@inflexa-ai/harness 0.1.1 → 0.2.0

package/dist/memory/thread-history.js

@@ -79,6 +79,28 @@ function getInstruments() {
 export function __resetThreadHistoryMetricsForTest() {
     instruments = undefined;
 }
+/**
+ * Chunked-eviction block size, in whole turns — the granularity at which
+ * `loadRecent`'s retained window may advance its START turn.
+ *
+ * `loadRecent` snaps its eviction count UP to a multiple of this block, so the
+ * window's first turn — hence `messages[0]` and the whole tools+system+history
+ * prompt-cache prefix — stays byte-identical across a run of appends and shifts
+ * only once per block instead of once per turn. That single shift is the only
+ * message-cache miss the block costs.
+ *
+ * The block is at once (a) the cache-miss cadence — one prefix shift per
+ * `EVICTION_BLOCK_TURNS` appends once a thread is over budget — and (b) the most
+ * extra context ever sacrificed: snapping up drops up to `EVICTION_BLOCK_TURNS -
+ * 1` oldest turns the budget alone would have kept, trading a little history for
+ * a still prefix. 4 holds the prefix for ~4 turns at a cost of at most 3 turns of
+ * headroom — negligible against a ~120k-token budget that spans far more turns,
+ * while cutting cache misses on a long thread roughly fourfold. A turn-count
+ * block (not a token block) is deliberate: a cache miss is triggered by the START
+ * turn moving, a per-turn event, so counting in turns makes the miss cadence
+ * exact and independent of how large any individual turn is.
+ */
+export const EVICTION_BLOCK_TURNS = 4;
 /**
  * Create a `ThreadHistory` bound to a Postgres pool — a factory closure
  * capturing `pool` (dependency injection per the harness-durable-runtime spec). The `messages` table is
@@ -125,9 +147,22 @@ export function createThreadHistory(pool) {
             const turns = groupTurns(parsed, (row) => isGenuineUserStart(row.message));
             const turnTokens = turns.map((turn) => turn.reduce((sum, row) => sum + row.tokens, 0));
             const threadTotal = turnTokens.reduce((sum, n) => sum + n, 0);
-            // Walk turns newest-first, accumulating token cost. The most recent turn
-            // is always included — even if it alone exceeds the budget, a valid
-            // sequence beats an under-budget one. Older turns join while they fit.
+            // Chunked eviction holds the prompt-cache prefix still. The budget alone
+            // evicts the OLDEST turns newest-first, so the window START — the stable
+            // head of the tools+system+history cache prefix — advances by ~one turn
+            // per appended turn; every turn then ships a shifted `messages[0]` and
+            // rewrites the whole message cache instead of reading it back (watch
+            // `cortex.harness.agent.cache_read_tokens` collapse on long threads).
+            // Instead, take the budget-minimal eviction and snap it UP to a whole
+            // `EVICTION_BLOCK_TURNS` block: `evicted` stays constant while the minimum
+            // sits inside a block and jumps by a block when it crosses, so
+            // `messages[0]` is byte-identical for a block of appends (the cache reads
+            // survive) and shifts only once per block. Snapping UP retains a subset of
+            // the budget-minimal window, so the kept tokens never exceed `tokenBudget`.
+            //
+            // Budget-minimal fill: walk newest-first, always keeping the most recent
+            // turn (a valid over-budget single turn beats an under-budget cut), then
+            // add older turns while they fit.
             let included = 0;
             let cumulative = 0;
             for (let t = turns.length - 1; t >= 0; t--) {
@@ -136,13 +171,18 @@ export function createThreadHistory(pool) {
                 cumulative += turnTokens[t];
                 included++;
             }
-            const turnsEvicted = turns.length - included;
+            const minimalEvicted = turns.length - included;
+            // Snap the eviction count up to a block boundary, clamped below the last
+            // turn so the most recent turn always ships. Both terms of the min are
+            // >= `minimalEvicted`, so `turnsEvicted >= minimalEvicted`: the retained
+            // suffix is a subset of the budget-minimal one and stays within budget.
