@frockbot/plugin-shell 0.3.11 → 0.3.13

package/src/run-failure-copy.test.ts

@@ -0,0 +1,150 @@
+import { describe, expect, test } from "bun:test";
+import type { SessionEvent } from "@frockbot/kernel-contracts";
+import { MODEL_FIRST_BYTE_DEADLINE_REASON_V1 } from "@frockbot/kernel-contracts";
+import {
+  knownFailureCopyV1,
+  RUN_FAILURE_COPY_V1,
+  RUN_FAILURE_FALLBACK_COPY_V1,
+  runFailureCopyV1,
+  USER_FACING_FAILURE_REASONS_V1,
+} from "./run-failure-copy.js";
+import { initializeBotSettingsV1 } from "@frockbot/configuration-core";
+import type { StoredRun } from "./backend-contracts.js";
+import { projectClientRunV1 } from "./run-protocol.js";
+
+/**
+ * Words that describe the machine. Every one of them reached a chat bubble
+ * before this: the verification run read "Reconciliation was explicitly
+ * abandoned: Bot turn ended with outcome model-error: Flock AI keeps no durable
+ * copy of an interrupted response, so it cannot be recovered".
+ */
+const FORBIDDEN_V1 = [
+  "reconcil",
+  "outcome",
+  "durable",
+  "supersede",
+  "admission",
+  "provider",
+  "model-error",
+  "tool-error",
+  "turn/end",
+  "session event",
+  "run id",
+  "runid",
+];
+
+function assertPlainV1(copy: string): void {
+  const lowered = copy.toLowerCase();
+  for (const word of FORBIDDEN_V1) {
+    expect(lowered.includes(word)).toBe(false);
+  }
+  // A bare " run " is jargon; "running" and the like are not, so the check is
+  // on the word rather than the substring.
+  expect(/\brun(s|id)?\b/.test(lowered)).toBe(false);
+}
+
+const TIMESTAMP = "2026-09-04T00:00:00.000Z";
+let seq = 0;
+const turnEnd = (outcome: string) =>
+  ({
+    type: "turn/end",
+    turn: 1,
+    outcome,
+    seq: (seq += 1),
+    timestamp: TIMESTAMP,
+  }) as unknown as SessionEvent;
+
+function failedRun(failure: string, events: SessionEvent[]): StoredRun {
+  return {
+    runId: "run-1",
+    commandFingerprint: "fingerprint",
+    sessionId: "user:primary",
+    acceptedAt: TIMESTAMP,
+    input: "make me an applet",
+    events,
+    effectAdmissions: [],
+    status: "failed",
+    phase: "executing",
+    compositionGenerationId: "test-composition-generation",
+    configurationSnapshot: initializeBotSettingsV1("primary"),
+    previousEventCount: 0,
+    failure,
+  };
+}
+
+describe("runFailureCopyV1", () => {
+  test("every mapped sentence is written for a person", () => {
+    for (const copy of Object.values(RUN_FAILURE_COPY_V1)) assertPlainV1(copy);
+    assertPlainV1(RUN_FAILURE_FALLBACK_COPY_V1);
+    for (const reason of USER_FACING_FAILURE_REASONS_V1) assertPlainV1(reason);
+  });
+
