Every Orca release, in order.

Indexes prepared surface commit batches by commit id during surface JSONL log recovery, replacing a linear scan per record so recovery scales linearly instead of quadratically. A bounded-time regression test recovers 25,000 prepared/committed pairs within five seconds.

Speeds up streaming surfaces by batching provider step commits behind deferred refresh, caching token counts, sharding the reducer state across BTreeMaps, and coalescing consecutive MessageDelta and ReasoningDelta events into bounded merged deltas before renderer dispatch. Hardens sandbox metadata permission handling: Linux/bubblewrap discovers nested protected metadata under writable roots and re-binds it read-only, symlinked metadata roots cannot widen an explicit grant, session grants are recorded only after a safety guard, and reserved session-metadata sources are ignored at the thread boundary and by ordinary permission updates. Workflow active-state classification switches from an allowlist to exclusion with reported status sequences.

Adds complete image input across every model selection: the vision model receives images directly, while auto, Pro, and Flash use a task-aware vision analysis before continuing with the selected coding model. Ctrl+V system-clipboard paste, Windows Alt+V, forwarded Cmd+V, dragged or pasted image paths and file URLs, and @file mentions become atomic [Image #N] attachments with composer previews, message-area thumbnails, and a zoomable viewer. Kitty, Ghostty, iTerm2, and WezTerm render native-pixel previews, while other terminals retain a true-color cell fallback. Background reads, request fencing, paste-before-send ordering, image-only turns, queue editing, rejection recovery, durable history, ACP image blocks, and provider replay preserve the same typed input across macOS, Linux, Windows, and WSL. RuntimeHost also delegates generation context, interaction routing, operation recovery, Goal control, and task/workflow ownership to focused controllers, with stable ContextWindowId compaction epochs.

Makes the unsandboxed shell permission an explicit, reusable, session-scoped capability. The turn permission overlay and its delta now carry the capability with merge and apply semantics that preserve it, bash consumes it before prompting so a granted session never re-asks, and grants are recorded only after an allow response. Session-scope allow responses persist the capability into thread settings and JSONL metadata, restore it into every new turn and command_exec operation, validate grant deltas against the requested profile, and cannot be silently revoked.

Adds runtime-owned, checkpointable continuation lineages for synchronous subagents, async workers, and Workflow children. Leased attempts, revision fencing, digest-verified conversation checkpoints, compatibility identities, pre-dispatch replay boundaries, and cold orphan reconciliation resume only safe durable facts and fail closed on indeterminate side effects; retryable resumable Workflow attempts retain their worktree. The durable prompt queue projects one admission and lifecycle model across TUI, ACP, JSONL, and Headless, routes Alt+Up editing through a revision-checked delete, restores rejected prompts, and bounds previews. The TUI keeps large ordinary-chat pastes as compact chips while sending the complete text, enforces the 1 MiB limit, and materializes active Goal pastes and oversized objectives into validated ORCA_HOME attachment files with cleanup on uncommitted failure.

Unifies tool approval, permission requests, user input, and MCP elicitation behind one durable interaction broker across TUI, ACP, JSONL, and Headless. Restartable intents, exact route and response fencing, durable invocation receipts, pre-side-effect permission retry, and stable continuation operation identities make crash recovery deterministic without replaying ambiguous side effects. Recovered answers retain user-level trust, ACP continuations preserve their surface origin and capabilities, and timed-out Headless callbacks cannot create unbounded worker threads. The obsolete RuntimePendingInteractionStore compatibility API is removed.

Adds thread-owned exec_command and write_stdin sessions with optional PTY, raw control-character input, bounded incremental output, and task-based process-tree control. A bounded-mailbox, single-owner terminal supervisor actively settles natural exits and TaskRegistry stop requests without another poll, releases retained resources, and injects one bounded completion notification before the next model turn unless the terminal result was already observed.

Adds an interactive /config panel for current-session model, reasoning, and approval settings; presents ask_user_question choices as an owned dialog with descriptions, previews, multi-select, and custom-answer support; and separates Editor shortcuts from Global, Idle, and Running actions so readline and Vim keys edit drafts without accidentally opening search or help, scrolling the transcript, backtracking, or backgrounding work.

Makes interactive session state more reliable by assigning queued input, approvals, terminal startup, renderer events, and session, operation, Goal, plan, workflow, and metrics projections to explicit owners. Side re-entry preserves background presentation without replaying stale events, while restarted sessions reconcile legacy active and terminal workflow tasks into the current durable task model.

Adds durable, project-scoped automatic memory for recorded sessions. After a successful verifier-gated root turn, Orca queues bounded and redacted extraction work behind a leased, fenced job ledger. Later turns receive only relevant, provenance-bearing facts as non-transcript context; the repairable SQLite FTS index falls back to lexical recall. Manual /remember remains separate, while auto_memory = false disables automatic capture and recall.

Fixes the runtime-surface release gate's repeated Rust-source masking. The validator now caches masks by source content, so its self-tests finish in a bounded time instead of rescanning the full TUI tree for every synthetic inventory fixture. v0.3.18's 45-minute release timeout and split test gates remain in force.

Hardens the execution-budget protocol end to end. Budget stops commit the real durable conversation boundary first (session checkpoint with the last committed message id), then the journal checkpoint and terminal, so a resumable terminal can never point at a boundary that does not exist. Child-agent leases reserve per child and settle exactly once with usage receipts, batch children partition the remaining budget evenly, and stateless or suspended over-budget exchanges commit non-resumable stops instead of claiming success. The operation journal records the committed tool outcome (status and error) with dimension-specific stop reasons, and approval-waiting operations never persist a terminal.

Eliminates the high-parallelism test hangs and flaky failures under cargo test --test-threads=16. The test harness now uses thread-local per-test homes instead of mutating ORCA_HOME, and RuntimeHost installs the calling test's home on all of its threads, so hosted tests resolve one consistent private home with no env-lock deadlocks. GoalStore schema initialization is fenced behind a cross-process sibling lock with WAL set once at init, so concurrent opens no longer race DDL. The typed-provider-outcome failure injection is session-keyed, and load-sensitive tests poll instead of racing a 20 ms budget.

Makes long-running background work safer across process boundaries. Durable task leases, fencing epochs, stale-owner takeover, and publication revisions prevent an expired worker from overwriting a newer result, while task status refreshes from the persisted record. TUI parent/Side attachment events now pass through one routing authority with FIFO interaction replay. DeepSeek requests gain deterministic tool ordering and explicit cache-prefix checkpoints, and a real-API compaction smoke verifies remote summaries retain the current request while reducing wire context pressure.

Makes headless resume a first-class CLI capability. orca exec resume <SESSION_ID> continues a saved session with a fresh budget scope, resume --last picks the most recent session, and --resume-at <MESSAGE_ID> restores only up to a durable message boundary. session.completed now carries the durable session_id, text-mode exits print the exact resume command, and a budget-exhausted run persists a typed session.checkpoint (status, reason, budget consumed, last committed message, task plan, resumable) before the terminal projection — uncommitted tool calls remain indeterminate on restore, so Orca promises resumable, not exactly-once, execution.

Adds runtime-owned Side Conversations for quick questions without disturbing the main task. /side creates a separate disposable child from an atomic parent snapshot; Ctrl+/ switches between parent and Side while the parent keeps running, and Ctrl+C closes and joins only the Side. Side history, memory, goals, and transcript output never merge into the durable parent. TUI response projection also fences provider responses by turn and item identity so older or partial streams cannot overwrite the current response.

Strengthens the reliability boundary across headless, TUI, MCP, server, and automatic-memory workflows. Headless max-turn trajectories now preserve terminal truth and compare streamed projections with persisted records; terminal waiters cancel and join cleanly; MCP SSE elicitation validates requests and terminal IDs, cancels in-flight response posts, and covers decline, malformed, and wire cancellation paths; inherited network grants ask once and persist the retry; JSONL tool approvals remain runtime-owned; automatic memory writes are lock-governed and cancellation-safe; and the cross-surface contract fixtures now use deterministic local resources.

Makes TUI interaction lifecycle runtime-owned end to end. Approvals, user input, cancellation, terminal settlement, and replay now use one typed surface rail instead of parallel client state. Goal tool Allow and Deny settle durably with exact usage; Deny pauses without executing the tool, and explicit resume starts a fresh fenced run. Session browsing ignores symlinks, FIFOs, devices, and other non-regular transcript entries, preventing special files from stalling the picker or transcript reader.

Upgrades Plan mode from a permission-only gate to a full plan-then-execute workflow. The agent now performs read-only exploration, emits a formal proposed plan, and presents a bottom-anchored approval dialog. Approving restores the previous mode and executes the plan automatically; rejecting stays in Plan for further iteration. Per-turn mode context injection ensures Plan constraints apply immediately when switching modes mid-session. PageUp/PageDown and scroll review long plans inline.

