@humwick/server 0.0.0-stage → 0.130.0

package/src/memory-injection.ts

@@ -0,0 +1,954 @@
+import { contextInjectUnsupported, launchContextSurvivesCompact, launchSystemPromptAppend } from "./context-injection-channel";
+// #1565 P4b — closing the auto-inject loop at the OTHER two boundaries (design §4.4).
+//
+// P4a made every spawn and every restart carry the composed memory preamble in
+// `systemPromptAppend`. That leaves the two boundaries an agent crosses most often — `clear` and
+// `compact` — where a fresh context comes back with the continuity envelope but no memory. This
+// module fills them, through the seam relay already owns: an `agent.injectContext` command.
+//
+// THREE INVARIANTS, all of which are ways this could quietly go wrong:
+//
+//  • BESIDE, NEVER MERGED (§7). Memory and the continuity envelope are different things with
+//    different lifetimes — durable curated instruction vs. this task, right now. They ride as two
+//    distinct `agent.injectContext` payloads with distinct `reason`s, so neither can dilute or
+//    truncate the other, and the continuation's bytes are untouched by anything here.
+//
+//  • RECOMPOSE, NEVER REPLAY — the CONTENT. The block is rebuilt from the DB at each boundary, so
+//    a retraction takes effect. The IDENTITY is replayed, not re-derived (#1625,
+//    `memory-seam.ts`), while Project inclusion is derived from that identity's current profile.
+//    The launch-time switch result rides on the seam only to detect a profile flip and soften the
+//    notice below; it never gates composition.
+//
+//    It does NOT delete the earlier copy (#1565 F-REPLACES). A clear/compact does not respawn, so
+//    the spawn-time block stays in the system prompt and this one lands in the transcript beside
+//    it — two blocks, same markers. The delivered copy therefore carries
+//    `MEMORY_SUPERSEDE_NOTICE`, which says in the prompt itself that it is the current one and that
+//    anything missing from it was retracted, expired, or is no longer injectable. That STATEMENT is
+//    how a mid-session retraction takes effect; nothing available mid-session can rewrite a system
+//    prompt. The notice is added on delivery only — the hash and the delta gate stay on the
+//    canonical composed block, so the two sides of the comparison keep the same shape.
+//
+//    The retraction claim is CONDITIONAL (#1625). It is only true if both copies were resolved
+//    under the same launch-recorded identity AND the Project switch has not changed. When either
+//    agreement is unproven, the boundary delivers `MEMORY_SUPERSEDE_NOTICE_UNVERIFIED` instead.
+//    Telling an agent that live instruction was withdrawn is worse than telling it nothing — it
+//    acts on it.
+//
+//  • DELTA-GATED AT COMPACT (§4.3(4)). A native compact PRESERVES the system prompt, so the
+//    spawn-time block is usually still there: re-sending an unchanged block is pure token tax.
+//    We hash what was last injected per agent and skip when nothing moved — and SAY SO in the
+//    accounting event, because a silent skip is indistinguishable from a broken seam. `clear`
+//    destroys the context, so it always re-injects; there is nothing left to be unchanged.
+//
+//  • FIRES ON THE BOUNDARY, NOT ON ITS CONFIRMATION (#2291). Which boundary statuses count is NOT
+//    decided here — it is `boundaryMayHaveCommitted` in `self-resume.ts`, shared with the
+//    continuation sweep. This module owned a stricter private copy (`status === "succeeded"`) for
+//    the whole of #1565 P4b, and a runner that cannot CONFIRM a `/clear` fails the command on
+//    purpose (#2043 F2), so the block was dropped on every unconfirmed clear and every timed-out
+//    compact — silently, with no recovery, while the continuation beside it was re-delivered by a
+//    path that already knew better. Redundant beats wiped: fail toward injecting.
+//
+// PROVIDER-AGNOSTIC BY CONSTRUCTION: the composer takes an identity record, delivery is an
+// `agent.injectContext` command (declared `context.inject` — true for Claude and Codex alike),
+// and the payload is markdown. A provider that declares `inject:false` degrades to
+// spawn-time-only injection, reported in the event rather than crashing or silently vanishing.
+
+import { createHash } from "node:crypto";
+import { stripRenderedAtLine } from "./context-block-rendered-at";
+import { errMessage, stringValue } from "@humwick/sdk";
+import { createCommand, findLaunchPromptCommandForAgent } from "./commands-db";
+import { emitCommandEvent } from "./command-events";
+import { REAP_INTERVAL_MS } from "./config";
+import { getConfig, setConfig } from "./config-store";
+import { findMessageByIdempotencyKey, getAgent, type MemoryIdentity } from "./db";
+import { composeMemoryPreamble, describeInstructionTruncation, describeMemoryDemotions, describeMemoryOmissions, describeUnresolvedInstructions, extractMemoryPreamble, memoryRetractionBlock, unresolvedInstructionSlugs, withMemorySupersedeNotice, type ComposedMemoryPreamble } from "./memory-preamble";
+import {
+  composeJournalPreamble,
+  extractJournalPreamble,
+  extractJournalStateHash,
+  journalProfileEnabled,
+  journalRetractionBlock,
+  withJournalSupersedeNotice,
+  type ComposedJournalPreamble,
+} from "./journal-preamble";
+import { describeInjectionDrops } from "./memory-inject-filter";
+import { memorySeamForAgent, projectMemoryEnabledForSeam, type ResolvedMemorySeam } from "./memory-seam";
+import { lifecycleMemoryCells, lifecycleProjectNativeInstructionFiles } from "./project-instructions";
+import { INJECTION_SWEEP_BACKLOG_INTERVAL_MS, pacedInjectionSweep } from "./injection-sweep-pacing";
+import { isSqliteBusyError } from "./db/connection";
+import { boundaryMayHaveCommitted, injectionAttemptDecision, MAX_INJECTION_ATTEMPTS, sweepableBoundaryCommands } from "./self-resume";
+import { settleAreaMemoryCommand } from "./memory-area-injection";
+import { emitRelayInjectionEvent } from "./sse";
+import type { AgentCard, Command } from "./types";
+
+/** The `agent.injectContext` discriminator for a memory payload. Distinct from the continuation's
+ *  `self-resume-continuation` and the identity block's `agent-relay-identity`, so all three can
+ *  correlate to the SAME clear/compact command without colliding (§7: beside, never merged). */
+export const MEMORY_INJECTION_REASON = "memory-preamble";
+
+/** Where the per-agent "what did we last inject" hash lives. Not on the agent card: the card is
+ *  re-registered on every relaunch, and this has to outlive that to be worth anything. */
+const MEMORY_INJECTION_NAMESPACE = "memory-injection";
+
+/** #2591 — the journal sibling's own gate state, same shape and same home pattern (its own
+ *  config namespace so neither gate can clobber the other). */
+const JOURNAL_INJECTION_NAMESPACE = "journal-injection";
+
+/** Which boundary produced an injection — the only branch in this module, and it is on the
+ *  LIFECYCLE event, never on the provider. */
+export type MemoryInjectionEvent = "clear" | "compact";
+
+/** Why a boundary did NOT inject. Reported, never silent — an operator looking at an agent that
+ *  came back without memory must be able to see which of these it was. */
+export type MemoryInjectionSkip = "unchanged" | "inject-unsupported" | "nothing-to-inject";
+
+export interface MemoryInjectionState {
+  /** Hash of the composed block, or "" for "nothing resolved". */
+  hash: string;
+  tokens: number;
+  entries: number;
+  event: MemoryInjectionEvent;
+  at: number;
+}
+
+/** Stable content hash of a composed block. Short: it is an equality token, not a digest anyone
+ *  needs to verify. "" hashes to "" so "nothing resolved" is a first-class state rather than the
+ *  hash of the empty string. */
+export function memoryBlockHash(block: string): string {
+  if (!block) return "";
+  // #3698 — hashed without its render time, so a launch-baked copy equals an unchanged re-render.