+  test("the stored diagnostic never reaches the copy", () => {
+    const failure =
+      "Reconciliation was explicitly abandoned: Bot turn ended with outcome model-error: Flock AI keeps no durable copy of an interrupted response, so it cannot be recovered";
+    const copy = runFailureCopyV1({
+      failure,
+      events: [turnEnd("interrupted")],
+    });
+    expect(copy).toBe(RUN_FAILURE_COPY_V1.interrupted);
+    assertPlainV1(copy);
+  });
+
+  test("a kernel sentence written for a person survives its wrapper", () => {
+    const copy = runFailureCopyV1({
+      failure: `Model request "abc" has no durable provider outcome: Model response outcome is uncertain: ${MODEL_FIRST_BYTE_DEADLINE_REASON_V1}`,
+      events: [turnEnd("interrupted")],
+    });
+    expect(copy).toBe(MODEL_FIRST_BYTE_DEADLINE_REASON_V1);
+  });
+
+  test("a Turn with no terminal event still says something plain", () => {
+    expect(runFailureCopyV1({ failure: "boom" })).toBe(
+      RUN_FAILURE_FALLBACK_COPY_V1,
+    );
+  });
+
+  // The client's own guard, because a `ClientRun` can arrive from an older
+  // backend that forwarded the raw diagnostic, and the thread must not render
+  // a provider's words as though the Bot said them.
+  test("the thread accepts only sentences the product wrote", () => {
+    for (const written of [
+      ...Object.values(RUN_FAILURE_COPY_V1),
+      ...USER_FACING_FAILURE_REASONS_V1,
+    ]) {
+      expect(knownFailureCopyV1(written)).toBe(written);
+    }
+    for (const diagnostic of [
+      undefined,
+      "",
+      "Provider reconciliation is required",
+      "Bot turn ended with outcome model-error: Model request failed (401)",
+      'Skill "bot/no-such-skill" is unknown',
+    ]) {
+      const copy = knownFailureCopyV1(diagnostic);
+      expect(copy).toBe(RUN_FAILURE_FALLBACK_COPY_V1);
+      assertPlainV1(copy);
+    }
+  });
+
+  test("the projection sends the copy, not the diagnostic", () => {
+    const projected = projectClientRunV1(
+      failedRun(
+        "Reconciliation was explicitly abandoned: Bot turn ended with outcome model-error",
+        [
+          {
+            type: "turn/start",
+            turn: 1,
+            seq: (seq += 1),
+            timestamp: TIMESTAMP,
+          } as unknown as SessionEvent,
+          turnEnd("interrupted"),
+        ],
+      ),
+    );
+    expect(projected.outcome?.type).toBe("failed");
+    if (projected.outcome?.type !== "failed") throw new Error("unreachable");
+    assertPlainV1(projected.outcome.message);
+    expect(projected.outcome.message).toBe(RUN_FAILURE_COPY_V1.interrupted);
+  });
+});

