@miller-tech/uap 1.20.48 → 1.20.50

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@miller-tech/uap",
-  "version": "1.20.48",
+  "version": "1.20.50",
   "description": "Autonomous AI agent memory system with CLAUDE.md protocol enforcement",
   "type": "module",
   "main": "dist/index.js",

package/tools/agents/scripts/anthropic_proxy.py

@@ -207,6 +207,19 @@ _READ_ONLY_TOOL_CLASS = frozenset({
     "search", "Search", "list_files", "ListFiles",
 })
 
+# Tools that produce or mutate a deliverable. Using any of these in a turn
+# means the agent is converging from exploration toward output, and resets
+# the recon-convergence streak (B1). This is deliberately a SHORT allowlist
+# of write tools, NOT a read-only denylist: exploration happens through an
+# open-ended set of tools (Bash, WebFetch, Agent, ...) that cannot be
+# enumerated, but "the agent produced a write" is a small, stable signal.
+# Names are matched case-insensitively (callers lower() before lookup).
+_WRITE_TOOL_CLASS = frozenset({
+    "write", "edit", "multiedit", "notebookedit",
+    "str_replace", "str_replace_editor", "str_replace_based_edit_tool",
+    "create_file", "applypatch", "apply_patch",
+})
+
 PROXY_GUARDRAIL_RETRY = os.environ.get("PROXY_GUARDRAIL_RETRY", "on").lower() not in {
     "0",
     "false",
@@ -224,12 +237,15 @@ PROXY_FINALIZE_CONTINUATION_MAX = int(
 PROXY_FINALIZE_SESSION_HARD_CAP = int(
     os.environ.get("PROXY_FINALIZE_SESSION_HARD_CAP", "3")
 )
-# Recon-convergence guardrail: after this many consecutive turns of PURE
-# read-only exploration (Read/Grep/Glob/etc. — no write/edit/deliverable
-# tool), the proxy injects a directive telling the model to stop exploring
-# and produce its deliverable. Targets the failure mode where an agentic
-# recon task reads files for hundreds of turns and never converges to the
+# Recon-convergence guardrail: after this many consecutive turns that use
+# tools but produce NO write/deliverable tool call (see _WRITE_TOOL_CLASS),
+# the proxy injects a directive telling the model to stop exploring and
+# produce its deliverable. Targets the failure mode where an agentic recon
+# task explores for hundreds of turns and never converges to the
 # synthesis/write step (observed: 664-turn recon, no deliverable started).
+# Defined as write-tool ABSENCE rather than read-tool presence: a real
+# recon agent explores via Bash/WebFetch/Agent, not just Read/Grep, so a
+# "all tools are recognized read-only" test never accumulates a streak.
 # 0 disables.
 PROXY_RECON_CONVERGENCE_THRESHOLD = int(
     os.environ.get("PROXY_RECON_CONVERGENCE_THRESHOLD", "40")
@@ -712,6 +728,7 @@ class SessionMonitor:
     peak_input_tokens: int = 0  # High-water mark
     prune_count: int = 0  # How many times pruning was triggered
     overflow_count: int = 0  # How many context overflow errors caught
+    prune_drop_count: int = 0  # monotonic: # of oldest middle msgs pruned (B3)
     context_history: list = field(default_factory=list)  # Recent token counts
 
     # --- Token Loop Protection ---
@@ -726,7 +743,7 @@ class SessionMonitor:
     )
     loop_warnings_emitted: int = 0  # How many loop warnings sent to the model
     no_progress_streak: int = 0  # Forced tool turns without new tool_result
-    consecutive_readonly_turns: int = 0  # turns of pure read-only exploration (B1)
+    consecutive_no_write_turns: int = 0  # turns exploring with no write tool (B1)
     unexpected_end_turn_count: int = 0  # end_turn without tool_use in active loop
     tool_starvation_streak: int = 0  # Consecutive forced turns with no tool_calls produced
     malformed_tool_streak: int = 0  # consecutive malformed pseudo tool payloads
@@ -884,15 +901,19 @@ class SessionMonitor:
         if len(self.tool_call_history) > 30:
             self.tool_call_history = self.tool_call_history[-30:]
 
