
  no-op'd and channel audit fell back to the requested route.
- a hard AbortHandle cancel dropped only the consumer stream; the spawned
  provider.chat ran to completion and was still billed.

Fix, entirely in the openhuman seam:
- Capture thread_id (current_thread_id) and the resolved-route audit slot
  (new current_route_slot) on the caller's task before spawning, and
  re-establish them inside via with_thread_id / with_route_slot so the
  detached provider.chat sees the same ambient context.
- Expose RouteSlot + current_route_slot + with_route_slot from resolved_route
  (explicit out-slot instead of a lost task-local).
- Add AbortOnDrop guard (tinyagents/abort_guard.rs) holding the producer
  JoinHandle and move it into the consumer stream state, so dropping the
  stream/turn future aborts the in-flight provider call. Debug-log aborts.

Claude-Session: https://claude.ai/code/session_019j5TLsRLHsM3kqAYFyH4hR

…rites (tinyhumansai#4458)

The memory read->dedupe->write->update-index protocol can only close its
write cycle via a successful `update_memory_md` call, and every durable
write appends an instruction to call it — but `UpdateMemoryMdTool` was
never registered in `all_tools_with_runtime`; it was only re-exported. The
archivist's `[tools] named` allowlist selects it, but subagents only filter
the parent set, so it silently resolved away, producing a permanent
unsatisfiable "call update_memory_md" nag loop (unknown-tool error → the
tracker never observes IndexUpdate → escalating drift warnings + an
after_agent stale-index warning every run).

Changes:
- Register `UpdateMemoryMdTool` in `all_tools_with_runtime`, always-on like
  the other memory tools; per-agent visibility stays governed by each
  agent's `named` allowlist. Targets the workspace MEMORY.md/SKILL.md.
- Make writes atomic + serialized: temp-file + atomic rename, guarded by a
  process-global per-workspace async lock keyed on the canonicalized
  workspace path. Concurrent index updates now queue instead of racing, and
  a killed process can never leave a truncated MEMORY.md. (Becomes live the
  moment registration is fixed.)
- Classify `remember_preference`/`save_preference` with an explicit,
  documented `MemoryOp::Other` arm: they persist via `Memory::store` but
  into dedicated preference namespaces surfaced by prompt injection /
  per-query recall, not the MEMORY.md wiki — classifying them as writes
  would resurrect the same nag loop.

Deferred (final test pass): registry-inventory assertion mirroring the
adapter-inventory test, plus concurrency/atomicity tests.

Claude-Session: https://claude.ai/code/session_019j5TLsRLHsM3kqAYFyH4hR

… failure in snapshot (tinyhumansai#4459)

Repairs tinyhumansai#4413 tool-failure classification.

A/B/E: the classifier now short-circuits POLICY_BLOCKED_MARKER and
POLICY_DENIED_MARKER *before* the `timed out` sniff, so a user deny →
`Denied` and an approval-TTL expiry → `ApprovalExpired` (both
`FailureCategory::UserDeclined`, non-retryable, honest copy) instead of a
recoverable Unknown "try again" or a Timeout "will retry". Middleware now
sniffs both `error` and `content`, and the dead `"policy denied"` needle is
removed.

C: `ToolTimelineEntry` gains `failure: Option<PersistedToolFailure>`
(camelCase, matching the TS `PersistedToolFailure` contract) threaded through
`mirror.rs`, so a failed tool's explanation survives thread switch / restart.

D: `SubagentToolCallCompleted` gains a `failure` field populated from the
already-computed classification (observability.rs) and forwarded on the web
event + persisted `SubagentToolCall`, so failed sub-agent rows carry an
explanation.

Frontend: TS types (`PersistedSubagentToolCall.failure`,
`SubagentToolCallEntry.failure`, slice mapping), the localized-failure-class
set gains `denied`/`approvalExpired`, and i18n keys land in en.ts + all
locales.

Tests deferred to the final pass.

Claude-Session: https://claude.ai/code/session_019j5TLsRLHsM3kqAYFyH4hR

…yhumansai#4461)

The crate ContextCompressionMiddleware installed in assemble_turn_harness
regressed compaction vs the legacy engine in two ways:

1. A summarizer failure propagated (before_model does summarize(..).await?),
   mapping any provider hiccup to TinyAgentsError::Model and aborting the whole
   turn — on exactly the longest, most valuable threads.
2. Once over the 90% threshold, every model call re-ran a full-transcript
   summarizer LLM call: the crate rewrites only the per-call request clone, so
   the loop's working transcript never shrinks and re-summarizes each iteration.