package/src/run-failure-copy.ts

@@ -0,0 +1,110 @@
+import type { SessionEvent, TurnOutcome } from "@frockbot/kernel-contracts";
+import {
+  MODEL_FIRST_BYTE_DEADLINE_REASON_V1,
+  MODEL_IDLE_DEADLINE_REASON_V1,
+} from "@frockbot/kernel-contracts";
+import { TURN_DEADLINE_REASON_V1 } from "@frockbot/kernel-agent-loop";
+import { UNRECONCILABLE_RUN_FAILURE_V1 } from "@frockbot/kernel-do";
+
+/**
+ * The one place a Turn that did not finish is turned into a sentence for the
+ * person who was waiting on it.
+ *
+ * A run's stored `failure` is a diagnostic. It is composed by whoever settled
+ * the run, out of whatever the layer below handed up, and it reads like it:
+ * "Reconciliation was explicitly abandoned: Bot turn ended with outcome
+ * model-error: Flock AI keeps no durable copy of an interrupted response, so it
+ * cannot be recovered". Every word of that is useful — on the debug surface,
+ * where it stays, unchanged. None of it belongs in a chat bubble. A person
+ * asked for a countdown applet; they should not have to learn what
+ * reconciliation is to find out that the model gave up.
+ *
+ * So the projection stops forwarding the diagnostic and picks the sentence
+ * instead. Two inputs, in order:
+ *
+ *  1. The kernel's own user-facing reasons. A handful of failures already have
+ *     a sentence written for a person — the model deadlines, the Turn deadline,
+ *     the unretrievable settlement — and those say something the outcome alone
+ *     cannot, so a stored failure that carries one hands it straight through.
+ *  2. Otherwise the Turn's terminal outcome, which is a closed set, mapped
+ *     below. It says less, and it can never leak.
+ *
+ * The diagnostic is never the answer, not even as a fallback: an unmapped
+ * outcome gets the generic line rather than whatever prose happened to be
+ * stored.
+ */
+
+/**
+ * Sentences the kernel writes for the person rather than for the log. They are
+ * matched as substrings because the layer that settles a run wraps the reason
+ * it was handed — the sentence survives the wrapping, the wrapper does not.
+ */
+export const USER_FACING_FAILURE_REASONS_V1: readonly string[] = [
+  MODEL_FIRST_BYTE_DEADLINE_REASON_V1,
+  MODEL_IDLE_DEADLINE_REASON_V1,
+  TURN_DEADLINE_REASON_V1,
+  UNRECONCILABLE_RUN_FAILURE_V1,
+];
+
+/**
+ * What each terminal outcome says. Total over `TurnOutcome` so adding one to
+ * the kernel's union is a type error here rather than a silent generic line.
+ */
+export const RUN_FAILURE_COPY_V1: Record<TurnOutcome, string> = {
+  completed: "This Bot couldn't finish its reply. Try again.",
+  blocked: "This Bot wouldn't do that. Try asking a different way.",
+  cancelled: "You stopped this.",
+  interrupted: "This reply stopped before it finished. Try again.",
+  "model-error": "The model couldn't finish its reply. Try again.",
+  "tool-error": "Something the Bot was using didn't work. Try again.",
+};
+
+/** What a Turn says when nothing more specific is known about how it ended. */
+export const RUN_FAILURE_FALLBACK_COPY_V1 =
+  "This Bot couldn't finish its reply. Try again.";
+
+/** The outcome the run's own log records, or `undefined` on an unclosed Turn. */
+function terminalTurnOutcomeV1(
+  events: readonly SessionEvent[],
+): TurnOutcome | undefined {
+  const terminal = events.findLast((event) => event.type === "turn/end");
+  return terminal?.type === "turn/end" ? terminal.outcome : undefined;
+}
+
+export function runFailureCopyV1(input: {
+  failure?: string;
+  events?: readonly SessionEvent[];
+}): string {
+  const failure = input.failure ?? "";
+  const written = USER_FACING_FAILURE_REASONS_V1.find((reason) =>
+    failure.includes(reason),
+  );
+  if (written) return written;
+  const outcome = terminalTurnOutcomeV1(input.events ?? []);
+  return outcome ? RUN_FAILURE_COPY_V1[outcome] : RUN_FAILURE_FALLBACK_COPY_V1;
+}
+
+/**
+ * The product's own sentences, as a set a client can check a string against.
+ *
+ * The projection maps every failure through {@link runFailureCopyV1} on the way
+ * to the wire, so what reaches a client is already copy. The client still must
+ * not *trust* that: a `ClientRun` can arrive from an older backend that
+ * forwarded the raw diagnostic, and a provider's words under a bubble read as
+ * part of what the Bot was saying. So the thread accepts a failure only when it
+ * recognises it as something the product wrote, and otherwise says the generic
+ * line — which keeps the specific sentences (the model deadlines say something
+ * the outcome alone cannot) without ever letting an unknown string through.
+ */
+const KNOWN_FAILURE_COPY_V1 = new Set<string>([
+  ...Object.values(RUN_FAILURE_COPY_V1),
+  ...USER_FACING_FAILURE_REASONS_V1,
+  RUN_FAILURE_FALLBACK_COPY_V1,
+]);
+
+/** The failure if the product wrote it, else the line every failure can use. */
+export function knownFailureCopyV1(failure: string | undefined): string {
+  return failure && KNOWN_FAILURE_COPY_V1.has(failure)
+    ? failure
+    : RUN_FAILURE_FALLBACK_COPY_V1;
+}

