@vincemakes/kiso-runtime 0.1.28 → 0.1.30

package/dist/agent.d.ts

@@ -51,14 +51,14 @@ export interface AgentDefinition {
     readonly compaction?: {
         readonly thresholdTokens: number;
     };
-    /** C 区: microcompact threshold — passed through to every session. */
+    /** C area: microcompact threshold — passed through to every session. */
     readonly microcompact?: {
         readonly thresholdTokens: number;
     };
     readonly maxRetries?: number;
     /** E1: loaded extensions — their tools merge into the registry (a name
      *  collision with a built-in is a loud startup error), their hooks
-     *  compose after the agent's own (既有先行), their approvals join the
+     *  compose after the agent's own (the existing come first), their approvals join the
      *  loop's policy chain. */
     readonly extensions?: readonly KisoExtension[];
 }
@@ -68,7 +68,7 @@ export declare class AgentRuntime {
     sessionIds(): string[];
     /** Session metadata for listings (`kiso sessions`). */
     sessions(): import("./store.js").SessionMeta[];
-    /** Release every held fd and writer lock (E 组: the CLI closes on exit). */
+    /** Release every held fd and writer lock (E group: the CLI closes on exit). */
     close(): void;
     /** Load an existing session from disk, or create a fresh one. */
     session(options: {
@@ -78,7 +78,7 @@ export declare class AgentRuntime {
 /** The one-liner the README promises. */
 export declare function createAgent(definition: AgentDefinition): AgentRuntime;
 /**
- * 合并轮 B: the adapter factory the CLI uses for /model switches — the
+ * merge round B: the adapter factory the CLI uses for /model switches — the
  * same lazy provider resolution as createAgent's (the CLI never imports
  * provider SDKs directly; the runtime owns them here). Returns a NEW
  * adapter each call; the caller (session.setAdapter) decides when it

package/dist/agent.js

@@ -27,7 +27,7 @@ export class AgentRuntime {
         for (const ext of definition.extensions ?? []) {
             for (const tool of ext.tools ?? [])
                 this.#registry.register(tool);
-            // 0.1.26 (MCP 懒连接): an extension's tools array is LIVE — the
+            // 0.1.26 (MCP lazy connection): an extension's tools array is LIVE — the
             // registry consults it on every lookup, so tools registered by a
             // background connect (the MCP bridge's servers) are callable the
             // moment they land, without a session rebuild.
@@ -42,7 +42,7 @@ export class AgentRuntime {
     sessions() {
         return this.#definition.store.list();
     }
-    /** Release every held fd and writer lock (E 组: the CLI closes on exit). */
+    /** Release every held fd and writer lock (E group: the CLI closes on exit). */
     close() {
         this.#definition.store.closeAll();
     }
@@ -104,7 +104,7 @@ function policyHooks(policy) {
     };
 }
 /**
- * 合并轮 B: the adapter factory the CLI uses for /model switches — the
+ * merge round B: the adapter factory the CLI uses for /model switches — the
  * same lazy provider resolution as createAgent's (the CLI never imports
  * provider SDKs directly; the runtime owns them here). Returns a NEW
  * adapter each call; the caller (session.setAdapter) decides when it
@@ -119,7 +119,7 @@ async function resolveAdapter(definition) {
     if (definition.adapter)
         return definition.adapter;
     switch (definition.provider) {
-        // 七: the runtime imports ONLY the provider package — its high-level
+        // round 7: the runtime imports ONLY the provider package — its high-level
         // factory owns the SDK and builds the adapter from config. The SDKs
         // are private dependencies of the provider packages, so a nested
         // consumer install resolves them next to the provider, never through

package/dist/compose.d.ts

@@ -1,7 +1,7 @@
 /**
- * 手感批 B4 (pure move) — the E1/E2 composition helpers, moved verbatim
+ * the ergonomics batch B4 (pure move) — the E1/E2 composition helpers, moved verbatim
  * from session.ts: the extension system-prompt appends, the extension
- * hook composition (既有先行), and the loop's microcompact config lookup.
+ * hook composition (the existing come first), and the loop's microcompact config lookup.
  */
 import type { HookHost, KisoExtension } from "@vincemakes/kiso-core";
 import type { SessionConfig } from "./session.js";
@@ -12,7 +12,7 @@ import type { SessionConfig } from "./session.js";
  */
 export declare function composeSystemPrompt(base: string | undefined, extensions: readonly KisoExtension[]): string | undefined;
 /**
- * E1: extension hooks compose AFTER the agent's own (既有先行 — the existing
+ * E1: extension hooks compose AFTER the agent's own (the existing come first — the existing
  * hook sees every event first). Observers all run, in order; onUserMessage
  * and onPreTool — the FIRST decisive answer wins (the existing hook
  * outranks extensions; defers fall through); onPostTool folds — each

package/dist/compose.js

@@ -1,7 +1,7 @@
 /**
- * 手感批 B4 (pure move) — the E1/E2 composition helpers, moved verbatim
+ * the ergonomics batch B4 (pure move) — the E1/E2 composition helpers, moved verbatim
  * from session.ts: the extension system-prompt appends, the extension
- * hook composition (既有先行), and the loop's microcompact config lookup.
+ * hook composition (the existing come first), and the loop's microcompact config lookup.
  */
 /**
  * E2: the session's systemPrompt plus every extension's append, in LOAD
@@ -15,7 +15,7 @@ export function composeSystemPrompt(base, extensions) {
     return base === undefined ? appends.join("\n\n") : `${base}\n\n${appends.join("\n\n")}`;
 }
 /**
- * E1: extension hooks compose AFTER the agent's own (既有先行 — the existing
+ * E1: extension hooks compose AFTER the agent's own (the existing come first — the existing
  * hook sees every event first). Observers all run, in order; onUserMessage
  * and onPreTool — the FIRST decisive answer wins (the existing hook
  * outranks extensions; defers fall through); onPostTool folds — each
@@ -49,8 +49,8 @@ export function composeHooks(existing, extensions) {
         out.onUserMessage = messageHandlers[0]; // length 1 guarantees the element
     }
     else if (messageHandlers.length > 1) {
-        // 复审 E1-P2: the pipe + veto short-circuit — each handler sees the
-        // message as the PREVIOUS one left it (既有先行), and a null (veto)
+        // re-review E1-P2: the pipe + veto short-circuit — each handler sees the
+        // message as the PREVIOUS one left it (the existing come first), and a null (veto)
         // anywhere ends the chain immediately: never "no opinion" for the
         // next handler to outvote. Adding an extension can therefore never
         // make the chain MORE permissive (the approval chain's deny>ask>allow

package/dist/extensions.d.ts

@@ -21,7 +21,7 @@ export type { KisoExtension };
 export declare function loadProjectExtensions(dir: string, existing?: readonly KisoExtension[]): Promise<KisoExtension[]>;
 export declare function loadExtensions(dir: string): Promise<KisoExtension[]>;
 /**
- * 发现#8 (P1): dispose every extension's external resources — each call
+ * finding #8 (P1): dispose every extension's external resources — each call
  * guarded (one failure never blocks the rest), each capped at 5s (a
  * timeout is abandoned and recorded — Promise.allSettled semantics).
  * Whoever LOADS extensions is responsible for disposing them.