+            const turnsEvicted = turns.length === 0 ? 0 : Math.min(Math.ceil(minimalEvicted / EVICTION_BLOCK_TURNS) * EVICTION_BLOCK_TURNS, turns.length - 1);
             const { totalTokens, turnsEvicted: turnsEvictedHist } = getInstruments();
             const attributes = { eviction: turnsEvicted > 0 };
             totalTokens.record(threadTotal, attributes);
             turnsEvictedHist.record(turnsEvicted, attributes);
             return turns
-                .slice(turns.length - included)
+                .slice(turnsEvicted)
                 .flat()
                 .map((row) => row.message);
         });

package/dist/memory/working-memory.d.ts

@@ -6,18 +6,48 @@
  * to Markdown only when injected (see the harness-thread-store spec).
  *
  * Four sections. `goal`, `constraints`, `hypotheses` are analysis-flat;
- * `findings` is run-scoped, keyed by `runId`, so a finding stays attributable
- * to the run that produced it. There is deliberately no `context` section —
+ * `findings` is stored keyed by `runId`, so a finding stays attributable to
+ * the run that produced it. There is deliberately no `context` section —
  * analysis context lives in `cortex_analysis_state.context` and is injected
  * separately by the chat route.
  *
  * `updateSection` is a section-addressable read-modify-write: the named
  * section is replaced or amended and the other three are left byte-identical.
+ *
+ * **Working memory is re-injected, in full, into the uncached tail of every
+ * turn** — so every stored character is re-paid on every later turn for the
+ * life of the analysis. Two consequences shape this module:
+ *
+ *  - **Every section is bounded at write time** (`WORKING_MEMORY_LIMITS`). An
+ *    over-cap write is *rejected* with a model-actionable message, never
+ *    silently truncated: the agent must shorten the text or retire a stale
+ *    entry. Every section — findings included — therefore supports
+ *    add/revise/retire, so memory can shrink as well as grow.
+ *  - **Memory holds references to runs, never run content.** A finding cites
+ *    the `runId` that produced it and renders as one line in a single flat
+ *    list; the run's detail stays retrievable via `inspect_run`.
  */
-import type { ResultAsync } from "neverthrow";
+import { type ResultAsync } from "neverthrow";
 import type { Pool } from "pg";
 import { z } from "zod";
 import { type DbError } from "../lib/db-result.js";
+/**
+ * The write-time bounds on working memory. `updateSection` enforces them, the
+ * `update_working_memory` input schema declares them to the model (importing
+ * these same numbers), and `renderWorkingMemory` uses them to bound its output.
+ */
+export declare const WORKING_MEMORY_LIMITS: {
+    /** Max characters in the goal. */
+    readonly goalChars: 500;
+    /** Max characters in one constraint / hypothesis / finding entry. */
+    readonly entryChars: 300;
+    /** Max constraint entries. */
+    readonly constraints: 20;
+    /** Max hypothesis entries. */
+    readonly hypotheses: 10;
+    /** Max finding entries, summed across every run. */
+    readonly findings: 30;
+};
 /** A binding rule — user-stated or agent-derived. The highest-value section. */
 export declare const constraintSchema: z.ZodObject<{
     id: z.ZodString;
@@ -43,6 +73,11 @@ export type Finding = z.infer<typeof findingSchema>;
 /**
  * The persisted `data` shape — one JSONB object per analysis. `findings` is
  * keyed by `runId`; an analysis with no recorded findings has an empty map.
+ *
+ * Deliberately unbounded: the caps are a *write-time* rule, not a read-time
+ * one. A row written before the caps existed must still `load` — so this
+ * schema validates shape only, and `renderWorkingMemory` bounds what an
+ * oversized row is allowed to cost.
  */
 export declare const workingMemorySchema: z.ZodObject<{
     goal: z.ZodString;
@@ -66,6 +101,20 @@ export declare const workingMemorySchema: z.ZodObject<{
 export type WorkingMemory = z.infer<typeof workingMemorySchema>;
 /** The shape `load` returns for an analysis with no working-memory row. */
 export declare function emptyWorkingMemory(): WorkingMemory;
+/**
+ * A refused write: a cap was hit, or an id addresses nothing. Not a storage
+ * failure — it is an expected outcome the *model* can correct, so `message` is
+ * written for the model and says what to do next (shorten this, retire that).
+ * The tool surfaces it as an `is_error` tool result; the row is untouched.
