@modelprofile.com/flexharness 13.2.1 → 14.0.0

package/ts/classes.flexharness.callbacks.ts

@@ -384,22 +384,14 @@ export class FlexHarnessRunCallbacks<TScope> {
   }
 
   /**
-   * Announces a retry. The failed model call's text and reasoning are not in the session, so their
-   * parts are removed first, last part first, each with a `part.removed` event; its tool calls
-   * stay. The removals are outside the callback limits, like completions: their number is bounded
-   * by the run's parts. What the removed parts took of the limits stays taken.
+   * Announces a retry after the failed inference's observed output was saved. Keep those
+   * immutable parts in the transcript; a retry does not erase the work it follows.
+   * Completing a text part ends that part, not the run or its unsuccessful inference.
    */
   public onRetry(state: IStorageState, sessionId: string, retry: plugins.IAgentRetryEvent): void {
     const run = this.callbackRun(state, sessionId);
     if (!run || !this.reserveCallbackCapacity(run, 1, 0, 0)) return;
-    for (let partIndex = run.callbackParts.length - 1; partIndex >= 0; partIndex--) {
-      const part = run.callbackParts[partIndex]!;
-      if (!run.stepPartIds.has(part.partId)) continue;
-      this.core.emitPartRemovedEvent(run, part);
-      run.callbackParts.splice(partIndex, 1);
-      run.partTextUtf8Bytes.delete(part.partId);
-    }
-    run.stepPartIds.clear();
+    this.onStepCommitted(state, sessionId);
     this.core.emitEvent(run.scopeId, run.stored.session, {
       type: 'run.retrying',
       runId: run.runId,

package/ts/classes.flexharness.prompts.ts

@@ -12,6 +12,7 @@ import {
 } from './errors.js';
 import type {
   IFlexAgentContextInvocation,
+  IFlexEnqueuePromptOptions,
   IFlexSteerAdmission,
   IFlexSteerInput,
   IFlexPromptAdmission,
@@ -35,6 +36,7 @@ import type {
   IDelegatedRunAdmissionSeed,
   IQueuedPrompt,
   IPendingPromptAdmission,
+  IAdmittedSteer,
 } from './interfaces.flexharness.js';
 import { combineErrors, isAbortError } from './utils.flexharness.js';
 import { sessionPreview } from './utils.sessionpreview.js';
@@ -91,7 +93,7 @@ export class FlexHarnessPromptQueue<TScope> {
     scopeId: string,
     sessionId: string,
     prompt: TFlexPrompt,
-    options: IFlexPromptOptions = {},
+    options: IFlexEnqueuePromptOptions = {},
   ): Promise<IFlexPromptResult> {
     const admission = await this.startPrompt(scopeId, sessionId, prompt, options);
     return admission.completion;
@@ -101,10 +103,13 @@ export class FlexHarnessPromptQueue<TScope> {
     scopeId: string,
     sessionId: string,
     prompt: TFlexPrompt,
-    options: IFlexPromptOptions = {},
+    options: IFlexEnqueuePromptOptions = {},
   ): Promise<IFlexPromptAdmission> {
-    validatePromptOptions(options, false);
-    const queued = await this.enqueuePromptInternal(scopeId, sessionId, prompt, options);
+    const admitted = this.splitEnqueueOptions(options);
+    const queued = await this.enqueuePromptInternal(
+      scopeId, sessionId, prompt, admitted.options,
+      undefined, undefined, undefined, undefined, false, false, admitted.steers,
+    );
     return queued.started;
   }
 
@@ -112,13 +117,47 @@ export class FlexHarnessPromptQueue<TScope> {
     scopeId: string,
     sessionId: string,
     prompt: TFlexPrompt,
-    options: IFlexPromptOptions = {},
+    options: IFlexEnqueuePromptOptions = {},
   ): Promise<IFlexPromptQueueAdmission> {
-    validatePromptOptions(options, false);
-    const queued = await this.enqueuePromptInternal(scopeId, sessionId, prompt, options);
+    const admitted = this.splitEnqueueOptions(options);
+    const queued = await this.enqueuePromptInternal(
+      scopeId, sessionId, prompt, admitted.options,
+      undefined, undefined, undefined, undefined, false, false, admitted.steers,
+    );
     return queued.admission;
   }
 