package/src/run-protocol.test.ts

@@ -3,6 +3,7 @@ import { type SessionEvent } from "@frockbot/kernel-contracts";
 import { initializeBotSettingsV1 } from "@frockbot/configuration-core";
 import type { StoredRun } from "./backend-contracts.js";
 import { planBotRunRecovery } from "./backend-recovery.js";
+import { RUN_FAILURE_COPY_V1 } from "./run-failure-copy.js";
 import {
   createClientRunStopReceiptV1,
   decodeClientNotificationAcknowledgementCommandV1,
@@ -10,6 +11,7 @@ import {
   decodeClientRunLookupQueryV1,
   decodeClientRunReconciliationCommandV1,
   decodeClientRunStopCommandV1,
+  RESUMABLE_RUN_MESSAGE_V1,
   decodeClientRunStopReceiptV1,
   decodeClientTurnCommandV1,
   decodeClientRunLookupV1,
@@ -285,7 +287,7 @@ describe("client run protocol v1", () => {
       stopRequestedAt: "2026-08-28T00:00:05.000Z",
       outcome: {
         type: "cancelled",
-        message: "Stopped by an authenticated Stop command.",
+        message: "You stopped this.",
       },
     });
     expect(projectClientRunLookupV1(storedRun([], "cancelled"))).toMatchObject({
@@ -297,7 +299,7 @@ describe("client run protocol v1", () => {
       ).run,
     ).toMatchObject({
       status: "cancelled",
-      failure: "Stopped by an authenticated Stop command.",
+      failure: "You stopped this.",
     });
 
     expect(() =>
@@ -745,7 +747,7 @@ describe("client run protocol v1", () => {
           ],
           recovery: {
             action: "resume",
-            message: "Provider confirmation required",
+            message: RESUMABLE_RUN_MESSAGE_V1,
           },
         },
       ],
@@ -758,10 +760,10 @@ describe("client run protocol v1", () => {
         input: "continue",
         status: "reconciliation-required",
         events: projected.runs[0]?.events,
-        failure: "Provider confirmation required",
+        failure: RESUMABLE_RUN_MESSAGE_V1,
         recovery: {
           action: "resume",
-          message: "Provider confirmation required",
+          message: RESUMABLE_RUN_MESSAGE_V1,
         },
       },
     ]);
@@ -1278,14 +1280,18 @@ describe("client run protocol v1", () => {
       events,
       failure: plan.failure,
     });
+    // The provider's own words — its name, its status code — stay on the
+    // stored record, which is what the debug surface reads. What crosses to a
+    // chat bubble is the sentence for the outcome, and nothing else.
     expect(decodeClientRunLookupV1(structuredClone(lookup))).toMatchObject({
       state: "terminal",
       run: {
         status: "failed",
-        failure:
-          "Bot turn ended with outcome model-error: Ollama Cloud responded 401: invalid api key",
+        failure: RUN_FAILURE_COPY_V1["model-error"],
       },
     });
+    expect(JSON.stringify(lookup)).not.toContain("Ollama Cloud");
+    expect(JSON.stringify(lookup)).not.toContain("model-error");
   });
 
   test("carries rename announcements beside the Turns, and refuses a bad one", () => {
@@ -1335,6 +1341,43 @@ describe("client run protocol v1", () => {
       }),
     ).toThrow("run list.announcement.at is invalid");
   });
+
+  test("announces a compaction without putting its summary on the wire", () => {
+    const announcements = projectClientAnnouncementsV1([
+      { type: "turn/start", seq: 0, timestamp, turn: 1 },
+      {
+        type: "conversation/compacted",
+        seq: 4,
+        timestamp,
+        effectId: "compaction-1",
+        fromTurn: 1,
+        throughTurn: 6,
+        summary: "## Summary\nsomething private to the model",
+        identifiers: ["applet-9f2c"],
+        provider: "ollama-cloud",
+        model: "kimi-k2",
+      },
+    ]);
+    expect(announcements).toEqual([
+      {
+        type: "conversation/compacted",
+        announcementId: "compaction-4",
+        at: timestamp,
+        throughTurn: 6,
+      },
+    ]);
+    const page = createClientRunListV1([], { truncated: false }, announcements);
+    expect(JSON.stringify(page)).not.toContain("something private");
+    expect(decodeClientRunPageV1(structuredClone(page)).announcements).toEqual(
+      announcements,
+    );
+    expect(() =>
+      decodeClientRunPageV1({
+        ...page,
+        announcements: [{ ...announcements[0], throughTurn: 0 }],
+      }),
+    ).toThrow("run list.announcement.throughTurn is invalid");
+  });
 });
 
