Follow-up to #597: sync the compaction-rework delta spec into the
canonical netclaw-session spec and move the change directory to the
archive. Consolidates the stale 2026-03-25 refactor-llm-session-actor
delta fragment for "Conversation compaction" into the canonical
requirement — that fragment had been sitting un-merged since the earlier
refactor change was archived, and this rewrite supersedes its content.
"Decoupled immutable session state" fragment from the same archive is
left alone (unrelated to compaction work).

Stacks on the compaction-rework change (merged as #597). Adds a
`WorkingContext` field to `SessionState` that tracks recent files the
agent has read/written/edited, survives compaction, actor recovery,
and daemon restart without depending on the observer LLM to
reconstruct it.

This introduces a new tier of session state that sits parallel to
existing tiers:

- Skills: stateless how-to reference (already exists)
- Memory: cross-session facts (already exists, via memory store)
- WorkingContext: in-session mutable state (new)
- Conversation: turn history (already exists)

`WorkingContext` carries a single field: `RecentFiles` — a bounded
ring buffer of 10 file paths, most-recent-first, deduped on repeat
access. Updated automatically by `LlmSessionActor` when a path-taking
tool (file_read, file_write, file_edit, etc.) completes. The path is
extracted from the tool call's `ArgumentsJson` via
`WorkingContextUpdater.TryExtractFilePath` which probes well-known
JSON field names (`path`, `file_path`, `filePath`, `file`, `filename`,
`fileName`) — no tool-name allowlist, so first-party tools and MCP
filesystem tools participate automatically.

Security: `AddRecentFile` rejects paths containing control characters
(newline, carriage return, null byte). Without this, an attacker-
crafted path containing a literal newline would break out of the
`recent_files:` section in the `[working-context]` block and inject
arbitrary content into the LLM's system prompt. Rejected paths are
silently dropped at the earliest point in the ingestion pipeline.

Injection: `WorkingContext` is emitted as a `[working-context]` block
via `InjectDynamicContextLayers` on every LLM call when non-empty,
adjacent to the existing `[session]` block. Suppressed entirely when
`WorkingContext.IsEmpty` so the model doesn't see a barren header.

Explicitly NOT in this change:
- OpenGoals / ProgressMarkers fields and the observer-output parser
  that would populate them — deferred per "no hypothetical future
  requirements" rule. Can be added in a follow-up change when the
  parser lands.
- CurrentWorkingDirectory / ActiveProjectPath — GitHub #595.
- Authoritative CWD for path-taking tools — GitHub #596.

Journal compatibility: `WorkingContext` is a new optional field on
`SessionSnapshot` (ProtoMember 6) and `SessionCompacted` (ProtoMember
7). ProtoMember 5/6 respectively are reserved holes — formerly
`CompactionBoundaryIndex`, removed before compaction-rework merged.
Old snapshots and events without the field deserialize to
`WorkingContext.Empty` via `SessionState.FromSnapshot` /
`Apply(SessionCompacted)`.

Precedent: Cline's `TaskState.currentFocusChainChecklist` in
`src/core/task/focus-chain/` is the closest comparable pattern — a
persistent markdown todo list tracked on disk, re-attached to every
LLM call, explicitly protected from re-summarization. `WorkingContext`
is the Netclaw equivalent, stored on `SessionState` rather than a
standalone file.

Tests: 933/933 pass (+11 new). Slopwatch clean (SW003 on the
JsonException catch is explicitly ignored via inline directive with
justification — LLM-generated tool args can be malformed and "no
path tracked" is the correct handling).

Refs Aaronontheweb/netclaw#595, Aaronontheweb/netclaw#596

Stacks on the compaction-rework change (merged as #597). Adds a
`WorkingContext` field to `SessionState` that tracks recent files the
agent has read/written/edited, survives compaction, actor recovery,
and daemon restart without depending on the observer LLM to
reconstruct it.

This introduces a new tier of session state that sits parallel to
existing tiers:

- Skills: stateless how-to reference (already exists)
- Memory: cross-session facts (already exists, via memory store)
- WorkingContext: in-session mutable state (new)
- Conversation: turn history (already exists)

`WorkingContext` carries a single field: `RecentFiles` — a bounded
ring buffer of 10 file paths, most-recent-first, deduped on repeat
access. Updated automatically by `LlmSessionActor` when a path-taking
tool (file_read, file_write, file_edit, etc.) completes. The path is
extracted from the tool call's `ArgumentsJson` via
`WorkingContextUpdater.TryExtractFilePath` which probes well-known
JSON field names (`path`, `file_path`, `filePath`, `file`, `filename`,
`fileName`) — no tool-name allowlist, so first-party tools and MCP
filesystem tools participate automatically.