+  /** Validates the options of a prompt and the steers that join its run, in their given order. */
+  private splitEnqueueOptions(
+    options: IFlexEnqueuePromptOptions,
+  ): { options: IFlexPromptOptions; steers: IAdmittedSteer[] } {
+    if (!options || typeof options !== 'object' || Array.isArray(options)) {
+      throw new FlexHarnessValidationError('Prompt options must be a plain object.');
+    }
+    const { steers, ...promptOptions } = options;
+    validatePromptOptions(promptOptions, false);
+    if (steers === undefined) return { options: promptOptions, steers: [] };
+    if (!Array.isArray(steers)) throw new FlexHarnessValidationError('steers must be an array.');
+    const steerIds = new Set<string>();
+    const admitted = steers.map((steer): IAdmittedSteer => {
+      if (!steer || typeof steer !== 'object' || Array.isArray(steer)) {
+        throw new FlexHarnessValidationError('Each steer must be a plain object.');
+      }
+      validateIdentifier(steer.steerId, 'steerId');
+      requireTransferIdentifier(steer.steerId, 'steerId');
+      if (steerIds.has(steer.steerId)) {
+        throw new FlexHarnessValidationError(`Steer "${steer.steerId}" is given more than once.`);
+      }
+      steerIds.add(steer.steerId);
+      return {
+        steerId: steer.steerId,
+        prompt: normalizeFlexPrompt(steer.prompt, this.core.attachmentReferenceProtocols),
+        byteSize: this.promptAdmissionByteSize(steer.prompt, {}),
+      };
+    });
+    return { options: promptOptions, steers: admitted };
+  }
+
   public async schedulePrompt(
     scopeId: string,
     sessionId: string,
@@ -326,6 +365,7 @@ export class FlexHarnessPromptQueue<TScope> {
     admissionSignal?: AbortSignal,
     slashCommandAdmission = false,
     cacheWarm = false,
+    steers: readonly IAdmittedSteer[] = [],
   ): Promise<{
     admission: IFlexPromptQueueAdmission;
     started: Promise<IFlexPromptAdmission>;
@@ -335,7 +375,8 @@ export class FlexHarnessPromptQueue<TScope> {
     const normalizedPrompt = normalizeFlexPrompt(prompt, this.core.attachmentReferenceProtocols);
     const normalizedOptions = cloneSerializable(options);
     const byteSize = this.promptAdmissionByteSize(prompt, options, scheduleKey, debounceMs);
-    const releasePendingAdmission = this.reservePendingPromptAdmission(byteSize);
+    const steerBytes = steers.reduce((sum, steer) => sum + steer.byteSize, 0);
+    const releasePendingAdmission = this.reservePendingPromptAdmission(byteSize + steerBytes);
     let resolveSettled!: () => void;
     const pendingOwner: IPendingPromptAdmission = {
       controller: new AbortController(),
@@ -400,8 +441,11 @@ export class FlexHarnessPromptQueue<TScope> {
           `Session "${sessionId}" has reached its outstanding prompt limit.`,
         );
       }
+      if (steers.length > this.core.promptQueueLimits.maxOutstandingPromptsPerSession) {
+        throw new FlexHarnessQueueFullError(`Session "${sessionId}" has reached its pending steer limit.`);
+      }
       if (
-        stored.outstandingPromptBytes + byteSize
+        stored.outstandingPromptBytes + byteSize + steerBytes
         > this.core.promptQueueLimits.maxOutstandingBytesPerSession
       ) {
         throw new FlexHarnessQueueFullError(
@@ -452,9 +496,14 @@ export class FlexHarnessPromptQueue<TScope> {
         resolveStarted,
         rejectStarted,
       };
+      if (steers.length > 0) {
+        // The steers are the run's from admission on: a prompt that never runs reports them unapplied.
+        queued.steering = this.core.runs.createRunSteering(stored, steers);
+        queued.admittedSteerIds = steers.map((steer) => steer.steerId);
+      }
       stored.promptQueue.push(queued);
       stored.outstandingPromptsById.set(queued.queueId, queued);
-      stored.outstandingPromptBytes += byteSize;
+      stored.outstandingPromptBytes += byteSize + steerBytes;
       if (!cacheWarm) this.core.cacheWarm.onActivity(state.storageKey, sessionId);
       this.emitPromptQueueEvent(queued, 'prompt.queued');
       this.schedulePromptQueueDrain(state, stored);
@@ -712,6 +761,14 @@ export class FlexHarnessPromptQueue<TScope> {
     queued.status = run.scheduleKey ? 'scheduled' : 'starting';
     this.core.cacheWarm.onRunStarted(run, queued);
     this.emitPromptQueueEvent(queued, 'prompt.started');
+    for (const steerId of queued.admittedSteerIds ?? []) {
+      this.core.emitEvent(run.scopeId, run.stored.session, {
+        type: 'prompt.steer.accepted',
+        queueId: run.queueId,
+        runId: run.runId,
+        steerId,
+      });
+    }
     queued.resolveStarted(Object.freeze({
       queueId: queued.queueId,
       runId: run.runId,