Improves long-running and delegated work reliability. The context footer shows the remaining percentage, while /status reports remaining and total token counts; repeated compactions and queued steer input recover without restoring discarded context or losing user intent; asynchronous subagent results are durable and pageable; background task completion is announced proactively; stdio MCP reconnects after transport failures; and concurrent JSONL writers fail before reusing an event-sequence reservation. Workflow runs can enforce a shared tokenBudget, while /skills opens a searchable picker and slash settings reflect committed runtime state.

Completes session-context and TUI projection reliability. Recorded sessions restore provider prompt occupancy before the first resumed turn; revision-aware projection prevents an older surface snapshot from replacing a newer context footer; reasoning, message, and plan streams preserve their opened order during hydration; and already-streamed completed responses are no longer rendered twice. The delegated execution, transcript locking, retry diagnostics, and task-registry guarantees from v0.3.6 remain included.

Strengthens runtime reliability across delegated work and durable task state. Synchronous, asynchronous, and workflow child agents now inherit one serialized execution-policy snapshot; plaintext and compressed transcript paths share a stable cross-process lock during append and rewrite; provider compaction retries and truncated tool output remain visible in task summaries; and session completion publishes the complete task registry before the terminal event. The composer remains available while an activity line shows running or approval-blocked background work.

Adds one canonical ask_user_question tool for one to four structured questions, with described choices, previews, multi-select answers, custom responses, and cancellation through the runtime-owned TUI interaction broker. Goal mode now starts provider work correctly in optimized builds, /workflows remains available during foreground turns, and unknown slash commands are rejected instead of reaching the model. Terminal-Bench now reports the mounted binary version, preserves JSONL trajectories for Harbor without extending its closed AgentContext model, documents supported filters, and keeps generated benchmark artifacts out of Git.

Fixes the context meter and compaction policy for large model windows. The TUI now derives the remaining percentage of the full context window from provider-reported prompt usage instead of displaying an estimate against the old 96k compaction budget. Automatic compaction now triggers at 80% of the model window, keeps a 90% hard safety ceiling, and retains a fixed recent-context budget of about 48k tokens before summarizing older history. New sessions now default to sandboxed auto-edit; suggest, full-auto, and plan remain available explicitly. Existing absolute compaction overrides remain compatible.

Closes the Orca runtime and architecture audit. Goal persistence and terminal replies now settle in order without blocking Tokio actors, operation cancellation owns spawned task trees, and session switch, fork, rename, and stale-event handling are transactionally fenced. Runtime surfaces use an explicit facade, tool schemas are provider-neutral, root MCP ownership lives in RuntimeHost, and transcript streaming, reflow, search, deduplication, usage, and projection state now have bounded or revision-checked behavior.

Fixes a crash when Orca is launched through the npm wrapper (node stdio:inherit sets O_NONBLOCK on inherited terminal fds). Orca now clears non-blocking flags at startup and wraps stdout with an EAGAIN/EINTR retry writer, eliminating os error 35 during rapid terminal resize on macOS. Also adds reasoning effort low for DeepSeek V4, with correct thinking configuration and default max_tokens in API requests.

Orca now has a complete session lifecycle in the TUI. /resume is the single saved-session entry point, with resume, fork, rename, archive, delete and session-ID copy actions in one picker. /new starts a clean conversation, /fork preserves the current context in a new durable session, /rename updates the active session, /status reports the current runtime state and /copy copies a finalized assistant response. Recoverable operations use an explicit Continue or Cancel prompt, and exit prints the exact orca --resume command for returning later. Reasoning effort now supports low alongside medium and high, matching DeepSeek V4 parameter requirements with correct thinking configuration and default max_tokens. The npm wrapper startup crash caused by inherited O_NONBLOCK terminal file descriptors is fixed: Orca clears non-blocking flags at startup and wraps stdout with an EAGAIN/EINTR retry writer.

Orca now ships native Windows x64 and ARM64 support across the CLI, TUI, shell sessions, sandboxing, updates, persistence, npm packages and GitHub release archives. PowerShell 7, Windows PowerShell and cmd.exe resolve through explicit dialect-aware commands; ConPTY provides interactive terminal sessions; AltGr input, clipboard access, process-tree cleanup, atomic replacement and cross-process locks follow Windows semantics. The PowerShell installer verifies checksums, installs the runtime plus sandbox helpers and can provision, repair or remove the per-workspace sandbox capability. Native x64 and ARM64 CI run the platform contracts and full workspace tests before release.

The CLI binary is now limited to argument parsing and library forwarding: configuration, launch, update, history, trust, workflow, protocol and worker ownership live in orca-runtime and orca-tui. Stateless JSONL submissions now own their complete turn lifecycle without requiring a persisted thread, including exact EOF cancellation and settlement. macOS Seatbelt execution now uses the absolute system binary, parameterized path rules, protected metadata write roots and fail-closed enforcement, while trust and command-output failures propagate instead of being reported as success.

ACP and the JSONL server now complete the runtime-owned typed-surface convergence begun in v0.2.54. ACP session admission, prompt binding, replay, terminal flush, cancellation, capability settlement and bounded transport supervision are owned by the runtime. JSONL thread, control, permission, user-input and MCP routes now use one surface adapter with durable request identity, EOF settlement and restart recovery. Release gates exercise TUI, ACP and server paths against the real binary, while publication verifies exact archives, npm tarballs, checksums, registry integrity, package aliases, binary identity and clean installation.

The production TUI now completes its runtime-owned typed surface migration. The app loop, agent runtime and action dispatcher hold one typed surface control while RuntimeHost owns prompt admission, durable batches, operation and generation fences, interactions, cancellation, terminal finalization, workflow task state and restart recovery. Assistant and tool output is projected only after durable commit, interaction answers are persisted before waiters wake, manual compaction cannot report success before its terminal receipt, and restart restores the exact snapshot and pending ownership without redefining turn semantics in the renderer. ACP convergence follows this TUI release; JSONL compatibility remains later work.

Goal Mode now completes its first runtime-owned TUI vertical loop. Set-and-run, resume, pause and cancellation flow through typed commands; Goal state, outer-turn progress, continuation decisions and terminal results are committed durably before TUI projection or waiter wake. Restart recovery preserves the exact owner lease, operation and generation fences, pending mutation receipts, progress barriers and repeated-gap streaks. MaxInnerTurns remains resumable, plan-only work counts as progress, cost-budget exhaustion pauses as UsageLimit, and exact retry digests bind usage, progress, verification, continuation and terminal semantics.

Goal continuation now distinguishes an advanced turn, a resumable interruption, and a true blocker. Reaching the inner-turn limit preserves a MaxInnerTurns reason, emits soft-landing reminders, and continues with a structured handoff containing the objective, budget state, open gap, current task plan, and bounded assistant checkpoint. Cost-budget exhaustion, cancellation, approval, verification failure, and other blocking outcomes still pause. A separate durable watchdog counts only substantive tool or plan progress, preserves progress barriers across SQLite recovery, pauses after three repeated model-fixable gaps, and caps eight consecutive inner-turn interruptions.

Ordinary TUI turns now run end to end through a runtime-owned typed surface: prompt admission, atomic durable commit, assistant and tool projection, approval and permission decisions, cancellation, terminal cleanup, snapshot replay, and restart recovery share one RuntimeHost truth. Recovered controls remain bound to the original operation and generation, interaction responses are durable before waiters wake, and production tests cover real Record-to-Resume history plus PTY terminal restoration. ACP typed prompt, replay, permission, and bounded RPC bridges are included without changing Goal, workflow, or JSONL compatibility.

Goal Mode no longer has a fixed outer-turn or continuation ceiling. RuntimeHost admits the next turn from semantic state, cancellation, pending interactions, workflow ownership, progress, and token budget; continuation_count remains only persisted ledger and event telemetry. This removes the false Paused(NoProgress) terminal that could appear after 64 otherwise valid turns without weakening budget, stall, or user-control boundaries.

Goal Mode now has one runtime owner for lifecycle, continuation admission, cancellation, recovery, usage, and persistence. Terminal model claims are typed intents audited at turn end, SQLite replaces direct JSON mutation with migration and crash recovery, and role-safe context plus semantic events keep TUI and ACP projections consistent. Five real DeepSeek scenarios verify completion, rejected completion, genuine blocking, cancellation, and resume with no stale continuation or in-flight run.

ACP initialization now reports the Orca binary release version from RunConfig instead of the internal orca-runtime crate version. Integration coverage also isolates ORCA_HOME, verifies that each session keeps its requested working directory, and exercises cancellation arriving before the hosted operation handle is installed.

Orca now exposes an additive Agent Client Protocol adapter over stdio with --mode=acp. ACP sessions and prompts project directly onto RuntimeHost threads and hosted turns, EventEnvelope streams become standard session/update notifications, and cancellation reaches the active Generation Fence through OperationHandle. The existing internal JSONL server protocol remains unchanged.

Goal Mode control tools now execute through the runtime that advertised them. get_goal, create_goal, and update_goal use the recorded session and live extension context before any normal-tool worker boundary, with the old thread-local callback removed. Invalid model arguments remain recoverable, while missing control-plane ownership or persistence failures stop one turn, atomically stall an active goal, and clear stale Goal context. A billed DeepSeek gate verifies one non-goal tool, exactly one terminal update_goal call, and zero eligible continuations.

