Edits. A cascade of nine fuzzy replacers tried in order — simple, line-trimmed, block-anchor, whitespace-normalised, indentation-flexible, escape-normalised, trimmed-boundary, context-aware, multi-occurrence — each a generator of candidate matches, accepted only when unambiguous. BOM and line endings are preserved, a per-path semaphore serialises writes, and the computed unified diff is shown as permission metadata before the write lands.
Model-aware prompting. Nine per-model-family system prompts as .txt files (anthropic, gpt, codex, gemini, kimi, meta, beast, trinity, default) selected by substring match on the model id — and for GPT models the registry swaps edit/write out for apply_patch.
Compaction + pruning. Overflow triggers a hidden compaction agent with all tools denied, fed a serialised transcript with each tool output clipped to 2,000 characters and a preserved-recent budget clamped to 2k–15k tokens. Separately, opt-in pruning walks backwards clearing old tool-result bodies past a 40k-token protection window, never touching skill outputs.
Safety net. A shadow git repo commits the worktree at every step, so revert/unrevert can roll the tree and truncate history to any message. A doom-loop detector fires a permission ask when the last three parts are the identical tool with identical input.