package/ts/classes.flexharness.reversions.ts

@@ -1224,8 +1224,16 @@ export class FlexHarnessReversions<TScope> {
       const nextCandidate = candidates[1];
       let end = 0;
       if (!firstCandidate) {
-        if (dropNonUndoablePrefix) end = stored.reversionSegments.length;
-        else if (overLimit) {
+        // Unsuccessful turns with output still contribute to model context. Keep their
+        // segments so the next completed turn can group (and undo) that leading history.
+        const firstVisibleSegment = dropNonUndoablePrefix
+          ? stored.reversionSegments.findIndex((segment) => plugins.isGenerationInModelContext(
+              stored.agentSession.getEvents(), segment.runId,
+            ))
+          : -1;
+        if (dropNonUndoablePrefix && firstVisibleSegment !== 0) {
+          end = firstVisibleSegment < 0 ? stored.reversionSegments.length : firstVisibleSegment;
+        } else if (overLimit) {
           end = Math.max(
             1,
             stored.reversionSegments.length + (reserveSegment ? 1 : 0)

package/ts/classes.flexharness.runs.ts

@@ -46,6 +46,7 @@ import type {
   IStoredSessionState,
   IStorageState,
   IActiveRun,
+  IAdmittedSteer,
   IRunSteering,
   IRunSteeringOutcome,
   IQueuedPrompt,
@@ -76,13 +77,34 @@ export class FlexHarnessRuns<TScope> {
     return true;
   }
 
-  public createActiveRun(queued: IQueuedPrompt): IActiveRun {
+  /**
+   * The steering of a run, holding `steers` as accepted and waiting for its first step boundary.
+   * The caller already counted their bytes against the session.
+   */
+  public createRunSteering(
+    stored: IStoredSessionState,
+    steers: readonly IAdmittedSteer[] = [],
+  ): IRunSteering {
     const steering: IRunSteering = {
       input: new plugins.AgentPendingInputQueue(),
-      stored: queued.stored,
+      stored,
       accepted: new Map(),
       applied: new Set(),
     };
+    for (const steer of steers) {
+      steering.input.add({
+        inputId: steer.steerId,
+        content: cloneSerializable(steer.prompt.modelMessage.content) as Parameters<
+          plugins.IAgentSession['beginGeneration']
+        >[0],
+      });
+      steering.accepted.set(steer.steerId, { prompt: steer.prompt, byteSize: steer.byteSize });
+    }
+    return steering;
+  }
+
+  public createActiveRun(queued: IQueuedPrompt): IActiveRun {
+    const steering = queued.steering ?? this.createRunSteering(queued.stored);
     queued.steering = steering;
     return {
       steering,

package/ts/classes.flexharness.ts

@@ -8,6 +8,7 @@ import type {
   IFlexCreateSessionOptions,
   IFlexDeleteSessionGenerationCohortInput,
   IFlexDeleteSessionGenerationCohortResult,
+  IFlexEnqueuePromptOptions,
   IFlexEventArchiveMetadata,
   IFlexHarnessOptions,
   IFlexImportedRun,
@@ -25,7 +26,6 @@ import type {
   IFlexPromptAdmission,
   IFlexPromptQueueAdmission,
   IFlexPromptQueueEntry,
-  IFlexPromptOptions,
   IFlexPromptResult,
   IFlexRedoSessionResult,
   IFlexScheduledPromptAdmission,
@@ -305,7 +305,7 @@ export class FlexHarness<TScope = unknown> {
     scopeId: string,
     sessionId: string,
     prompt: TFlexPrompt,
-    options?: IFlexPromptOptions,
+    options?: IFlexEnqueuePromptOptions,
   ): Promise<IFlexPromptResult> {
     return this.core.prompts.prompt(scopeId, sessionId, prompt, options);
   }
@@ -314,7 +314,7 @@ export class FlexHarness<TScope = unknown> {
     scopeId: string,
     sessionId: string,
     prompt: TFlexPrompt,
-    options?: IFlexPromptOptions,
+    options?: IFlexEnqueuePromptOptions,
   ): Promise<IFlexPromptAdmission> {
     return this.core.prompts.startPrompt(scopeId, sessionId, prompt, options);
   }
@@ -323,7 +323,7 @@ export class FlexHarness<TScope = unknown> {
     scopeId: string,
     sessionId: string,
     prompt: TFlexPrompt,
-    options?: IFlexPromptOptions,
+    options?: IFlexEnqueuePromptOptions,
   ): Promise<IFlexPromptQueueAdmission> {
     return this.core.prompts.enqueuePrompt(scopeId, sessionId, prompt, options);
   }

package/ts/interfaces.flexharness.ts

@@ -337,6 +337,13 @@ export interface IRunSteering {
   outcome?: IRunSteeringOutcome;
 }
 