+  return createHash("sha256").update(stripRenderedAtLine(block)).digest("hex").slice(0, 16);
+}
+
+export function readMemoryInjectionState(agentId: string): MemoryInjectionState | null {
+  return getConfig<MemoryInjectionState>(MEMORY_INJECTION_NAMESPACE, agentId)?.value ?? null;
+}
+
+export function recordMemoryInjectionState(agentId: string, state: MemoryInjectionState): void {
+  setConfig(MEMORY_INJECTION_NAMESPACE, agentId, state, "memory-injection");
+}
+
+/** #2591 — the journal gate's "what did this agent last receive" record. Same lifetime rules
+ *  as the memory state: written only on a DELIVERY that succeeded, so a failed payload leaves
+ *  the previous hash and the next boundary retries. */
+export interface JournalInjectionState {
+  /** The journal contentHash ("" = an empty-journal retraction was delivered). */
+  hash: string;
+  tokens: number;
+  fields: number;
+  event: MemoryInjectionEvent;
+  at: number;
+}
+
+export function readJournalInjectionState(agentId: string): JournalInjectionState | null {
+  return getConfig<JournalInjectionState>(JOURNAL_INJECTION_NAMESPACE, agentId)?.value ?? null;
+}
+
+export function recordJournalInjectionState(agentId: string, state: JournalInjectionState): void {
+  setConfig(JOURNAL_INJECTION_NAMESPACE, agentId, state, "journal-injection");
+}
+
+/**
+ * WHO a live agent is, in the shape `composeMemoryPreamble` wants — the sibling of
+ * `callerMemoryIdentity` (which resolves the same cells from a signed token) and of what
+ * `composeProfileSpawnInstructions` builds at spawn time.
+ *
+ * It MUST agree with the spawn-time identity, or the delta gate compares two different blocks and
+ * either re-injects forever or skips something that really did change — and, worse, the delivered
+ * block's supersede notice describes the difference as a retraction (#1625). It does not merely
+ * try to agree by re-deriving the same fields any more: `memorySeamForAgent` REPLAYS the identity
+ * the launch recorded, and falls back to the derivation only when there is no record.
+ */
+export function memoryIdentityForAgent(agent: AgentCard): MemoryIdentity {
+  return memorySeamForAgent(agent).identity;
+}
+
+/** Compose an agent's block over the SAME profile-selected cells the spawn seam walks. Project
+ *  inclusion is re-derived from the current profile named by the replayed identity, never from a
+ *  persisted launch override. */
+export function composeMemoryForAgent(agent: AgentCard, now?: number): ComposedMemoryPreamble {
+  return composeMemoryForSeam(memorySeamForAgent(agent), now);
+}
+
+function composeMemoryForSeam(seam: ResolvedMemorySeam, now?: number): ComposedMemoryPreamble {
+  const projectInstructionsEnabled = projectMemoryEnabledForSeam(seam);
+  return composeMemoryPreamble(seam.identity, {
+    cells: lifecycleMemoryCells(projectInstructionsEnabled),
+    projectNativeInstructionFiles: lifecycleProjectNativeInstructionFiles(
+      projectInstructionsEnabled,
+      seam.identity.provider,
+    ),
+    ...(now !== undefined ? { now } : {}),
+  });
+}
+
+function entriesLabel(count: number): string {
+  return `${count} ${count === 1 ? "entry" : "entries"}`;
+}
+
+/** The `{ entries, tokens, scopes, omitted }` accounting §4.4 puts on the `relay-injection` event,
+ *  plus the per-injection provenance the dashboard's cost panel reads. ONE shape for injected and
+ *  skipped alike, so a skip is as inspectable as a send. */
+function injectionDetail(
+  agent: AgentCard,
+  event: MemoryInjectionEvent,
+  seam: ResolvedMemorySeam,
+  composed: ComposedMemoryPreamble,
+  extra: Record<string, unknown>,
+): Record<string, unknown> {
+  return {
+    source: "memory-preamble",
+    event,
+    agentId: agent.id,
+    identity: seam.identity,
+    // #1625 — whether the profile included the project cell, and WHERE its identity came from.
+    // `seam:"derived"` is the operator-visible form of "this boundary could not prove it
+    // agrees with the spawn block", which is also what softens the supersede notice.
+    projectMemoryEnabled: projectMemoryEnabledForSeam(seam),
+    seam: seam.fromLaunch ? "launch" : "derived",
+    // #2264 — both halves, because they answer different operator questions. `launchProjectAbsent`
+    // is why the notice below stops short of the retraction claim (a property of the launch record);
+    // `projectBackfilled` is "this agent's memory just came back" (a property of this composition).
+    launchProjectAbsent: seam.launchProjectAbsent === true,
+    projectBackfilled: seam.projectBackfilled === true,
+    tokens: composed.tokens,
+    // The instruction preface's cost and per-slug status ride along at every boundary too
+    // (#1565 P5.1) — a slug edit takes effect HERE first (§10.1(2)), so this is where an
+    // operator watches whether it landed.
+    instructionTokens: composed.instructionTokens,
+    instructionSlugs: composed.instructionSlugs,
+    omitted: composed.omitted,
+    omittedByReason: composed.omittedByReason,
+    // Demotions to the index (#1979 I1) — the softening that replaced most omissions. Carried so
+    // the dashboard cost panel can explain the index's size, not just the rare true loss.
+    demoted: composed.demoted,
+    demotedByReason: composed.demotedByReason,
+    budgets: composed.budgets,
+    scopes: composed.scopes,
+    entries: composed.entries,
+    // What the SHARED injectability filter refused, with reasons (#1565 P5.4) — a boundary
+    // re-inject accounts for its drops exactly like a spawn does, or an entry that stopped being
+    // injectable mid-session would just quietly vanish from the next block.
+    filtered: composed.filtered,
+    filteredByReason: composed.filteredByReason,
+    // #3409 — on-touch deferrals and the block's cost without them; outside the hashed bytes.
+    areaDeferredCount: composed.areaDeferredCount,
+    counterfactualTokens: composed.counterfactualTokens,
+    hash: memoryBlockHash(composed.block),
+    ...extra,
+  };
+}
+
+function renderedCount(composed: ComposedMemoryPreamble): number {
+  return composed.entries.filter((entry) => entry.rendered).length;
+}
+
+function omissionSuffix(composed: ComposedMemoryPreamble): string {
+  // A demotion to the index (#1979 I1) is a softening, not a loss — named, but distinct from the
+  // rare true omission (the index cap itself overflowed).