Approval modes now match their execution boundaries: auto-edit runs autonomously inside the workspace sandbox, while full-auto combines automatic approval with danger-full-access and no post-failure sandbox escape prompt.

macOS Sequoia sandbox shell resolution is fixed. sandbox-exec invocations now use /bin/sh instead of bare sh, bypassing the /private/var/select/sh kernel lookup that macOS 15 blocks inside a seatbelt sandbox. This eliminates the spurious Unsandboxed Shell Required approval prompt that appeared on every tool call in full-auto mode.

Linux fail-closed enforcement is now scoped to strict restricted-read policies, so untrusted-folder and strict read-only modes still refuse to run when neither bubblewrap nor Landlock can enforce them. Non-strict capability modes (workspace write and global read-only) keep their established Landlock-plus-seccomp or plain compatibility fallback when a policy needs bwrap-only features and no bwrap is on PATH, matching the reference agents' fail-open-for-built-ins behavior. The release test runner no longer installs bubblewrap, so CI exercises the Landlock plus seccomp fallback path directly.

Linux command isolation now prefers bubblewrap for mount, namespace, capability, and network boundaries, then falls back to Landlock plus seccomp when the policy is expressible. Strict restricted-read policies refuse to run when neither backend can enforce them. Folder trust persists user decisions outside the repository: untrusted folders do not load project config, instructions, skills, or named workflows and receive a read-only, no-network default, while explicit capability modes, permission rules, and network-proxy grants keep their existing authority. Runtime lifecycle tests now use an explicit danger-full-access capability profile, proving that this established override remains authoritative without weakening the Linux fail-closed default.

Foreground subagents now have one runtime-owned invocation lifetime for admission, child cancellation, worker join, panic classification, schema validation, worktree completion, usage, and exactly-once terminal selection. Interrupting a synchronous delegation waits for child cleanup before the turn settles or the next prompt starts, while a child panic becomes an indeterminate result instead of escaping RuntimeHost. Async delegation now projects its durable task to the TUI immediately without creating an unmatched foreground lifecycle; atomic PID adoption prevents a fast worker from being overwritten, and foreground interrupt remains independent from explicit task_stop cancellation. The inline single-child loop, scoped batch runtime, duplicate formatting, stale adoption path, and source-shape ownership tests are removed; cross-process leases and stale-owner takeover remain P1.4.

Sequential normal tools now run as runtime-owned child lifetimes. RuntimeToolCallRuntime owns admission, started state, cancellation policy, the worker, join, panic classification, permission deltas, and the exactly-once terminal while bounded typed bridges carry output, approval, and MCP elicitation. Interrupting bash, external tools, or MCP calls waits for cleanup before the turn settles or the next prompt starts; WaitForTerminal preserves an observed mutation, and a worker panic after start becomes indeterminate. Turn permission grants are merged before later sibling calls. The borrowed normal executor, fallback owner, inline path, and source-shape tests are removed; subagents remain the explicit P1.2c boundary.

Interrupting a TUI or server turn now reaches parallel read-only tool calls that have already started, waits for every worker and transport to clean up, and only then publishes the operation terminal or admits the next prompt. RuntimeToolCallRuntime owns each invocation's concurrency permit, cancellation, started state, blocking task, join, panic classification, and exactly-once terminal while preserving provider order. MCP resource list, template, and read requests are cancellable; stdio reconnects after cancellation and SSE remains reusable. The old orca-tools batch scheduler is removed. Normal tools and subagents remain explicit P1.2 follow-ups.

A submitted prompt now has one admission owner and one durable user row. Hosted turn preparation persists the identified user message before committing it to model context, while agent-loop bootstrap explicitly distinguishes owned child-agent conversations from borrowed hosted sessions and never replays borrowed initial history. Live thread reads, turn pagination, item pagination, cold ThreadStore reads, restart, and resume now expose one user item per logical turn with stable turn and item ids. Existing duplicate history remains readable without a projection-time deduplication layer.

Completed DeepSeek responses now have one durable canonical fact. Agent-message, reasoning, and proposed-plan ids are allocated before streaming and stay identical through live projection, approval suspension and continuation, restart, pagination, and resume. Runtime persists one typed model.response.completed event instead of a second assistant record, and model replay plus ThreadStore history reduce that same event. Legacy combined assistant records remain readable through one isolated reducer, while malformed current completions fail closed. The real DeepSeek gate now compares complete persisted item objects and internal/external ids across processes.

Recorded conversations now keep opaque turn and item identities across reload, resume, compaction, repair, pagination, rename, archive, and compression. Logical turn ids are separate from runtime task ids, so concurrent first turns cannot collide in server control routing. New records use typed UUIDv7 identities, tool and workflow items retain their domain ids, and legacy histories remain readable through one isolated fallback. A real DeepSeek gate now records a turn, restarts the process, resumes the same thread, and proves both context continuity and stable prior ids.

The production TUI now runs foreground turns, interrupted streams, approvals, user input, MCP elicitation, background providers, and saved workflows through one process-owned RuntimeHost. RuntimeHost owns cancellation, joins, terminal events, usage commits, and shutdown cleanup; the duplicate TUI provider/tool/workflow loops and TaskSupervisor are removed. A cancelled live DeepSeek stream releases the foreground operation and the next submit starts cleanly, while repeated idle Goal refreshes no longer duplicate the same notice.

Runtime now has a process-owned RuntimeHost and one bounded ThreadActor per conversation, with typed operation handles and completion terminals so headless and TUI turns share one ownership boundary. Structured @ mention bindings now resolve exact files, skills, plugins, and MCP resources, recover rejected submissions, and keep mention search and history isolated from user data. TUI selection, clipboard, input history, status formatting, and submission hints are also refined.

Server turn cancellation is now generation-owned. Interrupt permanently cancels the current DeepSeek execution; resume waits for it to return, starts a fresh scope on the same logical turn id, and never appends the original prompt twice. Permission, user-input, and MCP waiters are cancellation-aware and generation-fenced, stale steer and responses are rejected, and a replaced generation cannot publish stale cancellation errors or a stale terminal event. The first interaction request id remains compatible; resumed generations receive an internal generation suffix. A real DeepSeek gate interrupts after the first stream delta and verifies one successful terminal event.

Every submitted TUI turn, manual compaction, Goal operation, and approved background continuation now receives a fresh one-shot cancellation scope with a stable operation id. Esc and Ctrl+C cancel only the active scope, so interrupting a DeepSeek stream cannot be undone by a later reset or leave the next turn born cancelled. All production TUI reset calls are gone, and an agent-loop behavior test cancels a delayed first turn before proving that a second submit gets a different scope, produces output, and completes successfully. CLI arguments, TUI keys and flows, server JSONL, persisted records, and DeepSeek behavior remain compatible. The server turn/resume reset path remains an explicit actor-owned follow-up rather than a permanent compatibility layer.

The TUI now admits runtime events through a 256-item mailbox and user actions through a 64-item mailbox with blocking backpressure, so a slow or paused renderer cannot grow an unbounded queue and admitted output, approvals, errors, and terminal state keep FIFO order. Runtime compaction and approved background continuation project the original typed EventEnvelope through EventObserver instead of serializing JSONL into a partial-frame buffer and parsing it back. Provider streaming, mention catalog refresh, and silent child-agent event disposal also use explicit bounded ownership, with the silent drain thread joined before return. CLI/server JSONL, persisted records, DeepSeek behavior, TUI keys, and interaction flows remain compatible.

Network-restricted TUI bash and server command sessions now own every proxy connection through one managed supervisor. Admission is capped at 32 concurrent connections; excess clients receive a bounded connection-limit response instead of spawning another worker. Request and header framing is bounded before parsing, network-block reports use a fixed-capacity non-blocking queue, and DNS lookup, upstream connect, and socket I/O have explicit deadlines. Stopping a command, cancelling a turn, or dropping the proxy stops admission, aborts and awaits every active connection, closes both ends of CONNECT tunnels, and joins the supervisor thread. CLI flags, permission profiles, proxy environment variables, TUI flows, server/JSONL shapes, and persisted records remain compatible.

Every accepted tool invocation now reaches one truthful terminal result, including interruption, pre-execution rejection, and siblings that never started. Incomplete legacy history is repaired as indeterminate without replaying old calls. Ordinary process stdout and stderr are capped at 1 MiB per stream, while file reads and exact edits reject non-regular, binary, invalid UTF-8, growing, and oversized inputs before unsafe admission. External tools, MCP servers, workflows, async subagents, verifier commands, server turns, shells, and search managers now have explicit cleanup or reaper ownership; MCP and WorkflowHost transports and shutdown paths are bounded; observed completion wins cancellation and timeout races; and internal worker API keys no longer persist or appear in process arguments. Windows descendant-tree parity, a total WorkflowHost deadline, and a managed-proxy connection ceiling remain follow-up work.