package/dist/extensions.js

@@ -61,7 +61,7 @@ export async function loadExtensions(dir) {
     return out;
 }
 /**
- * 发现#8 (P1): dispose every extension's external resources — each call
+ * finding #8 (P1): dispose every extension's external resources — each call
  * guarded (one failure never blocks the rest), each capped at 5s (a
  * timeout is abandoned and recorded — Promise.allSettled semantics).
  * Whoever LOADS extensions is responsible for disposing them.

package/dist/recovery.d.ts

@@ -1,5 +1,5 @@
 /**
- * 手感批 B4 (pure move) — the recovery support pieces, moved verbatim from
+ * the ergonomics batch B4 (pure move) — the recovery support pieces, moved verbatim from
  * session.ts: the open-run gate, the abort sentinel/race wrapper, and the
  * merged abort signal.
  */
@@ -8,7 +8,7 @@ import type { StoreRecord } from "./store.js";
 /**
  * The most recent run WITHOUT a terminal, or undefined when every recorded
  * run terminated. Recovery can only drive ONE run to its terminal, so an
- * open run must be the exclusive reason a session refuses new runs (四).
+ * open run must be the exclusive reason a session refuses new runs (round 4).
  */
 export declare function openRunId(records: readonly StoreRecord[]): string | undefined;
 /** Sentinel: the signal aborted while the recovery awaited a decision. */

package/dist/recovery.js

@@ -1,12 +1,12 @@
 /**
- * 手感批 B4 (pure move) — the recovery support pieces, moved verbatim from
+ * the ergonomics batch B4 (pure move) — the recovery support pieces, moved verbatim from
  * session.ts: the open-run gate, the abort sentinel/race wrapper, and the
  * merged abort signal.
  */
 /**
  * The most recent run WITHOUT a terminal, or undefined when every recorded
  * run terminated. Recovery can only drive ONE run to its terminal, so an
- * open run must be the exclusive reason a session refuses new runs (四).
+ * open run must be the exclusive reason a session refuses new runs (round 4).
  */
 export function openRunId(records) {
     const terminated = new Set(records.filter((r) => r.event.type === "terminal").map((r) => r.runId));

package/dist/run.d.ts

@@ -1,5 +1,5 @@
 /**
- * 手感批 B4 (pure move) — the Run class (a single turn: write-ahead
+ * the ergonomics batch B4 (pure move) — the Run class (a single turn: write-ahead
  * persistence, the loop drive, the durable recovery state machine), moved
  * verbatim from session.ts.
  */

package/dist/run.js

@@ -1,5 +1,5 @@
 /**
- * 手感批 B4 (pure move) — the Run class (a single turn: write-ahead
+ * the ergonomics batch B4 (pure move) — the Run class (a single turn: write-ahead
  * persistence, the loop drive, the durable recovery state machine), moved
  * verbatim from session.ts.
  */
@@ -46,7 +46,7 @@ export class Run {
         // run at ANY yield (even the user_input one) must release the
         // session's single-run slot and its approval resolvers.
         try {
-            // 第四轮: health is re-checked when the iterator ACTUALLY starts —
+            // round 4: health is re-checked when the iterator ACTUALLY starts —
             // a run constructed before the session was poisoned must fail
             // here, before any log or disk mutation.
             this.#session.ensureHealthy();
@@ -80,7 +80,7 @@ export class Run {
                     this.#decisionIds.push(decisionId);
                     this.#session.registerResolver(decisionId, resolve);
                 }),
-                // 第四轮(对抗): the abort paths consult these so a verdict
+                // round 4 (adversarial): the abort paths consult these so a verdict
                 // the human gave in the same instant as the abort is
                 // recorded, exactly once.
                 approvalVerdict: (decisionId) => this.#session.approvalVerdict(decisionId),
@@ -98,7 +98,7 @@ export class Run {
                 }
             };
             if (this.#resume) {
-                // ── B 组: recovery is PER-RUN, keyed by StoreRecord.runId ──
+                // ── B group: recovery is PER-RUN, keyed by StoreRecord.runId ──
                 // Rebuild run boundaries; only the LAST unterminated run is
                 // recovered. Earlier runs that DID terminate have their
                 // dangling approvals closed (permission_expired) — a dead
@@ -167,14 +167,14 @@ export class Run {
                 }
                 // 2. Continuation: drive the LAST OPEN run to its terminal.
                 //    The guard is scoped to that run — an earlier run's
-                //    terminal must not suppress it (B 组).
+                //    terminal must not suppress it (B group).
                 if (!lastOpen.events.some((e) => e.type === "terminal")) {
                     for await (const ev of runLoop())
                         yield ev;
                 }
                 return;
             }
-            // 四: a session with an open run REFUSES new runs at the
+            // round 4: a session with an open run REFUSES new runs at the
             // persistence layer — a second open run would be permanently
             // orphaned (recovery only ever recovers the last one). The
             // open run is continued via resume(), never by starting another.
@@ -196,7 +196,7 @@ export class Run {
                 yield ev;
         }
         finally {
-            // 第五轮(P1-5): flush verdicts the consumer submitted before the
+            // round 5(P1-5): flush verdicts the consumer submitted before the
             // generator was abandoned — an approve()/resolveUncertain() whose
             // durable event the loop never got to persist must STILL land on
             // disk, exactly once.
@@ -232,7 +232,7 @@ export class Run {
         const requests = scope.filter((e) => e.type === "permission_requested");
         for (const pending of requests) {
             const decided = log.all.find((e) => e.type === "permission_decided" && e.decisionId === pending.decisionId);
-            // 四: paired by events NEWER than the request — a historical
+            // round 4: paired by events NEWER than the request — a historical
             // same-callId execution from an earlier run must not count as THIS
             // request's execution (the provider callId may repeat across runs).
             const hasExecution = log.all.some((e) => e.type === "tool_execution_started" && e.callId === pending.callId && e.seq > pending.seq);
@@ -247,7 +247,7 @@ export class Run {
                 // Area 4: an abort during the resumed approval wait ends the
                 // run; the request stays durable and pending.
                 if (signal.aborted) {
-                    // 第五轮(P1-6): a verdict given in the same instant as the
+                    // round 5(P1-6): a verdict given in the same instant as the
                     // abort is still recorded — the abort must not bypass the
                     // durable fallback (aligned with the loop's abort path).
                     const verdict = this.#session.approvalVerdict(pending.decisionId);
@@ -264,7 +264,7 @@ export class Run {
                 }
                 const final = await abortable(pendingDecision, signal);
                 if (final === ABORTED) {
-                    // 第四轮(对抗): a verdict given in the same instant as the
+                    // round 4 (adversarial): a verdict given in the same instant as the
                     // abort is recorded (exactly once), never lost.
                     const verdict = this.#session.approvalVerdict(pending.decisionId);
                     if (verdict !== undefined) {
@@ -282,7 +282,7 @@ export class Run {
                 yield log.append({
                     type: "permission_decided",
                     decisionId: pending.decisionId,
-                    callId: pending.callId, // binds the decision to the invocation (B 组)
+                    callId: pending.callId, // binds the decision to the invocation (B group)
                     decision: final.action === "allow" ? "approved" : "denied",
                     ...(final.action === "deny" && final.reason !== undefined ? { reason: final.reason } : {}),
                 });
@@ -311,7 +311,7 @@ export class Run {
         // whose model-facing result never landed is completed FROM THE
         // RECEIPT — never re-executed. Snapshot the scope first: this phase
         // appends the repaired results, and iterating a growing array would
-        // re-visit them. 四: pairing is by executionId — a same-callId result
+        // re-visit them. round 4: pairing is by executionId — a same-callId result
         // from a different execution never suppresses the repair.
         for (const ev of [...scope]) {
             if (ev.type !== "tool_execution_succeeded" && ev.type !== "tool_execution_failed")
@@ -325,7 +325,7 @@ export class Run {
                     callId: ev.callId,
                     content: ev.result.content,
                     isError: false,
-                    // 八: the repaired result reproduces the normal path
+                    // round 8: the repaired result reproduces the normal path
                     // losslessly — the tags ride on the durable receipt.
                     ...(ev.tags !== undefined ? { tags: ev.tags } : {}),
                     executionId: ev.executionId,
@@ -340,9 +340,9 @@ export class Run {
                     executionId: ev.executionId,
                 });
         }
-        // B 组 crash window: a resolution was persisted but its tool_result
+        // B group crash window: a resolution was persisted but its tool_result
         // fill never landed — complete it so the model is never left staring
-        // at a dangling tool_use. 四: keyed by executionId, and the fill
+        // at a dangling tool_use. round 4: keyed by executionId, and the fill
         // carries it, so a same-callId result from another execution is never
         // confused with this one.
         for (const ev of [...scope]) {
@@ -403,7 +403,7 @@ export class Run {
                 result = await this.#config.hooks.onPostTool({ callId, name, input }, result, { sessionId: this.#session.id });
             }
         }
-        // 裁决 #12 修正一: the honest note rides the recovered failure too —
+        // ruling #12 correction one: the honest note rides the recovered failure too —
         // the receipt and the repaired tool_result reproduce the live path
         // losslessly.
         if (result.isError && tool?.idempotent !== true) {
@@ -440,12 +440,12 @@ export class Run {
             isError: result.isError,
             // P1-9: errorKind only exists on errors — runtime-guarded too.
             ...(result.isError && result.errorKind !== undefined ? { errorKind: result.errorKind } : {}),
-            // 五: live tags survive the resumed path too.
+            // round 5: live tags survive the resumed path too.
             ...(result.tags !== undefined ? { tags: result.tags } : {}),
             executionId,
         });
-        // 裁决 #12 (ADR-0038): the failed-receipt uncertain PAUSE is REMOVED
-        // here too (it mirrored the live loop's C 组 pause) — a complete
+        // ruling #12 (ADR-0038): the failed-receipt uncertain PAUSE is REMOVED
+        // here too (it mirrored the live loop's C group pause) — a complete
         // receipt IS the outcome; uncertainty belongs to the crash window
         // alone. A retry passes the approval chain again.
     }