+ */
+export interface WorkingMemoryRejection {
+    readonly type: "working_memory_rejected";
+    readonly message: string;
+}
+/** `updateSection`'s error channel: a storage failure, or a refused write. */
+export type WorkingMemoryError = DbError | WorkingMemoryRejection;
+/** Narrow a `WorkingMemoryError` to the model-correctable branch. */
+export declare function isWorkingMemoryRejection(error: WorkingMemoryError): error is WorkingMemoryRejection;
 /**
  * A list-section amendment: append a new entry, revise an existing one's
  * text, or retire a stale one. `revise`/`retire` address an entry by the
@@ -95,6 +144,23 @@ export type ConstraintOp = {
     readonly op: "retire";
     readonly id: string;
 };
+/**
+ * As `ListOp`, but `add` also carries the `runId` the finding is attributed
+ * to. `revise`/`retire` address the finding by its own id — the run holding it
+ * is found from that id, so the agent never has to re-cite the run.
+ */
+export type FindingOp = {
+    readonly op: "add";
+    readonly runId: string;
+    readonly text: string;
+} | {
+    readonly op: "revise";
+    readonly id: string;
+    readonly text: string;
+} | {
+    readonly op: "retire";
+    readonly id: string;
+};
 /** The `value` argument of `updateSection`, keyed by the `section` name. */
 export interface SectionValue {
     readonly goal: {
@@ -102,10 +168,7 @@ export interface SectionValue {
     };
     readonly constraint: ConstraintOp;
     readonly hypothesis: ListOp;
-    readonly finding: {
-        readonly runId: string;
-        readonly text: string;
-    };
+    readonly finding: FindingOp;
 }
 export type Section = keyof SectionValue;
 /**
@@ -118,13 +181,33 @@ export interface WorkingMemoryStore {
     load(analysisId: string): ResultAsync<WorkingMemory, DbError>;
     /**
      * Atomically read-modify-write one section. The other three sections are
-     * left byte-identical; the row is upserted if absent.
+     * left byte-identical; the row is upserted if absent. A write that breaks a
+     * cap or addresses an unknown id is refused — `err(WorkingMemoryRejection)`,
+     * and the row is left exactly as it was.
      */
-    updateSection<S extends Section>(analysisId: string, section: S, value: SectionValue[S]): ResultAsync<void, DbError>;
+    updateSection<S extends Section>(analysisId: string, section: S, value: SectionValue[S]): ResultAsync<void, WorkingMemoryError>;
     /** Serialize working memory to a Markdown document for injection. */
     render(analysisId: string): ResultAsync<string, DbError>;
 }
-/** Serialize working memory to the Markdown document injected each turn. */
+/**
+ * Serialize working memory to the Markdown document injected each turn.
+ *
+ * Renders only what exists: an empty section is omitted entirely — no heading,
+ * no placeholder — and an entirely empty memory renders to the **empty
+ * string**, costing nothing. The chat route injects the render
+ * unconditionally, and the provider's outbound sanitizer drops a message whose
+ * content is `""` before the wire call (`providers/ai-sdk.ts`), so an empty
+ * memory reaches the model as no message at all.
+ *
+ * Findings render as ONE flat list, each line citing the run it came from —
+ * never a per-run heading block. Memory holds the reference; `inspect_run`
+ * holds the run.
+ *
+ * The output is bounded to `WORKING_MEMORY_LIMITS` no matter what the row
+ * holds. Writes are capped, so only a row written before the caps existed can
+ * exceed them — and it degrades to its newest entries rather than exploding
+ * the context window.
+ */
 export declare function renderWorkingMemory(wm: WorkingMemory): string;
 /**
  * Create a `WorkingMemoryStore` bound to a Postgres pool — a factory closure

package/dist/memory/working-memory.js

@@ -6,16 +6,47 @@
  * to Markdown only when injected (see the harness-thread-store spec).
  *
  * Four sections. `goal`, `constraints`, `hypotheses` are analysis-flat;
- * `findings` is run-scoped, keyed by `runId`, so a finding stays attributable
- * to the run that produced it. There is deliberately no `context` section —
+ * `findings` is stored keyed by `runId`, so a finding stays attributable to
+ * the run that produced it. There is deliberately no `context` section —
  * analysis context lives in `cortex_analysis_state.context` and is injected
  * separately by the chat route.