The Orca TUI gains native-feeling mouse text interaction. Drag over the transcript to select text with an editor-style theme-aware highlight that preserves syntax foregrounds; releasing the button copies the selection to the system clipboard through OSC 52 (VS Code, iTerm2, kitty, WezTerm, and SSH sessions) with a pbcopy fallback on macOS, and a transient `copied N chars to clipboard` notice appears on the status line. Selections are anchored in content space rather than screen space, so streaming output and scrolling never shift what was selected. Soft-wrapped prose copies back as one line with the wrap-dropped whitespace restored, while hard-split long words such as URLs stay unbroken. Double-click selects the word under the cursor and copies it immediately; dragging onto the transcript's first or last row auto-scrolls on the animation timer so the selection keeps growing while the pointer sits still; and a floating `Jump to bottom` pill appears whenever auto-follow is disarmed and re-arms it on click. The obsolete `shift+drag to copy` status hint is gone, and the mouse wheel keeps its existing scroll behavior.

Orca's `@` mention now spans multiple workspace roots and every candidate kind at once. `orca-file-search` sessions accept one or more roots, so equal relative paths from different roots stay distinct while browse, fuzzy, exclude, Git-ignore, cancellation, and million-path bounds keep working unchanged. Files, Skills, Plugins, MCP Resources, and Resource Templates now share one typed `MentionCandidate`/`MentionTarget` model with stable ids derived from the full target rather than display text, so same-name results never collapse. Selecting a candidate records a hidden atomic binding: it rebases across earlier edits, invalidates on overlapping edits, and expands the exact selected root, Skill path, plugin manifest, or MCP resource at submission time instead of re-resolving visible text. The Codex-compatible `fuzzyFileSearch/*` app-server contract now takes explicit multi-root input, and a new thread-bound `mention/search/*` contract discovers and expands candidates against a live thread's own workspace roots and MCP registry. TUI and app-server submissions share the same expansion and validation code, legacy unbound `@file`/`$skill` input remains valid, and search-session reapers are retained and joined on stop/shutdown so late output can never race a stopped session.

DeepSeek turns that end without visible content or a tool call now receive one bounded semantic recovery request instead of an identical replay. The request-local correction preserves valid tool-call reasoning and tool results, never persists the incomplete response, avoids replaying recovery reasoning already shown in the TUI, and preserves usage reported by both attempts. Foreground budgeted requests use serialized admission and later-turn preflight, while detached completions persist priced usage and redacted diagnostics through the task-correlated background_task.provider_response record without overwriting global session completion. Resume accounting now uses session.usage_baseline, and Goal tokens count input plus output without adding cache hits twice. The release also updates the tag-driven GitHub Actions pipeline to current v5 artifact, checkout, and Node setup actions.

The TUI now keeps long sessions compact across the full interaction loop. Large pastes stay collapsed in the composer and transcript while the complete prompt reaches the model; Goal objectives and notices, task-plan steps, and tool targets use display-width-aware ellipses; long approval content cannot push decisions away; slash and file menus follow the selected row; and the responsive footer preserves permission mode and context before optional metadata. Permission modes now use blue, violet, red, and teal semantic accents.

macOS Seatbelt now lets sandboxed test runners signal only their own child workers, so Vitest, Tinypool, Jest, and similar pools can clean up after failures and shutdown. The incident behind this fix left 10 Node workers using 40.51 GiB while Orca native used about 30.2 MiB and its npm wrapper about 11.8 MiB; it was not an Orca transcript-heap leak. Workspace-write and read-only profiles keep unrelated processes outside the signal boundary.

Unknown or malformed DeepSeek function names now become recorded, failed tool results that the model can correct inside the same agent turn instead of terminal provider errors that pause Goal mode. Orca preserves the original call id, name, and raw arguments across streaming and non-streaming responses, but never infers or executes bash from command-shaped names; registry validation rejects them before approval, hooks, task creation, or execution.

Active Goal activity time now stays cumulative across automatic continuations by combining persisted completed-turn time with the current turn delta. /goal resume preserves the objective, budget, token usage, elapsed time, and creation timestamp; same- and cross-session restoration use one atomic migration with an occupied-target guard and unchanged state on failure. Restored history projects the preserved Goal before TurnStarted so the first running frame includes the persisted base.

TUI context compaction now has a visible, interruptible lifecycle. Automatic soft-limit, hard-limit, and prompt-too-long recovery show Compacting context before hooks or remote summary work; manual /compact uses the same state. Ctrl+C, Esc, and Ctrl+G cancel hooks and the streaming DeepSeek summary, while completion appears only after persistence and post-compact hooks finish. DeepSeek header waits, retry delays, error-body reads, and SSE reads now race cancellation through a joined provider worker, including between events from one SSE frame. Malformed or prematurely ended streams fail explicitly and retry only before visible output; malformed JSON for a known tool is preserved, validated before approval, hooks, task creation, or execution, and returned as a corrective tool failure. Older compacted events remain compatible.

TUI resume now drops legacy reasoning-only assistant turns before replaying history to DeepSeek. New provider responses that contain reasoning but no visible content or tool calls are retried instead of being persisted, while valid reasoning attached to tool calls remains intact. The release gate now exercises this malformed-history recovery against the real DeepSeek API.

Server-mode MCP elicitation now matches the TUI interaction path. When an stdio MCP tool sends elicitation/create during a turn, Orca emits a turn-scoped mcp_elicitation_request event, accepts mcp_elicitation/respond by requestId, writes accept/decline back to the MCP server, and then continues the original tool call. turn/interrupt now cancels unanswered MCP elicitation prompts, MCP transport cancellation returns promptly across stdio and SSE paths, and server shell/list stops reaping command/exec-owned backing shells.

Runtime task output now flows through a bounded, UTF-8-safe task-output store. Long-running TUI bash and command/exec sessions avoid unbounded stdout/stderr retention, command/exec streaming keeps cumulative output caps correct after retained-output rebases, and terminal command paths evict retained output after completion, stop, or permission denial.

TUI scroll performance gets a full overhaul so long sessions stay responsive. A frame scheduler coalesces wheel events and caps per-batch processing, message rendering flows through a version-based cache instead of redrawing the whole transcript each frame, and a virtual viewport renders only the visible messages. Scroll offsets widen to usize so sessions past 65,535 lines scroll correctly, and the bottom status line drops the scroll: N/total indicator.

TUI keyboard handling now runs through a context-aware shortcut resolver. Global, composer, running-turn, and approval-dialog keys keep the same behavior, but the resolver, tests, and shortcut help path now share one binding boundary so future keymap and task-control changes are easier to verify.

TUI compacted-context notices now keep the runtime compaction reason and strategy. Long DeepSeek sessions can show when Orca compacted near the token limit, at the hard limit, or after prompt-too-long recovery, including the collapsed message count, instead of only showing a generic before/after message total.

TUI automatic compaction and prompt-too-long retry recovery now run through the runtime compaction boundary. The visible context meter, compacted-context notice, and failed compaction errors keep the same TUI shape, but the main TUI loop no longer owns context-pressure decisions or retry state, reducing drift from server and child-agent compaction paths.

Command/exec sandbox and permission-profile resolution now lives behind a focused server module instead of the generic server loop. TUI bash and server command/exec still share the same sandbox behavior and JSON wire shapes, while the permission-profile boundary is easier to test before future network, filesystem, and task-control changes.

Core now owns the reusable thread-item projection types for user, persisted, assistant-message, proposed-plan, and reasoning transcript items. Runtime projection still emits the same TUI/server JSON, but live streams, active steer messages, and resumed history now share one typed item boundary before serialization, reducing drift in the transcript cards users see.

TUI proposed plans now render as their own scrollback message instead of leaking <proposed_plan> tags into assistant text. The server and TUI share one UTF-8-safe parser, so split tags and Chinese streaming text keep the same tested behavior across local TUI and server projection.

Server command/exec network-policy denials now use the same runtime permission evaluation boundary as TUI bash. Requestable blocked hosts still open the existing permission-request and retry flow, while configured denylist hosts now surface a clear policy-denial error instead of falling through as an unpromptable missing request.

TUI bash network-policy denials are now explicit. Runtime permission policy returns a structured Request or Deny evaluation for network blocks, so requestable hosts still open the normal approval flow while configured denylist blocks end as a clear denied tool result instead of being represented as a missing prompt.

TUI MCP tool calls can now surface real stdio elicitation requests instead of silently dropping them. When an MCP server sends elicitation/create during a tool call, Orca projects the URL or form request through the runtime pending-interaction store, shows a TUI waiting-input prompt keyed by the runtime id, writes accept or decline back to the server, and then continues the original tool call.

DeepSeek tool-call compatibility gets hardened. update_goal and update_plan normalize the status aliases and boolean status flags DeepSeek emits before validation, the glob and update_goal JSON Schemas support nullable/anyOf parameters, and tool validation errors now list the allowed and required properties. The system prompt stops inlining full tool schemas in favor of concise examples, and the line adds reasoning-content replay, a tool-count cap, and empty-response retry for DeepSeek turns.