package/dist/session.d.ts

@@ -23,7 +23,7 @@
  * Restart recovery is the same code path as a second run: rebuild the log
  * from the JSONL, continue numbering where the file ended.
  *
- * 手感批 B4 (pure move): the Run class lives in run.ts, the recovery
+ * the ergonomics batch B4 (pure move): the Run class lives in run.ts, the recovery
  * support in recovery.ts, the E1/E2 composition helpers in compose.ts —
  * same package, same exports (index.ts re-exports all four).
  */
@@ -32,7 +32,7 @@ import { type SessionStore } from "./store.js";
 import { Run } from "./run.js";
 /** A session whose disk write was rejected (stale handle) is PERMANENTLY
  * poisoned: its in-memory log no longer matches the disk, so no further
- * run may proceed — reload the session (一). */
+ * run may proceed — reload the session (round 1). */
 export declare class PoisonedSessionError extends Error {
     constructor(reason: string);
 }
@@ -65,12 +65,12 @@ export declare class AgentSession {
     #private;
     readonly id: string;
     readonly log: EventLog;
-    /** Permanently invalidate the session after a rejected disk write (一). */
+    /** Permanently invalidate the session after a rejected disk write (round 1). */
     poison(reason: string): void;
     ensureHealthy(): void;
     constructor(id: string, log: EventLog, store: SessionStore, adapter: Adapter, config: SessionConfig);
     /** Write-ahead through the store; a rejected write POISONS the session
-     *  (一/第四轮): the in-memory log no longer matches the disk — whatever
+     *  (round 1/round 4): the in-memory log no longer matches the disk — whatever
      *  the cause (stale handle, corruption, a live external writer, an I/O
      *  fault) — so no further run, resume, or log mutation may proceed.
      *  The health check runs BEFORE every write, on every path. */
@@ -80,7 +80,7 @@ export declare class AgentSession {
     /** The conversation so far, as the model sees it. */
     projected(): readonly Message[];
     /**
-     * 合并轮 B (/model): replace the adapter for SUBSEQUENT runs. The
+     * merge round B (/model): replace the adapter for SUBSEQUENT runs. The
      * kernel reads the adapter through the loop-config closure at each
      * turn, so the swap takes effect at the next turn — a run already in
      * flight keeps the adapter it started with. The CLI calls this between
@@ -115,7 +115,7 @@ export declare class AgentSession {
     }): Promise<SummarizeResult | null>;
     /**
      * Pauses that still await a human decision (durable, survives restart).
-     * B 组: a request whose RUN has terminated is DEAD — it is neither
+     * B group: a request whose RUN has terminated is DEAD — it is neither
      * re-presented here nor recoverable; expired requests are excluded too.
      */
     pendingApprovals(): ApprovalRequest[];
@@ -134,7 +134,7 @@ export declare class AgentSession {
     uncertainExecutions(): import("@vincemakes/kiso-core").ExecutionRecord[];
     /**
      * The human's verdict on an interrupted execution, keyed by EXECUTION ID
-     * (B 组): "rerun" (the human says the side effect did NOT happen — the
+     * (B group): "rerun" (the human says the side effect did NOT happen — the
      * attempt is completed with a recorded failure so the model may re-issue
      * it as a new logical call) or "abandoned" (treated as failed forever).
      * Only uncertain → rerun/abandoned is legal; a resolved or successful
@@ -148,12 +148,12 @@ export declare class AgentSession {
     registerUncertaintyResolver(executionId: string, resolve: (resolution: "rerun" | "abandoned") => void): void;
     dropUncertaintyResolver(executionId: string): void;
     registerResolver(decisionId: string, resolve: (decision: PermissionDecision) => void): void;
-    /** 第四轮(对抗): a verdict the human already gave for a live decision. */
+    /** round 4 (adversarial): a verdict the human already gave for a live decision. */
     approvalVerdict(decisionId: string): boolean | undefined;
-    /** 第四轮(对抗): a verdict the human already gave for a live execution. */
+    /** round 4 (adversarial): a verdict the human already gave for a live execution. */
     uncertaintyVerdict(executionId: string): "rerun" | "abandoned" | undefined;
     /**
-     * 第五轮(P1-5): flush every verdict submitted to a live resolver that is
+     * round 5(P1-5): flush every verdict submitted to a live resolver that is
      * not yet durable. Called from the Run iterator's FINALLY — whether the
      * run completed, aborted, or was abandoned by the consumer. An event the
      * loop already appended is left alone (its persist precedes its yield);
@@ -178,7 +178,7 @@ export interface SessionConfig {
     readonly compaction?: {
         readonly thresholdTokens: number;
     };
-    /** C 区: microcompact threshold — passed through to the loop verbatim. */
+    /** C area: microcompact threshold — passed through to the loop verbatim. */
     readonly microcompact?: {
         readonly thresholdTokens: number;
     };
@@ -186,7 +186,7 @@ export interface SessionConfig {
     /**
      * E1: loaded extensions — their tools join the registry (idempotently;
      * a collision with a built-in name was already rejected at agent
-     * creation), their hooks compose AFTER the existing ones (既有先行),
+     * creation), their hooks compose AFTER the existing ones (the existing come first),
      * their approval policies enter the loop's policy chain.
      */
     readonly extensions?: readonly KisoExtension[];

