fix: address 8 review issues from merge audit

HIGH:
- heal: re-apply heal_loaded_messages() call in spawn_loop_runner
  (lost during revert of unrelated retry.rs breakage)
- compact_model: add deferred-wiring doc note

MEDIUM:
- inflight: move sequential add into Prepared arm to match parallel
  path — no more spurious add/delete for Immediate outcomes
- context_manager: guard ctx_max == 0 returning None instead of
  computing inf ratio

LOW:
- storm: remove no-op Value round-trip in args normalisation
  (serde_json::Map is already BTreeMap, to_string is canonical)
- storm: document BUILTIN_TOOL_NAMES sync and feature-gated tools
- schema_flatten: add debug_assert for type=object precondition
- scavenge: skip past unmatched brace to avoid O(n²) rescan on
  pathological JSON inputs

Author: Yogthos

src/agent/agent_loop/context_manager.rs

@@ -133,6 +133,16 @@ pub fn decide_after_usage(
             aggressive: false,
         };
     };
+    if ctx_max == 0 {
+        return PostUsageDecision {
+            kind: PostUsageDecisionKind::None,
+            prompt_tokens,
+            ctx_max,
+            ratio: 0.0,
+            tail_budget: None,
+            aggressive: false,
+        };
+    }
     let ratio = prompt_tokens as f64 / ctx_max as f64;
 
     if ratio > FORCE_SUMMARY_THRESHOLD {
@@ -270,10 +280,10 @@ mod tests {
 
     #[test]
     fn zero_ctx_max_handled_gracefully() {
-        // ratio would be infinity, but comparison still works
+        // ctx_max == 0 is degenerate (unknown model, config error).
+        // Guard returns None rather than computing inf/NaN ratio.
         let d = decide_after_usage(Some(1000), 0, false);
-        // ratio > FORCE_SUMMARY_THRESHOLD → ExitWithSummary
-        assert_eq!(d.kind, PostUsageDecisionKind::ExitWithSummary);
+        assert_eq!(d.kind, PostUsageDecisionKind::None);
     }
 
     // ============================================================

src/agent/agent_loop/integration.rs

@@ -67,6 +67,7 @@ use tokio::task::JoinHandle;
 use crate::event::AgentEvent;
 
 use super::bridge::EventBridge;
+use super::heal;
 use super::message::{LoopMessage, UserMessage};
 use super::run::run_agent_loop;
 use super::steering::steering_from_queue;
@@ -435,7 +436,7 @@ pub fn spawn_loop_runner(cfg: LoopSpawnConfig) -> LoopRunner {
         }
     }
 
-    let context = Context {
+    let mut context = Context {
         system_prompt: cfg.system_prompt,
         messages: cfg.history.iter().map(loop_message_to_value).collect(),
         tools: cfg.tools,
@@ -454,6 +455,22 @@ pub fn spawn_loop_runner(cfg: LoopSpawnConfig) -> LoopRunner {
         let event_tx_inner = event_tx.clone();
         let signal_inner = signal_for_task.clone();
 
+        // Heal messages loaded from disk before the first LLM call.
+        // Shrinks oversized tool results and drops unpaired tool
+        // calls that would otherwise 400 the next API request.
+        let heal_result =
+            heal::heal_loaded_messages(&context.messages, heal::DEFAULT_MAX_RESULT_CHARS);
+        if heal_result.healed_count > 0 {
+            tracing::info!(
+                target: "dirge::agent_loop",
+                healed = %heal_result.healed_count,
+                chars_saved = %heal_result.chars_saved,
+                "healed {} message(s) after session restore",
+                heal_result.healed_count,
+            );
+            context.messages = heal_result.messages;
+        }
+
         // Code-review bug #4 fix: run the loop AND the
         // translation pump in the SAME outer task via
         // `tokio::join!`. The earlier version spawned the loop