Security: `AddRecentFile` rejects paths containing control characters
(newline, carriage return, null byte). Without this, an attacker-
crafted path containing a literal newline would break out of the
`recent_files:` section in the `[working-context]` block and inject
arbitrary content into the LLM's system prompt. Rejected paths are
silently dropped at the earliest point in the ingestion pipeline.

Injection: `WorkingContext` is emitted as a `[working-context]` block
via `InjectDynamicContextLayers` on every LLM call when non-empty,
adjacent to the existing `[session]` block. Suppressed entirely when
`WorkingContext.IsEmpty` so the model doesn't see a barren header.

Explicitly NOT in this change:
- OpenGoals / ProgressMarkers fields and the observer-output parser
  that would populate them — deferred per "no hypothetical future
  requirements" rule. Can be added in a follow-up change when the
  parser lands.
- CurrentWorkingDirectory / ActiveProjectPath — GitHub #595.
- Authoritative CWD for path-taking tools — GitHub #596.

Journal compatibility: `WorkingContext` is a new optional field on
`SessionSnapshot` (ProtoMember 6) and `SessionCompacted` (ProtoMember
7). ProtoMember 5/6 respectively are reserved holes — formerly
`CompactionBoundaryIndex`, removed before compaction-rework merged.
Old snapshots and events without the field deserialize to
`WorkingContext.Empty` via `SessionState.FromSnapshot` /
`Apply(SessionCompacted)`.

Precedent: Cline's `TaskState.currentFocusChainChecklist` in
`src/core/task/focus-chain/` is the closest comparable pattern — a
persistent markdown todo list tracked on disk, re-attached to every
LLM call, explicitly protected from re-summarization. `WorkingContext`
is the Netclaw equivalent, stored on `SessionState` rather than a
standalone file.

Tests: 933/933 pass (+11 new). Slopwatch clean (SW003 on the
JsonException catch is explicitly ignored via inline directive with
justification — LLM-generated tool args can be malformed and "no
path tracked" is the correct handling).

Refs Aaronontheweb/netclaw#595, Aaronontheweb/netclaw#596

Stacks on the compaction-rework change (merged as #597). Adds a
`WorkingContext` field to `SessionState` that tracks recent files the
agent has read/written/edited, survives compaction, actor recovery,
and daemon restart without depending on the observer LLM to
reconstruct it.

This introduces a new tier of session state that sits parallel to
existing tiers:

- Skills: stateless how-to reference (already exists)
- Memory: cross-session facts (already exists, via memory store)
- WorkingContext: in-session mutable state (new)
- Conversation: turn history (already exists)

`WorkingContext` carries a single field: `RecentFiles` — a bounded
ring buffer of 10 file paths, most-recent-first, deduped on repeat
access. Updated automatically by `LlmSessionActor` when a path-taking
tool (file_read, file_write, file_edit, etc.) completes. The path is
extracted from the tool call's `ArgumentsJson` via
`WorkingContextUpdater.TryExtractFilePath` which probes well-known
JSON field names (`path`, `file_path`, `filePath`, `file`, `filename`,
`fileName`) — no tool-name allowlist, so first-party tools and MCP
filesystem tools participate automatically.

Security: `AddRecentFile` rejects paths containing control characters
(newline, carriage return, null byte). Without this, an attacker-
crafted path containing a literal newline would break out of the
`recent_files:` section in the `[working-context]` block and inject
arbitrary content into the LLM's system prompt. Rejected paths are
silently dropped at the earliest point in the ingestion pipeline.

Injection: `WorkingContext` is emitted as a `[working-context]` block
via `InjectDynamicContextLayers` on every LLM call when non-empty,
adjacent to the existing `[session]` block. Suppressed entirely when
`WorkingContext.IsEmpty` so the model doesn't see a barren header.

Explicitly NOT in this change:
- OpenGoals / ProgressMarkers fields and the observer-output parser
  that would populate them — deferred per "no hypothetical future
  requirements" rule. Can be added in a follow-up change when the
  parser lands.
- CurrentWorkingDirectory / ActiveProjectPath — GitHub #595.
- Authoritative CWD for path-taking tools — GitHub #596.

Journal compatibility: `WorkingContext` is a new optional field on
`SessionSnapshot` (ProtoMember 6) and `SessionCompacted` (ProtoMember
7). ProtoMember 5/6 respectively are reserved holes — formerly
`CompactionBoundaryIndex`, removed before compaction-rework merged.
Old snapshots and events without the field deserialize to
`WorkingContext.Empty` via `SessionState.FromSnapshot` /
`Apply(SessionCompacted)`.