 describe("dispatched subagents in the run projection", () => {

package/src/run-protocol.ts

@@ -24,6 +24,7 @@ import {
   type BotTurnCompletion,
   type StoredRun,
 } from "./backend-contracts.js";
+import { runFailureCopyV1 } from "./run-failure-copy.js";
 
 const MAX_RUN_ID_LENGTH = 128;
 const MAX_TIMESTAMP_LENGTH = 64;
@@ -54,8 +55,15 @@ export type ClientRunStatusV1 =
   | "superseded"
   | "reconciliation-required";
 
-const CANCELLED_RUN_MESSAGE = "Stopped by an authenticated Stop command.";
+// Both are sentences for the person, not descriptions of the mechanism: the
+// wire outcome is what a client with no copy of its own renders verbatim, and
+// "Stopped by an authenticated Stop command" told somebody who pressed Stop
+// about the authentication of their own button press.
+const CANCELLED_RUN_MESSAGE = "You stopped this.";
 const SUPERSEDED_RUN_MESSAGE = "Interrupted by your next message.";
+/** What a Turn waiting on a person's "Try again" says while it waits. */
+export const RESUMABLE_RUN_MESSAGE_V1 =
+  "This reply stopped partway. Try again to continue it.";
 
 /**
  * Why the Bot declined to admit a Turn. A refusal is an ordinary answer — the
@@ -244,14 +252,30 @@ export interface ClientRunPageV1 {
  * A durable Session event that belongs to no Turn. The WebUI renders it as a
  * system line in the conversation.
  */
-export interface ClientAnnouncementV1 {
-  type: "bot/renamed";
-  announcementId: string;
-  at: string;
-  from: string;
-  to: string;
-  namedBy: "user" | "bot";
-}
+/**
+ * A session-level line in the transcript that belongs to neither party.
+ *
+ * `conversation/compacted` is ADR 0030's one user-visible surface: the earlier
+ * Turns are still there and still readable, and this says plainly that the
+ * model now carries a summary of them instead of the Turns themselves. ADR
+ * 0027's "not summarised" notice still stands where Turns were genuinely
+ * evicted, so the two never claim each other's ground.
+ */
+export type ClientAnnouncementV1 =
+  | {
+      type: "bot/renamed";
+      announcementId: string;
+      at: string;
+      from: string;
+      to: string;
+      namedBy: "user" | "bot";
+    }
+  | {
+      type: "conversation/compacted";
+      announcementId: string;
+      at: string;
+      throughTurn: number;
+    };
 
 export interface ClientRunListV1 {
   schemaVersion: 1;
@@ -286,6 +310,19 @@ export interface ClientConversationListV1 {
   conversations: ClientConversationV1[];
 }
 