Wrap the LLM-backed ProviderModelSummarizer in a per-turn
FaultTolerantCachingSummarizer adapter (seam-side, no crate change):

- On Err: warn, trip a per-turn circuit breaker, and return a deterministic
  (LLM-free) front-drop trim of the input instead of propagating. The turn
  continues; later compactions skip the known-bad LLM. Restores the legacy
  warn + circuit-breaker + deterministic-trim behavior.
- Single-slot content-hash cache (keyed by message count + slice hash) makes a
  repeat identical input slice free — retries / re-issued requests no longer
  re-dispatch the summarizer LLM until the transcript grows again.
- Fallback produces a proper SummaryRecord with provenance, so the existing
  compaction-provenance drain surfaces it (observability preserved).

Compaction failure can no longer fail a run; long over-threshold turns stop
paying a fresh summarizer LLM call for identical input.

Claude-Session: https://claude.ai/code/session_019j5TLsRLHsM3kqAYFyH4hR

…eviction (tinyhumansai#4462)

Replace the crate `MessageTrimMiddleware` with a seam-owned
`ImageAwareMessageTrimMiddleware` that restores the deleted
`harness/token_budget.rs` semantics regressed by the TinyAgents migration:

1. Image marker cost: inline `[IMAGE:…]` markers and native
   `ContentBlock::Image` blocks are each charged a flat 1200 tokens instead of
   pricing the base64 payload at chars/4 (~2M tokens), so a single large image
   no longer reads as massively over budget and evicts the whole transcript.
2. Trim reserve: restore the legacy proportional clamp
   `clamp(window/10, >=512, <=max(8192, window/4))` — an 8k local model's input
   budget is ~7373 again, not the fixed `window - 16384` floored at 1024.
3. System survival + order: system messages are never dropped and never
   reordered to the front; only non-system history is evictable (oldest-first),
   leading orphaned tool results are snapped past.
4. Observability: any eviction emits a grep-able `[tinyagents::mw] message_trim`
   warn carrying messages-dropped and tokens/messages before-and-after.

Fixed entirely in the openhuman seam; vendor/tinyagents untouched.

Claude-Session: https://claude.ai/code/session_019j5TLsRLHsM3kqAYFyH4hR

…om, terminal-inference halt, autonomous iter-cap lift (tinyhumansai#4463)

Restores loop-guard behaviors dropped with the legacy `tool_loop.rs` in the
TinyAgents migration; the crate `no_progress` ladder tracks *failures* only and
does not replace them. All fixes are seam-side (`src/openhuman/**`); vendored
crate untouched.

- RepeatProgressMiddleware (new, `after_model` + batch-aware `after_tool`):
  halts on 3× identical *successful* `(tool, args)` batches (tinyhumansai#4088) and 4×
  identical outputs (tinyhumansai#4095); `wait_subagent` polling exemption ported. Shares
  the halt-summary slot + steering handle with the failure breaker.
- RepeatedToolFailureMiddleware: differentiated headroom restored — recoverable
  classes (timeout/transient markers + tinyhumansai#4445 classifier: Timeout/
  ServiceUnavailable/ModelConnection) get 8 identical / 12 varied instead of the
  crate's fixed 3/6; POLICY_DENIED_MARKER rejoins POLICY_BLOCKED_MARKER for the
  2-repeat hard-reject fast-trip (tinyhumansai#4463 part 6).
- Terminal delegated-inference fast-halt (tinyhumansai#3104): budget-exhausted /
  provider-config-rejection delegation failures halt on first occurrence, gated
  on the delegated-inference envelope so recoverable tool stderr isn't caught.
- Autonomous iter-cap lift (part 7): `autonomous_iter_cap()` was a dead knob —
  wired back in via `subagent_iter_cap_with_autonomous_lift` at the subagent
  `effective_max_iterations()` sites, so task-dispatcher / skill subagents run
  up to TASK_RUN_MAX_ITERATIONS again instead of the normal per-agent cap.
- Updated the adapter-inventory middleware-count assertions (15→16, 11→12).

Tests deferred to the final parity test pass.

Claude-Session: https://claude.ai/code/session_019j5TLsRLHsM3kqAYFyH4hR

…apture sees capped (tinyhumansai#4464)

The tinyagents crate runs after_tool hooks in REVERSE registration order
(MiddlewareStack::run_after_tool iterates .iter().rev()). Two seam
registrations assumed the opposite:

(A) TurnContextMiddleware::install pushed HandoffMiddleware before
ToolOutputMiddleware, so the 16 KiB byte cap truncated FIRST and a capped
~4k-token payload could never cross the 50k-token handoff threshold — the
ResultHandoffCache/extract_from_result drill-in was unreachable. Flip the
push order (tool-output budget first, handoff last) so the effective
after_tool chain is handoff(raw) -> summarizer/tokenjuice/caps.

