Prompt economy: measure the prompt, and errors that name an alternative

[andreasronge]

Two slices, one commit each. Neither changes a word of the system prompt: the measuring instrument lands independently of the thing it will be used to measure.

Slice A — feat(prompt): measure the prompt

priv/preludes/kernel/agent.prompt.clj renders the system prompt every agent gets, and it is the one authored surface in the tree with no authoring budget. Runtime limits (max_transcript_chars) bound one run, not the source. PR #1310 grew the instruction text twice — including the time it was repaired by deleting a clause — because there was nothing to measure with.

New pure prelude prompt.audit, all functions taking a string:

• segments — the ordered emission segments (marker, protocol, language, examples, api-heading, api-notes, api-legend, api-entries); joining them reproduces the input exactly.
• measure — {"rows" [...] "recognised?" bool}, one row per segment plus derived authored, dynamic, total.
• delta — per-segment character change between two renderings.

Because the input is a string, one implementation serves the REPL reading a recorded run, the tests guarding the committed artifacts, and the gate.

Recognition fails closed. Manifest text reaches the prompt unescaped, so a docstring that reproduces an anchor, a duplicated API notes heading, or an entry list truncated by even one character all yield a single unrecognised segment rather than a guess.

The gate reads total, not authored, on a pinned canonical fixture that renders all eight segments. authored would not move when render-entry grows — exactly the change the gate exists to catch. The ceiling is stated with its reason in the test; raising it is allowed, raising it silently is not.

Two corrections to the plan's own reckoning:

• It listed 12 files for the inspection-analysis-v2 → v3 bump. Re-deriving the list by repository search found 16, of which 13 needed changing — analysis_session_builder.ex was missing from the plan. The other three are docs/plans/* historical records, left at v2 rather than rewritten.
• AnalysisResources was the silent one, as predicted: it pattern-matches the profile ID as a module-attribute literal, so a missed bump fails every v3 capture with :invalid_analysis_resources.

Slice B — fix(lisp): name an alternative in lookup errors

Given a failed name lookup, take the highest rung reachable: name one alternative verified to exist, list the bounded set the name came from, or point at search. The first two cost the model no turns and the third costs one, and no rung may print a name that was not resolved first.

The plan's premise needed correcting. It places three of the six sites in format_closure_error/1. Bare symbols never reach it — check_undefined_var_candidates/2 intercepts every statically visible undefined name before evaluation. The hint ladder was effectively dead code for the model-facing case: map_indexed produced a bare Undefined variable: map_indexed with no hint at all. Fixing only format_closure_error would have produced no observable change. The ladder now lives in one function both producers call.

Site	Before	After
Unresolved bare name	Undefined variable: x	points at (apropos "x") and states it searches prelude exports — not builtins, lexical bindings, or earlier definitions
Underscore names	rewrote any foo_bar → foo-bar unverified	hyphenated candidate looked up in Env.initial/0 and suggested only when it resolves, then the verified fuzzy match, then the convention with no name asserted
Unsupported Java class	named the class and stopped	lists admitted class names from the distinct class_ids of Surface.references/0 — not class_spellings/0, which carries inventory-only classes and constructor spellings like "java.util.Date."
Java arity (analysis path)	Java reference integer_parse_int expects arity [1]	names a canonical admitted spelling and the accepted arities; a field called as a function is named as a field rather than reported as accepting an empty arity
Receiver mismatch	unsupported Java member for receiver class	names the member; the receiver profile stays structured detail, since :unsupported is not a type the model could act on
@clojure_alternatives	import denied because there is "no Java interop"	corrected; refer, defmacro, eval, read-string added

The format, re-find and re-seq entries are deleted: all three are builtins, so the entries were unreachable and asserted that three available functions were unavailable — and the re-find entry offered grep, which has never existed in this dialect. A test now holds both halves of the invariant: every key is genuinely unbound, and every name the hints offer resolves.

Authority refusals keep the carve-out — listing the tools a caller does hold is fine and already happens; listing what a denial hides is not. Asserted per clause, not as a blanket rule.

The rollback statement went into agent.feedback rather than any evaluator condition: only one of the three failure paths carries details.message, so a sentence written into a condition would reach the model on one path in three. Added to all three with an integration test each.

Codex review

Three rounds, the cap agreed for this work. Every round found something real.

Round	Findings	Outcome
1	1 × P1, 4 × P2	4 fixed, 1 declined
2	2 × P2	both fixed
3	1 × P2	fixed

Round 1's P1 was a correctness bug I had misfiled as the documented residual: a namespace docstring containing a blank line ended api-notes early and counted the remainder — manifest text — as authored. That is categorically worse than the residual, which only misattributes in the approximate direction. The notes segment now ends at the last blank line before the legend, which fixes it without the literal-matching the plan explicitly rejected.

Round 3's finding was the sharpest: line counting used a regex, and the regex runtime truncates its input at 32,768 bytes and undercounts silently rather than failing. The round-2 test sat at 32,229 bytes — just under. Line counting now uses sequence functions, bounded by neither that limit nor the 1,000-iteration loop cap, and the test counts lines outside the runtime so an undercount fails instead of rounding down into a plausible number. Verified by reverting the implementation: the test fails 1275 vs 2053.

One finding was declined: naming the member in the runtime Java arity path. Codex is factually right that details.reference_id is available there, but the plan scopes runtime arity out in writing — naming accepted arities needs overload lookup plus receiver-inclusive arity normalisation. Recorded as a residual, with the note that the member name is separable from the arity work.

The last fix landed after the third round, so it carries mix precommit and a reverted-implementation check rather than a fourth review.

Documented residual

Recognition does not fully fail closed. The optional tool-envelope sentence is not validated, so arbitrary text inserted immediately before the map-type legend preserves every anchor, the ordering and the rejoin invariant, and is accepted as part of api-legend. Reaching that state requires a manifest whose namespace docstrings end exactly at that position.

Recorded rather than fixed because it cannot move the gated number: the gate reads total on a pinned fixture, and segment attribution does not enter that measurement. It can only mislead the reporting rows, which are already documented as approximate. Closing it would mean validating that span as exactly either the 82- or 254-character form — cheap, but it reintroduces literal-matching into the parser for a reporting-only benefit, which is the trade this plan already made once in the other direction.

Verification

mix precommit green: format, compile, cycles, stable-CLI callers, credo (no issues), duplication (new=0), spec validation 100%, generated-artifact staleness, and the root, Viewer and launcher suites. No new :e2e tests — neither slice reaches a provider.