-        # Recon-convergence (B1): count consecutive turns of PURE read-only
-        # exploration. A turn that uses any non-read-only tool (write, edit,
-        # a deliverable tool) resets the streak — that's the model
-        # converging from exploration toward synthesis/action.
-        _ro = {n.lower() for n in _READ_ONLY_TOOL_CLASS}
-        if tool_names and all(n.lower() in _ro for n in tool_names):
-            self.consecutive_readonly_turns += 1
-        else:
-            self.consecutive_readonly_turns = 0
+        # Recon-convergence (B1): count consecutive turns that use tools but
+        # produce NO write/deliverable tool call. A turn that uses any write
+        # tool resets the streak — that's the model converging from
+        # exploration toward synthesis/output. A turn with no tool calls at
+        # all is a plain-text turn (neither exploration nor a write) and
+        # leaves the streak unchanged. This is the inverse of the old
+        # "all tools are recognized read-only" test, which reset on any
+        # Bash/WebFetch/Agent turn and so never accumulated for real agents.
+        if tool_names:
+            if any(n.lower() in _WRITE_TOOL_CLASS for n in tool_names):
+                self.consecutive_no_write_turns = 0
+            else:
+                self.consecutive_no_write_turns += 1
 
         # Track read-only tool targets for dedup (Option 3)
         if tool_targets:
@@ -1318,24 +1339,83 @@ def estimate_total_tokens(anthropic_body: dict) -> int:
     return tokens
 
 
+# Max tool-result breadcrumbs listed in a prune summary (B2). Bounds the
+# summary size — beyond this the oldest breadcrumbs are elided.
+_PRUNE_SUMMARY_MAX_ITEMS = int(os.environ.get("PROXY_PRUNE_SUMMARY_MAX_ITEMS", "30"))
+
+
+def _summarize_pruned_block(dropped: list[dict]) -> str:
+    """Build a compact breadcrumb summary of pruned messages (B2).
+
+    Instead of discarding dropped tool-results outright, leave a one-line
+    trace of each so the agent retains *what it already found*. A recon
+    agent that can still see "I read auth_handler.cpp — JWT validation in
+    validateToken()" is far likelier to converge to a synthesis than one
+    whose findings vanished entirely and which therefore re-explores.
+
+    Heuristic only — no LLM call. Bounded to the most recent
+    PROXY_PRUNE_SUMMARY_MAX_ITEMS tool-result breadcrumbs so the summary
+    itself cannot grow unbounded.
+    """
+    breadcrumbs: list[str] = []
+    for msg in dropped:
+        content = msg.get("content", [])
+        if not isinstance(content, list):
+            continue
+        for block in content:
+            if isinstance(block, dict) and block.get("type") == "tool_result":
+                text = _extract_text(block.get("content", "")).strip()
+                if not text:
+                    continue
+                excerpt = " ".join(text.split())[:100]
+                breadcrumbs.append(
+                    f"- tool result (~{estimate_tokens(text)} tok): {excerpt}"
+                )
+    if not breadcrumbs:
+        return (
+            "[CONTEXT PRUNED: older messages were removed to fit the context "
+            "window. The conversation continues from recent context below.]"
+        )
+    total = len(breadcrumbs)
+    if total > _PRUNE_SUMMARY_MAX_ITEMS:
+        breadcrumbs = breadcrumbs[-_PRUNE_SUMMARY_MAX_ITEMS:]
+    header = (
+        f"[CONTEXT PRUNED — {len(dropped)} older messages removed to fit the "
+        "context window. Breadcrumbs of earlier findings"
+    )
+    if total > len(breadcrumbs):
+        header += f" (most recent {len(breadcrumbs)} of {total} tool results)"
+    header += " — rely on these instead of re-reading those files:]"
+    return header + "\n" + "\n".join(breadcrumbs)
+
+
 def prune_conversation(
     anthropic_body: dict,
     context_window: int,
+    monitor: "SessionMonitor | None" = None,
     target_fraction: float = 0.65,
     keep_last: int = 8,
 ) -> dict:
     """Prune the conversation to fit within the context window.
 