(B) ToolOutcomeCaptureMiddleware was pushed AFTER context_mw.install, so its
after_tool ran BEFORE the caps and the sink held full raw output per call for
the whole turn (multi-MB) while failure classification / output_summary saw
pre-cap content. Move its push BEFORE context_mw.install so it runs AFTER the
caps and records the final capped content.

Comments now state the crate's reverse-order rule explicitly. Keeps tinyhumansai#4453
credential-scrub ordering consistent.

Claude-Session: https://claude.ai/code/session_019j5TLsRLHsM3kqAYFyH4hR

…tinyhumansai#4465)

The tinyagents migration (model.rs -> agent/harness/parse.rs) kept the
XML/JSON/markdown/GLM grammars but dropped the legacy **P-Format**
positional grammar (`<tool_call>name[arg1|arg2]</tool_call>`) — even
though `PFormat` is the default `ToolCallFormat` and ~10 builtin agent
prompts still teach `name[a|b]`. A model that followed its own
instructions emitted calls the parser logged as "malformed <tool_call>
JSON" and silently dropped, so the turn continued as if no tool ran.

Restore parity (option (a)) entirely in the openhuman seam:

- `parse::parse_tool_calls_with_pformat(text, &PFormatRegistry)` walks
  the `<tool_call>`-family tags and, per tag, prefers the registry-driven
  positional parse (existing `agent::pformat::parse_call`) and falls back
  to the JSON entry the canonical parser produced — the exact per-tag
  selection the legacy `PFormatToolDispatcher` did. Empty registry
  short-circuits to `parse_tool_calls`, so non-PFormat paths are
  behaviour-neutral. `ParsedToolCall` gains `Clone` for the fallback copy.
- `tinyagents::model` builds a `PFormatRegistry` from the advertised
  `request.tools` schemas and routes the text-mode fallback through the
  new parser in both the buffered (`invoke`) and streaming (`stream`)
  paths.

Verbose `[agent_parse]` debug logging on the recovery path (tool name
only — never the argument body, which may carry user data).

vendor/tinyagents untouched (upstream/read-only).

Claude-Session: https://claude.ai/code/session_019j5TLsRLHsM3kqAYFyH4hR

…yhumansai#4466)

The TinyAgents-migrated sub-agent path lost several behaviours the legacy
per-iteration observer provided. Fix them entirely in the openhuman seam:

1. Failed runs persisted nothing. The graph `?`-returned on a harness error
   before `persist_subagent_transcript` / `mirror_worker_thread`, so a crash
   mid-run left no `session_raw` transcript (breaking `transcript_ingest`) and
   an empty worker thread. Add a `TranscriptSnapshotMiddleware` that mirrors
   each `before_model` transcript into an openhuman-owned buffer; on the error
   path persist those completed rounds + mirror them to the worker thread with
   a failure marker, then return the error.

2. Worker-thread mirror metadata was reduced to `{scope, agent_id, task_id}`.
   Restore the legacy `iteration` / `final` / `tool_calls` / `tool_call_id` /
   `tool_name` / `mode` fields.

3. Lossy streaming: the progress bridge used `try_send` and dropped deltas on a
   full channel. Keep the synchronous fast path but, on `Full`, defer to an
   awaited `send()` on a spawned task (backpressure) instead of silently
   dropping — the `EventListener` callback is sync so it cannot `.await` inline.

4. Sub-agent TokenJuice compaction was silently off (`TurnContextMiddleware::
   defaults()` = compression Off). Build the sub-agent context middleware from
   the live `[context]` config + `definition.effective_tokenjuice_compression()`
   (compaction, byte budget, microcompact, autocompact opt-out), same as chat.

5. Breaker halt reported `Completed`: circuit-breaker-halted children returned
   `hit_cap=false`, so parents treated a halted child as finished. Carry a
   `breaker_halt` reason on the turn outcome and map it to `Incomplete`.

cargo check --lib: clean. Tests deferred to the final test pass.

Claude-Session: https://claude.ai/code/session_019j5TLsRLHsM3kqAYFyH4hR

…-run usage, tool timing + DomainEvents (tinyhumansai#4467)

Restore cost-accounting and telemetry parity lost on the tinyagents path:

- Charged USD (item 1): thread the provider `UsageInfo` (backend-charged
  USD + context window + cache-creation/reasoning tokens the crate `Usage`
  drops) from the model adapter to the event bridge via a shared FIFO carry;
  the bridge now prefers the provider's charged amount over the catalogue
  estimate (charged > estimate precedence) and records a real context window.
- Cap-summary usage (item 2): fold all four token fields, price the call, and
  feed the global cost tracker directly for the sub-agent cap-hit checkpoint
  call (it bypasses the harness bridge, so its spend was previously lost).
- Failed unobserved runs (item 3): attach the event bridge for every turn —
  including unobserved background/cron turns — so per-call usage reaches the
  cost tracker during the run and a later Err return no longer drops spend.
- Tool timing (item 4): measure real `elapsed_ms` in `execute_openhuman_tool`
  and carry `elapsed_ms`/`output_chars` through the outcome side-channel so
  `ToolCallCompleted` shows real duration + output size instead of 0/0.
- SSE per-tool events (item 5): re-publish `DomainEvent::ToolExecutionStarted`
  / `ToolExecutionCompleted` around session tool execution.
- Child arg deltas (item 6): drop child-scoped `ToolCallArgsDelta` so a child
  run's argument composition no longer renders as the parent's own activity.
- Unknown tools (item 7): default a missing tool outcome to `success: false`
  (hallucinated/unknown tool) in the post-turn records and derive the cap
  digest's per-tool `[ok|failed]` status from the captured outcomes.

Entirely in the openhuman seam; vendor/tinyagents untouched. cargo check --lib
clean. Tests deferred to the final parity test pass.

Claude-Session: https://claude.ai/code/session_019j5TLsRLHsM3kqAYFyH4hR

…nyhumansai#4469)

Batchable low-severity parity items from the TinyAgents-migration audit:

- item 1: correct the GoalBudgetStopHook "hard-stops the moment" docs
  (runtime.rs, turn/core.rs) to the actual graceful-pause semantics —
  the stop vote is drained at the next iteration boundary, so the current
  tool round + one wrap-up call still run (bounded overshoot).
- item 2: forward is_local_provider / is_local_provider_for_model /
  loaded_context_window / prompt_cache_capabilities through
  TextModeProvider so a local provider behind text mode keeps its
  n_keep>=n_ctx guard and KV-cache pricing.
- item 3: recover poisoned mutexes via PoisonError::into_inner on the
  error_slot recovery reads (tinyagents/mod.rs) and the EarlyExitHook
  slots (tinyagents/tools.rs) instead of panicking.
- item 5: cap-summary output cap now honours the sub-agent definition's
  own max_output_tokens budget instead of the global
  AGENT_TURN_MAX_OUTPUT_TOKENS floor.
- item 6: enforce a minimum envelope allowance in aggregate tool-result
  spill so a saturated allowed_len can't blank the [tool_result_preview]
  envelope and strip its artifact_path pointer.
- item 8: remove the dead rolling_segment_recap method (zero callers
  since the migration) + refresh its module/helper docs.
- item 9: fix the misleading "falling back to inline truncation" log —
  the envelope is kept regardless for its artifact_path pointer.
- item 10: drop stale model_vision_context doc links
  (turn_attachments_context.rs, tokenjuice/savings.rs).
- item 11: remove deleted harness/interrupt.rs from agent/README.md.
- item 12: payload-summarizer threshold doc default 500000 -> 4000.
- item 13: correct the TraceSpan doc — raw NDJSON is an OTel-style span
  dump, not directly Langfuse-ingestible (that is spans_to_langfuse_batch).

Items 4 (max_iterations==0 -> 10) and 7 (LazyToolkitResolver / mid-turn
resync) are already documented / tracked in-code; no change needed.

Claude-Session: https://claude.ai/code/session_019j5TLsRLHsM3kqAYFyH4hR

…er upstream merge

Post-merge integration fix: tinyhumansai#4459 added a `failure` field to
AgentProgress::SubagentToolCallCompleted; the merged unknown-tool
recovery path (observability.rs) needed to populate it.

Claude-Session: https://claude.ai/code/session_019j5TLsRLHsM3kqAYFyH4hR

…p cleanup

- Restore ArchivistHook::rolling_segment_recap (tinyhumansai#4469 removed it but an E2E
  test target still calls it; the removal was optional 'remove or re-wire').
- Preserve QueueMode when re-queueing residual steer/collect on forwarder drop
  so a delivered collect line isn't re-framed as user steering (tinyhumansai#4456).
- Clean up the staged temp file if the initial write fails in update_memory_md
  (tinyhumansai#4458).

Claude-Session: https://claude.ai/code/session_019j5TLsRLHsM3kqAYFyH4hR

…yhumansai#4465)

A <tool_call> tag that parses as P-Format has no json_calls entry (the JSON
pass can't parse it), so advancing json_idx shifted every later JSON tag onto
the wrong index and silently dropped a real JSON call. Both review bots flagged
this. Leave json_idx untouched for P-Format tags.

Claude-Session: https://claude.ai/code/session_019j5TLsRLHsM3kqAYFyH4hR