+/** A steer admitted together with the prompt whose run takes it in before its first model call. */
+export interface IAdmittedSteer {
+  readonly steerId: string;
+  readonly prompt: INormalizedFlexPrompt;
+  readonly byteSize: number;
+}
+
 export interface IRunSteeringOutcome {
   /** Whether the run's prompt, the steers it took in and what its model produced stay in context. */
   readonly keptInContext: boolean;
@@ -410,8 +417,13 @@ export interface IQueuedPrompt {
   options?: IFlexPromptOptions;
   delegationSeed?: IDelegatedRunAdmissionSeed;
   byteSize: number;
-  /** The steering of the run the prompt started, once it started one. */
+  /**
+   * The steering of the run the prompt started, once it started one. A prompt admitted with steers
+   * has it from admission on, holding those steers and their bytes.
+   */
   steering?: IRunSteering;
+  /** The steers admitted with the prompt, in their given order. */
+  admittedSteerIds?: readonly string[];
   completion: Promise<IFlexPromptResult>;
   resolveCompletion: (result: IFlexPromptResult) => void;
   rejectCompletion: (error: unknown) => void;

package/ts/interfaces.ts

@@ -404,6 +404,7 @@ export interface IFlexUpdateSessionOptions {
 export interface IFlexPromptOptions {
   modelHint?: string;
   system?: string;
+  /** Optional positive safe integer step cap; no limit unless configured. */
   maxSteps?: number;
 }
 
@@ -588,6 +589,19 @@ export interface IFlexSchedulePromptOptions extends IFlexPromptOptions {
   debounceMs?: number;
 }
 
+/**
+ * Options of a prompt that starts a run now or queues it. `steers` are further user messages that
+ * join the prompt's run in the order given: the run accepts them when it starts and its generation
+ * takes them in before its first model call, each as a user message of its own carrying its
+ * `steerId`. They count against the session's outstanding prompt limits from admission on, and
+ * report like every other steer of the run: `prompt.steer.applied` names each message, and
+ * `unappliedSteerIds` names the ones the model context of later turns does not hold, also when the
+ * prompt is cancelled before its run started.
+ */
+export interface IFlexEnqueuePromptOptions extends IFlexPromptOptions {
+  steers?: readonly IFlexSteerInput[];
+}
+
 export interface IFlexScheduledPromptAdmission extends IFlexPromptAdmission {
   scheduleKey: string;
 }
@@ -653,6 +667,7 @@ export interface IFlexResolvedModel {
   system?: string;
   providerOptions?: TFlexAgentProviderOptions;
   cache?: TFlexAgentCacheSetting;
+  /** Optional positive safe integer step cap; no limit unless configured. */
   maxSteps?: number;
 }
 
@@ -1890,6 +1905,7 @@ export interface IFlexSubagentDefinition {
   description: string;
   modelHint?: string;
   system?: string;
+  /** Optional positive safe integer step cap; no limit unless configured. */
   maxSteps?: number;
   /** Exact model-facing names permitted for this agent; omitted means unrestricted. */
   allowedTools?: readonly string[];
@@ -2107,9 +2123,8 @@ export interface IFlexPartDeltaEvent extends IFlexPartEventBase {
 }
 
 /**
- * A streamed part left its message: the model call that streamed it failed and is retried, and
- * the retry streams its own parts. `partIndex` is the part's position before it left; the parts
- * after it move up by one.
+ * A part left its message. `partIndex` is its position before it left; the parts after it
+ * move up by one. Failed-inference observations are retained, not removed for a retry.
  */
 export interface IFlexPartRemovedEvent extends IFlexPartEventBase {
   readonly type: 'part.removed';

package/ts/readme.md

@@ -130,7 +130,9 @@ Sessions whose metrics were written before input and cache tokens were counted c
 them from their next settled call on and never report the breakdown complete; their
 lifetime total keeps its completeness.
 