-    Strategy:
-    - Always keep: system prompt, first user message, last N messages
-    - Remove from the middle: oldest tool_result messages first (they're
-      the largest -- file contents, command output, etc.), then oldest
-      assistant messages, then oldest user messages.
-    - Inject a [CONTEXT PRUNED] marker so the model knows history was trimmed.
+    Strategy (reworked — UAP PR #186):
+    - Always keep: system prompt, first user message, last N messages.
+    - Drop a CONTIGUOUS block of the oldest middle messages. The drop
+      count is persisted per-session on the monitor (`prune_drop_count`)
+      and is monotonic — it only ever grows. This keeps the retained
+      region a stable recent *suffix*: on turns where the boundary does
+      not advance, the upstream KV-cache prefix stays valid and the turn
+      is not reprocessed. (The previous priority-greedy keep was
+      non-contiguous and reshuffled the prompt mid-stream every turn,
+      defeating the cache.)
+    - Replace the dropped block with a breadcrumb summary (see
+      _summarize_pruned_block) so the agent keeps its earlier findings.
 
     Args:
         anthropic_body: The full Anthropic request body
         context_window: Maximum context window in tokens
+        monitor: SessionMonitor — carries the monotonic prune boundary.
+            When None, pruning still works but is non-monotonic per call.
         target_fraction: Target utilization after pruning (0.0-1.0)
         keep_last: Number of recent messages to always keep (default 8)
 
@@ -1411,70 +1491,39 @@ def prune_conversation(
 
     remaining_budget = message_budget - protected_tokens
 
-    # Score middle messages for removal priority:
-    # - tool_result messages: remove first (biggest, least important historically)
-    # - assistant text-only: remove second
-    # - user messages: remove last (provide context for the model's actions)
-    # Within each category, remove oldest first.
-    scored_middle = []
-    for i, msg in enumerate(middle):
-        content = msg.get("content", [])
-        tokens = estimate_message_tokens(msg)
-        is_tool_result = False
-        is_assistant = msg.get("role") == "assistant"
-
-        if isinstance(content, list):
-            is_tool_result = any(
-                isinstance(b, dict) and b.get("type") == "tool_result" for b in content
-            )
-
-        # Lower priority = removed first
-        if is_tool_result:
-            priority = 0  # Remove first
-        elif is_assistant:
-            priority = 1  # Remove second
-        else:
-            priority = 2  # Remove last (user messages)
-
-        scored_middle.append((priority, i, tokens, msg))
-
-    # Sort by priority (ascending = remove first), then by index (oldest first)
-    scored_middle.sort(key=lambda x: (x[0], x[1]))
-
-    # Greedily keep messages from highest priority (keep last) until budget fills
-    kept_middle = []
-    used_tokens = 0
-    # Process in reverse priority order (keep high-priority messages first)
-    for priority, idx, tokens, msg in reversed(scored_middle):
-        if used_tokens + tokens <= remaining_budget:
-            kept_middle.append((idx, msg))
-            used_tokens += tokens
-
-    # Sort kept messages back into original order
-    kept_middle.sort(key=lambda x: x[0])
-    kept_msgs = [m for _, m in kept_middle]
+    # --- Monotonic contiguous prune boundary (cache-stable, B3) ---
+    # Drop the oldest `drop_count` middle messages as one contiguous block.
+    # Seed from the monitor's persisted boundary; advance it only as far as
+    # the budget forces. Persist back monotonically so a later/looser prune
+    # in the same turn can't shrink it (which would reshuffle the prompt).
+    drop_count = 0
+    if monitor is not None:
+        drop_count = min(max(0, monitor.prune_drop_count), len(middle))
+    while drop_count < len(middle):
+        kept_tokens = sum(estimate_message_tokens(m) for m in middle[drop_count:])
+        if kept_tokens <= remaining_budget:
+            break
+        drop_count += 1
+    if monitor is not None:
+        monitor.prune_drop_count = max(monitor.prune_drop_count, drop_count)
 
-    removed_count = len(middle) - len(kept_msgs)
-    removed_tokens = sum(t for _, _, t, _ in scored_middle) - used_tokens
+    dropped = middle[:drop_count]
+    kept_msgs = middle[drop_count:]
 