Server interactive responses now stay with their focused processors. permission/respond resolves pending permission grants inside the permission processor, user_input/respond resolves runtime user-input waiters inside the user-input processor, and ownership tests guard that the generic server module does not reclaim those response paths.

Permission approval dialogs now name the requested risk directly. Network blocks, filesystem write grants, and unsandboxed shell retries keep their runtime permission kind through pending interactions, so the TUI modal can show Network Permission Required, Filesystem Permission Required, or Unsandboxed Shell Required instead of a generic approval title. request_permissions also reaches the runtime permission handler instead of being intercepted as an ordinary tool approval, making TUI and server permission grants more reliable.

RuntimeProviderResponseStep now consumes RuntimeProviderResponseInput directly instead of flattening the response handoff. Child-agent executors travel through RuntimeProviderResponseExecutors, so provider final-message and tool-turn dispatch keep one named response boundary while behavior stays unchanged.

RuntimeProviderTurnStep now receives provider-call state through a named RuntimeProviderTurnInput. Provider-turn I/O refs live behind RuntimeProviderTurnIo, so conversation, history, events, sink, and cost tracking are handed into provider execution as one boundary while provider behavior stays unchanged.

RuntimeProviderResponseInput now carries provider-response I/O refs through a named RuntimeProviderResponseIo bundle. RuntimeTurnKernel assembles events, sink, conversation, history, cost tracking, and background workflow handles as one handoff, and provider response handling destructures that bundle only at the execution boundary.

RuntimeProviderCycleInput now reuses RuntimeStepCapabilitySnapshot for provider-cycle capability refs. runtime_turn_iteration assembles that bundle once, provider_turn passes it into RuntimeStepContext without expanding flat capability fields, and provider/tool behavior stays unchanged while the provider-cycle boundary gets smaller.

RuntimeStepSnapshot now carries request-scoped capability refs through a named RuntimeStepCapabilitySnapshot. Tool dispatch reads instructions, memory, MCP registry, hooks, cancel state, task registry, workflow IPC, and interaction handlers through that capability bundle, keeping provider/tool behavior unchanged while shrinking the next Codex-style step-context boundary.

Runtime request_user_input handling now shares RuntimeTurnInteractionState with permission requests. ThreadTurnRequest can carry a runtime user-input handler, the provider/tool cycle passes it through RuntimeStepSnapshot and ToolExecutionContext, and RuntimeToolRouter treats request_user_input as a runtime special dispatch instead of a normal tool fallback.

Runtime turn-scoped interaction handlers now flow through RuntimeTurnInteractionState. AgentLoopContext, runtime_turn_loop, and runtime_turn_iteration carry the permission-request handler through one grouped boundary, preserving current approval behavior while preparing request-user-input and other interaction waiters to share the same turn-owned surface.

RuntimeStepContext now carries request-scoped runtime inputs through a named RuntimeStepSnapshot. Provider response handling reads final-response settings through the snapshot, and tool dispatch splits the step context into snapshot plus extension binding before routing normal, readonly, workflow, and subagent tool turns.

Runtime directives now flow through a named RuntimeCapabilitySnapshot. Switch-model, allowed-tool, and runtime system-message patches share one capability contract, and RuntimeDirectiveState exposes that snapshot so later skill, hook, MCP, and tool-policy work can derive from the same state surface.

RuntimeTurnKernel now owns turn-loop state assembly as an instance handoff. RuntimeTurnState creates the kernel from scoped extension stores and asks that instance to build RuntimeTurnLoopState, while shared extension stores keep the kernel-owned borrow boundary compatible with the loop state it hands forward.

RuntimeTurnKernel now assembles the lifecycle-owned RuntimeTurnLoopState. RuntimeTurnState no longer expands loop runtime and extension-state fields itself, continuing the turn-state consolidation started around provider response handling.

RuntimeTurnKernel now assembles the provider-response input object itself. Provider response handling no longer exposes kernel-owned sampling state or step-context binding as separate fields, tightening the turn-state handoff while preserving behavior.

RuntimeTurnKernel now retains the extension stores used by its reducer and binds provider-response RuntimeStepContext extensions through the same kernel. Provider response handling no longer wires extension stores directly, tightening the Codex-style turn-state boundary without changing behavior.

RuntimeTurnKernel now owns the per-sampling request state together with the runtime turn reducer. Provider response handling constructs tool-dispatch state through that kernel before passing it into tool turns, preserving behavior while giving the next Codex-style turn-state consolidation a named boundary.

command/exec/list snapshots now include the backing shellId, taskId, requestedTerminalMode, and effectiveTerminalMode. Reconnecting app-server clients can restore active command/exec display and PTY or pipe semantics with the same task identity used by shell/list.

Server-mode clients can now call command/exec/list to recover active command/exec process handles. The listed snapshots include processId, command, cwd, running status, stream output settings, output cap, and stdout/stderr byte counters, and completed processes are drained out before the next list response.

Server-mode command/exec/read now accepts outputBytesCap. Read requests can tighten the active streaming process output cap before the normal pre-dispatch drain, so bounded polling returns UTF-8-safe deltas with capReached metadata instead of leaking a larger burst.

Server-mode command/exec now accepts command/exec/read for client-driven drains of long-running streaming process handles. The read request acknowledges the active process and reuses the existing outputDelta stream, cap metadata, and completion path.

Server-mode shell/read now accepts outputBytesCap for bounded incremental shell output. stdout/stderr deltas and shell_updated or shell_completed responses are truncated on UTF-8 boundaries and include capReached metadata when the read budget is reached.

Server-mode clients can now query shell/capabilities before starting shell or command/exec PTY work. The response reports the current platform, whether native PTY and PTY resize are available, accepted terminal modes, pipe fallback behavior, and the processId requirement for streaming command/exec sessions.

Bash sandbox recovery now handles pathless macOS sandbox denials such as GitHub HTTPS credential prompts: runtime, JSONL command/exec, and the TUI can ask to re-run the command without the filesystem sandbox after approval. Shell task session state also moves to ORCA_HOME with migration from legacy project .orca/task-sessions directories.

RuntimeSamplingRequestState now records normal tool results and owns the approval-required and subagent-failure terminal folding for single-tool turns. Normal tool execution borrows its permission overlay and records its result through the same request state, leaving tool_turn to delegate without changing user-visible behavior.

RuntimeSamplingRequestState now produces clamped RuntimeToolDispatchWindow values for readonly and subagent batches. Tool turns no longer read raw cursor positions or slice batch windows directly, and a stalled batch collector still advances over the current request instead of risking a stuck dispatch loop.

RuntimeSamplingRequestState now owns the tool-dispatch cursor as well as the per-sampling permission overlay. Tool turns read and advance the current request through sampling state instead of keeping a separate ToolRequestCursor, so Codex-style request-scoped runtime state has one clearer owner without changing tool execution behavior.

RuntimeSamplingRequestState now owns the per-sampling permission overlay. Provider response handling creates the sampling state and tool turns borrow its overlay instead of allocating local permission state, giving the next Codex-style request-state split a concrete home without changing tool behavior.

Runtime turn-loop input construction now lives behind a focused run_agent_turn_loop entrypoint. agent_loop passes a RuntimeAgentTurnLoopInput launch object instead of constructing the wide RuntimeTurnLoopInput directly, leaving runtime_turn_loop as the owner of the internal turn-loop handoff.

RuntimeTurnLoopState now owns the directive-resolved loop policy surface. agent_loop no longer destructures loop state or reads directive accessors directly; lifecycle resolves tool policy, runtime system messages, model override, cost/cancel/task refs, and grouped extension context for each turn-loop iteration.

RuntimeTurnState now hands agent_loop a lifecycle-owned RuntimeTurnLoopState, separating runtime directives from the mutable turn-loop runtime refs. RuntimeTurnLoopInput owns that grouped runtime handoff and derives RuntimeExtensionContext at the iteration boundary, so agent_loop no longer destructures extension registry/thread/turn fields or reconstructs extension context from raw parts.

RuntimeTurnState now exposes the grouped RuntimeExtensionContext boundary and owns the registry/store composition helper used by agent_loop. The loop still passes the same registry, thread store, and turn store into RuntimeTurnLoopInput, but extension-context construction no longer lives directly in the loop body.

Runtime turn-loop, iteration, and provider-cycle inputs now carry one RuntimeExtensionContext instead of parallel extension registry, thread store, and turn store fields. agent_loop creates the grouped context once, and provider turns reuse it when building RuntimeStepContext, preserving lifecycle notifications while narrowing the runtime extension boundary.

RuntimeStepContext and RuntimeNormalToolTurnContext now carry a grouped RuntimeExtensionContext instead of parallel extension registry, thread store, and turn store fields. Provider turns still build the same stores once, while normal tool execution receives the same lifecycle data through a narrower extension boundary.

ToolExecutionContext now carries grouped RuntimeExtensionStores instead of reconstructing them from parallel thread/turn references. Tool lifecycle contributors, goal progress recording, and router dispatch keep the same behavior while the normal tool execution entrypoint has a smaller extension-store API.