-Conversational runs that exhaust `maxSteps` with tool work or unseen input remaining
+Conversational runs have **no `maxSteps` limit by default**. A cap is optional and must be a positive finite safe integer; `0`, negative or fractional values, `NaN`, infinity and unsafe integers are invalid, not ways to request unlimited execution. In AgentSession, a prepared generation lease's `maxSteps` takes precedence over the per-generation option, then the session setting; omitting all three leaves execution unbounded. FlexHarness prompt options override the resolved model's cap, and a subagent definition may explicitly cap its child run. Cache-warm turns retain their separate two-step cap. An unbounded run still honors owner stops, permission rejection, real errors, usage accounting and resource cleanup.
+
+Conversational runs that exhaust an explicitly configured `maxSteps` with tool work or unseen input remaining
 fail with `FlexHarnessStepLimitError` (`FLEX_STEP_LIMIT`), rather than being marked
 completed with an empty answer. Standalone Agent callers retain tool-only results
 and can inspect `terminationReason: 'model' | 'step-limit'`.
@@ -620,7 +622,7 @@ Attachment payloads are never copied into public audit messages or events. Publi
 }
 ```
 
-The original string remains only in canonical private Agent events, so a later model turn can receive the attachment again. A turn that succeeded stays in future context, and so does a turn stopped through `abort()` or `cancelPrompt()` once its model produced output: its prompt, the steers it took in and what the model produced before the stop, with every tool call that has no recorded result closed by an error result saying its effect is unknown. A turn stopped before any model output leaves no trace, so its prompt can be sent again without appearing twice; its `run.finished` event and finished queue entry carry `keptInContext: false`. Failed, resolver-failed, cleanup-failed, and persistence-failed turns, and turns a process restart interrupted, do not add anything to future context.
+The original string remains only in canonical private Agent events, so a later model turn can receive the attachment again. Successful turns stay in future context. Failed, stopped, rejected and restart-interrupted generations also retain their prompt, applied steers and recorded partial model/tool output once execution started and produced output. Their model-visible outcome marker truthfully says rejected, interrupted or stopped by owner, never successful. An unsuccessful generation with no model/tool output stays out of future context; its `run.finished` event and finished queue entry carry `keptInContext: false`. An unresolved tool call is closed in model context with an error result saying its effect is unknown: this does not assert that the action failed, succeeded or was rolled back. Restoring history never automatically reruns the generation or replays tools; inspect `listUncertainToolExecutions()` and reconcile external effects before treating them as known. Resolver, cleanup and persistence failures still reject completion; retention depends on durable canonical output and outcome, not the failure label.
 
 The main session methods are:
 
@@ -728,7 +730,9 @@ console.log(result.unappliedSteerIds); // [] once the run took the steer in
 
 The run takes a steer in at its next step boundary: after the tool results of its current model step are recorded and before its next model call. A running tool call or a pending permission is never interrupted; the steer waits for the boundary that follows it. A steer taken in is a user message of the run (`steerId` set) that the model sees in its next call and every later turn. If the run had already answered, the assistant message that answered is completed and the run answers on in a new assistant message after the steer; a steer taken in before the run answered anything is placed before its still empty assistant message. `IFlexPromptResult.userMessage` stays the prompt and `assistantMessage` is the run's last assistant message. Undo and redo treat the run's messages as one turn.
 
-`steerPrompt()` resolves with `{ steerId, queueId, runId }` once the run accepted the steer and `prompt.steer.accepted` was emitted; `prompt.steer.applied` carries the `messageId` of the user message the steer became. Every accepted steer ends in exactly one of two ways: it is in the model context of later turns, or it is listed in `unappliedSteerIds`, in arrival order, on `IFlexPromptResult` and `run.finished`, and on the finished queue entry when that list is not empty. A steer is listed when the run did not take it in before it ended, because its last model step was already running or because it was stopped or failed, and also when the run itself does not stay in context. `keptInContext` on `run.finished` and on the finished queue entry says whether it does: it is `false` for a failed run and for a run stopped before any model output, and such a run lists every steer it accepted, including the ones it took in and reported with `prompt.steer.applied`. Send its prompt and its unapplied steers again to have them answered. The run stops taking steers atomically when its generation ends or `abort()`/`cancelPrompt()` stops it. A steer for a prompt without a running run, or whose run is ending, is refused with `FlexHarnessSteerRejectedError` reason `not-running`; the caller sends it as the next turn instead. Reusing a `steerId` within a run is refused with reason `duplicate`, an unknown `queueId` throws `FlexHarnessNotFoundError`, and child sessions reject this general API (their exact parent run uses `sendSubagentInput()` or `delegate_send` instead). A run holds at most `maxOutstandingPromptsPerSession` pending steers, and their bytes count against the session's outstanding prompt byte limit until the run takes them in or ends, so `startPrompt()` and `enqueuePrompt()` are refused with `FlexHarnessQueueFullError` while pending steers fill it. They are process-local like queue entries: a process restart ends the run and drops its pending steers, while steers it took in are durable parts of the turn.
+`steerPrompt()` resolves with `{ steerId, queueId, runId }` once the run accepted the steer and `prompt.steer.accepted` was emitted; `prompt.steer.applied` carries the `messageId` of the user message the steer became. Every accepted steer ends in exactly one of two ways: it is in the model context of later turns, or it is listed in `unappliedSteerIds`, in arrival order, on `IFlexPromptResult` and `run.finished`, and on the finished queue entry when that list is not empty. A steer is listed when the run did not take it in before it ended, because its last model step was already running or because it was stopped or failed, and also when the run itself does not stay in context. `keptInContext` on `run.finished` and on the finished queue entry reports actual canonical retention, not success: a failed or stopped run with retained model/tool output can report `true`. Applied steers in that retained history are not listed as unapplied; pending steers that never became durable are. When the run is not retained, every accepted steer is listed, including ones reported with `prompt.steer.applied`. Decide explicitly whether to send absent input as a later turn; do not automatically replay a retained prompt or its tool effects. The run stops taking steers atomically when its generation ends or `abort()`/`cancelPrompt()` stops it. A steer for a prompt without a running run, or whose run is ending, is refused with `FlexHarnessSteerRejectedError` reason `not-running`; the caller sends it as the next turn instead. Reusing a `steerId` within a run is refused with reason `duplicate`, an unknown `queueId` throws `FlexHarnessNotFoundError`, and child sessions reject this general API (their exact parent run uses `sendSubagentInput()` or `delegate_send` instead). A run holds at most `maxOutstandingPromptsPerSession` pending steers, and their bytes count against the session's outstanding prompt byte limit until the run takes them in or ends, so `startPrompt()` and `enqueuePrompt()` are refused with `FlexHarnessQueueFullError` while pending steers fill it. They are process-local like queue entries: a process restart ends the run and drops its pending steers, while steers it took in are durable parts of the turn.
