Brief P4: enforce the thinking cap through reasoning_control

Approved 2026-09-17. Evidence is in docs/decisions.md.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

docs/decisions.md

@@ -28,6 +28,7 @@ Approved by the owner on 2026-09-17. One commit each.
 | P1 | Inference contract 6: the `tools` array is fixed per epoch. `find_tool` returns schemas as a tool result and the model calls them through a `call_tool(name, arguments)` meta-tool. Never instruct the model to call an undeclared tool. | M0 (h): adding a tool re-read the whole prompt; undeclared calls were coerced into `write_file`. |
 | P2 | Inference contract 2: the session log stores assistant messages exactly as returned, including `reasoning_content`, and replays them unchanged. Remove the "known risk" about dropped thinking blocks. | M0 (e): Ornith's template keeps every think block. |
 | P3 | Inference contract 7: requests set `return_progress: true`; progress events count as liveness. | M0 (i): otherwise the stream is silent during prefill. |
+| P4 | Inference contract 8: the thinking cap uses `reasoning_control` and the control endpoint. | README b10809. Not yet exercised. |
 
 ## Proposed changes to the design brief
 
@@ -35,7 +36,6 @@ From M0 and the kickoff review. None is applied yet. Each lands as its own commi
 
 | # | Change | Evidence |
 |---|---|---|
-| P4 | Inference contract 8: the thinking cap uses `reasoning_control` and the control endpoint. | README b10809. Not yet exercised. |
 | P5 | Settle the open question: chat-completions with server-side tool parsing. | M0 (b), (c). |
 | P6 | Code constraints: `Decision` lives in `brokerd`, has a private field and does not implement `Deserialize`. `proto` carries a plain `DecisionRecord` for the audit log. | Rust privacy is per crate, and a deserializable type can be built by anyone. |
 | P7 | Inference contract 1: the baseline budget test needs the server's tokenizer, so `make gate` has an offline part and an on-device part (`make verify-device`). | `/tokenize` is a server endpoint. |

docs/design.md

@@ -104,7 +104,10 @@ ordinary outbound networking can reach the whole tailnet and the internet as the
    processing produces events. The timeout is "no bytes for N seconds", never a total-request
    deadline. Progress events count as bytes.
 8. **Runaway control.** Per-turn thinking-token cap, per-turn tool-iteration cap, detection of
-   repeated identical tool calls.
+   repeated identical tool calls. `loopd` enforces the thinking cap: it counts streamed reasoning
+   tokens and ends the block with the server's `reasoning_control` mechanism
+   (`POST /v1/chat/completions/control`, action `reasoning_end`). M2 exercises this on straylight
+   before relying on it.
 9. **Startup self-test.** On boot `loopd` checks: tool-call round trip parses, turn-2 prompt
    processing count shows a cache hit, configured context matches what the server reports.
    It refuses to start if any check fails.