package/dist/session.js

@@ -23,7 +23,7 @@
  * Restart recovery is the same code path as a second run: rebuild the log
  * from the JSONL, continue numbering where the file ended.
  *
- * 手感批 B4 (pure move): the Run class lives in run.ts, the recovery
+ * the ergonomics batch B4 (pure move): the Run class lives in run.ts, the recovery
  * support in recovery.ts, the E1/E2 composition helpers in compose.ts —
  * same package, same exports (index.ts re-exports all four).
  */
@@ -35,7 +35,7 @@ import { composeHooks } from "./compose.js";
 import { Run } from "./run.js";
 /** A session whose disk write was rejected (stale handle) is PERMANENTLY
  * poisoned: its in-memory log no longer matches the disk, so no further
- * run may proceed — reload the session (一). */
+ * run may proceed — reload the session (round 1). */
 export class PoisonedSessionError extends Error {
     constructor(reason) {
         super(`session is poisoned: ${reason} — reload it; the in-memory log no longer matches the disk`);
@@ -63,16 +63,16 @@ export class AgentSession {
     #pendingResolvers = new Map();
     #uncertaintyResolvers = new Map();
     #answered = new Set();
-    /** 七: verdicts already passed to a live resolver — the resolution event
+    /** round 7: verdicts already passed to a live resolver — the resolution event
      *  lands in the log asynchronously (the loop owns it), so the ledger
      *  alone cannot make resolveUncertain idempotent across the same tick. */
     #uncertaintyAnswered = new Set();
-    /** 第四轮(对抗): verdicts the human GAVE, recorded when passed to a live
+    /** round 4 (adversarial): verdicts the human GAVE, recorded when passed to a live
      *  resolver. If an abort races the verdict, the loop / recovery queries
      *  these and records the decision (exactly once) instead of losing it. */
     #approvalVerdicts = new Map();
     #uncertaintyVerdicts = new Map();
-    /** 第五轮(P1-5): verdicts submitted to a LIVE resolver but not yet known
+    /** round 5(P1-5): verdicts submitted to a LIVE resolver but not yet known
      *  durable. An async generator only advances on next(), so approve()/
      *  resolveUncertain() CANNOT wait for the loop to persist — that would
      *  deadlock (the consumer waits while the generator needs a next()).
@@ -82,7 +82,7 @@ export class AgentSession {
     #pendingDurableApprovals = new Map();
     #pendingDurableUncertainties = new Map();
     #poisoned = null;
-    /** Permanently invalidate the session after a rejected disk write (一). */
+    /** Permanently invalidate the session after a rejected disk write (round 1). */
     poison(reason) {
         if (this.#poisoned === null)
             this.#poisoned = reason;
@@ -110,7 +110,7 @@ export class AgentSession {
         this.#config = composedHooks === undefined ? config : { ...config, hooks: composedHooks };
     }
     /** Write-ahead through the store; a rejected write POISONS the session
-     *  (一/第四轮): the in-memory log no longer matches the disk — whatever
+     *  (round 1/round 4): the in-memory log no longer matches the disk — whatever
      *  the cause (stale handle, corruption, a live external writer, an I/O
      *  fault) — so no further run, resume, or log mutation may proceed.
      *  The health check runs BEFORE every write, on every path. */
@@ -120,7 +120,7 @@ export class AgentSession {
             await this.#store.append(this.id, runId, event);
         }
         catch (err) {
-            // 第四轮: ANY rejected write poisons — not only the typed
+            // round 4: ANY rejected write poisons — not only the typed
             // stale/corruption errors. A live external writer's lock error
             // is the realistic case; the in-memory log is ahead of the disk
             // in all of them.
@@ -143,7 +143,7 @@ export class AgentSession {
         return projectMessages(this.log.all);
     }
     /**
-     * 合并轮 B (/model): replace the adapter for SUBSEQUENT runs. The
+     * merge round B (/model): replace the adapter for SUBSEQUENT runs. The
      * kernel reads the adapter through the loop-config closure at each
      * turn, so the swap takes effect at the next turn — a run already in
      * flight keeps the adapter it started with. The CLI calls this between
@@ -206,7 +206,7 @@ export class AgentSession {
     // ── Phase D: approvals ───────────────────────────────────────────────
     /**
      * Pauses that still await a human decision (durable, survives restart).
-     * B 组: a request whose RUN has terminated is DEAD — it is neither
+     * B group: a request whose RUN has terminated is DEAD — it is neither
      * re-presented here nor recoverable; expired requests are excluded too.
      */
     pendingApprovals() {
@@ -250,7 +250,7 @@ export class AgentSession {
      * lost decision only re-presents the request.
      */
     async approve(decisionId, allow) {
-        // 第四轮: a poisoned session may not mutate the log — checked before
+        // round 4: a poisoned session may not mutate the log — checked before
         // anything is recorded.
         this.ensureHealthy();
         // Idempotent: one decision per request (review finding 7). The
@@ -263,7 +263,7 @@ export class AgentSession {
         this.#answered.add(decisionId);
         if (this.log.all.some((e) => e.type === "permission_decided" && e.decisionId === decisionId))
             return;
-        // B 组: a late approve() on a TERMINATED run writes nothing and
+        // B group: a late approve() on a TERMINATED run writes nothing and
         // executes nothing — a dead run's approval cannot resurrect it.
         const records = this.#store.load(this.id);
         const request = records.find((r) => r.event.type === "permission_requested" && r.event.decisionId === decisionId);
@@ -274,10 +274,10 @@ export class AgentSession {
         }
         const resolver = this.#pendingResolvers.get(decisionId);
         if (resolver !== undefined) {
-            // 第四轮(对抗): recorded so an abort racing the verdict cannot
+            // round 4 (adversarial): recorded so an abort racing the verdict cannot
             // lose it — the loop's abort path consults approvalVerdict.
             this.#approvalVerdicts.set(decisionId, allow);
-            // 第五轮(P1-5): the verdict is SUBMITTED — the Run's finally
+            // round 5(P1-5): the verdict is SUBMITTED — the Run's finally
             // flushes it to disk if the generator never gets to persist it.
             // (Waiting here for durability would deadlock: the generator
             // only advances on the consumer's next(), which the consumer
@@ -304,7 +304,7 @@ export class AgentSession {
     }
     /**
      * The human's verdict on an interrupted execution, keyed by EXECUTION ID
-     * (B 组): "rerun" (the human says the side effect did NOT happen — the
+     * (B group): "rerun" (the human says the side effect did NOT happen — the
      * attempt is completed with a recorded failure so the model may re-issue
      * it as a new logical call) or "abandoned" (treated as failed forever).
      * Only uncertain → rerun/abandoned is legal; a resolved or successful
@@ -313,37 +313,37 @@ export class AgentSession {
      * rejected by real providers (review finding 1).
      */
     async resolveUncertain(executionId, resolution) {
-        // 第四轮: a poisoned session may not mutate the log.
+        // round 4: a poisoned session may not mutate the log.
         this.ensureHealthy();
         const record = executionLedger(this.log.all).get(executionId);
         if (!record)
             throw new Error(`no execution record for ${executionId}`);
         if (record.status !== "uncertain")
             return; // idempotent + irreversible
-        // 七: a verdict already passed to a live resolver is FINAL — the
+        // round 7: a verdict already passed to a live resolver is FINAL — the
         // loop's resolution event lands asynchronously, so the ledger alone
         // cannot make this idempotent across the same tick.
         if (this.#uncertaintyAnswered.has(executionId))
             return;
         this.#uncertaintyAnswered.add(executionId);
-        // 七: with a LIVE resolver, the active loop / recovery generator
+        // round 7: with a LIVE resolver, the active loop / recovery generator
         // OWNS the resolution event — it appends, yields, and persists it
         // through the Run, so the consumer's stream and the durable log
         // stay identical. We only pass the verdict; a hidden append here
-        // would leave a seq gap. 第四轮(对抗): the verdict is recorded so an
+        // would leave a seq gap. round 4 (adversarial): the verdict is recorded so an
         // abort racing it cannot lose it.
         const resolver = this.#uncertaintyResolvers.get(executionId);
         if (resolver !== undefined) {
             this.#uncertaintyVerdicts.set(executionId, resolution);
-            // 第五轮(P1-5): submitted — flushed to disk by the Run's finally
+            // round 5(P1-5): submitted — flushed to disk by the Run's finally
             // if the generator never persists it.
             this.#pendingDurableUncertainties.set(executionId, { resolution, callId: record.callId });
             this.#uncertaintyResolvers.delete(executionId);
             resolver(resolution);
             return;
         }
-        // 七: OFFLINE verdict — no live resolver: persist directly.
-        // 四: the verdict is attributed to the ORIGINAL run of the execution
+        // round 7: OFFLINE verdict — no live resolver: persist directly.
+        // round 4: the verdict is attributed to the ORIGINAL run of the execution
         // — never the fake runId "resolution".
         const runId = this.runIdFor(executionId);
         const resolved = this.log.append({
@@ -353,10 +353,10 @@ export class AgentSession {
             resolution,
         });
         await this.persist(runId, resolved);
-        // 四: the fill is keyed by THIS execution — a tool_result belonging to
+        // round 4: the fill is keyed by THIS execution — a tool_result belonging to
         // a different (same-callId) execution must not suppress the verdict's
         // model-facing result, and the fill itself carries the executionId.
-        // 八(对抗): the fill also carries the tags from the durable RECEIPT —
+        // round 8 (adversarial): the fill also carries the tags from the durable RECEIPT —
         // the normal live path emits the result with tags before the pause,
         // so a crash-window repair reproduces them.
         if (!this.log.all.some((e) => e.type === "tool_result" && e.executionId === record.executionId)) {
@@ -399,16 +399,16 @@ export class AgentSession {
     registerResolver(decisionId, resolve) {
         this.#pendingResolvers.set(decisionId, resolve);
     }
-    /** 第四轮(对抗): a verdict the human already gave for a live decision. */
+    /** round 4 (adversarial): a verdict the human already gave for a live decision. */
     approvalVerdict(decisionId) {
         return this.#approvalVerdicts.get(decisionId);
     }
-    /** 第四轮(对抗): a verdict the human already gave for a live execution. */
+    /** round 4 (adversarial): a verdict the human already gave for a live execution. */
     uncertaintyVerdict(executionId) {
         return this.#uncertaintyVerdicts.get(executionId);
     }
     /**
-     * 第五轮(P1-5): flush every verdict submitted to a live resolver that is
+     * round 5(P1-5): flush every verdict submitted to a live resolver that is
      * not yet durable. Called from the Run iterator's FINALLY — whether the
      * run completed, aborted, or was abandoned by the consumer. An event the
      * loop already appended is left alone (its persist precedes its yield);

