Tool calling + recursion seems to be the answer. Two tools are for manipulating the logical call stack - call/return. The trick is to not permit use of any meaningful tools at the root of recursion, but to always make their descriptions available. For instance, the root can't QueryWidgets or ExecuteShell, but any descendant of it can.

These constraints result in token-hungry activity being confined to child scopes that are fully isolated from their parents. The only way to communicate between stack frames is by way of the arguments to call() and return(). Theoretically, recursive dispatch gives us exponential scaling of effective context size as we descend into the call graph. It also helps to isolate bad trips and potentially learn from them.