+
+A prompt can bring further user messages into its run: `startPrompt()`, `enqueuePrompt()` and `prompt()` take `steers`, a list of `{ steerId, prompt }`, in their options. The run accepts them when it starts, emitting `prompt.steer.accepted` for each in the given order right after `prompt.started`, and takes them in before its first model call, so the model sees the prompt and its steers as consecutive user messages of their own in one call, each with its own `steerId`, `messageId` and attachments. From then on they report like every other steer of the run. They count against the session's outstanding prompt limits from admission on. The whole prompt is refused with `FlexHarnessValidationError` when a `steerId` repeats, and with `FlexHarnessQueueFullError` when it brings more steers than `maxOutstandingPromptsPerSession` or its steers' bytes exceed the outstanding byte limit. A prompt cancelled before its run started lists them in `unappliedSteerIds` on its finished queue entry and `prompt.finished`, with `keptInContext: false`. A caller holding several waiting messages for a session delivers them in one turn this way, without merging them into one message.
 
 ### Keeping the Prompt Cache Warm
 
@@ -808,7 +812,7 @@ At most 128 custom commands may be registered. Every registration must be a plai
 
 `/undo` and `/redo`, plus `undoSession()` and `redoSession()`, move a durable history cursor. The direct methods return `{ revertedRunId }` and `{ restoredRunId }`; the slash forms return `{ type: 'operation', name: 'undo' | 'redo' }`. Each committed cursor move emits one `session.history.changed` event with `direction`, `runId`, and the selected session identity. A committed branch emits the same event with `direction: 'branch'` and no `runId`, so controllers should refresh the complete selected session. Capture finalization, cleanup, and metadata-only changes do not emit this event.
 
-A completed root-session turn defines an operation-group boundary. Failed and cancelled turns after it belong to that group; leading failed or cancelled turns belong to the first completed group. No completed boundary means there is nothing to undo. Undo applies selected segments in reverse order and redo applies them in forward order. Without `turnReversionProvider`, only transcript and future model context move. Hidden messages disappear from `getMessages()`, message pages, exact message lookup, and future model context. Starting a new prompt, template, handler, or compaction from an undone position commits a branch: hidden messages and segments are removed durably and cannot be redone. Successful event archival also commits hidden redo history; a missing compaction or failed archive leaves it intact. Automatic budget compaction archives covered events after generation finalization and advances the same undo horizon; set `contextCompactionBytes: false` to disable that automatic policy.
+A completed root-session turn defines an operation-group boundary. Failed and cancelled turns after it belong to that group; leading failed or cancelled turns belong to the first completed group. No completed boundary means there is nothing to undo; retained leading unsuccessful history is grouped with the next completed turn rather than silently discarded. Undo hides that group's canonical partial history and outcome markers as well as its visible messages, redo restores them, and branching keeps the hidden history excluded. Transcript-only undo never claims to reverse external tool effects. Undo applies selected segments in reverse order and redo applies them in forward order. Without `turnReversionProvider`, only transcript and future model context move. Hidden messages disappear from `getMessages()`, message pages, exact message lookup, and future model context. Starting a new prompt, template, handler, or compaction from an undone position commits a branch: hidden messages and segments are removed durably and cannot be redone. Successful event archival also commits hidden redo history; a missing compaction or failed archive leaves it intact. Automatic budget compaction archives covered events after generation finalization and advances the same undo horizon; set `contextCompactionBytes: false` to disable that automatic policy.
 
 Two horizons bound undo. Retention pruning removes the oldest complete visible units when `reversionLimits` is exceeded. Explicit event archival marks covered turns context-unavailable and prunes complete prefixes that can no longer be rebuilt; FlexHarness never crosses that archive horizon. Manual compaction without archival retains the original events and remains undoable. Schema-1 projection history and sessions migrated from `2.x` have no reversion segments, so historical turns are not retroactively undoable; newly written turns are tracked normally.
 
@@ -942,11 +946,11 @@ Applications removing a scope must stop and serialize new admission across every
 
 The model context is built by the session's canonical AgentSession event history as:
 
-1. Previous canonically accepted generations.
+1. Previous canonically accepted generations and unsuccessful generations with recorded model/tool output, including their truthful outcome markers, subject to the reversion cursor and compaction horizon.
 2. The normalized current user message.
 3. AgentSession's result messages.
 
-A failed or cancelled prompt remains visible through `getMessages()`, with `failed` or `cancelled` status, but is not included in future model context. Canonical Agent events remain private and are not exposed by the session or message APIs.
+A failed or cancelled prompt remains visible through `getMessages()` with its truthful `failed` or `cancelled` status. Its canonical partial history also remains in future model context when execution produced output; an unsuccessful generation without output is omitted. Retention is not acceptance and does not roll back or replay external effects. Canonical Agent events remain private and are not exposed by the session or message APIs.
 
 Resolved model identity contains provider and model IDs plus optional display name and effective `variant`. The identity, including its variant, is attached to a failed assistant message when resolution completed before a later failure, matching the provider/model behavior. Prompt results contain it only on success.
 
@@ -1133,8 +1137,8 @@ const unsubscribe = harness.subscribe((event) => {
       break;
     case 'run.finished':
       markRunFinished(event.runId, event.status);
-      // A run that did not stay in context needs its prompt sent again, followed by its unapplied steers.
-      resendAsNextTurn(event.keptInContext ? [] : [event.runId], event.unappliedSteerIds);
+      // Retention is not success. Offer absent input for explicit resubmission; never autoplay effects.
+      offerResubmission(event.keptInContext ? [] : [event.runId], event.unappliedSteerIds);
       break;
     case 'prompt.steer.accepted':
       markSteerPending(event.steerId);
@@ -1157,7 +1161,7 @@ const unsubscribe = harness.subscribe((event) => {
 unsubscribe();
 ```
 