package/dist/store.d.ts

@@ -1,9 +1,9 @@
 /**
- * SessionStore — append-only JSONL durability, identity-safe (A 组).
+ * SessionStore — append-only JSONL durability, identity-safe (A group).
  *
  * One file per session: `<root>/<id>.jsonl`, lines of
  * `{"runId": string, "ts": number, "event": Event}`. The single-writer
- * lock (第四轮) is an EXCLUSIVE KERNEL flock on `<id>.lock`, held by a
+ * lock (round 4) is an EXCLUSIVE KERNEL flock on `<id>.lock`, held by a
  * dedicated helper process:
  *
  * - the kernel arbitrates every race — a contender can never remove or
@@ -11,7 +11,7 @@
  *   the lock simply exists while the helper lives and vanishes with it;
  * - the lock file ALSO carries `{"pid": number, "token": string}` written
  *   by the holder, as a best-effort guard for OLD-format writers (whose
- *   O_EXCL pidfile scheme does not honor flock). 第五轮(P1-4): this guard
+ *   O_EXCL pidfile scheme does not honor flock). round 5(P1-4): this guard
  *   is NOT a seamless rolling upgrade — an old writer that created an
  *   empty lock file before writing its pid creates a split-brain window
  *   that a pidfile read cannot close. The documented upgrade contract is
@@ -22,7 +22,7 @@
  *   held helper — a foreign close can never release another writer's
  *   kernel lock (flock is tied to the helper's open file description).
  *
- * Consistency contract (A 组):
+ * Consistency contract (A group):
  * - every id is validated BEFORE any file side effect (append, close,
  *   load, lock paths);
  * - append runs an expected-last-seq CAS against the file's REAL last
@@ -31,7 +31,7 @@
  *   so the in-memory EventLog never continues past a rejected write;
  * - the torn tail is repaired before EVERY append, and committed records
  *   (newline-terminated) are never truncated;
- * - load is strict (A 组 round 1): a partial final line is the only
+ * - load is strict (A group round 1): a partial final line is the only
  *   tolerated damage; everything else throws StoreCorruptionError.
  */
 import { type Event } from "@vincemakes/kiso-core";
@@ -64,25 +64,25 @@ export declare class SessionStore {
     private pathFor;
     private lockPathFor;
     /**
-     * Take the single-writer lock (第四轮): an EXCLUSIVE kernel flock held
+     * Take the single-writer lock (round 4): an EXCLUSIVE kernel flock held
      * by a dedicated helper process. The KERNEL arbitrates every race —
      * there is no stale lock to delete and no takeover to race: a
      * contender either gets the flock (the previous holder is gone) or it
      * fails. The lock file also carries the holder's identity so an OLD-format
      * writer (which does not honor flock) still sees a live owner and
      * refuses to take over — a best-effort guard, NOT a seamless rolling
-     * upgrade (第五轮 P1-4): the documented upgrade contract is quarantine —
+     * upgrade (round 5 P1-4): the documented upgrade contract is quarantine —
      * stop every old-format process, then start the new version.
      * No recursion, no deletion, no window between NEW-format writers.
      */
     private acquireLock;
-    /** 第五轮(P1-2): true only while the helper process is alive. */
+    /** round 5(P1-2): true only while the helper process is alive. */
     private lockHeld;
     /**
      * Release OUR lock only: kill OUR helper. The kernel releases the
      * flock with the helper's death; the identity file is CLEARED so a
      * same-process successor is never mistaken for a live legacy owner —
-     * the flock is the authority, the file is advisory (第四轮).
+     * the flock is the authority, the file is advisory (round 4).
      */
     private releaseLock;
     /** Write-ahead: durable (written + fsynced) before returning. */