  *
  * `updateSection` is a section-addressable read-modify-write: the named
  * section is replaced or amended and the other three are left byte-identical.
+ *
+ * **Working memory is re-injected, in full, into the uncached tail of every
+ * turn** — so every stored character is re-paid on every later turn for the
+ * life of the analysis. Two consequences shape this module:
+ *
+ *  - **Every section is bounded at write time** (`WORKING_MEMORY_LIMITS`). An
+ *    over-cap write is *rejected* with a model-actionable message, never
+ *    silently truncated: the agent must shorten the text or retire a stale
+ *    entry. Every section — findings included — therefore supports
+ *    add/revise/retire, so memory can shrink as well as grow.
+ *  - **Memory holds references to runs, never run content.** A finding cites
+ *    the `runId` that produced it and renders as one line in a single flat
+ *    list; the run's detail stays retrievable via `inspect_run`.
  */
+import { err, ok, okAsync } from "neverthrow";
 import { z } from "zod";
 import { tryMutation, tryQuery, withTransaction } from "../lib/db-result.js";
+/**
+ * The write-time bounds on working memory. `updateSection` enforces them, the
+ * `update_working_memory` input schema declares them to the model (importing
+ * these same numbers), and `renderWorkingMemory` uses them to bound its output.
+ */
+export const WORKING_MEMORY_LIMITS = {
+    /** Max characters in the goal. */
+    goalChars: 500,
+    /** Max characters in one constraint / hypothesis / finding entry. */
+    entryChars: 300,
+    /** Max constraint entries. */
+    constraints: 20,
+    /** Max hypothesis entries. */
+    hypotheses: 10,
+    /** Max finding entries, summed across every run. */
+    findings: 30,
+};
 /** A binding rule — user-stated or agent-derived. The highest-value section. */
 export const constraintSchema = z.object({
     id: z.string(),
@@ -35,6 +66,11 @@ export const findingSchema = z.object({
 /**
  * The persisted `data` shape — one JSONB object per analysis. `findings` is
  * keyed by `runId`; an analysis with no recorded findings has an empty map.
+ *
+ * Deliberately unbounded: the caps are a *write-time* rule, not a read-time
+ * one. A row written before the caps existed must still `load` — so this
+ * schema validates shape only, and `renderWorkingMemory` bounds what an
+ * oversized row is allowed to cost.
  */
 export const workingMemorySchema = z.object({
     goal: z.string(),
@@ -46,106 +82,198 @@ export const workingMemorySchema = z.object({
 export function emptyWorkingMemory() {
     return { goal: "", constraints: [], hypotheses: [], findings: {} };
 }
+/** Narrow a `WorkingMemoryError` to the model-correctable branch. */
+export function isWorkingMemoryRejection(error) {
+    return error.type === "working_memory_rejected";
+}
 /** A short, render-friendly entry id. */
 function newId() {
     return crypto.randomUUID().slice(0, 8);
 }
-function applyListOp(entries, op) {
+function reject(message) {
+    return err({ type: "working_memory_rejected", message });
+}
+function rejectUnknownId(section, id) {
+    return reject(`no ${section} with id "${id}" — nothing was changed. Copy an id verbatim from the [id] shown ` +
+        `against each entry in the rendered working memory, or add a new entry instead.`);
+}
+function rejectFull(section, limit) {
+    return reject(`${section} is full (${limit}/${limit}) — the new entry was NOT recorded. Working memory is ` +
+        `re-injected on every turn, so it is capped. Retire a stale entry first (operation "retire" ` +
+        `with its id), then add this one — or drop it, if it earns its place less than everything ` +
+        `already there.`);
+}
+/** Validate one entry's text against the shared entry cap. */
+function checkEntryText(section, text) {
+    const trimmed = text.trim();
+    if (trimmed.length === 0)
+        return reject(`${section} text is empty — nothing was recorded.`);