-    if removed_count > 0:
-        # Insert a context-pruned marker
+    if dropped:
+        # Replace the dropped block with a findings-breadcrumb summary (B2).
         prune_marker = {
             "role": "user",
-            "content": (
-                f"[CONTEXT PRUNED: {removed_count} older messages (~{removed_tokens} tokens) "
-                f"were removed to fit within the context window. "
-                f"The conversation continues from recent context below.]"
-            ),
+            "content": _summarize_pruned_block(dropped),
         }
         anthropic_body["messages"] = (
             protected_head + [prune_marker] + kept_msgs + protected_tail
         )
         logger.warning(
-            "PRUNED: removed %d messages (~%d tokens), kept %d messages, "
-            "target=%.0f%% of %d ctx",
-            removed_count,
-            removed_tokens,
+            "PRUNED: dropped %d oldest middle messages (boundary=%d), "
+            "kept %d total, target=%.0f%% of %d ctx",
+            len(dropped),
+            drop_count,
             len(anthropic_body["messages"]),
             target_fraction * 100,
             context_window,
@@ -3240,46 +3289,46 @@ def _resolve_state_machine_tool_choice(
 
 
 def _maybe_inject_recon_convergence(openai_body: dict, monitor: "SessionMonitor") -> None:
-    """Nudge a session stuck in prolonged read-only exploration toward its
-    deliverable.
-
-    Fires when `consecutive_readonly_turns` crosses
-    PROXY_RECON_CONVERGENCE_THRESHOLD — the model has read files for many
-    turns without writing anything. Targets the observed failure mode of
-    an agentic recon task wandering for hundreds of turns and never
-    converging to the synthesis/write step. Two escalation tiers: a firm
-    "switch to synthesis" directive, then a hard "STOP, write it now" once
-    the streak is 2x over threshold.
+    """Nudge a session stuck in prolonged exploration toward its deliverable.
+
+    Fires when `consecutive_no_write_turns` crosses
+    PROXY_RECON_CONVERGENCE_THRESHOLD — the model has used tools for many
+    turns without producing any write/deliverable tool call. Targets the
+    observed failure mode of an agentic recon task wandering for hundreds
+    of turns and never converging to the synthesis/write step. Two
+    escalation tiers: a firm "switch to synthesis" directive, then a hard
+    "STOP, write it now" once the streak is 2x over threshold.
     """
     if PROXY_RECON_CONVERGENCE_THRESHOLD <= 0:
         return
-    streak = monitor.consecutive_readonly_turns
+    streak = monitor.consecutive_no_write_turns
     if streak < PROXY_RECON_CONVERGENCE_THRESHOLD:
         return
     util = monitor.get_utilization()
     if streak >= 2 * PROXY_RECON_CONVERGENCE_THRESHOLD:
         directive = (
             f"STOP exploring. You have run {streak} consecutive turns of "
-            f"read-only exploration and context is at {util * 100:.0f}%. "
-            "You will NOT finish if you keep reading files. Produce your "
-            "deliverable NOW from the information you already have — write "
-            "it to a file with the appropriate tool. Do not read anything else."
+            f"exploration without producing a deliverable and context is at "
+            f"{util * 100:.0f}%. You will NOT finish if you keep exploring. "
+            "Produce your deliverable NOW from the information you already "
+            "have — write it to a file with the appropriate tool. Do not "
+            "read or run anything else."
         )
         tier = "hard"
     else:
         directive = (
-            f"You have read files for {streak} consecutive turns without "
+            f"You have explored for {streak} consecutive turns without "
             f"producing a deliverable (context {util * 100:.0f}%). You have "
             "enough to begin. Switch from exploration to synthesis: write "
-            "your deliverable now. Read at most one more file, and only if "
-            "strictly required to write it."
+            "your deliverable now. Explore at most one more time, and only "
+            "if strictly required to write it."
         )
         tier = "firm"
     msgs = openai_body.get("messages", [])
     msgs.append({"role": "user", "content": directive})
     openai_body["messages"] = msgs
     logger.warning(
-        "RECON CONVERGENCE: injected %s directive (readonly_streak=%d, ctx=%.0f%%)",
+        "RECON CONVERGENCE: injected %s directive (no_write_streak=%d, ctx=%.0f%%)",
         tier, streak, util * 100,
     )
 
@@ -3792,8 +3841,8 @@ def build_openai_request(
         _apply_tool_call_grammar(openai_body, grammar_override=profile_grammar)
 