-Events are discriminated, deeply immutable values with one global sequence within each `FlexHarness` instance. Every `IFlexEventBase` carries the exact source `sessionGenerationId` and `sessionGenerationSequence`; `session.deleted` retains the deleted generation after live metadata is removed. Listener exceptions are isolated from runs and other listeners. Every accepted queue entry emits `prompt.queued` and exactly one `prompt.finished`. Every accepted steer emits `prompt.steer.accepted`, and `prompt.steer.applied`, after the `message.*` events of its user message, once the run took it in; `run.finished` lists it in `unappliedSteerIds` unless it is in the model context of later turns. Durable promotion additionally emits `prompt.started`, and actual model preparation emits `prompt.running`; cancellation or failure can omit either intermediate event. Existing durable run/message terminal events precede `prompt.finished`. Every callback-backed streamed text part that stays in its message emits exactly one `part.completed` event before the corresponding `run.finished` event: once the model step that streamed it is committed, so its text is final and saved, or with the run's terminal projection when that step did not commit. Text a later model step streams starts a new part. When a model call fails and is retried, the text and reasoning parts it streamed are not in the session: `part.removed` takes each of them out of its message, last part first, and the retry streams its own parts. Its `partIndex` is the part's position before it left; the parts after it move up by one. A removed part has no further events, and `part.removed` does not count against `callbackLimits`. The tool parts of calls the failed model call executed stay. Every `part.started`, `part.delta`, `part.updated`, `part.completed`, and `part.removed` event carries zero-based `messageIndex` and `partIndex` coordinates from the session's authoritative message and part sequences.
+Events are discriminated, deeply immutable values with one global sequence within each `FlexHarness` instance. Every `IFlexEventBase` carries the exact source `sessionGenerationId` and `sessionGenerationSequence`; `session.deleted` retains the deleted generation after live metadata is removed. Listener exceptions are isolated from runs and other listeners. Every accepted queue entry emits `prompt.queued` and exactly one `prompt.finished`. Every accepted steer emits `prompt.steer.accepted` (a steer admitted with its prompt when the run starts, and not at all when the prompt is cancelled or fails before), and `prompt.steer.applied`, after the `message.*` events of its user message, once the run took it in; `run.finished` lists it in `unappliedSteerIds` unless it is in the model context of later turns. Durable promotion additionally emits `prompt.started`, and actual model preparation emits `prompt.running`; cancellation or failure can omit either intermediate event. Existing durable run/message terminal events precede `prompt.finished`. Every callback-backed streamed text part that stays in its message emits exactly one `part.completed` event before the corresponding `run.finished` event: once the model step that streamed it is committed, so its text is final and saved, or with the run's terminal projection when that step did not commit. Text a later model step streams starts a new part. When a model call fails and is retried, the text and reasoning parts it streamed are not in the session: `part.removed` takes each of them out of its message, last part first, and the retry streams its own parts. Its `partIndex` is the part's position before it left; the parts after it move up by one. A removed part has no further events, and `part.removed` does not count against `callbackLimits`. The tool parts of calls the failed model call executed stay. Every `part.started`, `part.delta`, `part.updated`, `part.completed`, and `part.removed` event carries zero-based `messageIndex` and `partIndex` coordinates from the session's authoritative message and part sequences.
 