Permission-sensitive tool contexts now pass grouped RuntimeExtensionStores instead of parallel thread/turn extension references. RuntimeTurnReducer can be constructed from that grouped store boundary, so request_permissions, bash auto-escalation, router overlay transfer, and direct runtime-tool actor compatibility keep the same behavior while the runtime state API gets smaller.

Permission reduction is now consistently instance-owned by RuntimeTurnReducer. The old static permission reducer accessor is gone, while request_permissions, bash auto-escalation, router overlay transfer, and direct runtime-tool actor calls keep their existing behavior through turn/thread extension stores.

Permission overlay requests and merges now reduce through RuntimeTurnReducer. request_permissions, bash auto-escalation, and router overlay transfer keep the same behavior while permission state mutation leaves the direct call sites.

Runtime directives now reduce through RuntimeTurnReducer. Model switches, allowed-tool replacement, and injected runtime system messages keep the same behavior while RuntimeTurnState no longer writes directive state directly.

RuntimeTurnReducer now owns completed-tool goal progress recording. TUI completed normal tools route through that reducer instead of writing goal progress directly, keeping the live thread extension guard in one runtime-owned state boundary.

Goal terminal updates now consult live runtime thread extension state. TUI turns record completed normal tools into the same goal progress store, and update_goal refuses complete or blocked claims until the live thread has observed real non-goal tool progress.

RuntimeThread now owns the thread-scoped extension store and hands it to each RuntimeTurnState, while every RuntimeThread turn receives a fresh turn extension store id. Goal and future runtime contributors can now keep stable thread-level state across headless, TUI, and server turns without leaking turn-local data.

RuntimeTurnState now owns the default extension registry plus thread and turn extension stores, installs the goal tool lifecycle contributor, and threads that state through the provider/tool turn path into normal tool execution. Goal progress can now observe real normal-tool completions from the live runtime path without changing CLI, TUI, server, JSONL, or goal storage behavior.

ToolExecutionContext can now carry an extension registry plus thread and turn extension stores, and ToolExecutionActor notifies lifecycle contributors around normal tool execution. This makes completed, blocked, aborted, and not-implemented tool outcomes visible at the extension boundary without changing CLI, TUI, server, or JSONL wire behavior.

Orca now has a runtime extension contributor kernel with typed per-scope ExtensionData and ordered tool lifecycle contributors. Goal tool progress has the first real contributor seed, so future goal, memory, task, and tool lifecycle work can move out of the main runtime loop without changing CLI or app-server behavior.

Realtime server item projection now lives behind a shared RuntimeEventProjector reducer. Assistant messages, proposed plans, reasoning, command execution, MCP/dynamic tools, file changes, and workflow lifecycle events keep the same app-server wire shape while ServerRequestWriter no longer owns the projection state maps.

Async subagent worker entrypoints now use grouped AsyncSubagentWorkerInput, AsyncSubagentWorkerContext, AsyncSubagentLaunchContext, and spawn context objects instead of long argument lists or clippy allowances. CLI worker startup, parent async launch, task registry state, worktree handoff, async completion payloads, subagent contracts, and TUI async subagent behavior stay unchanged.

Child-agent runtime constructor inputs now flow through a grouped ChildAgentRuntimeContext instead of a long cwd/events/sink/instructions/memory/MCP/hooks/cancel/lifecycle/executor argument list. Existing orca_runtime::agent_child re-exports remain available, while child-agent loop setup, provider turns, compaction, response folding, tool execution, sync and async subagent contracts, workflow child agents, and TUI child-agent delegation behavior stay unchanged.

Child-agent loop runner inputs now flow through a grouped ChildAgentLoopContext instead of a long request/cwd/instructions/memory/hooks/cost-tracker argument list. Existing orca_runtime::agent_child re-exports remain available, while loop setup, provider turns, compaction, response folding, tool execution, subagent contracts, workflow child agents, and TUI child-agent delegation behavior stay unchanged.

Child-agent prompt entrypoint inputs now flow through a grouped ChildAgentPromptContext instead of a long argument list. Existing orca_runtime::agent_child re-exports remain available, while prompt-to-request construction, model override, child cost tracking, subagent contracts, workflow child agents, and TUI child-agent delegation behavior stay unchanged.

Child-agent public entrypoints now live in a focused child_agent_entrypoints module instead of the agent_child facade. Existing orca_runtime::agent_child imports remain available through re-exports, while model override, child cost tracking, prompt-to-request construction, subagent contracts, workflow child agents, and TUI child-agent delegation behavior stay unchanged.

Child-agent behavior tests now live in a focused child_agent_tests module instead of the agent_child facade. Existing orca_runtime::agent_child imports remain available through re-exports, while child-agent setup, provider turns, response folding, loop running, subagent contracts, and TUI child-agent delegation behavior stay unchanged.

Child-agent request, result, runtime, and executor types now live in a focused child_agent_types module. Existing orca_runtime::agent_child imports remain available through re-exports, while loop setup, provider turns, response folding, loop running, subagent contracts, and TUI child-agent delegation behavior stay unchanged.

Child-agent loop orchestration now lives in a focused child_agent_loop_runner module. Existing orca_runtime::agent_child imports remain available through re-exports, while loop setup, provider turns, response folding, tool-result folding, subagent contracts, and TUI child-agent delegation behavior stay unchanged.

Child-agent provider response folding, tool request extraction, tool execution context, and tool-result folding now live in a focused child_agent_response_folding module. Existing orca_runtime::agent_child imports remain available through re-exports, while child-agent loop orchestration, provider turns, subagent contracts, and TUI child-agent delegation behavior stay unchanged.

Child-agent model routing, provider hook execution, provider call dispatch, child compaction, and prompt-too-long retry/failure handling now live in a focused child_agent_provider_turn module. Existing orca_runtime::agent_child imports remain available through re-exports, while provider response folding, tool request extraction, tool result folding, subagent contracts, and TUI child-agent delegation behavior stay unchanged.

Child-agent loop setup, provider bootstrap, conversation seed, approval policy seed, and child turn-budget state now live in a focused child_agent_loop_setup module. Existing orca_runtime::agent_child imports remain available through re-exports, while child-agent model routing, provider turns, tool folding, subagent contracts, and TUI delegation behavior stay unchanged.

Runtime approval decisions, approval handlers, and config-backed interactive approval handling now live in a focused runtime_approval module. Existing orca_runtime::lifecycle imports remain available through re-exports, while approval policy resolution and interactive approval behavior stay unchanged.

Runtime permission requests now live in a focused runtime_permission module. The existing orca_runtime::lifecycle imports remain available through re-exports, while request_permissions execution and turn permission overlay behavior keep the same runtime shape.

Runtime request_user_input handling now lives in a focused runtime_user_input module. The existing orca_runtime::lifecycle imports remain available through re-exports, while request parsing, handler dispatch, answer completion, and cancellation failure behavior keep the same runtime and TUI shape.

Runtime ORCA_HOME-scoped tests now share a poison-tolerant test environment lock helper. If one test panics while holding the shared environment mutex, later history, server, session, thread-store, and workflow-host tests can recover the lock instead of cascading into misleading PoisonError failures.

Sandbox bash command construction now uses grouped WorkspaceWriteSandboxCommandContext and ReadOnlySandboxCommandContext inputs, with the macOS Seatbelt profile helpers also receiving focused profile contexts. Shell sessions, command/exec, bash sandboxing, network and filesystem policy flags, Unix socket allowlists, and non-interactive process preparation keep the same behavior while the sandbox API no longer exposes long argument lists.

Runtime bash sandbox execution and one-shot shell spawning now use focused RuntimeBashSandboxContext and RuntimeBashOnceContext inputs. The model-visible bash flow still owns permission-profile sandboxing, network and filesystem permission retries, cancellation, task-registry handoff, output truncation, and diagnostics while runtime_bash.rs no longer needs internal long-argument helper escape hatches.

Readonly tool-turn batch execution now lives in a focused runtime_readonly_tool_turn module with grouped readonly batch and tool-turn contexts. The main tool_turn dispatcher still owns request cursoring, child-tool policy checks, subagent batching, readonly batch selection, and normal tool turns while readonly hook gating, parallel execution, and result recording keep the same runtime behavior.

Async subagent worker launch and completion now live in a focused subagent_async_worker module. The parent subagent executor still owns sync and batch execution, while worker spawn, task-registry usage writes, worktree handoff, and async result payloads keep the same CLI and subagent_status behavior.

Server shell-session state now lives in a focused shell_manager module. Optional runtime shell session storage, lazy task-registry-backed initialization, shell CRUD/read/kill/reap/wait calls, and command/exec drain compatibility keep the same server shell protocol shape.

Server pending-permission request state now lives in a focused permission_manager module. Runtime request_permissions waits, command/exec permission retry records, pending request removal, and permission request handler registration keep the same server permission protocol shape.

Server active-turn lifecycle state now lives in a focused active_turn_manager module. Active turn controls, running turn handles, finished-turn reclamation, thread-specific reclaim waits, and session permission metadata merge keep the same server turn protocol shape.