+    if (trimmed.length > WORKING_MEMORY_LIMITS.entryChars) {
+        return reject(`${section} text is ${trimmed.length} characters — the cap is ${WORKING_MEMORY_LIMITS.entryChars}. It was ` +
+            `NOT recorded. Rewrite it as one concise line and retry; keep the detail in the run itself, ` +
+            `which inspect_run still serves.`);
+    }
+    return ok(trimmed);
+}
+/** Amend a flat `{id, text}` list — the shared body of constraints and hypotheses. */
+function applyEntryOp(entries, op, section, limit, create) {
     switch (op.op) {
         case "add":
-            return [...entries, { id: newId(), text: op.text }];
-        case "revise":
-            return entries.map((e) => (e.id === op.id ? { ...e, text: op.text } : e));
-        case "retire":
-            return entries.filter((e) => e.id !== op.id);
+            if (entries.length >= limit)
+                return rejectFull(section, limit);
+            return checkEntryText(section, op.text).map((text) => [...entries, create(text)]);
+        case "revise": {
+            if (!entries.some((e) => e.id === op.id))
+                return rejectUnknownId(section, op.id);
+            return checkEntryText(section, op.text).map((text) => entries.map((e) => (e.id === op.id ? { ...e, text } : e)));
+        }
+        case "retire": {
+            if (!entries.some((e) => e.id === op.id))
+                return rejectUnknownId(section, op.id);
+            return ok(entries.filter((e) => e.id !== op.id));
+        }
     }
 }
-function applyConstraintOp(entries, op) {
+/** Findings across every run — the cap governs the section, not one run's bucket. */
+function countFindings(findings) {
+    return Object.values(findings).reduce((n, list) => n + list.length, 0);
+}
+/** The run a finding id hangs under, or `undefined` if no run holds it. */
+function runOfFinding(findings, id) {
+    return Object.keys(findings).find((runId) => findings[runId].some((f) => f.id === id));
+}
+function applyFindingOp(findings, op) {
     switch (op.op) {
-        case "add":
-            return [...entries, { id: newId(), text: op.text, origin: op.origin }];
-        case "revise":
-            return entries.map((e) => (e.id === op.id ? { ...e, text: op.text } : e));
-        case "retire":
-            return entries.filter((e) => e.id !== op.id);
+        case "add": {
+            if (countFindings(findings) >= WORKING_MEMORY_LIMITS.findings) {
+                return rejectFull("findings", WORKING_MEMORY_LIMITS.findings);
+            }
+            return checkEntryText("finding", op.text).map((text) => ({
+                ...findings,
+                [op.runId]: [...(findings[op.runId] ?? []), { id: newId(), text }],
+            }));
+        }
+        case "revise": {
+            const runId = runOfFinding(findings, op.id);
+            if (runId === undefined)
+                return rejectUnknownId("finding", op.id);
+            return checkEntryText("finding", op.text).map((text) => ({
+                ...findings,
+                [runId]: findings[runId].map((f) => (f.id === op.id ? { ...f, text } : f)),
+            }));
+        }
+        case "retire": {
+            const runId = runOfFinding(findings, op.id);
+            if (runId === undefined)
+                return rejectUnknownId("finding", op.id);
+            const kept = findings[runId].filter((f) => f.id !== op.id);
+            const next = { ...findings };
+            // An emptied run bucket is dropped whole: memory references a run only
+            // for as long as it holds a finding from it.
+            if (kept.length === 0)
+                delete next[runId];
+            else
+                next[runId] = kept;
+            return ok(next);
+        }
     }
 }
-/** Pure section-addressable amendment. Sibling sections are never touched. */
+/**
+ * Pure section-addressable amendment. Sibling sections are never touched; a
+ * refused write returns `err` and the caller writes nothing.