 `getSessionView(scopeId, sessionId)` reads a session's metadata, visible messages and pending permission requests in one step, together with the instance's event `sequence` they include. The messages include what a running turn has streamed so far, so a consumer that applies every event of the instance with a greater `sequence` follows the session exactly from the view on; events up to `sequence` are already in it. The read waits while a queued write or a change that emits events for the session is in progress; a session that keeps changing through 64 consecutive waits is refused with `FlexHarnessSessionBusyError`, and the read can be repeated. Session metadata is current: status changes such as `waiting_permission` emit no event. A permission request its run leaves unanswered leaves `pendingPermissions` without an event of its own; the run's `run.finished` follows.
 
@@ -1205,7 +1209,7 @@ The JSON stores are explicitly not cross-process safe. When several processes ca
 
 Direct store operations and non-run session mutations surface conflicts as `FlexHarnessStoreConflictError` or the corresponding AgentSession store conflict. Malformed, wrong-schema, or non-JSON snapshots are surfaced as `FlexHarnessStoreFormatError`. A write or deletion that changed its target but cannot confirm parent-directory durability surfaces `FlexHarnessStoreCommitUncertainError` with the affected path, operation, and cause. Run persistence failures cross the external error boundary and therefore become `FlexHarnessExternalError`. FlexHarness does not merge conflicts.
 
-Each domain serializes its own mutations. A successful run first persists a hidden completed projection, then finalizes the canonical Agent generation as `accepted`, then promotes the hidden projection publicly. Recovery uses the canonical generation outcome to promote an accepted stage or publish a failed/cancelled projection. Failed and cancelled generations remain auditable but never enter future model context.
+Each domain serializes its own mutations. A successful run first persists a hidden completed projection, then finalizes the canonical Agent generation as `accepted`, then promotes the hidden projection publicly. Recovery uses the canonical generation outcome to promote an accepted stage or publish a failed/cancelled projection. Failed and cancelled generations remain auditable and, once execution produced model/tool output, also remain in future model context with their actual outcome; no-output unsuccessful generations remain excluded.
 
 Projection stores accept schema version 1, 2, or 3 from `load()`, but every `save()` receives a change that makes the current schema-3 shape. A change to a loaded schema-1 or schema-2 projection carries both lists whole. Schema 3 records explicit reversion protocol, transcript/workspace provenance, and V2 disposition. A terminal V2 segment must be conclusively `revertible`, `no-change`, or `nonrevertible`; a pending V2 capture remains owned by its capture WAL and is never treated as transcript history.