+  const demoted = composed.demoted ? ` (${composed.demoted} demoted to index — ${describeMemoryDemotions(composed.demotedByReason, composed.budgets)})` : "";
+  const entries = composed.omitted ? ` (${composed.omitted} omitted — ${describeMemoryOmissions(composed.omittedByReason, composed.budgets)})` : "";
+  // Budget drops and filter refusals have different fixes, so the summary names them separately
+  // instead of adding up to one undifferentiated "missing" count (#1602's discipline, #1565 P5.4).
+  const filtered = composed.filtered.length
+    ? ` (${composed.filtered.length} not injectable — ${describeInjectionDrops(composed.filteredByReason)})`
+    : "";
+  // …and a slug that did not resolve at all is a THIRD, differently-fixed cause (#1626 F4): the
+  // instruction is missing from the store or its render threw, which no budget or audience edit
+  // repairs. It reads on the delivered summary too, not only the skip: a spawn whose charter
+  // vanished still delivers a block, just a silently shorter one.
+  return `${demoted}${entries}${describeInstructionTruncation(composed.omittedByReason, composed.budgets)}${filtered}${describeUnresolvedInstructions(composed.instructionSlugs)}`;
+}
+
+/**
+ * Is there anything to ACCOUNT FOR when the composed block came out empty (#1626 F4)?
+ *
+ * The empty block is the one case with no block of its own to state its omissions in, so this
+ * predicate is the whole reporting surface for it — and it used to read `composed.omitted` alone,
+ * i.e. BUDGET DROPS ONLY. An agent whose every entry was refused by the injectability filter
+ * (`sensitive`, `inject:'never'`, an audience it is not in) and whose instruction slugs resolved to
+ * nothing emitted NO event at all: `injected:false` and silence, indistinguishable from a broken
+ * seam. That silence was masked by `memory.charter` shipping populated — so the state it actually
+ * bit in was the BLANK-SLUG state, §10.3.5's K2 kill switch, the configuration an operator is in
+ * precisely while diagnosing an incident.
+ *
+ * All five causes now count, and each keeps its own name in the event because each has a different
+ * fix (#1602's discipline): a budget/ceiling drop, a filter refusal, an instruction truncated at
+ * its cap, an instruction slug that did not resolve at all, or a whole project cell excluded by
+ * the selected profile's Project Instructions switch.
+ *
+ * What is deliberately still SILENT is the genuinely-empty identity: no entries, no candidates, no
+ * refusals, every slug blank or cleanly rendered. Nothing was dropped there, so there is nothing to
+ * report — and emitting anyway would put a skip event on every boundary of every agent that simply
+ * has no memory yet, which is how a real signal gets tuned out.
+ */
+function hasEmptyBlockAccounting(seam: ResolvedMemorySeam, composed: ComposedMemoryPreamble): boolean {
+  return composed.omitted > 0
+    || composed.filtered.length > 0
+    || composed.omittedByReason.instruction > 0
+    || unresolvedInstructionSlugs(composed.instructionSlugs).length > 0
+    || (seam.identity.projectId !== undefined && !projectMemoryEnabledForSeam(seam));
+}
+
+/**
+ * The P4b seam: re-inject the composed memory preamble after a clear/compact, BESIDE the
+ * continuation (never merged into it), delta-gated on compact.
+ *
+ * Returns the created `agent.injectContext` command, or null when nothing was sent — which is a
+ * normal outcome (unchanged set, nothing resolvable, provider cannot inject) and is always
+ * reported in the `relay-injection` event rather than being inferred from silence.
+ */
+export function enqueueMemoryInjectionAfterContextCommand(command: Command, now: number = Date.now()): Command | null {
+  // #2291 — the boundary's status answers "did the runner CONFIRM the destructive step", not "did a
+  // boundary HAPPEN". This used to read `!== "succeeded"`, which silently dropped the whole memory
+  // block on every unconfirmed clear and every timed-out compact: on the live coordinator that was
+  // 14 of 17 boundaries over five days, with no event and no recovery, while the continuation beside
+  // it was re-delivered every time. Same set as every other boundary re-delivery, from its ONE home
+  // in `self-resume.ts` — a second hand-rolled list here is exactly how this drifted in the first
+  // place. Idempotency is unchanged: `injectionAttemptsFor` below is keyed by this command's id, so
+  // the widened set costs at most one redundant payload, never a duplicate command.
+  if (!boundaryMayHaveCommitted(command)) return null;
+  if (command.type !== "agent.clearContext" && command.type !== "agent.compact") return null;
+  const agent = getAgent(command.target);
+  if (!agent) return null;
+  // Idempotent against the reactive path running twice (bus update + HTTP update) for one command —
+  // and, since #2293, against the sweep running beside it. The rule is the CONTINUATION seam's rule,
+  // read from its one home: an attempt in flight or already succeeded blocks a second payload, an
+  // attempt that FAILED is retried under the shared cap. The retry arm is unreachable from the
+  // reactive path (the first attempt is created at this settle, so nothing can have failed yet) —
+  // it exists for the sweep, and closing #1023 window 3 for memory is the whole reason it is here
+  // rather than in a second private list.
+  if (injectionAttemptDecision(command, MEMORY_INJECTION_REASON).decision !== "enqueue") return null;
+
+  const event: MemoryInjectionEvent = command.type === "agent.compact" ? "compact" : "clear";
+  // #1625 — resolved ONCE for this boundary and threaded through composition, accounting and the
+  // notice. Resolving it per use would let the three disagree with each other as well.
+  const seam = memorySeamForAgent(agent);
+  const composed = composeMemoryForSeam(seam, now);
+  const hash = memoryBlockHash(composed.block);
+  // #2591 — the journal sibling side, resolved once beside the memory side. Non-journal
+  // profiles get `applicable:false`, which neither delivers nor gates: their boundaries stay
+  // byte-identical to pre-#2591. Composition runs through the SAME seam identity, so the
+  // journal a boundary re-injects is keyed by exactly the (project, profile) the launch used.
+  const journal = journalBoundarySide(agent, seam, event);
+
+  if (contextInjectUnsupported(agent)) {
+    // Declared and logged, never a crash: this agent keeps whatever its spawn put in the system
+    // prompt and simply does not get the boundary refresh.
+    emitMemorySkip(agent, event, seam, composed, "inject-unsupported", command, now);
+    return null;
+  }
+
+  // An empty composition is only "nothing to do" when the agent is not already CARRYING a block.
+  // #2154 made that distinction load-bearing: with the project cell the last one left, switching
+  // Project Instructions off composes to nothing — and returning null there would leave the
+  // spawn-time block sitting in the prompt as current, forever, with no correction. That is the
+  // exact mis-description the supersede notice exists to prevent, so an empty composition against a
+  // prompt that IS carrying a block falls through to delivery and retracts it.
+  //
+  // Carrying it has TWO sources and both must be checked: the launch prompt, and an EARLIER
+  // boundary's own injection. An agent that spawned into an empty project (no launch block), got a
+  // block at compact #1, then had the switch turned off, is carrying one from the second source
+  // alone — and skipping there would leave `readMemoryInjectionState` claiming that hash forever.