+/**
+ * The answer to "start a new conversation": the list, or the reason not now.
+ *
+ * A refusal is a value, not an exception. The request crosses a Durable Object
+ * boundary and a Worker boundary to get here, and an exception that crosses
+ * either is logged by workerd as `Uncaught Error` — the log then showed the
+ * isolate going down with a broken pipe behind it. Carrying the refusal as
+ * data means the only thing that reaches the client is the 409 it expects.
+ */
+export type ClientConversationOutcomeV1 =
+  | ({ status: "started" } & ClientConversationListV1)
+  | { status: "refused"; schemaVersion: 1; reason: string };
+
 export function decodeClientConversationListV1(
   input: unknown,
 ): ClientConversationListV1 {
@@ -807,8 +844,11 @@ export function projectClientRunV1(run: StoredRun): ClientRunV1 {
       : status === "failed"
         ? ({
             type: "failed",
+            // The stored `failure` is a diagnostic and stays one: it is what
+            // the debug surface reads. What crosses to a chat bubble is the
+            // sentence written for the person — see `runFailureCopyV1`.
             message: truncateWireString(
-              run.failure ?? "Agent request failed.",
+              runFailureCopyV1({ failure: run.failure, events: run.events }),
               MAX_FAILURE_BYTES,
             ),
             ...interruptedOutcomeTextV1(run),
@@ -830,11 +870,10 @@ export function projectClientRunV1(run: StoredRun): ClientRunV1 {
     status === "reconciliation-required"
       ? ({
           action: "resume",
-          message: truncateWireString(
-            run.failure ??
-              "Provider reconciliation is required before this Turn can continue.",
-            MAX_FAILURE_BYTES,
-          ),
+          // The stored failure is the diagnostic the debug surface reads; a
+          // person offered a "Try again" needs the sentence, not the reason
+          // the Bot cannot answer it on its own.
+          message: RESUMABLE_RUN_MESSAGE_V1,
         } satisfies ClientRunRecoveryV1)
       : undefined;
   return {
@@ -983,24 +1022,74 @@ export function createClientRunListV1(
 const MAX_ANNOUNCEMENTS = 64;
 const MAX_ANNOUNCEMENT_NAME_BYTES = 400;
 
-/** Projects the Bot's durable announcement events onto the wire. */
+/**
+ * Where each Turn ended, by Turn number.
+ *
+ * A compaction is written at the end of the Turn that crossed the threshold,
+ * which is the *newest* Turn — so its own timestamp would place its marker at
+ * the bottom of the thread, far from the range it describes. The boundary it
+ * actually names is the end of `throughTurn`, and that is what the marker is
+ * dated with.
+ */
+function turnEndTimestampsV1(
+  session: readonly SessionEvent[],
+): Map<number, string> {
+  const ends = new Map<number, string>();
+  for (const event of session) {
+    if (event.type === "turn/end") ends.set(event.turn, event.timestamp);
+  }
+  return ends;
+}
+
+/**
+ * Projects the Bot's durable announcement events onto the wire.
+ *
+ * `session` is the conversation's own log, used only to date a compaction
+ * marker at the boundary it covers. Omitting it dates the marker by when the
+ * compaction was written, which is where it used to sit.
+ */
 export function projectClientAnnouncementsV1(
   events: readonly SessionEvent[],
+  session: readonly SessionEvent[] = events,
 ): ClientAnnouncementV1[] {
-  return events.flatMap((event) =>
-    event.type === "bot/renamed"
-      ? [
-          {
-            type: "bot/renamed" as const,
-            announcementId: `announcement-${event.seq}`,
-            at: truncate(event.timestamp, MAX_TIMESTAMP_LENGTH),
-            from: truncateWireString(event.from, MAX_ANNOUNCEMENT_NAME_BYTES),
-            to: truncateWireString(event.to, MAX_ANNOUNCEMENT_NAME_BYTES),
-            namedBy: event.namedBy,
-          },
-        ]
-      : [],
-  );
+  const turnEnds = turnEndTimestampsV1(session);
+  return events.flatMap((event): ClientAnnouncementV1[] => {
+    if (event.type === "bot/renamed") {
+      return [
+        {
+          type: "bot/renamed" as const,
+          announcementId: `announcement-${event.seq}`,
+          at: truncate(event.timestamp, MAX_TIMESTAMP_LENGTH),
+          from: truncateWireString(event.from, MAX_ANNOUNCEMENT_NAME_BYTES),
+          to: truncateWireString(event.to, MAX_ANNOUNCEMENT_NAME_BYTES),
+          namedBy: event.namedBy,
+        },
+      ];
+    }
+    if (event.type === "conversation/compacted") {
+      // The summary itself is deliberately not on the wire. A person can read
+      // every Turn it covers, unchanged, immediately above this line; the
+      // summary is what the model carries, and it belongs to the audit view.
+      return [
+        {
+          type: "conversation/compacted" as const,
+          // A distinct prefix: a compaction is numbered by the session log and
+          // a rename by this Bot's announcement log, and the two counters would
+          // otherwise collide on an id the client upserts by.
+          announcementId: `compaction-${event.seq}`,
+          // Dated where the covered range ends, not when the summariser ran,
+          // so the marker sits between the last compacted Turn and the first
+          // verbatim one and stays there as newer Turns arrive.
+          at: truncate(
+            turnEnds.get(event.throughTurn) ?? event.timestamp,
+            MAX_TIMESTAMP_LENGTH,
+          ),
+          throughTurn: event.throughTurn,
+        },
+      ];
+    }
+    return [];
+  });
 }
 