Precedent: Cline's `TaskState.currentFocusChainChecklist` in
`src/core/task/focus-chain/` is the closest comparable pattern — a
persistent markdown todo list tracked on disk, re-attached to every
LLM call, explicitly protected from re-summarization. `WorkingContext`
is the Netclaw equivalent, stored on `SessionState` rather than a
standalone file.

Tests: 933/933 pass (+11 new). Slopwatch clean (SW003 on the
JsonException catch is explicitly ignored via inline directive with
justification — LLM-generated tool args can be malformed and "no
path tracked" is the correct handling).

Refs Aaronontheweb/netclaw#595, Aaronontheweb/netclaw#596

* feat(sessions): durable WorkingContext grounding

Stacks on the compaction-rework change (merged as #597). Adds a
`WorkingContext` field to `SessionState` that tracks recent files the
agent has read/written/edited, survives compaction, actor recovery,
and daemon restart without depending on the observer LLM to
reconstruct it.

This introduces a new tier of session state that sits parallel to
existing tiers:

- Skills: stateless how-to reference (already exists)
- Memory: cross-session facts (already exists, via memory store)
- WorkingContext: in-session mutable state (new)
- Conversation: turn history (already exists)

`WorkingContext` carries a single field: `RecentFiles` — a bounded
ring buffer of 10 file paths, most-recent-first, deduped on repeat
access. Updated automatically by `LlmSessionActor` when a path-taking
tool (file_read, file_write, file_edit, etc.) completes. The path is
extracted from the tool call's `ArgumentsJson` via
`WorkingContextUpdater.TryExtractFilePath` which probes well-known
JSON field names (`path`, `file_path`, `filePath`, `file`, `filename`,
`fileName`) — no tool-name allowlist, so first-party tools and MCP
filesystem tools participate automatically.

Security: `AddRecentFile` rejects paths containing control characters
(newline, carriage return, null byte). Without this, an attacker-
crafted path containing a literal newline would break out of the
`recent_files:` section in the `[working-context]` block and inject
arbitrary content into the LLM's system prompt. Rejected paths are
silently dropped at the earliest point in the ingestion pipeline.

Injection: `WorkingContext` is emitted as a `[working-context]` block
via `InjectDynamicContextLayers` on every LLM call when non-empty,
adjacent to the existing `[session]` block. Suppressed entirely when
`WorkingContext.IsEmpty` so the model doesn't see a barren header.

Explicitly NOT in this change:
- OpenGoals / ProgressMarkers fields and the observer-output parser
  that would populate them — deferred per "no hypothetical future
  requirements" rule. Can be added in a follow-up change when the
  parser lands.
- CurrentWorkingDirectory / ActiveProjectPath — GitHub #595.
- Authoritative CWD for path-taking tools — GitHub #596.

Journal compatibility: `WorkingContext` is a new optional field on
`SessionSnapshot` (ProtoMember 6) and `SessionCompacted` (ProtoMember
7). ProtoMember 5/6 respectively are reserved holes — formerly
`CompactionBoundaryIndex`, removed before compaction-rework merged.
Old snapshots and events without the field deserialize to
`WorkingContext.Empty` via `SessionState.FromSnapshot` /
`Apply(SessionCompacted)`.

Precedent: Cline's `TaskState.currentFocusChainChecklist` in
`src/core/task/focus-chain/` is the closest comparable pattern — a
persistent markdown todo list tracked on disk, re-attached to every
LLM call, explicitly protected from re-summarization. `WorkingContext`
is the Netclaw equivalent, stored on `SessionState` rather than a
standalone file.

Tests: 933/933 pass (+11 new). Slopwatch clean (SW003 on the
JsonException catch is explicitly ignored via inline directive with
justification — LLM-generated tool args can be malformed and "no
path tracked" is the correct handling).

Refs Aaronontheweb/netclaw#595, Aaronontheweb/netclaw#596

* feat(sessions): observability + compaction-pipeline integration test for WorkingContext

WorkingContextUpdater now takes an optional ILoggingAdapter and emits debug
logs for both tracked files and schema-drift (tool call had string-valued
arguments but none of the probed field names matched). Operators hunting
"why isn't this file in [working-context]" get a concrete signal in debug
logs.

Adds an end-to-end integration test that drives a file_read tool call
through the real compaction pipeline (3 turns: populate → compact → probe)
and verifies the [working-context] block still contains src/Rect.cs after
compaction. This exercises WorkingContextUpdater, the SessionCompacted
event path, and InjectDynamicContextLayers together — not just direct
Apply() on an in-memory state.

Refs #600 (sub-agent gap discovered during this work).