+  //
+  // #2591 — a skip on the MEMORY side no longer returns on its own: a journal side that DELIVERS
+  // rescues the boundary with its own payload (the two blocks have independent change clocks, and
+  // gating the journal on the memory gate would starve it of updates whenever memory is quiet).
+  let memoryDelivers = false;
+  if (!composed.block.trim() && !launchCarriesMemoryBlock(agent) && !injectedHashForAgent(agent)) {
+    // Nothing resolvable. Still worth an event when anything was DROPPED OR DEFECTIVE (§4.3(2) —
+    // the empty block is exactly the case with no block to state its own omissions in). See
+    // `hasEmptyBlockAccounting`: budget drops, filter refusals and instruction defects all count
+    // (#1626 F4), not budget alone.
+    //
+    // The gate state is deliberately NOT written here (#1565 F6). This module's own invariant is
+    // that only a DELIVERY records state, and nothing was delivered: writing "" would claim an
+    // empty block reached the agent when the spawn-time block is in fact still in its prompt.
+    // Nothing needs the write either — the recorded hash is the block the agent LAST RECEIVED, and
+    // if memory reappears the composed hash differs from it and the next boundary re-injects.
+    if (hasEmptyBlockAccounting(seam, composed)) emitMemorySkip(agent, event, seam, composed, "nothing-to-inject", command, now);
+    if (!journal.delivers) return null;
+  } else if (event === "compact" && launchContextSurvivesCompact(agent) && launchBakedMemoryHash(agent) === hash) {
+    // §4.3(4): a native compact preserves a real system prompt, so a block BAKED there and still
+    // unchanged is already present. Launch text riding summarizable parts (OpenCode) or a user
+    // message (Codex) does not survive: launchContextSurvivesCompact() forces re-injection instead
+    // of this delta skip (#3698). A clear destroys the context — nothing survives it to be unchanged. #2596 —
+    // this reads `launchBakedMemoryHash`, NOT the "recorded last delivery" hash: a block that only
+    // ever rode a transcript message has no such proof (see that function's doc).
+    emitMemorySkip(agent, event, seam, composed, "unchanged", command, now);
+    if (!journal.delivers) return null;
+  } else {
+    memoryDelivers = true;
+  }
+
+  // Delivered WITH the supersede notice; hashed and gated on the canonical block (§F-REPLACES).
+  //
+  // #1625 — and the notice only makes its RETRACTION claim when this block can be shown to have
+  // been resolved the same way the earlier copy was. The identity must come from the launch record
+  // and the current Project switch must match the launch-time witness; otherwise a difference may
+  // be a resolution/profile-selection difference. A prompt with no launch memory block has no
+  // earlier copy to mis-describe, so it remains safe regardless.
+  const currentProjectMemoryEnabled = projectMemoryEnabledForSeam(seam);
+  // A legacy launch with no witness predates profile gating, when project memory was included.
+  // It therefore agrees only while the current selection is still enabled; an OFF switch must
+  // downgrade the notice for that first generation instead of assuming the missing field matches.
+  const projectGateMatchesLaunch = seam.projectMemoryEnabled === undefined
+    ? currentProjectMemoryEnabled
+    : seam.projectMemoryEnabled === currentProjectMemoryEnabled;
+  // #2264 — a launch that recorded NO project composed its block without a project cell, so the two
+  // copies differ for a resolution reason rather than a retraction. Gated on the launch RECORD, not
+  // on whether the backfill happened to resolve one this time: a probe-derived gate would flip the
+  // hard claim back on the moment a cwd stops resolving, against an agent still carrying the
+  // previous block.
+  const seamVerified = (seam.fromLaunch && !seam.launchProjectAbsent && projectGateMatchesLaunch)
+    || !launchCarriesMemoryBlock(agent);
+  // Empty here means the launch block is being RETRACTED (the guard above only lets an empty
+  // composition through when the prompt is carrying one), so the notice needs a block of its own.
+  const memoryContent = !memoryDelivers
+    ? ""
+    : composed.block.trim()
+      ? withMemorySupersedeNotice(composed.block, { seamVerified })
+      : memoryRetractionBlock({ seamVerified });
+  // #2591 — one payload, two independent blocks beside each other (§7's "beside, never merged"
+  // applies to the continuation; the journal rides the same delivery as its sibling block, each
+  // keeping its own markers, notice and gate state).
+  const content = [memoryContent, journal.content].filter(Boolean).join("\n\n");
+  const boundaryKey = command.type === "agent.clearContext" ? { afterClearCommandId: command.id } : { afterCompactCommandId: command.id };
+  const inject = createCommand({
+    type: "agent.injectContext",
+    source: "system",
+    target: command.target,
+    correlationId: command.id,
+    params: {
+      reason: MEMORY_INJECTION_REASON,
+      content,
+      // Each side's metadata rides only when that side actually delivered, so a journal-only
+      // delivery never records a phantom memory hash (and vice versa).
+      ...(memoryDelivers
+        ? {
+          memory: {
+            event,
+            hash,
+            tokens: composed.tokens,
+            entries: renderedCount(composed),
+            omitted: composed.omitted,
+            ...boundaryKey,
+          },
+        }
+        : {}),
+      ...(journal.delivers
+        ? {
+          journal: {
+            event,
+            hash: journal.hash,
+            tokens: journal.composed!.tokens,
+            fields: journal.composed!.fields.length,
+            ...boundaryKey,
+          },
+        }
+        : {}),
+    },
+  });
+  emitCommandEvent(inject, "command.requested");
+  emitRelayInjectionEvent({
+    agentId: agent.id,
+    category: "memory",
+    summary: deliverySummary(event, composed, memoryDelivers, journal),
+    detail: injectionDetail(agent, event, seam, composed, { commandId: inject.id, content, seamVerified, ...journalEventDetail(journal) }),
+    timestamp: now,
+    idempotencyKey: memoryBoundaryEventKey("delivered", agent.id, command.id),
+  });
+  return inject;
+}
+
+/** The resolved fate of the journal side at one boundary (#2591). */
+interface JournalBoundarySide {
+  /** False for every profile outside PROJECT_JOURNAL_PROFILES — the side is inert: no
+   *  composition, no gate, no payload, no accounting. */
+  applicable: boolean;
+  composed: ComposedJournalPreamble | null;
+  /** The payload this side contributes to the combined content ("" = contributes nothing). */
+  content: string;
+  delivers: boolean;
+  /** The journal contentHash — the delta-gate token (stable content, never rendered times). */
+  hash: string;
+}
+
+/** Compose and gate the journal side for a boundary, mirroring the memory side's three
+ *  outcomes: deliver (block or retraction), skip-unchanged (compact, hash equal), or
+ *  nothing-to-inject (journal empty AND the agent carries no journal block from launch or an
+ *  earlier boundary — silent by design; an empty journal is the normal state of a fresh
+ *  project, not a defect worth an event). A compose throw propagates to the contained caller,
+ *  which reports it exactly like a memory compose failure. */
+function journalBoundarySide(agent: AgentCard, seam: ResolvedMemorySeam, event: MemoryInjectionEvent): JournalBoundarySide {
+  const identity = seam.identity;
+  if (!identity.projectId || !journalProfileEnabled(identity.profile)) {
+    return { applicable: false, composed: null, content: "", delivers: false, hash: "" };
+  }
+  // #3698 — rendered at the shared render clock, never the boundary's event clock.