src/agent/agent_loop/scavenge.rs

@@ -234,6 +234,7 @@ fn iterate_json_objects(text: &str) -> Vec<String> {
                 }
             }
         }
+        // Unmatched brace — skip past it to avoid O(n²) rescan.
         i += 1;
     }
     out

src/agent/agent_loop/schema_flatten.rs

@@ -40,6 +40,10 @@ pub fn analyze_schema(schema: &Value) -> FlattenDecision {
 ///
 /// Returns the input unchanged if it's not a deep/wide schema.
 pub fn flatten_schema(schema: &Value) -> Value {
+    debug_assert!(
+        schema.get("type").and_then(|v| v.as_str()) == Some("object"),
+        "flatten_schema precondition: root schema must have type=object"
+    );
     let mut flat_props = serde_json::Map::new();
     let mut required: Vec<String> = Vec::new();
     collect("", schema, &mut flat_props, &mut required, true);

src/agent/agent_loop/storm.rs

@@ -109,10 +109,11 @@ impl StormBreaker {
                 return StormVerdict::pass();
             }
         }
-        let args_str = serde_json::to_string(&call.arguments).unwrap_or_default();
-        let args = serde_json::from_str::<serde_json::Value>(&args_str)
-            .and_then(|v| serde_json::to_string(&v))
-            .unwrap_or(args_str);
+        // serde_json::Map is a BTreeMap — key order is already
+        // canonical. to_string produces compact form so integer/
+        // float differences (1 vs 1.0) are handled by serde's
+        // number serialisation.
+        let args = serde_json::to_string(&call.arguments).unwrap_or_default();
 
         let mutating = self.is_mutating.as_ref().map(|f| f(call)).unwrap_or(false);
         let read_only = !mutating;
@@ -194,6 +195,7 @@ impl StormBreaker {
 }
 
 /// Built-in mutating tools: calls that change filesystem state.
+/// Kept in sync with `crate::agent::tools::BUILTIN_TOOL_NAMES`.
 fn default_mutating(call: &ToolCall) -> bool {
     matches!(
         call.name.as_str(),
@@ -203,6 +205,10 @@ fn default_mutating(call: &ToolCall) -> bool {
 
 /// Built-in storm-exempt tools: cheap inspectors that should never
 /// trip the repeat-loop guard regardless of repetition count.
+/// Kept in sync with `crate::agent::tools::BUILTIN_TOOL_NAMES`.
+/// `find_callers` / `find_callees` are behind `#[cfg(feature = "semantic")]`
+/// but listing them here is harmless — the match simply won't fire
+/// when the feature is off.
 fn default_exempt(call: &ToolCall) -> bool {
     matches!(
         call.name.as_str(),

src/agent/agent_loop/tools.rs

@@ -113,9 +113,6 @@ pub async fn execute_tool_calls_sequential(
             })
             .await;
 
-        // Inflight: add at dispatch entry. Idempotent.
-        inflight.add(&tool_call.id);
-
         // 2. prepare
         let prepared =
             prepare_tool_call(context, assistant_message, tool_call, config, signal).await;
@@ -128,6 +125,8 @@ pub async fn execute_tool_calls_sequential(
                 is_error,
             },
             PrepareOutcome::Prepared { tool, args } => {
+                // Inflight: add now that we know the tool will actually run.
+                inflight.add(&tool_call.id);
                 let executed =
                     execute_prepared_tool_call(&tool, tool_call, &args, signal, emit).await;
                 finalize_executed_tool_call(

src/agent/agent_loop/types.rs

@@ -281,6 +281,11 @@ pub struct LoopConfig {
     /// truncation). When `Some`, summarisation and related tasks
     /// use this model instead of the session model. Reasonix uses
     /// `deepseek-v4-flash` for all auxiliary work.
+    ///
+    /// **Status**: deferred. Wiring requires a second `StreamFn`
+    /// constructed from a separate model + provider, which needs
+    /// `LoopSpawnConfig` / `provider.rs` plumbing. Until then this
+    /// field is accepted but not acted on.
     pub compact_model: Option<String>,
 }