package/dist/store.js

@@ -1,9 +1,9 @@
 /**
- * SessionStore — append-only JSONL durability, identity-safe (A 组).
+ * SessionStore — append-only JSONL durability, identity-safe (A group).
  *
  * One file per session: `<root>/<id>.jsonl`, lines of
  * `{"runId": string, "ts": number, "event": Event}`. The single-writer
- * lock (第四轮) is an EXCLUSIVE KERNEL flock on `<id>.lock`, held by a
+ * lock (round 4) is an EXCLUSIVE KERNEL flock on `<id>.lock`, held by a
  * dedicated helper process:
  *
  * - the kernel arbitrates every race — a contender can never remove or
@@ -11,7 +11,7 @@
  *   the lock simply exists while the helper lives and vanishes with it;
  * - the lock file ALSO carries `{"pid": number, "token": string}` written
  *   by the holder, as a best-effort guard for OLD-format writers (whose
- *   O_EXCL pidfile scheme does not honor flock). 第五轮(P1-4): this guard
+ *   O_EXCL pidfile scheme does not honor flock). round 5(P1-4): this guard
  *   is NOT a seamless rolling upgrade — an old writer that created an
  *   empty lock file before writing its pid creates a split-brain window
  *   that a pidfile read cannot close. The documented upgrade contract is
@@ -22,7 +22,7 @@
  *   held helper — a foreign close can never release another writer's
  *   kernel lock (flock is tied to the helper's open file description).
  *
- * Consistency contract (A 组):
+ * Consistency contract (A group):
  * - every id is validated BEFORE any file side effect (append, close,
  *   load, lock paths);
  * - append runs an expected-last-seq CAS against the file's REAL last
@@ -31,7 +31,7 @@
  *   so the in-memory EventLog never continues past a rejected write;
  * - the torn tail is repaired before EVERY append, and committed records
  *   (newline-terminated) are never truncated;
- * - load is strict (A 组 round 1): a partial final line is the only
+ * - load is strict (A group round 1): a partial final line is the only
  *   tolerated damage; everything else throws StoreCorruptionError.
  */
 import { spawn } from "node:child_process";
@@ -59,10 +59,10 @@ export class SessionStore {
     #fds = new Map();
     /** sessionId → the lock helper process THIS instance spawned. */
     #lockHelpers = new Map();
-    /** 第四轮(对抗): serialize concurrent acquireLock calls ON this instance —
+    /** round 4 (adversarial): serialize concurrent acquireLock calls ON this instance —
      *  two racing appends must not spawn two helpers and fight each other. */
     #lockAcquiring = new Map();
-    /** 第五轮(P1-1): serialize the WHOLE append critical section per session on
+    /** round 5(P1-1): serialize the WHOLE append critical section per session on
      *  this instance — lock check → CAS → write → fsync. A rejected write
      *  propagates to every append queued behind it, so a concurrent write can
      *  never land after a stale failure (which would fork memory and disk). */
@@ -84,19 +84,19 @@ export class SessionStore {
         return join(this.root, `${sessionId}.lock`);
     }
     /**
-     * Take the single-writer lock (第四轮): an EXCLUSIVE kernel flock held
+     * Take the single-writer lock (round 4): an EXCLUSIVE kernel flock held
      * by a dedicated helper process. The KERNEL arbitrates every race —
      * there is no stale lock to delete and no takeover to race: a
      * contender either gets the flock (the previous holder is gone) or it
      * fails. The lock file also carries the holder's identity so an OLD-format
      * writer (which does not honor flock) still sees a live owner and
      * refuses to take over — a best-effort guard, NOT a seamless rolling
-     * upgrade (第五轮 P1-4): the documented upgrade contract is quarantine —
+     * upgrade (round 5 P1-4): the documented upgrade contract is quarantine —
      * stop every old-format process, then start the new version.
      * No recursion, no deletion, no window between NEW-format writers.
      */
     async acquireLock(sessionId) {
-        // 第五轮(P1-2): the lock is held only while the helper PROCESS is
+        // round 5(P1-2): the lock is held only while the helper PROCESS is
         // alive — flock is bound to the helper's lifetime. A dead helper's
         // entry must never be trusted as "locked".
         if (this.lockHeld(sessionId))
@@ -108,7 +108,7 @@ export class SessionStore {
         this.#lockAcquiring.set(sessionId, attempt);
         return attempt;
     }
-    /** 第五轮(P1-2): true only while the helper process is alive. */
+    /** round 5(P1-2): true only while the helper process is alive. */
     lockHeld(sessionId) {
         const child = this.#lockHelpers.get(sessionId);
         if (child === undefined || child.pid === undefined || child.pid <= 0)
@@ -128,7 +128,7 @@ export class SessionStore {
                 // be alive — its lock file names it. Refuse, and release
                 // the flock (the helper dies). A MODERN lock (with a token)
                 // naming OUR OWN process is a same-process writer's residue
-                // (第四轮: the file is advisory; the flock is the authority).
+                // (round 4: the file is advisory; the flock is the authority).
                 const legacy = readLockIdentity(lockPath);
                 if (legacy?.pid !== undefined && isAlive(legacy.pid) && (legacy.token === undefined || legacy.pid !== process.pid)) {
                     child.kill();
@@ -144,7 +144,7 @@ export class SessionStore {
                     // the file itself is advisory — the kernel lock holds
                 }
                 this.#lockHelpers.set(sessionId, child);
-                // 第五轮(P1-2): the helper's death removes the entry — the
+                // round 5(P1-2): the helper's death removes the entry — the
                 // flock dies with the process; a later append re-acquires
                 // (and fails honestly if a rival holds the flock now).
                 child.on("exit", () => {
@@ -156,7 +156,7 @@ export class SessionStore {
             }
             child.kill();
             if (verdict === "SPAWN_FAILED") {
-                // 第四轮(对抗): the helper could not start (python3 missing) —
+                // round 4 (adversarial): the helper could not start (python3 missing) —
                 // an HONEST error, never a fake lock conflict.
                 throw new Error(`session locking unavailable: the flock helper (python3) failed to start for ${sessionId}`);
             }
@@ -164,7 +164,7 @@ export class SessionStore {
             // exiting (its helper is dying). A FOREIGN live writer's identity
             // is in the file — refuse at once. A MODERN lock (with a token)
             // naming OUR OWN process is a same-process writer — it will
-            // release its helper; retry until it does (第四轮: never a
+            // release its helper; retry until it does (round 4: never a
             // spurious self-conflict). A legacy bare-pid lock naming our own
             // process is still a live foreign owner and is refused.
             const legacy = readLockIdentity(lockPath);
@@ -174,7 +174,7 @@ export class SessionStore {
             if (attempt >= 25) {
                 throw new Error(`session ${sessionId} is locked by another writer`);
             }
-            // 第五轮(P1-3): a close() that landed while we waited ends the
+            // round 5(P1-3): a close() that landed while we waited ends the
             // acquisition immediately — no 500ms wait, no lock at all.
             if (this.#closed.has(sessionId)) {
                 throw new Error(`session store is closed for ${sessionId}`);
@@ -186,14 +186,14 @@ export class SessionStore {
      * Release OUR lock only: kill OUR helper. The kernel releases the
      * flock with the helper's death; the identity file is CLEARED so a
      * same-process successor is never mistaken for a live legacy owner —
-     * the flock is the authority, the file is advisory (第四轮).
+     * the flock is the authority, the file is advisory (round 4).
      */
     releaseLock(sessionId) {
         const child = this.#lockHelpers.get(sessionId);
         if (child === undefined)
             return;
         this.#lockHelpers.delete(sessionId);
-        // 第四轮(对抗): the identity is cleared BEFORE the helper dies — a
+        // round 4 (adversarial): the identity is cleared BEFORE the helper dies — a
         // contender that acquires the flock in the release gap writes its
         // own identity AFTER our clear, so it is never wiped by us (the
         // file is advisory; the kernel flock is the authority).
@@ -212,7 +212,7 @@ export class SessionStore {
             throw new Error(`session store is closed for ${sessionId}`);
         }
         this.pathFor(sessionId); // id validated before ANY file side effect
-        // 第五轮(P1-1): the WHOLE critical section is serialized per session
+        // round 5(P1-1): the WHOLE critical section is serialized per session
         // on this instance — and a rejection PROPAGATES to every append
         // queued behind it: a concurrent write can never land after a
         // stale failure that poisoned the session.
@@ -229,7 +229,7 @@ export class SessionStore {
         }
     }
     async #appendOnce(sessionId, runId, event) {
-        // 第五轮(P1-3): close() may have returned while we waited — the
+        // round 5(P1-3): close() may have returned while we waited — the
         // lifecycle barrier is re-checked after the lock acquisition.
         if (this.#closed.has(sessionId)) {
             throw new Error(`session store is closed for ${sessionId}`);
@@ -247,13 +247,13 @@ export class SessionStore {
         }
         catch (err) {
             // The lock was acquired but the JSONL could not be opened:
-            // release the lock — it must not leak (A 组).
+            // release the lock — it must not leak (A group).
             this.releaseLock(sessionId);
             throw err;
         }
         repairTornTail(fd);
         // Expected-last-seq CAS against the file's REAL last committed seq
-        // (A 组): a stale preloaded handle cannot write a duplicate seq.
+        // (A group): a stale preloaded handle cannot write a duplicate seq.
         const last = lastCommittedSeq(fd);
         const expected = (last ?? -1) + 1;
         if (event.seq !== expected) {
@@ -261,7 +261,7 @@ export class SessionStore {
         }
         appendFileSync(fd, `${JSON.stringify({ runId, ts: Date.now(), event })}\n`);
         fsyncSync(fd);
-        // 第五轮(P1-3): a close() that landed during the write must not
+        // round 5(P1-3): a close() that landed during the write must not
         // leave our helper behind.
         if (this.#closed.has(sessionId)) {
             this.releaseLock(sessionId);
@@ -302,7 +302,7 @@ export class SessionStore {
             if (lines[i] !== "")
                 nonEmpty.push(i);
         }
-        // 二: a line WITHOUT a trailing newline is NOT committed — whether
+        // round 2: a line WITHOUT a trailing newline is NOT committed — whether
         // or not it happens to parse. load and append must agree: append's
         // torn-tail repair truncates exactly what load refuses to return.
         const tolerantTail = !raw.endsWith("\n");
@@ -384,7 +384,7 @@ function isRecord(value) {
     return typeof v.runId === "string" && typeof v.ts === "number" && isKisoEvent(v.event);
 }
 /**
- * Read a lock file's holder identity (第四轮). Formats:
+ * Read a lock file's holder identity (round 4). Formats:
  *   modern:  {"pid": 123, "token": "..."}
  *   legacy:  a bare pid — either the STRING "123" or, because
  *            JSON.parse("123") yields the NUMBER 123, the number itself.
@@ -480,7 +480,7 @@ function helperVerdict(child) {
         });
         child.stdout?.on("end", () => done(buf.trim()));
         child.stdout?.on("error", () => done("FAILED"));
-        // 第五轮(P2-1): a spawn failure (python3 missing, exec denied) is
+        // round 5(P2-1): a spawn failure (python3 missing, exec denied) is
         // DISTINCT from a busy lock — the caller must not report "locked by
         // another writer" for a missing helper. The verdict is SPAWN_FAILED
         // and the acquire path checks exactly that string.