+  const composed = composeJournalPreamble({ projectId: identity.projectId, profile: identity.profile });
+  const hash = composed.contentHash;
+  const carries = launchCarriesJournalBlock(agent) || readJournalInjectionState(agent.id) !== null;
+  if (!composed.block.trim() && !carries) {
+    return { applicable: true, composed, content: "", delivers: false, hash };
+  }
+  if (event === "compact" && launchContextSurvivesCompact(agent) && launchBakedJournalHash(agent) === hash) {
+    return { applicable: true, composed, content: "", delivers: false, hash };
+  }
+  const content = composed.block.trim() ? withJournalSupersedeNotice(composed.block) : journalRetractionBlock();
+  return { applicable: true, composed, content, delivers: true, hash };
+}
+
+/** The delivered-boundary summary across both sides. The memory clause is byte-identical to
+ *  the pre-#2591 sentence (worker boundaries and existing assertions are unchanged); the
+ *  journal clause appends when the journal side delivered, or stands alone when it rescued a
+ *  boundary the memory side skipped. */
+function deliverySummary(event: MemoryInjectionEvent, composed: ComposedMemoryPreamble, memoryDelivers: boolean, journal: JournalBoundarySide): string {
+  const memoryClause = memoryDelivers
+    ? `re-injected memory after ${event}: ${entriesLabel(renderedCount(composed))}, ${composed.tokens} tokens${omissionSuffix(composed)}`
+    : "";
+  const journalClause = journal.delivers
+    ? `journal: ${journal.composed!.fields.length} field${journal.composed!.fields.length === 1 ? "" : "s"}, ${journal.composed!.tokens} tokens`
+    : "";
+  if (memoryClause && journalClause) return `${memoryClause} + ${journalClause}`;
+  if (journalClause) return `re-injected ${journalClause} after ${event}`;
+  return memoryClause;
+}
+
+/** The `journal` sub-object the delivered/skip event detail carries — only when the side is
+ *  applicable, so non-journal profiles' events keep their exact pre-#2591 shape. */
+function journalEventDetail(journal: JournalBoundarySide): Record<string, unknown> {
+  if (!journal.applicable || !journal.composed) return {};
+  return {
+    journal: {
+      hash: journal.hash,
+      tokens: journal.composed.tokens,
+      fields: journal.composed.fields.map((field) => ({ field: field.field, tokens: field.tokens, ...(field.truncated ? { truncated: true } : {}) })),
+      delivered: journal.delivers,
+    },
+  };
+}
+
+/**
+ * The `relay-injection` idempotency keys for one boundary, in ONE place (#2293).
+ *
+ * They are no longer only a dedup token: the sweep READS them back to tell "the settle already ran
+ * and decided" from "the settle never ran at all". A key spelled twice would drift, the sweep would
+ * stop recognising a decided boundary, and it would recompose every candidate on every tick —
+ * silently turning a backstop into a per-minute tax on the whole 24h lookback.
+ */
+function memoryBoundaryEventKey(outcome: "delivered" | "skipped" | "failed", agentId: string, commandId: string): string {
+  const suffix = outcome === "delivered" ? "" : outcome === "skipped" ? "-skip" : "-error";
+  return `memory-injection${suffix}:${agentId}:${commandId}`;
+}
+
+/**
+ * The whole memory side of settling a lifecycle command, in ONE contained call (#1565 F8).
+ *
+ * Both settle chains (HTTP `PATCH /commands/:id` and the bus update) run a sequence of independent
+ * settles; a throw anywhere in it aborts everything after. Composing a block reaches into the DB,
+ * ownership resolution and cwd→project resolution, so it has more ways to throw than its neighbours
+ * — and none of them are a reason to skip a restart settle or an interrupt redirect. Reported, not
+ * swallowed silently: the operator sees the failure on the agent's timeline. The continuation
+ * enqueue runs BEFORE this and is untouched by it, which is the ordering that matters.
+ */
+export function settleMemoryInjectionAfterContextCommand(command: Command, now: number = Date.now()): Command | null {
+  return containedMemoryInjection(command, now).inject;
+}
+
+/**
+ * The contained enqueue, and WHICH of the two null outcomes happened (#2293).
+ *
+ * The settle chains only need "did anything go out". The sweep needs more: a compose that THREW is
+ * a retryable failure, while a compose that legitimately declined is a decision. Told apart here,
+ * both callers share one containment and one error report — a second try/catch in the sweep would
+ * be a second place for the reporting to drift.
+ */
+function containedMemoryInjection(command: Command, now: number, sweep = false): { inject: Command | null; composeFailed: boolean } {
+  try {
+    const inject = enqueueMemoryInjectionAfterContextCommand(command, now);
+    settleMemoryInjectionCommand(command, now);
+    settleAreaMemoryCommand(command, now);
+    return { inject, composeFailed: false };
+  } catch (error) {
+    // #2712 — the sweep runs on a fast-fail connection; a held write lock defers the boundary to the
+    // next run rather than counting against its compose-failure cap.
+    if (sweep && isSqliteBusyError(error)) throw error;
+    emitRelayInjectionEvent({
+      agentId: command.target,
+      category: "memory",
+      summary: `memory re-injection failed to compose after ${command.type === "agent.compact" ? "compact" : command.type === "agent.clearContext" ? "clear" : command.type}: ${errMessage(error)}`,
+      detail: { source: "memory-preamble", agentId: command.target, commandId: command.id, failed: true },
+      timestamp: now,
+      idempotencyKey: memoryBoundaryEventKey("failed", command.target, command.id),
+    });
+    return { inject: null, composeFailed: true };
+  }
+}
+
+/**
+ * #2293 — the missed-boundary SWEEP for memory, the sibling of `sweepMissedContinuationInjections`.
+ *
+ * #2291 widened WHICH statuses re-inject, but the memory block still only ever gets composed from
+ * the reactive settle chains (HTTP `PATCH /commands/:id`, the bus `command.update`). Two windows
+ * have no settle to react to at all, and the continuation survives them only because it has a sweep:
+ *
+ *   1. `timed_out`. The runner NEVER settles a clear/compact to `timed_out` — it reports
+ *      succeeded/failed. The only producer is the DB TTL sweep (`expireCommands`, run by the
+ *      `command-expiration` job), and that loop moves the row terminal without running any settle.
+ *      So the `timed_out` arm of `boundaryMayHaveCommitted` was DEAD for memory in the field: the
+ *      two timed-out compacts in #2291's field trace could never have been recovered by F1 alone.
+ *   2. #1023 windows 2/3 — a relay crash between persisting the boundary status and enqueuing the
+ *      inject, and a single inject attempt that fails with no retry.
+ *
+ * It composes from the DB as it is NOW (recompose, never replay), so a boundary recovered late
+ * delivers current memory rather than a stale snapshot.
