Stabilize OpenSim agent runtime and Mentra integration

docs/grid-agent-architecture.md

@@ -31,8 +31,8 @@ observable receivers.
 | Interaction ingress / observations | `InteractionHandle` | 8,192 each hard, lower queue configuration | bounded admission; lifecycle uses nonblocking watch state |
 | Per-avatar interaction FIFO | `InteractionCoordinator` | 4,096 senders / 64 messages each hard, lower `interaction` limits | fair ready queue, one active request per avatar/channel |
 | Interaction inference / outbound | generation tasks and channel rate limiters | 64 concurrent hard; 1,023 bytes per grid part | timeout/cancellation fencing; independent public/IM pacing |
-| LLM request slots | shared `LlmClient` semaphore | 256 hard / configured concurrent requests | async acquire or cancellation |
-| Reasoning/tool session | `ToolLoop` caller | 32 turns / 256 calls hard, with lower configured limits | total timeout, cancellation, or supersession |
+| LLM conversation runtime | avatar-scoped Mentra agent | configured model/tool budgets and 2-minute default wall time | SSE cancellation, compaction, or supersession |
+| Autonomous approval review | fresh volatile Mentra runtime | one model request, no tools/history/memory | exact ALLOW/DENY; every error fails closed |
 | Policy tools / approvals / schedules | `PolicyGateway` mutex | 64 tools / 4,096 approval records / 1,024 scheduler grants hard | deny before opaque authorization |
 | Principal/global resource budget | `PolicyGateway` time window | validated calls, zero L$, upload, inventory, movement, and build ceilings | atomic charge or stable denial |
 | Authorized avatars | immutable `AgentConfig` set | 1,024 hard ceiling, lower configured limit | malformed, nil, duplicate, and wildcard input rejected |
@@ -84,10 +84,10 @@ cleanup, fencing old events and late LLM/tool results. See
   non-forgeable `AuthorizedAction` produced by `PolicyGateway`. Raw calls and
   caller-created decisions are not accepted. This issue supplies no live
   mutation implementation.
-- LLM traffic crosses one exact configured URL through `LlmClient`. Redirects
-  are refused, response bodies are bounded while streaming, bearer secrets are
-  redacted, and provider/model discovery does not exist. Proposed calls cross
-  `ToolExecutor` only after registered-name and schema validation.
+- LLM traffic crosses the configured provider base through Mentra's Responses
+  SSE runtime. MetaCrate supplies only endpoint, credential, model, permitted
+  tools, and run bounds. Proposed calls cross `PolicyToolExecutor` only after
+  Mentra schema handling and MetaCrate's independent policy evaluation.
 - Conversation context is keyed by immutable avatar UUID and either public chat
   or direct IM. Group channels are not representable. The LLM projection can
   retrieve only one exact key, and recovered/untrusted summaries remain user-role
@@ -113,11 +113,12 @@ typed config/events/policy boundaries    live-grid feature boundary
      |                                           |
      +-----------------> libremetaverse-types    +--> libremetaverse::GridClient
 
-avatar session -> bounded ToolLoop -> exact-endpoint LlmClient
+avatar session -> persistent Mentra agent -> Responses SSE / compaction / memory
                        |
                        +-> PolicyToolExecutor -> PolicyGateway
-                                                   |
-                                                   +-> AuthorizedToolBackend
+                               |                   |
+                               |                   +-> AuthorizedToolBackend
+                               +-> one-shot Mentra safety reviewer when required
 ```
 
 The package has no build script or direct native dependency. The focused