package/dist/summarize.d.ts

@@ -1,6 +1,6 @@
 /**
  * The /compact summary layer (ADR-0044) — the MODEL-GENERATED half of
- * context economy. 归位式抽取 (0.1.26 gate 裁决): this OFF-LOOP
+ * context economy. the home-relocation extraction (0.1.26 gate ruling): this OFF-LOOP
  * ORCHESTRATION lived in the kernel by a context-round expedience; it
  * calls the ADAPTER to generate the summary, which is the RUNTIME's
  * business — the kernel's duty is the `summarized` EVENT TYPE and the
@@ -50,6 +50,14 @@ export declare function lastSummaryPoint(events: readonly Event[]): number;
  * a turn boundary by construction, so the projection's skip never splits
  * a message. Returns undefined when fewer than keepRounds+1 uncovered
  * rounds exist (nothing worth covering yet).
+ *
+ * ⑥ (todo round): a tool result tagged do-not-compact is DURABLE work
+ * memory (the todo_set echo) — the summary must never cover its round,
+ * or the model loses the current list. When the base boundary would
+ * cover such a result, the boundary pulls back to just before the round
+ * containing the LATEST one (still a turn boundary). A protected round
+ * as the FIRST uncovered round leaves nothing before it to cover →
+ * undefined (an honest "nothing to compact").
  */
 export declare function summaryBoundarySeq(events: readonly Event[], keepRounds?: number): number | undefined;
 /**