+ *
+ * WHAT IT WILL NOT DO is second-guess a settle that already ran. A boundary the reactive path
+ * DECIDED — delivered, or skipped as unchanged/nothing-to-inject/inject-unsupported — is left alone,
+ * read back from that decision's own `relay-injection` event. Without that check the sweep would
+ * recompose every delta-gated compact in the 24h lookback on every tick, which on a busy relay is a
+ * per-minute walk of the whole memory store for boundaries that were correctly handled the first
+ * time. The same readback is why a compose FAILURE is capped rather than retried forever (below).
+ *
+ * COST IS BOUNDED BY AGENTS, NOT BY BOUNDARIES. Composition — not the enumeration — is what this
+ * job costs on the loop (~1.1ms per candidate even for an agent with NO memory, because an empty
+ * identity walks the same cells). Two bounds keep it off the maintenance breaker
+ * (`MAINTENANCE_BREAKER_LAG_MS`, which would durably auto-PAUSE this job — the backstop switching
+ * itself off on exactly the fleet that needs it):
+ *   • NEWEST BOUNDARY PER AGENT. Memory is a state refresh — "the block this context should now
+ *     carry" — not a per-event payload, so an older boundary is moot the moment a newer one exists.
+ *     One composition per agent per tick instead of one per boundary, and one agent can no longer
+ *     receive N multi-KB blocks back-to-back from a single tick.
+ *   • THE DECIDED SET, including the SILENT decisions. A genuinely empty identity composes to
+ *     nothing and stays silent on purpose (§4.3(2) — a skip event on every boundary of every agent
+ *     with no memory yet is how a real signal gets tuned out), so it has no event to read back and
+ *     would otherwise be re-composed every 60s forever, which is precisely the population a fresh
+ *     relay is made of. `rememberSweepDecision` records those in-process instead.
+ *
+ * Idempotency is F1's seam, unchanged: `injectionAttemptDecision` keyed by the boundary command id,
+ * so the sweep cannot double-inject against the reactive path or against its own previous tick.
+ *
+ * ACCEPTED WITH EYES OPEN: `agent.injectContext` carries `LIFECYCLE_TTL_MS`, so an inject the runner
+ * has queued but not settled within it is expired to `timed_out` and re-delivered here, up to the
+ * shared cap — an agent mid-turn for longer than that TTL can receive 2-3 blocks. That is the
+ * continuation sweep's existing policy (redundant beats wiped) applied to a larger payload, not a
+ * new one; the runner's `ProviderInputQueue` serializes them rather than dropping any.
+ */
+export function sweepMissedMemoryInjections(now: number = Date.now(), signal?: AbortSignal): { enqueuedCommandIds: string[]; aborted?: true } {
+  const enqueuedCommandIds: string[] = [];
+  // #1819 — one candidate is the unit; bailing between candidates leaves the rest for the next tick.
+  for (const command of newestBoundaryPerAgent(now, signal)) {
+    if (signal?.aborted) break;
+    sweepMemoryBoundary(command, now, enqueuedCommandIds);
+  }
+  return { enqueuedCommandIds, ...(signal?.aborted ? { aborted: true as const } : {}) };
+}
+
+/** #2712 — the job's form of {@link sweepMissedMemoryInjections}: the same units, one macrotask each. */
+async function sweepMissedMemoryInjectionsPaced(now: number, signal?: AbortSignal): Promise<{ enqueuedCommandIds: string[]; aborted?: true; moreWork?: true }> {
+  const enqueuedCommandIds: string[] = [];
+  const { moreWork } = await pacedInjectionSweep(() => newestBoundaryPerAgent(now, signal), (command) => sweepMemoryBoundary(command, now, enqueuedCommandIds), signal);
+  return { enqueuedCommandIds, ...(signal?.aborted ? { aborted: true as const } : {}), ...(moreWork ? { moreWork: true as const } : {}) };
+}
+
+function sweepMemoryBoundary(command: Command, now: number, enqueuedCommandIds: string[]): void {
+  const { decision, attempts } = injectionAttemptDecision(command, MEMORY_INJECTION_REASON);
+  if (decision === "in-flight") return;
+  if (decision === "exhausted") {
+    notifyMemoryInjectionExhausted(command, attempts, now);
+    return;
+  }
+  if (attempts === 0 && (sweepAlreadyDecided(command) || boundaryAlreadyDecided(command))) return;
+  // Through the CONTAINED enqueue: composing reaches into the store, the ownership seam and
+  // cwd→project resolution, and a throw on one agent must not abort the sweep for every agent
+  // behind it (the #1565 F8 rationale, one level up).
+  const { inject, composeFailed } = containedMemoryInjection(command, now, true);
+  if (inject) {
+    enqueuedCommandIds.push(inject.id);
+    return;
+  }
+  rememberSweepDecision(command, composeFailed, now);
+}
+
+/**
+ * The candidate set, collapsed to ONE boundary per agent — the newest.
+ *
+ * `sweepableBoundaryCommands` yields per TYPE (every clear, then every compact), each page ordered
+ * `created_at DESC`, so "newest" is a cross-type comparison and cannot be read off the iteration
+ * order. Everything older for that agent is dropped, not deferred: whatever the newest boundary
+ * decides is the state the context should now be in, and a delivery for an older one would be a
+ * block sent in the name of a boundary that is long over.
+ *
+ * `created_at` is a millisecond stamp, so boundaries can tie. That is a non-event here: tied
+ * boundaries describe the same state, the block is composed from the store as it is NOW either way,
+ * and the id only decides what the delivery correlates to.
+ */
+function newestBoundaryPerAgent(now: number, signal?: AbortSignal): Command[] {
+  const newest = new Map<string, Command>();
+  const newestClear = new Map<string, Command>();
+  for (const command of sweepableBoundaryCommands(now, signal)) {
+    const held = newest.get(command.target);
+    if (!held || command.createdAt > held.createdAt) newest.set(command.target, command);
+    if (command.type !== "agent.clearContext") continue;
+    const heldClear = newestClear.get(command.target);
+    if (!heldClear || command.createdAt > heldClear.createdAt) newestClear.set(command.target, command);
+  }
+  return [...newest.values()].map((command) => boundaryThatMustSpeak(command, newestClear.get(command.target)));
+}
+
+/**
+ * Which of an agent's collapsed boundaries gets to decide — and why it is not always the newest.
+ *
+ * A `clear` destroys the transcript the last delivery landed in, which is exactly why §4.3(4) never
+ * delta-gates one. A `compact` after it IS gated, against `readMemoryInjectionState` — a delivery
+ * that the clear wiped. So collapsing a [missed clear, missed compact] pair to the compact alone
+ * would let the gate skip a block the context no longer has, and the agent would keep running on
+ * whatever its system prompt happened to carry: the #2291 failure mode, re-entered through an
+ * optimisation. When the clear happened after the delivery the gate compares against, the clear is
+ * the boundary that must speak.