     # Recon-convergence guardrail (B1) — runs on every built request so a
-    # session wandering in read-only exploration is nudged toward its
-    # deliverable regardless of tool-turn phase.
+    # session wandering in exploration without producing a write is nudged
+    # toward its deliverable regardless of tool-turn phase.
     _maybe_inject_recon_convergence(openai_body, monitor)
 
     return openai_body
@@ -7560,7 +7609,8 @@ async def messages(request: Request):
                     target_frac * 100,
                 )
             body = prune_conversation(
-                body, ctx_window, target_fraction=target_frac, keep_last=keep_last
+                body, ctx_window, monitor=monitor,
+                target_fraction=target_frac, keep_last=keep_last,
             )
             monitor.prune_count += 1
             # Option 4: Post-prune validation — verify actual reduction
@@ -7581,7 +7631,8 @@ async def messages(request: Request):
                     post_util * 100,
                 )
                 body = prune_conversation(
-                    body, ctx_window, target_fraction=0.35, keep_last=4
+                    body, ctx_window, monitor=monitor,
+                    target_fraction=0.35, keep_last=4,
                 )
                 monitor.prune_count += 1
                 estimated_tokens = estimate_total_tokens(body)

package/tools/agents/tests/test_anthropic_proxy_streaming.py

@@ -5375,10 +5375,13 @@ class TestSlotSaveRestore(unittest.TestCase):
 
 class TestReconConvergence(unittest.TestCase):
     """Tests for the B1 recon-convergence guardrail — nudges a session
-    stuck doing read-only exploration toward producing its deliverable.
+    stuck exploring without producing a write toward its deliverable.
 
-    Targets the observed failure: a 664-turn agentic recon task that read
-    files for hours and never converged to the synthesis/write step."""
+    The streak is defined as write-tool ABSENCE, not read-tool presence: a
+    real recon agent explores via Bash/WebFetch/Agent, so an "all tools are
+    recognized read-only" test never accumulates. Targets the observed
+    failure: a 664-turn agentic recon task that explored for hours and
+    never converged to the synthesis/write step."""
 
     def setUp(self):
         self._threshold = proxy.PROXY_RECON_CONVERGENCE_THRESHOLD
@@ -5387,37 +5390,60 @@ class TestReconConvergence(unittest.TestCase):
         proxy.PROXY_RECON_CONVERGENCE_THRESHOLD = self._threshold
 
     def test_readonly_turns_increment_the_streak(self):
-        """Consecutive turns using only read-only tools grow the streak."""
+        """Consecutive turns using only read tools grow the streak."""
         m = proxy.SessionMonitor(context_window=131072)
         for _ in range(5):
             m.record_tool_calls(["Read"])
-        self.assertEqual(m.consecutive_readonly_turns, 5)
+        self.assertEqual(m.consecutive_no_write_turns, 5)
         m.record_tool_calls(["Grep", "Glob"])
-        self.assertEqual(m.consecutive_readonly_turns, 6)
+        self.assertEqual(m.consecutive_no_write_turns, 6)
 
-    def test_non_readonly_tool_resets_the_streak(self):
+    def test_bash_and_webfetch_turns_increment_the_streak(self):
+        """The core fix: exploration via Bash/WebFetch/Agent — tools the old
+        read-only allowlist did not recognize — must grow the streak. The
+        old logic reset on every such turn, so the streak never built."""
+        m = proxy.SessionMonitor(context_window=131072)
+        m.record_tool_calls(["Bash"])
+        m.record_tool_calls(["WebFetch"])
+        m.record_tool_calls(["Agent"])
+        m.record_tool_calls(["Read", "Bash"])  # mixed exploration, no write
+        self.assertEqual(m.consecutive_no_write_turns, 4)
+
+    def test_write_tool_resets_the_streak(self):
         """A turn using a write/edit tool means the model converged toward
-        action — the streak resets to 0."""
+        output — the streak resets to 0."""
         m = proxy.SessionMonitor(context_window=131072)
         for _ in range(10):
-            m.record_tool_calls(["Read"])
-        self.assertEqual(m.consecutive_readonly_turns, 10)
+            m.record_tool_calls(["Bash"])
+        self.assertEqual(m.consecutive_no_write_turns, 10)
         m.record_tool_calls(["Write"])
-        self.assertEqual(m.consecutive_readonly_turns, 0)
+        self.assertEqual(m.consecutive_no_write_turns, 0)
 