+ */
 function applySectionUpdate(wm, section, value) {
     switch (section) {
-        case "goal":
-            return { ...wm, goal: value.text };
-        case "constraint":
-            return {
-                ...wm,
-                constraints: applyConstraintOp(wm.constraints, value),
-            };
-        case "hypothesis":
-            return {
-                ...wm,
-                hypotheses: applyListOp(wm.hypotheses, value),
-            };
-        case "finding": {
-            const { runId, text } = value;
-            const existing = wm.findings[runId] ?? [];
-            return {
-                ...wm,
-                findings: {
-                    ...wm.findings,
-                    [runId]: [...existing, { id: newId(), text }],
-                },
-            };
+        case "goal": {
+            const text = value.text.trim();
+            if (text.length > WORKING_MEMORY_LIMITS.goalChars) {
+                return reject(`the goal is ${text.length} characters — the cap is ${WORKING_MEMORY_LIMITS.goalChars}. It was NOT ` +
+                    `recorded. State the objective in a sentence or two; the supporting detail belongs in ` +
+                    `constraints and findings, not in the goal.`);
+            }
+            return ok({ ...wm, goal: text });
+        }
+        case "constraint": {
+            const op = value;
+            const origin = op.op === "add" ? op.origin : "agent";
+            return applyEntryOp(wm.constraints, op, "constraints", WORKING_MEMORY_LIMITS.constraints, (text) => ({
+                id: newId(),
+                text,
+                origin,
+            })).map((constraints) => ({ ...wm, constraints }));
         }
+        case "hypothesis":
+            return applyEntryOp(wm.hypotheses, value, "hypotheses", WORKING_MEMORY_LIMITS.hypotheses, (text) => ({
+                id: newId(),
+                text,
+            })).map((hypotheses) => ({ ...wm, hypotheses }));
+        case "finding":
+            return applyFindingOp(wm.findings, value).map((findings) => ({ ...wm, findings }));
     }
     // Unreachable — `section` is exhaustively a `Section`.
-    return wm;
+    return ok(wm);
+}
+/** Every finding, in insertion order, each carrying its run reference. */
+function flattenFindings(findings) {
+    return Object.entries(findings).flatMap(([runId, list]) => list.map((f) => ({ ...f, runId })));
+}
+/** Keep the newest `limit` entries, reporting how many older ones were dropped. */
+function newest(entries, limit) {
+    if (entries.length <= limit)
+        return { shown: entries, omitted: 0 };
+    return { shown: entries.slice(entries.length - limit), omitted: entries.length - limit };
 }
-/** Serialize working memory to the Markdown document injected each turn. */
+/** Bound one entry's rendered text. Only a legacy over-cap row can hit this. */
+function clamp(text, limit) {
+    const trimmed = text.trim();
+    return trimmed.length <= limit ? trimmed : `${trimmed.slice(0, limit)}…`;
+}
+function renderSection(heading, lines, omitted, label) {
+    const body = omitted > 0 ? [...lines, `- … ${omitted} older ${label} omitted — over cap; retire entries above.`] : lines;
+    return `## ${heading}\n\n${body.join("\n")}`;
+}
+/**
+ * Serialize working memory to the Markdown document injected each turn.
+ *
+ * Renders only what exists: an empty section is omitted entirely — no heading,
+ * no placeholder — and an entirely empty memory renders to the **empty
+ * string**, costing nothing. The chat route injects the render
+ * unconditionally, and the provider's outbound sanitizer drops a message whose
+ * content is `""` before the wire call (`providers/ai-sdk.ts`), so an empty
+ * memory reaches the model as no message at all.
+ *
+ * Findings render as ONE flat list, each line citing the run it came from —
+ * never a per-run heading block. Memory holds the reference; `inspect_run`
+ * holds the run.
+ *
+ * The output is bounded to `WORKING_MEMORY_LIMITS` no matter what the row
+ * holds. Writes are capped, so only a row written before the caps existed can
+ * exceed them — and it degrades to its newest entries rather than exploding
+ * the context window.