+ *
+ * COMPARE SETTLE TIMES, NOT ENQUEUE TIMES. `delivered.at` is when the inject SETTLED; the clear's
+ * matching clock is therefore `updatedAt` (its terminal settle), not `createdAt` (its enqueue). An
+ * inject enqueued before a clear but landing after it is still wiped by that clear — the runner's
+ * `ProviderInputQueue` delivers in enqueue order, so the block goes in and the clear then destroys
+ * it. Reading `createdAt` concludes "the delivery survived", hands the decision to the compact, and
+ * the compact skips against a hash the context no longer carries: exactly the silent drop this
+ * function exists to prevent. `updatedAt` is a strict superset — it can only over-deliver, which is
+ * the safe direction.
+ */
+function boundaryThatMustSpeak(newest: Command, clear: Command | undefined): Command {
+  if (!clear || clear.id === newest.id) return newest;
+  const delivered = readMemoryInjectionState(newest.target);
+  return delivered && clear.updatedAt > delivered.at ? clear : newest;
+}
+
+/**
+ * The sweep's own record of a boundary it decided NOT to deliver, per agent, in this process.
+ *
+ * It exists for the outcomes that leave no trace anywhere else: an empty identity (silent by
+ * design), an agent that has since been removed, and a composition that THREW. Without it those
+ * re-compose every tick for the whole 24h lookback — the permanent per-minute tax, and the one that
+ * scales with a fleet that has no memory yet.
+ *
+ * Deliberately in-process, not durable: it is a de-duplicator for a repeating tick, not a decision
+ * anyone needs after a restart. A restart pays one composition per agent and re-derives the same
+ * answer, which is cheaper and simpler than a config row (and its history) per boundary. Keyed by
+ * agent with the boundary id inside, so a NEW boundary always re-decides — a memory edit still takes
+ * effect at the next boundary, exactly as it does for the reactive path (§10.1(2)). Command ids are
+ * UUIDs, so an entry can only ever suppress the exact boundary it was recorded for.
+ *
+ * A compose failure is the one retryable case: it keeps its own counter and stops at the SAME cap
+ * the inject attempts use, because a deterministic composer throw would otherwise re-run a full
+ * compose every tick for 24h and be reported only once.
+ */
+const sweptBoundaryDecisions = new Map<string, { commandId: string; composeFailures: number; done: boolean }>();
+/** One entry per agent, so this only grows with agent CHURN. Dropped wholesale rather than
+ *  LRU-tracked: the worst a cold memo costs is one re-composition per agent on the next tick. */
+const MAX_SWEPT_DECISIONS = 10_000;
+
+function sweepAlreadyDecided(command: Command): boolean {
+  const held = sweptBoundaryDecisions.get(command.target);
+  return held?.commandId === command.id && held.done;
+}
+
+function rememberSweepDecision(command: Command, composeFailed: boolean, now: number): void {
+  const held = sweptBoundaryDecisions.get(command.target);
+  const composeFailures = (held?.commandId === command.id ? held.composeFailures : 0) + (composeFailed ? 1 : 0);
+  const done = !composeFailed || composeFailures >= MAX_INJECTION_ATTEMPTS;
+  if (sweptBoundaryDecisions.size >= MAX_SWEPT_DECISIONS && !held) sweptBoundaryDecisions.clear();
+  sweptBoundaryDecisions.set(command.target, { commandId: command.id, composeFailures, done });
+  if (composeFailed && done) notifyMemoryInjectionExhausted(command, composeFailures, now, "compose");
+}
+
+export const MEMORY_INJECTION_SWEEP_JOB = {
+  id: "memory-injection-sweep",
+  critical: false,
+  title: "Memory injection sweep",
+  description: "Re-compose the memory preamble for a clear/compact boundary whose inject was never created — a timed_out boundary (settled by the TTL sweep, which runs no settle), a relay crash between persisting the boundary and enqueuing, or a failed inject attempt (#2293, closes the #2291 gap).",
+  intervalMs: REAP_INTERVAL_MS,
+  backlogIntervalMs: INJECTION_SWEEP_BACKLOG_INTERVAL_MS,
+  runOnStart: true,
+  handler(context: { signal?: AbortSignal }) {
+    return sweepMissedMemoryInjectionsPaced(Date.now(), context.signal);
+  },
+};
+
+/** Did a settle already decide this boundary — delivered it, or stated why it skipped? Read from
+ *  the decision's own event, which every non-silent outcome emits (see `memoryBoundaryEventKey`). */
+function boundaryAlreadyDecided(command: Command): boolean {
+  return findMessageByIdempotencyKey(command.target, memoryBoundaryEventKey("delivered", command.target, command.id)) !== null
+    || findMessageByIdempotencyKey(command.target, memoryBoundaryEventKey("skipped", command.target, command.id)) !== null;
+}
+
+/** The cap is spent: stop retrying and SAY so, once. An agent running without its current block is
+ *  exactly the state #2291 showed nobody can infer from silence. The two ways to spend it — the
+ *  DELIVERY failing and the COMPOSITION throwing — carry different keys, or the first one reported
+ *  would silence the other for the same boundary. */
+function notifyMemoryInjectionExhausted(command: Command, attempts: number, now: number, kind: "delivery" | "compose" = "delivery"): void {
+  const idempotencyKey = `memory-injection-exhausted${kind === "compose" ? "-compose" : ""}:${command.target}:${command.id}`;
+  if (findMessageByIdempotencyKey(command.target, idempotencyKey)) return;
+  const event = command.type === "agent.compact" ? "compact" : "clear";
+  const what = kind === "compose" ? "failed to compose" : "could not be delivered";
+  emitRelayInjectionEvent({
+    agentId: command.target,
+    category: "memory",
+    summary: `memory re-injection gave up after ${attempts} attempt(s) at a ${event} boundary — it ${what}, so this agent is running without the current block`,
+    detail: { source: "memory-preamble", agentId: command.target, commandId: command.id, event, attempts, exhausted: kind },
+    timestamp: now,
+    idempotencyKey,
+  });
+}
+
+function emitMemorySkip(
+  agent: AgentCard,
+  event: MemoryInjectionEvent,
+  seam: ResolvedMemorySeam,
+  composed: ComposedMemoryPreamble,
+  skipped: MemoryInjectionSkip,
+  command: Command,
+  now: number,
+): void {
+  const summaries: Record<MemoryInjectionSkip, string> = {
+    unchanged: `memory unchanged after ${event} — re-injection skipped (${entriesLabel(renderedCount(composed))}, ${composed.tokens}t)`,
+    "inject-unsupported": `memory NOT re-injected after ${event}: provider declares context.inject:false (spawn-time block only)`,
+    "nothing-to-inject": `memory resolved nothing to inject after ${event}${omissionSuffix(composed)}`,
+  };
+  emitRelayInjectionEvent({
+    agentId: agent.id,
+    category: "memory",
+    summary: summaries[skipped],
+    detail: injectionDetail(agent, event, seam, composed, { skipped, commandId: command.id }),
+    timestamp: now,
+    idempotencyKey: memoryBoundaryEventKey("skipped", agent.id, command.id),
+  });
+}
+
+/**
+ * Record what an `agent.injectContext` actually DELIVERED, once it succeeds.
+ *
+ * Deliberately not recorded at enqueue time: an inject that fails must not leave a hash claiming
+ * it landed, or the next compact would skip a block the agent never received and the memory would
+ * stay missing until the set happened to change. Recording on success makes the gate self-healing
+ * — a failed delivery simply leaves the previous hash, and the next boundary retries.