Server command/exec active process state now lives in a focused command_exec_manager module. Buffered output, streaming deltas, stdin writes, PTY resize, termination, output caps, sandbox diagnostics, and permission retry behavior keep the same server protocol shape.

RuntimeToolActorContext now lives in a focused runtime_tool_actor module. Existing orca_runtime::lifecycle imports remain available through a re-export, while approval, hook, user-input, normal-tool, permission-overlay, and active-task behavior keep the same runtime shape.

Runtime lifecycle state machine types now live in a focused runtime_lifecycle module. The existing orca_runtime::lifecycle imports remain available through re-exports, while task/turn ids, status mapping, event payloads, and RuntimeTurnRunner behavior stay unchanged.

Runtime turn setup now lives in a focused runtime_turn_setup module. Agent loop still delegates through RuntimeTurnSetupStep, and the new module owns context budget setup, tool approval policy construction, and provider config composition while lifecycle.rs keeps actor/lifecycle primitives.

Runtime conversation bootstrap now lives in a focused runtime_conversation_bootstrap module. Agent loop still delegates through RuntimeConversationBootstrapStep, and the new module owns RuntimePreparedConversation, borrowed-or-owned conversation storage, session bootstrap composition, and initial history recording while lifecycle.rs keeps actor/lifecycle primitives.

Runtime steer application now lives in a focused runtime_steer module with a grouped RuntimeSteerInput boundary. RuntimeTurnOpeningStep and RuntimeProviderTurnStep still drain pending steer inputs into the conversation and history before the model call, while lifecycle.rs keeps ThreadSteerHandle storage and sheds another reducer slice.

Runtime model-route orchestration now lives in a focused runtime_model_route module with a grouped RuntimeModelRouteInput boundary. RuntimeTurnOpeningStep still composes compaction, turn start, model routing, and steering in the same order, while lifecycle.rs keeps the actor/lifecycle primitives and sheds another reducer slice without adding a new long-argument surface.

Runtime turn-start orchestration now lives in a focused runtime_turn_start module instead of lifecycle.rs. RuntimeTurnOpeningStep still composes compaction, turn start, model routing, and steering in the same order, while lifecycle.rs keeps the actor/lifecycle primitives and sheds another lower-level reducer slice.

Runtime turn-opening orchestration now lives in a focused runtime_turn_opening module with a grouped RuntimeTurnOpeningInput boundary. RuntimeTurnIterationStep still composes opening and provider-cycle execution in the same order, while lifecycle.rs keeps the lower-level start/model-route/steer steps and sheds another reducer-sized layer.

Runtime turn-iteration orchestration now lives in a focused runtime_turn_iteration module instead of lifecycle.rs. The outer runtime_turn_loop still delegates through RuntimeTurnIterationStep, provider-cycle behavior still lives in provider_turn, and lifecycle.rs keeps the opening/start/model-route pieces while getting smaller for the next reducer-style split.

Runtime turn-loop orchestration now lives in a focused runtime_turn_loop module instead of lifecycle.rs. Agent loop still delegates through RuntimeTurnLoopStep with the same grouped input/executor objects and the same iteration retry/return behavior, while lifecycle.rs gets smaller for the next Codex/package-3-inspired reducer split.

Shell-session bash execution now receives one grouped RuntimeBashInvocationContext instead of a long execute_bash_with_shell_session argument list. RuntimeNormalToolExecutor still owns the bash branch, permission overlays, cancellation, output truncation, task registry handoff, and network/filesystem permission retries keep the same behavior, while the bash boundary gets smaller for the next shell/session and async-subagent slices.

Filesystem sandbox denials now recover more clearly across server command/exec and model-visible bash. Orca diagnoses macOS Seatbelt write blocks such as nested .git/index.lock failures, explains when they are sandbox scope issues rather than stale locks, requests a turn-scoped filesystem write grant when an approval handler is available, and retries the original command with the granted root.

Tool-turn dispatch now receives one grouped RuntimeToolTurnsContext from provider response handling instead of a long run_tool_turns call. RuntimeStepContext, events, sink, conversation, history writer, tool requests, cost tracking, background workflow state, and child executors still flow unchanged while the provider-to-tool boundary gets smaller.

Normal tool-turn execution now receives one grouped RuntimeNormalToolTurnContext instead of a long run_normal_tool_turn argument list. Tool execution, approval, result recording, plan-state recording, permission overlays, workflow/background state, and child executor handoff keep the same runtime behavior while the tool-turn boundary gets smaller.

Tool approval gate inputs now move through one grouped ToolApprovalGateContext instead of a long handle_approval argument list. Config, events, sink, tool request, invocation, policy, strict auto-review, and delta emission still flow unchanged, while approval allow/ask/deny behavior and tool-call item emission keep the same public shape.

Historical projected tool completions now rebuild through the shared complete_projected_tool_item helper in tool_item_projection.rs instead of thread_store/projection.rs calling MCP, dynamic, commandExecution, and fileChange completed-item constructors directly. Realtime and persisted history stay behavior-compatible while the remaining tool-item schema drift has one smaller ownership point.

Runtime normal-tool routing now passes a grouped RuntimeNormalToolInvocation from the router into lifecycle actors instead of calling the long roots/cancel method directly. Bash shell-session execution, MCP/external fallback, permission overlays, cancellation, and output truncation keep the same behavior while the common tool path gets a smaller call surface for later shell and async-subagent work.

Normal tool invocation now funnels through one runtime_normal_tool helper instead of letting lifecycle.rs instantiate the executor directly. RuntimeTaskActor and RuntimeToolActorContext still preserve the same bash, MCP, external, cancellation, and permission-overlay behavior, but the next shell-session and async subagent slices have a smaller call surface to build on.

Tool-call argument streaming now reports progress end to end: a new tool.call.progress event and ToolCallProgress provider step flow through runtime and server, and the TUI renders received-bytes progress with cache-friendly updates. Adds an SSE streaming idle-timeout guard and fixes environment-variable proxy configuration and hook-timeout output handling.

The normal-tool fallback path is now injectable through a focused RuntimeNormalToolFallbackExecutor boundary. MCP, TOML external, and built-in tool execution still use the same default orca-tools path, but the runtime can now test fallback context handoff without hardcoding that implementation.

Normal tool execution now lives behind a focused RuntimeNormalToolExecutor boundary. The shell-session bash branch and the MCP/external/built-in fallback path move out of lifecycle.rs, while CLI, TUI, server, workflow, permission, and model-visible tool behavior stay unchanged.

Runtime tool invocation dispatch now lives behind a focused RuntimeToolRouter boundary. ToolExecutionActor keeps invocation prep, approval, hooks, and result finalization, while workflow, subagent, task, permission, workflow IPC, and normal-tool routing move into the router without changing model-visible behavior.

Runtime turn execution now carries cleaner grouped inputs: turn iteration, provider cycle, provider response, and tool turns share request-scoped context boundaries. This Codex/package-3-inspired slice reduces repeated runtime state plumbing while preserving CLI, TUI, server, tool, workflow, and history behavior.

TUI child-agent execution now flows through runtime-owned request construction, model/cost setup, loop orchestration, provider handling, tool request extraction, and tool-result folding while TUI keeps only the interactive tool adapter. This keeps the new reasoning-effort configuration intact across child provider calls.

Reasoning effort is now configurable (high or max, default max) via env vars, config file, and CLI arguments, carried on DeepSeek API requests. The TUI /model command becomes a two-step picker — choose the model, then the reasoning effort — with deferred apply, clean Esc cancellation, and a status bar that shows both.

TUI polish: inline scrolling now detects real overflow via rendered-line-info, keeps auto-follow armed until content actually overflows, fixes CJK-aware wrap heights, moves memory extraction off the render thread, adds a live activity bar, and debounces inertial mouse scroll right after a turn completes.

Runtime-special tool dispatch and small executors now live in a focused runtime_special module, keeping request_permissions, workflow IPC, subagent status, task list/stop, and workflow draft preview behavior intact while shrinking lifecycle.rs.

Server submit-family dispatch now routes through a focused submit processor, preserving legacy submit, thread-bound turns, thread/start, thread/resume, and thread/fork behavior while leaving the generic router as a pure operation-family dispatcher.

Server permission/respond dispatch now routes through a focused permission processor, preserving turn/session grants, strict auto-review, filesystem overlays, and network allow/deny behavior while shrinking the generic router.

Server command/exec dispatch now routes through a focused command-exec processor, preserving buffered, streaming, stdin, resize, terminate, sandbox, and permission-profile behavior while shrinking the generic router.

Server shell-session dispatch now routes through a focused shell processor, preserving shell start, write, update, close, resize, list, read, and kill behavior while shrinking the generic router.

Server turn-control dispatch now routes through a focused turn processor, keeping interrupt, resume, and steer behavior intact while shrinking the generic router.

Synchronous server thread query and metadata operations now route through a focused thread processor, shrinking the generic router while preserving thread/read, list, search, turns, items, and metadata behavior.

Server-mode operation dispatch now lives behind a focused router boundary, preserving every existing wire method while opening the next request-processor refactor path.