     def test_mixed_turn_with_one_write_resets(self):
-        """A turn mixing read-only and a write tool still counts as
-        converging — any non-read-only tool resets."""
+        """A turn mixing exploration and a write tool still counts as
+        converging — any write tool resets."""
         m = proxy.SessionMonitor(context_window=131072)
         for _ in range(10):
             m.record_tool_calls(["Read"])
         m.record_tool_calls(["Read", "Edit"])
-        self.assertEqual(m.consecutive_readonly_turns, 0)
+        self.assertEqual(m.consecutive_no_write_turns, 0)
+
+    def test_no_tool_turn_leaves_streak_unchanged(self):
+        """A plain-text turn (no tool calls) is neither exploration nor a
+        write — it must leave the streak untouched, not reset it."""
+        m = proxy.SessionMonitor(context_window=131072)
+        for _ in range(7):
+            m.record_tool_calls(["Bash"])
+        self.assertEqual(m.consecutive_no_write_turns, 7)
+        m.record_tool_calls([])  # plain-text turn
+        self.assertEqual(m.consecutive_no_write_turns, 7)
+        m.record_tool_calls(["Read"])
+        self.assertEqual(m.consecutive_no_write_turns, 8)
 
     def test_no_injection_below_threshold(self):
         proxy.PROXY_RECON_CONVERGENCE_THRESHOLD = 40
         m = proxy.SessionMonitor(context_window=131072)
-        m.consecutive_readonly_turns = 39
+        m.consecutive_no_write_turns = 39
         body = {"messages": [{"role": "user", "content": "go"}]}
         proxy._maybe_inject_recon_convergence(body, m)
         self.assertEqual(len(body["messages"]), 1)
@@ -5425,7 +5451,7 @@ class TestReconConvergence(unittest.TestCase):
     def test_firm_directive_at_threshold(self):
         proxy.PROXY_RECON_CONVERGENCE_THRESHOLD = 40
         m = proxy.SessionMonitor(context_window=131072)
-        m.consecutive_readonly_turns = 45
+        m.consecutive_no_write_turns = 45
         m.last_input_tokens = 120000
         body = {"messages": [{"role": "user", "content": "go"}]}
         proxy._maybe_inject_recon_convergence(body, m)
@@ -5438,7 +5464,7 @@ class TestReconConvergence(unittest.TestCase):
         """Once the streak is 2x over threshold, escalate to a hard STOP."""
         proxy.PROXY_RECON_CONVERGENCE_THRESHOLD = 40
         m = proxy.SessionMonitor(context_window=131072)
-        m.consecutive_readonly_turns = 80
+        m.consecutive_no_write_turns = 80
         m.last_input_tokens = 250000  # over budget — the real-incident shape
         body = {"messages": [{"role": "user", "content": "go"}]}
         proxy._maybe_inject_recon_convergence(body, m)
@@ -5448,7 +5474,112 @@ class TestReconConvergence(unittest.TestCase):
     def test_disabled_when_threshold_zero(self):
         proxy.PROXY_RECON_CONVERGENCE_THRESHOLD = 0
         m = proxy.SessionMonitor(context_window=131072)
-        m.consecutive_readonly_turns = 500
+        m.consecutive_no_write_turns = 500
         body = {"messages": [{"role": "user", "content": "go"}]}
         proxy._maybe_inject_recon_convergence(body, m)
         self.assertEqual(len(body["messages"]), 1)
+
+
+class TestPrunerRework(unittest.TestCase):
+    """Tests for the reworked context pruner (B2 + B3): contiguous
+    monotonic prune boundary (cache-stable) + breadcrumb summary of the
+    dropped block (findings retained)."""
+
+    @staticmethod
+    def _tool_result_msg(idx: int, size: int = 4000) -> dict:
+        return {
+            "role": "user",
+            "content": [
+                {
+                    "type": "tool_result",
+                    "tool_use_id": f"toolu_{idx}",
+                    "content": f"FILE-{idx} " + ("x" * size),
+                }
+            ],
+        }
+
+    def _big_body(self, n_middle: int = 20) -> dict:
+        msgs = [{"role": "user", "content": "recon task: analyze the repo"}]
+        for i in range(n_middle):
+            msgs.append({"role": "assistant", "content": f"reading file {i}"})
+            msgs.append(self._tool_result_msg(i))
+        msgs.append({"role": "user", "content": "continue"})