+ *
+ * #2591 — the journal side records its own state from the same command's `params.journal`, under
+ * the same only-on-success rule. Each side records only when ITS payload rode the command, so a
+ * journal-only delivery never stamps a phantom memory hash (and vice versa).
+ */
+export function settleMemoryInjectionCommand(command: Command, now: number = Date.now()): void {
+  if (command.type !== "agent.injectContext" || command.status !== "succeeded") return;
+  if (command.params.reason !== MEMORY_INJECTION_REASON) return;
+  const memory = command.params.memory;
+  if (memory && typeof memory === "object" && !Array.isArray(memory)) {
+    const record = memory as Record<string, unknown>;
+    const hash = typeof record.hash === "string" ? record.hash : undefined;
+    if (hash !== undefined) {
+      recordMemoryInjectionState(command.target, {
+        hash,
+        tokens: typeof record.tokens === "number" ? record.tokens : 0,
+        entries: typeof record.entries === "number" ? record.entries : 0,
+        event: record.event === "clear" ? "clear" : "compact",
+        at: now,
+      });
+    }
+  }
+  const journal = command.params.journal;
+  if (journal && typeof journal === "object" && !Array.isArray(journal)) {
+    const record = journal as Record<string, unknown>;
+    const hash = typeof record.hash === "string" ? record.hash : undefined;
+    if (hash !== undefined) {
+      recordJournalInjectionState(command.target, {
+        hash,
+        tokens: typeof record.tokens === "number" ? record.tokens : 0,
+        fields: typeof record.fields === "number" ? record.fields : 0,
+        event: record.event === "clear" ? "clear" : "compact",
+        at: now,
+      });
+    }
+  }
+}
+
+/**
+ * The hash of the block THIS AGENT'S PROMPT ALREADY CARRIES, for the compact gate.
+ *
+ * The recorded state (what a previous boundary delivered) is authoritative — but only while the
+ * context it describes still exists. A relaunch composes a NEW system prompt from the DB as it is
+ * then, so a hash recorded before that launch describes a context that has been thrown away
+ * (#1565 F5): memory that changed and changed back across a restart would otherwise skip the next
+ * compact against a hash the running prompt never carried, and the agent would keep the block the
+ * restart actually gave it. So the recorded state loses to any launch composed after it.
+ *
+ * Otherwise, and before the first boundary, READ THE LAUNCHED PROMPT — its `systemPromptAppend` is
+ * the literal text the provider was started with. Without that read, the first compact of every
+ * agent's life would re-inject a block that is verifiably already in its system prompt, the exact
+ * unconditional re-payment §4.3(4) exists to avoid.
+ *
+ * Derived, never bookkept: no spawn path has to remember to write anything (there are four, and
+ * a fifth would forget), and the answer cannot drift from the bytes that actually launched. A
+ * prompt we cannot resolve yields null ⇒ one redundant injection, never a missing one.
+ */
+function injectedHashForAgent(agent: AgentCard): string | null {
+  const recorded = readMemoryInjectionState(agent.id);
+  const launch = findLaunchPromptCommandForAgent(agent.id, stringValue(agent.meta?.spawnRequestId));
+  if (recorded && !(launch && launch.createdAt > recorded.at)) return recorded.hash;
+  return launchBakedMemoryHash(agent, launch);
+}
+
+/**
+ * #2596 — the ONE hash a compact's "unchanged, skip" gate may trust, for memory and journal alike.
+ * §4.3(4)'s "a native compact preserves the system prompt" is true of a block composed there at
+ * spawn/restart — it is NOT true of a block a LATER boundary delivered as a plain transcript
+ * `agent.injectContext` message. That message rides the conversation history a compact summarizes,
+ * with no guarantee the summary keeps it byte-for-byte, or at all. `injectedHashForAgent` (above)
+ * and the pre-#2596 `journalHashForAgent` both trusted the "recorded" last-reactive-delivery hash
+ * for the identical purpose, which let an infrequently-changing block (journal fields move far less
+ * often than memory entries — the visible casualty in a live repro, #2596) get silently
+ * summarized away with nothing left to prove it ever needed re-sending. So the compact-skip decision
+ * reads ONLY the launch record: a block never baked into a launch — or one that has since diverged
+ * from what was — always re-injects on compact, exactly as it always does on clear. Redundant beats
+ * wiped (#1565, #2291); this is the same doctrine applied to the one place it was missing it.
+ *
+ * Accepts the launch command so callers that already resolved it (like `injectedHashForAgent`'s
+ * other branch) do not pay a second lookup.
+ */
+function launchBakedMemoryHash(agent: AgentCard, launch = findLaunchPromptCommandForAgent(agent.id, stringValue(agent.meta?.spawnRequestId))): string | null {
+  const prompt = launchSystemPromptAppend(launch);
+  if (!prompt) return null;
+  const block = extractMemoryPreamble(prompt);
+  return block === null ? null : memoryBlockHash(block);
+}
+
+/**
+ * Does the system prompt this agent was LAUNCHED with actually carry a memory block? (#1625)
+ *
+ * The supersede notice's retraction claim is a claim about a SPECIFIC earlier copy — the one in the
+ * system prompt. When there is none (a self-registered runner, a spawn whose identity resolved
+ * nothing), there is nothing for a re-derived seam to mis-describe and the claim is vacuously safe.
+ * Read from the launched bytes for the same reason `injectedHashForAgent` is: it cannot drift from
+ * what the provider was actually started with.
+ */
+function launchCarriesMemoryBlock(agent: AgentCard): boolean {
+  const prompt = launchSystemPromptAppend(findLaunchPromptCommandForAgent(agent.id, stringValue(agent.meta?.spawnRequestId)));
+  return prompt ? extractMemoryPreamble(prompt) !== null : false;
+}
+
+/**
+ * #2591/#2596 — the journal twin of {@link launchBakedMemoryHash}, for the identical reason: the
+ * ONLY hash a compact-skip may trust. One structural difference from the memory side: the journal
+ * block renders wall-clock staleness, so the launched prompt is read through its embedded
+ * `journal-state:` content-hash line rather than by hashing the rendered bytes. Never falls back to
+ * a "recorded" reactive-delivery hash (see `launchBakedMemoryHash`'s doc for why) — unresolvable ⇒
+ * null ⇒ one redundant injection, never a missing one.
+ */
+function launchBakedJournalHash(agent: AgentCard): string | null {
+  const prompt = launchSystemPromptAppend(findLaunchPromptCommandForAgent(agent.id, stringValue(agent.meta?.spawnRequestId)));
+  return prompt === undefined ? null : extractJournalStateHash(prompt);
+}
+
+/** #2591 — does the launched prompt carry a journal block? (The journal retraction branch's
+ *  carrying check, mirroring {@link launchCarriesMemoryBlock}.) */
+function launchCarriesJournalBlock(agent: AgentCard): boolean {
+  const prompt = launchSystemPromptAppend(findLaunchPromptCommandForAgent(agent.id, stringValue(agent.meta?.spawnRequestId)));
+  return prompt ? extractJournalPreamble(prompt) !== null : false;
+}