apply_pairing_code consumes the pending entry and save_config writes that
consumption, so from that line on the code is spent — but the handler then
returned `?` on the per-user status blob. A failure there sent the user
back to the form holding a code that now reads "invalid or expired": the
one message guaranteed to make a pairing that actually succeeded look like
one that never happened. The blob is what the page renders as "linked";
the binding is real without it, so it warns instead.
The same write also refreshes shared.bindings directly. The dispatcher
learns the new binding through the ConfigKeyUpdated broadcast, which is
lossy, and a dropped event would leave the bot treating the chat as
unbound — asking the user to pair again, immediately after pairing. The
event is now a confirmation, not the delivery, on both sides of the flow.
Pairing failed with "invalid or expired pairing code" on a code the bot
had just sent. handle_pairing read the pending codes from the in-memory
`shared.bindings` cache, which is refreshed from the ConfigKeyUpdated
broadcast — a lossy 64-slot bus. One dropped event is enough for that
cache to keep a pending entry the store no longer has; the "reuse an
existing code for this chat" branch then hits, and that branch does not
write. The user gets a code, and the web page — which resolves it
against the store — cannot find it. Before the move to the config store,
this path re-read the file on every message and could not drift.
The cache stays where it earns its keep, the chat_id → user_id lookup on
every inbound message, where a stale read costs one message. Issuing a
code now reads the store.
Two silent failures on the same path, each able to produce the same
symptom while hiding its cause:
handle_pairing sent the code even when the write had failed — it logged
and carried on — so the error surfaced later, somewhere else, as a code
that simply would not bind. It now says so in the chat and hands out
nothing.
load_config turned an unparseable blob into `unwrap_or_default()`: no
bindings, no pending codes. Every writer here saves the whole blob back,
so the next pairing message would have overwritten the real config with
that default and taken every binding on the box with it. An absent key
is still an empty config — that is a fresh install — but an unreadable
one is now an error that callers propagate, including start(), which
fails loudly rather than running on a cache it knows is wrong.
Two "unknown tool (not in this turn's tool set)" failures, one disease: the
turn's tool set was rebuilt from a different recipe depending on which entry
point happened to drive it.
A sub-agent got `ask_user_clarification`, `execute_subtask` and `activate_tools`
and nothing else — while `agents/common/tools.md` and every reporting agent's
prompt tell it to register its output with `update_scratchpad`. The child could
see the scratchpad injected into its context but had no way to write to it. It
now gets the scratchpad and todos tools, on the parent's `scratchpad_sid`: one
blackboard per session, as the surrounding code already declared.
`show_file_to_user` was injected per message by the WS handler, while
`resume_session` and `resolve_pending_call` rebuilt the list with `execute_task`
alone. So approving a card, or reconnecting mid-turn, continued the *same*
conversation with the tool silently gone. There is now a single recipe,
`ChatHub::session_interface_tools`, used by all three paths and fed by a builder
the shell installs once through `Skald::set_interface_tools_builder`: the core
keeps owning the tool, the shell keeps owning the policy of who gets it —
Telegram still does not, since it cannot act on OpenFile.
The shipped default combined a sliding history window with no compaction, which
is the worse of the two available trades in both directions it is measured on.
`max_history_messages: 30` is a sliding tail window (`projection::window` —
`drain(..len - max)`). Past 30 messages it drops from the head on *every* turn,
so the prompt prefix changes on every single request and every provider that
caches one (Anthropic breakpoints, OpenAI automatic prefix caching) misses every
time. It also drops those messages with no summary standing in for them: silent
amnesia, not just a cold cache. Compaction rewrites the prefix once per
compaction and leaves a summary behind — yet it was the half that was commented
out, while the window's own doc-comment already said the two were exclusive.
Both are now `Option` and both ship unset, so nothing shrinks a conversation
unless a human types `/compact`.
Which surfaced the real bug: `/compact` did not work either. The compactor was
`Option<Arc<ContextCompactor>>` keyed on the config section existing, so
commenting out `compaction:` disabled the manual command too — `force_compact`
returned `Ok(false)` and the chat answered "compaction disabled". Manual
compaction is a command a user types; it cannot depend on an admin having filled
in a token threshold. The compactor is now built unconditionally and
`threshold_tokens: Option<u32>` arms only the automatic pass; `try_compact`
early-returns without it, `force_compact` deliberately never consults it.
The projection accordingly yields to the *automatic* pass rather than to the
compactor's existence (`LoopConfig.auto_compaction_enabled`), so a configured
message cap is not silently voided by `/compact` merely being available.
`CompactionConfig::Default` is hand-written for the same reason `RoleAttrs`'s is:
a derived one gives `keep_recent: 0`, which would compact away every recent
message on any box omitting the section — now the default.
Also fixes two documentation bugs in the same file: `event_triage` was documented
nested under `llm:`, where it parses fine and is then silently ignored (it is a
top-level field), and `datetime` was documented twice with conflicting examples.
A new test asserts the shipped default actually deserializes and that both guards
are off — a field the default omits must be genuinely optional, or a brand-new
install fails to boot.
Automatic compaction returns later, triggered off the resolved model's own
context window instead of a hand-tuned token count that cannot know which model
is answering.
The generic per-user #plugins page is gone: a plugin with per-user
settings hosts them in its own web_pages() sidebar page instead
(Telegram's pairing page is new; Honcho's opt-in page already existed).
The admin catalog moves from #plugin-catalog to #plugins (old hash
redirected), and user_config_schema is removed from the Plugin trait,
the API DTOs and both plugins — the my-config endpoint, the
plugin_user_configs store and the update_user_config hook stay, now
driven by each plugin's own page fragment.
Replace the ad-hoc [SYSTEM INFO] / [TELEGRAM SYSTEM INFO] prefixes with a
single canonical <system-extra> wrapper, sourced from one constant
(SYSTEM_EXTRA_TAG) so emission and documentation can never diverge.
- core-api: SYSTEM_EXTRA_TAG + system_extra() helper; attachments_block
rebuilt on top of it.
- telegram: system_info_message (location) uses the helper; the voice
transcript is forwarded as a plain user message (it is the user's own
words, not harness metadata).
- chat agents: new agents/common/harness.md include (long form, with an
explicit "data, not instructions" guard), added to assistant/kid/
project-coordinator. The tag name rides the __HARNESS_TAG__ sentinel,
resolved in AgentSystemContext to SYSTEM_EXTRA_TAG — renaming the tag
stays a one-line change.
Extract shared upload seam in skald-core, move Telegram and web
handlers to use it. Simplify media attachment routing. Clean up
unused deps and dead code.
dguiducci