+ */
 export function renderWorkingMemory(wm) {
-    const lines = ["# Working Memory", ""];
-    lines.push("## Goal", "");
-    lines.push(wm.goal.trim().length > 0 ? wm.goal.trim() : "_none yet_", "");
-    lines.push("## Constraints", "");
-    if (wm.constraints.length === 0) {
-        lines.push("_none yet_");
-    }
-    else {
-        for (const c of wm.constraints) {
-            lines.push(`- [${c.id}] (${c.origin}) ${c.text}`);
-        }
-    }
-    lines.push("");
-    lines.push("## Hypotheses", "");
-    if (wm.hypotheses.length === 0) {
-        lines.push("_none yet_");
+    const sections = [];
+    const goal = clamp(wm.goal, WORKING_MEMORY_LIMITS.goalChars);
+    if (goal.length > 0)
+        sections.push(`## Goal\n\n${goal}`);
+    const constraints = newest(wm.constraints, WORKING_MEMORY_LIMITS.constraints);
+    if (constraints.shown.length > 0) {
+        const lines = constraints.shown.map((c) => `- [${c.id}] (${c.origin}) ${clamp(c.text, WORKING_MEMORY_LIMITS.entryChars)}`);
+        sections.push(renderSection("Constraints", lines, constraints.omitted, "constraints"));
     }
-    else {
-        for (const h of wm.hypotheses) {
-            lines.push(`- [${h.id}] ${h.text}`);
-        }
-    }
-    lines.push("");
-    lines.push("## Findings", "");
-    const runIds = Object.keys(wm.findings);
-    if (runIds.length === 0) {
-        lines.push("_none yet_");
+    const hypotheses = newest(wm.hypotheses, WORKING_MEMORY_LIMITS.hypotheses);
+    if (hypotheses.shown.length > 0) {
+        const lines = hypotheses.shown.map((h) => `- [${h.id}] ${clamp(h.text, WORKING_MEMORY_LIMITS.entryChars)}`);
+        sections.push(renderSection("Hypotheses", lines, hypotheses.omitted, "hypotheses"));
     }
-    else {
-        for (const runId of runIds) {
-            lines.push(`### Run ${runId}`, "");
-            const findings = wm.findings[runId] ?? [];
-            if (findings.length === 0) {
-                lines.push("_none yet_");
-            }
-            else {
-                for (const f of findings) {
-                    lines.push(`- [${f.id}] ${f.text}`);
-                }
-            }
-            lines.push("");
-        }
+    const findings = newest(flattenFindings(wm.findings), WORKING_MEMORY_LIMITS.findings);
+    if (findings.shown.length > 0) {
+        const lines = findings.shown.map((f) => `- [${f.id}] (${f.runId}) ${clamp(f.text, WORKING_MEMORY_LIMITS.entryChars)}`);
+        sections.push(renderSection("Findings", lines, findings.omitted, "findings"));
     }
-    return `${lines.join("\n").trimEnd()}\n`;
+    if (sections.length === 0)
+        return "";
+    return `# Working Memory\n\n${sections.join("\n\n")}\n`;
 }
 /**
  * Create a `WorkingMemoryStore` bound to a Postgres pool — a factory closure
@@ -164,7 +292,9 @@ export function createWorkingMemory(pool) {
         return withTransaction(pool, "working-memory.updateSection", (client) => 
         // Serialize concurrent read-modify-write on this analysis — the lock
         // covers the not-yet-existing-row case an `SELECT ... FOR UPDATE`
-        // would miss. Released automatically at COMMIT/ROLLBACK.
+        // would miss. Released automatically at COMMIT/ROLLBACK. The cap check
+        // runs under it too, so two racing adds cannot both slip past a full
+        // section.
         tryQuery("working-memory.updateSection.lock", () => client.query("SELECT pg_advisory_xact_lock(hashtext($1))", [analysisId]))
             .andThen(() => tryQuery("working-memory.updateSection.read", () => client.query("SELECT data FROM cortex_working_memory WHERE analysis_id = $1", [analysisId])))
             .map(({ rows }) => {
@@ -173,10 +303,16 @@ export function createWorkingMemory(pool) {
             const current = rows.length === 0 ? emptyWorkingMemory() : workingMemorySchema.parse(rows[0].data);
             return applySectionUpdate(current, section, value);
         })
-            .andThen((next) => tryMutation("working-memory.updateSection.upsert", () => client.query(`INSERT INTO cortex_working_memory (analysis_id, data, updated_at)
+            .andThen((amended) => 
+        // A rejection rides the transaction's ok channel: it is a decision, not a
+        // storage failure. The transaction commits having written nothing, and the
+        // rejection is lifted back into the error channel below.
+        amended.isErr()
+            ? okAsync(err(amended.error))
+            : tryMutation("working-memory.updateSection.upsert", () => client.query(`INSERT INTO cortex_working_memory (analysis_id, data, updated_at)
                VALUES ($1, $2::jsonb, NOW())
                ON CONFLICT (analysis_id)
-               DO UPDATE SET data = EXCLUDED.data, updated_at = NOW()`, [analysisId, JSON.stringify(next)])).map(() => undefined)));
+               DO UPDATE SET data = EXCLUDED.data, updated_at = NOW()`, [analysisId, JSON.stringify(amended.value)])).map(() => ok(undefined)))).andThen((written) => written);
     }
     function render(analysisId) {
         return load(analysisId).map(renderWorkingMemory);