+        return {"messages": msgs}
+
+    def test_prune_drop_count_is_monotonic(self):
+        """The per-session prune boundary only ever grows."""
+        m = proxy.SessionMonitor(context_window=8192)
+        proxy.prune_conversation(self._big_body(), 8192, monitor=m,
+                                 target_fraction=0.5, keep_last=6)
+        first = m.prune_drop_count
+        self.assertGreater(first, 0)
+        # A tighter target on the same body can only drop more, never fewer.
+        proxy.prune_conversation(self._big_body(), 8192, monitor=m,
+                                 target_fraction=0.25, keep_last=6)
+        self.assertGreaterEqual(m.prune_drop_count, first)
+
+    def test_kept_middle_is_contiguous_suffix(self):
+        """The pruner drops a contiguous oldest block — the surviving
+        middle messages are a contiguous suffix of the original middle,
+        never a non-contiguous greedy pick."""
+        m = proxy.SessionMonitor(context_window=8192)
+        body = self._big_body()
+        original = list(body["messages"])
+        result = proxy.prune_conversation(body, 8192, monitor=m,
+                                          target_fraction=0.5, keep_last=6)
+        out = result["messages"]
+        survivors = [msg for msg in out if msg in original]
+        idxs = [original.index(msg) for msg in survivors]
+        self.assertEqual(idxs, sorted(idxs))
+        tail_idxs = [i for i in idxs if i > 0]
+        if len(tail_idxs) > 1:
+            self.assertEqual(
+                tail_idxs, list(range(tail_idxs[0], tail_idxs[0] + len(tail_idxs)))
+            )
+
+    def test_stable_output_when_boundary_does_not_advance(self):
+        """Cache-stability: pruning the same body twice with the same
+        monitor yields byte-identical message lists — the second call
+        seeds from the persisted boundary and does not advance it."""
+        m = proxy.SessionMonitor(context_window=8192)
+        first = proxy.prune_conversation(self._big_body(), 8192, monitor=m,
+                                         target_fraction=0.5, keep_last=6)
+        boundary_after_first = m.prune_drop_count
+        second = proxy.prune_conversation(self._big_body(), 8192, monitor=m,
+                                          target_fraction=0.5, keep_last=6)
+        self.assertEqual(m.prune_drop_count, boundary_after_first)
+        self.assertEqual(first["messages"], second["messages"])
+
+    def test_dropped_tool_results_become_breadcrumbs(self):
+        """Pruned tool-results survive as one-line breadcrumbs in the
+        marker, not silently discarded."""
+        dropped = [self._tool_result_msg(i) for i in range(3)]
+        summary = proxy._summarize_pruned_block(dropped)
+        self.assertIn("CONTEXT PRUNED", summary)
+        self.assertIn("tool result", summary)
+        self.assertIn("FILE-0", summary)
+        self.assertIn("FILE-2", summary)
+
+    def test_summary_is_bounded_by_max_items(self):
+        """A huge dropped block does not produce an unbounded summary."""
+        old = proxy._PRUNE_SUMMARY_MAX_ITEMS
+        try:
+            proxy._PRUNE_SUMMARY_MAX_ITEMS = 5
+            dropped = [self._tool_result_msg(i) for i in range(40)]
+            summary = proxy._summarize_pruned_block(dropped)
+            self.assertEqual(summary.count("- tool result"), 5)
+            self.assertIn("most recent 5 of 40", summary)
+        finally:
+            proxy._PRUNE_SUMMARY_MAX_ITEMS = old
+
+    def test_summarize_no_tool_results_falls_back_to_static_marker(self):
+        """A dropped block with no tool-results yields the plain static
+        marker — no per-call varying text (cache-safe)."""
+        dropped = [
+            {"role": "assistant", "content": "thinking out loud"},
+            {"role": "user", "content": "ok"},
+        ]
+        summary = proxy._summarize_pruned_block(dropped)
+        self.assertIn("CONTEXT PRUNED", summary)
+        self.assertNotIn("tool result", summary)
+        self.assertNotIn("most recent", summary)