 export function clientRunListWireBytes(value: ClientRunListV1): number {
@@ -1828,14 +1917,19 @@ export function decodeClientRunLookupV1(input: unknown): ClientRunLookup {
 
 function decodeAnnouncement(value: unknown): ClientAnnouncementV1 {
   const announcement = record(value, "run list.announcement");
+  if (
+    announcement.type !== "bot/renamed" &&
+    announcement.type !== "conversation/compacted"
+  ) {
+    throw new Error("run list.announcement.type is invalid");
+  }
   exactKeys(
     announcement,
-    ["type", "announcementId", "at", "from", "to", "namedBy"],
+    announcement.type === "conversation/compacted"
+      ? ["type", "announcementId", "at", "throughTurn"]
+      : ["type", "announcementId", "at", "from", "to", "namedBy"],
     "run list.announcement",
   );
-  if (announcement.type !== "bot/renamed") {
-    throw new Error("run list.announcement.type is invalid");
-  }
   const at = string(
     announcement,
     "at",
@@ -1845,20 +1939,35 @@ function decodeAnnouncement(value: unknown): ClientAnnouncementV1 {
   if (!Number.isFinite(Date.parse(at))) {
     throw new Error("run list.announcement.at is invalid");
   }
+  const announcementId = publicEventId(
+    string(
+      announcement,
+      "announcementId",
+      MAX_EVENT_ID_LENGTH,
+      "run list.announcement",
+    ),
+    "run list.announcement.announcementId",
+  );
+  if (announcement.type === "conversation/compacted") {
+    if (
+      !Number.isSafeInteger(announcement.throughTurn) ||
+      (announcement.throughTurn as number) < 1
+    ) {
+      throw new Error("run list.announcement.throughTurn is invalid");
+    }
+    return {
+      type: "conversation/compacted",
+      announcementId,
+      at,
+      throughTurn: announcement.throughTurn as number,
+    };
+  }
   if (announcement.namedBy !== "user" && announcement.namedBy !== "bot") {
     throw new Error("run list.announcement.namedBy is invalid");
   }
   return {
     type: "bot/renamed",
-    announcementId: publicEventId(
-      string(
-        announcement,
-        "announcementId",
-        MAX_EVENT_ID_LENGTH,
-        "run list.announcement",
-      ),
-      "run list.announcement.announcementId",
-    ),
+    announcementId,
     at,
     from: wireString(
       announcement,

package/src/settings-links.test.ts

@@ -62,10 +62,16 @@ describe("settings link scheme", () => {
     });
   });
 
-  test("drops a fragment belonging to another surface", () => {
+  test("a fragment belonging to another surface opens that surface", () => {
+    // The row is the specific request; the query parameter is where the link
+    // was written from, and rows move between surfaces.
     expect(
       decodeSettingsLinkV1("/?settings=bot-settings#bot-info-computer"),
-    ).toEqual({ surface: "bot-settings" });
+    ).toEqual({ surface: "bot-panel", anchor: "bot-info-computer" });
+    expect(decodeSettingsLinkV1("/?settings=bot-panel#bot-routines")).toEqual({
+      surface: "bot-settings",
+      anchor: "bot-routines",
+    });
   });
 
   test("drops an anchor nobody registered", () => {