Runtime permission requests now share one overlay merge path for file-system grants, network domain grants, and strict auto-review, keeping request_permissions and bash retry behavior aligned.

Model-visible bash now inherits the active permission profile's managed network policy, turns eligible proxy blocks into permission requests, and retries after a turn-scoped network allow.

Streaming command/exec processes now share the managed network permission flow: eligible proxy blocks request a session-scoped allow, then restart the same processId and stream output after the grant.

Command/exec can now turn managed network proxy blocks into a network permission request and retry the command after a session-scoped allow response, while denylist blocks remain final diagnostics.

Managed command/exec network blocks now include the normalized blocked host in proxy diagnostics, giving clients a stable attribution hook for upcoming automatic network permission prompts.

Session-scoped request_permissions network denials now override permission-profile allow entries, so interactive deny decisions can tighten later command/exec proxy policy.

Session-scoped request_permissions network domain grants now persist on server threads and feed command/exec's managed proxy, so later commands inherit interactive allowlist decisions.

Permission-profile Unix socket allowlists now flow into command/exec sandboxing on macOS, allowing configured AF_UNIX socket paths without enabling full network access.

The managed command/exec network proxy now checks resolved socket addresses before connecting, blocking DNS names that resolve to local, private, reserved, or otherwise non-public targets.

The managed command/exec network proxy now blocks local and private IP targets unless they are explicitly allowlisted, matching Codex's local-network guard while keeping allowlisted loopback workflows working.

Permission-profile network blocks now preserve Codex-style proxy reasons, so command/exec clients can distinguish denylist hits from allowlist misses instead of seeing only a generic policy 403.

The TUI conversation session now owns RuntimeThread instead of rebuilding InteractiveSession and RuntimeSessionLifecycle locally, completing the first headless/server/TUI runtime-state convergence pass while preserving TUI behavior.

Headless exec now creates and runs long-lived agent state through RuntimeThread, aligning CLI turns with server-mode ownership while preserving JSONL sequencing, session hooks, history, verifier, and npm behavior.

Server-mode threads now store their long-lived agent state through RuntimeThread, removing duplicated session/lifecycle/executor assembly while preserving thread projection, resume/fork, cancellation, and permission behavior.

RuntimeThread now groups the runtime-owned interactive session and lifecycle state behind one boundary, creating the next convergence point for server, TUI, and headless execution without changing public behavior.

The runtime protocol boundary now uses a small facade backed by focused command_exec, events, permissions, shell, thread, turn, and wire modules, preserving the public protocol API while making the next server dispatch split easier.

ThreadStore now has a focused storage facade backed by separate types, local JSONL, writer, projection, pagination, and live-thread modules, preserving the public runtime API while shrinking the monolithic store file.

Permission-profile network domain policies now run through a managed loopback HTTP proxy for command/exec, so allowed hosts can pass and denied hosts return a policy 403.

Permission-profile filesystem globs now support configurable scan depth through glob_scan_max_depth / globScanMaxDepth, with inherited profile defaults and child-profile overrides.

Permission profiles now expand bounded read/write/read-write filesystem globs into concrete command sandbox roots, keeping Codex-style split filesystem policies usable without weakening broad-glob safety checks.

Runtime compaction now lives in a dedicated module, keeping prompt-budget hooks, summary persistence, and prompt-too-long recovery out of the lifecycle orchestration module.

TUI history splits into native terminal scrollback for settled transcript output and a live bottom viewport for streaming content, plans, input, status, and modal/full-panel states.

Tool-turn execution now lives in a dedicated runtime module, separating provider tool schema/invocation preparation from cursoring, batching, execution, and result folding.

TUI tool approval gating now lives in the runtime interaction adapter, keeping approval request construction, preview generation, and interactive waits out of bridge orchestration.

TUI runtime approval and request-user-input handlers now live in a dedicated interaction adapter module, and the site build includes the server prerender entry used by crawler-visible HTML generation.

TUI runtime event projection now lives in a dedicated module, keeping EventEnvelope-to-TuiEvent mapping and workflow notification prompt shaping out of bridge orchestration.

Persisted edit and write_file history items now project as Codex-style fileChange items, aligning thread-read history with realtime server streams.

Persisted commandExecution history items now use shared projection builders while preserving command metadata placeholders and failed-command diagnostics.

Realtime commandExecution lifecycle items now use shared projection builders, closing another app-server item-shape drift point.

Realtime agent, plan, and reasoning lifecycle items now use shared projection builders, further tightening the app-server protocol boundary.

Realtime fileChange and workflow lifecycle items now use shared projection builders, and the tag release gate runs server-heavy Rust tests serially on CI.

MCP/dynamic completed-item projection is shared across realtime streams and history, and CI stdio MCP fixtures now launch through /bin/sh to avoid Linux ETXTBSY release flakes.

MCP and dynamic tool completed-item construction now uses shared projection builders across realtime streams and persisted history, with failed command projection guarded against output-shape regression.

Realtime streams and persisted history now share MCP and dynamic tool started-item builders, keeping first-class tool-call item shape aligned at creation time.

Realtime and persisted tool item projections now share exit-code error normalization and completed-status checks, reducing the remaining mcpToolCall/dynamicToolCall schema drift.

Realtime server streams and persisted thread projections now share MCP tool parsing, JSON argument parsing, MCP result shaping, and camelCase tool error helpers, with CI JSONL polling hardened for active background turns.

Realtime mcpToolCall and dynamicToolCall item errors now include exitCode when tool completion reports one, keeping server streams aligned with persisted thread item projections.

MCP initialize capabilities are now cached per server, so all-server resource/template discovery skips tools-only servers while explicit server filters still report that server's real error.

MCP resource and template discovery now includes registry-level startup errors in all-server results, so failed MCP servers stay visible alongside healthy resource context.

MCP resource templates are now model-visible through list_mcp_resource_templates, with resources/templates/list wired through stdio/SSE and partial per-server error reporting.

MCP resource discovery now returns available resources even when another server fails, with per-server errors surfaced in the list_mcp_resources result.

MCP resource tools ship with a hardened server-mode JSONL test harness, so noisy child-process output no longer flakes task_stop shell-session release coverage.

MCP resources are now model-visible through read-only list_mcp_resources and read_mcp_resource tools, with stdio/SSE resources/list and resources/read support wired through the shared registry.

Structured hook JSON stdout now validates declared actions and required string fields, so typoed or malformed hook outputs fail visibly instead of being silently injected or ignored.

Tool argument validation now evaluates JSON Schema oneOf and anyOf branches before execution, keeping runtime rejection behavior aligned with advertised provider schemas.

Model-facing file discovery now supports fuzzy path queries through glob mode=fuzzy, while preserving existing glob pattern behavior and list_files compatibility.

Runtime turn orchestration now lives behind lifecycle-owned turn opening, provider cycle, iteration, loop, and loop-input boundaries, shrinking the agent loop entrypoint while preserving behavior.

Claude Code-style workflow parity loop: generated drafts, edit/save/run controls, reusable workflow commands, evidence-bound reports, and process-tree timeout cleanup.

Workflow concurrency control rewrite (Promise.allSettled with fail-fast), structured failure taxonomy (tool/MCP/token/schema), concurrency metrics in evidence bundles, and stress-test coverage.

Workflow evidence bundles with standardized reporting (Markdown + JSON), automatic evidence capture at lifecycle checkpoints, and contract validation tests.

Workflow child task list tools, typed output schemas for subagents, team tool allowlists, durable IPC state, and agent lifecycle observability.

History/session persistence now flows through a dedicated SessionStore boundary, with runtime session/controller call sites aligned to the same entry point.

Shell execution now honors the configurable timeout, with timeout-aware child process waiting shared by bash and external tools.

Workflow agent runs now support worktree isolation, async handle recovery, and continue-on-failure phase fallback in the TUI workflow view.

Bracketed paste support in TUI input; textarea soft-wrap rendering rewritten with accurate height calculation.

Add a reusable real API release gate that verifies provider summary costs, CLI JSONL output, and server-mode streaming before tagging.

Centralize runtime tool invocation records, approval request construction, and hook-modified request validation across built-in, MCP, and external tools.

Add a typed runtime protocol boundary for server submissions and events while preserving the existing flat JSON wire format.

Runtime-owned interactive sessions now centralize conversation, history, instructions, memory, hooks, MCP, cost tracking, and workflow task state before the protocol split.

Workflow DSL and multi-stage runtime overhaul; TUI now shows workflow/task progress, elapsed time, notifications, and clearer approval choices.

Refactor TUI session preloading for clarity; extract goal session ID helper; add unit tests for session restoration and goal control flow.

Drop legacy deepseek-chat / deepseek-reasoner; tool arguments are JSON-Schema validated before any call; TUI text-wrap rewritten for wide chars and ANSI.

Kill the cache-compaction storm: wire-equivalent gating + 60% hysteresis, persist inherited summary state across --continue and --fork.

Update check falls back to npm registry (no rate limit); table rendering rewritten with progressive degradation down to narrow terminals.