package/dist/summarize.js

@@ -1,6 +1,6 @@
 /**
  * The /compact summary layer (ADR-0044) — the MODEL-GENERATED half of
- * context economy. 归位式抽取 (0.1.26 gate 裁决): this OFF-LOOP
+ * context economy. the home-relocation extraction (0.1.26 gate ruling): this OFF-LOOP
  * ORCHESTRATION lived in the kernel by a context-round expedience; it
  * calls the ADAPTER to generate the summary, which is the RUNTIME's
  * business — the kernel's duty is the `summarized` EVENT TYPE and the
@@ -13,7 +13,7 @@
  * unchanged ("nothing happened"). Only the generated `summarized` event
  * lands on disk; the original events stay there forever.
  */
-import { estimateTokens } from "@vincemakes/kiso-core";
+import { estimateTokens, DO_NOT_COMPACT } from "@vincemakes/kiso-core";
 /** K (ADR-0044): the recent ROUNDS kept intact by /compact — a constant,
  *  not a knob. The covered range ends just before the K-th most recent
  *  round, so the model still reasons over the recent conversation. */
@@ -84,6 +84,14 @@ export function lastSummaryPoint(events) {
  * a turn boundary by construction, so the projection's skip never splits
  * a message. Returns undefined when fewer than keepRounds+1 uncovered
  * rounds exist (nothing worth covering yet).
+ *
+ * ⑥ (todo round): a tool result tagged do-not-compact is DURABLE work
+ * memory (the todo_set echo) — the summary must never cover its round,
+ * or the model loses the current list. When the base boundary would
+ * cover such a result, the boundary pulls back to just before the round
+ * containing the LATEST one (still a turn boundary). A protected round
+ * as the FIRST uncovered round leaves nothing before it to cover →
+ * undefined (an honest "nothing to compact").
  */
 export function summaryBoundarySeq(events, keepRounds = KEEP_RECENT_ROUNDS) {
     const prevPoint = lastSummaryPoint(events);
@@ -94,9 +102,48 @@ export function summaryBoundarySeq(events, keepRounds = KEEP_RECENT_ROUNDS) {
     }
     if (uncoveredInputs.length <= keepRounds)
         return undefined;
+    const base = uncoveredInputs[uncoveredInputs.length - keepRounds] - 1;
+    const protectedRound = latestProtectedBoundary(events, prevPoint, base);
+    if (protectedRound !== undefined) {
+        if (protectedRound <= prevPoint)
+            return undefined;
+        return protectedRound;
+    }
     // The input at m - keepRounds opens the FIRST KEPT round; everything
     // before it (m - keepRounds ≥ 1 covered rounds) is summarizable.
-    return uncoveredInputs[uncoveredInputs.length - keepRounds] - 1;
+    return base;
+}
+/**
+ * ⑥: the boundary just before the round holding the LATEST do-not-compact
+ * tool result inside (prevPoint, base] — that round's opening user_input
+ * minus one, or undefined when the range holds no such result. The
+ * projection replaces by RANGE, so only the newest echo matters: older
+ * tagged echoes are superseded and may be covered.
+ */
+function latestProtectedBoundary(events, prevPoint, base) {
+    let protectSeq = -1;
+    for (const ev of events) {
+        if (ev.type === "tool_result" &&
+            ev.seq > prevPoint &&
+            ev.seq <= base &&
+            (ev.tags ?? []).includes(DO_NOT_COMPACT)) {
+            protectSeq = ev.seq;
+        }
+    }
+    if (protectSeq < 0)
+        return undefined;
+    // The round's opening input: the last user_input before the result.
+    // The result's whole round is uncovered by construction (the previous
+    // compact ended at a turn boundary before its input), so the input is
+    // > prevPoint — the guard is the belt.
+    let inputSeq = -1;
+    for (const ev of events) {
+        if (ev.type === "user_input" && ev.seq > prevPoint && ev.seq < protectSeq)
+            inputSeq = ev.seq;
+    }
+    if (inputSeq < 0)
+        return undefined;
+    return inputSeq - 1;
 }
 /**
  * The NoticeCell's number: estimated tokens of the covered content minus

package/dist/trust.d.ts

@@ -53,7 +53,7 @@ export interface ProjectArtifacts {
  * no recognized artifacts (an empty .kiso has nothing to gate).
  */
 export declare function projectArtifacts(cwd: string): Promise<ProjectArtifacts | null>;
-/** 发现#11: KISO_HOME is the ONE root — the store derives from it. */
+/** finding #11: KISO_HOME is the ONE root — the store derives from it. */
 export declare function kisoHome(): string;
 /**
  * The last record matching (root, digest) — append-only, last wins. A

package/dist/trust.js

@@ -44,7 +44,7 @@ export async function projectArtifacts(cwd) {
         throw err;
     }
     const root = await realpath(kisoDir);
-    // 发现#10 (P1): when cwd IS the KISO_HOME parent (the user's home
+    // finding #10 (P1): when cwd IS the KISO_HOME parent (the user's home
     // directory), <cwd>/.kiso IS the user-level config directory itself —
     // trusting your own configuration is nonsense, and the mcp merge would
     // mirror the same file onto itself and loudly conflict. The home is
@@ -83,7 +83,7 @@ export async function projectArtifacts(cwd) {
                 throw err; // a file named like a dir → ENOTDIR: inert, skip
         }
     }
-    // 合并轮 B: the project's config.json is an artifact of the trust
+    // merge round B: the project's config.json is an artifact of the trust
     // package — trusting the package trusts its config, and a CHANGED
     // config is a changed digest (the trust decision re-evaluates).
     try {
@@ -134,7 +134,7 @@ async function readdirOrEmpty(dir) {
 function isMissing(err) {
     return err.code === "ENOENT" || err.code === "ENOTDIR";
 }
-/** 发现#11: KISO_HOME is the ONE root — the store derives from it. */
+/** finding #11: KISO_HOME is the ONE root — the store derives from it. */
 export function kisoHome() {
     return process.env.KISO_HOME ?? join(homedir(), ".kiso");
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vincemakes/kiso-runtime",
-  "version": "0.1.28",
+  "version": "0.1.30",
   "description": "kiso runtime — durable multi-turn agent sessions: AgentDefinition, AgentRuntime, AgentSession, Run, append-only JSONL store.",
   "type": "module",
   "license": "MIT",
@@ -21,11 +21,11 @@
     "test": "vitest run"
   },
   "dependencies": {
-    "@vincemakes/kiso-core": "0.1.28"
+    "@vincemakes/kiso-core": "0.1.29"
   },
   "peerDependencies": {
-    "@vincemakes/kiso-provider-anthropic": "0.1.28",
-    "@vincemakes/kiso-provider-openai": "0.1.28"
+    "@vincemakes/kiso-provider-anthropic": "0.1.29",
+    "@vincemakes/kiso-provider-openai": "0.1.29"
   },
   "peerDependenciesMeta": {
     "@vincemakes/kiso-provider-anthropic": {
@@ -36,7 +36,7 @@
     }
   },
   "devDependencies": {
-    "@vincemakes/kiso-evals": "0.1.28",
+    "@vincemakes/kiso-evals": "0.1.29",
     "@types/node": "^26.1.2",
     "typescript": "^5.7.2",
     "vitest": "^3.0.0"