acp-kernel 0.0.99-pr.487.343 → 0.0.99-pr.490.347

package/DESIGN.md

@@ -262,10 +262,12 @@ Copyright protects _expression_, not ideas, methods, or algorithms (17 USC §102
 
 ### 8.1 First-user-message pin
 
-The session's **first user message survives prune unconditionally** — even when it is covered by an active block. In `rebuildMessages` (`src/prune.ts`) the pin check runs _before_ the covered-by-active-block check, so after compressing a range that includes the first user message, the rebuilt wire contains **both** the rendered summary **and** the first user message verbatim; all other covered messages drop as usual. Only the _first_ user message is pinned — later covered user messages are pruned normally.
+The session's **first user message survives prune when it is covered by an active block — unless dropping it cannot lose the guarantee the pin exists for.** In `rebuildMessages` (`src/prune.ts`) the pin check runs _before_ the covered-by-active-block check, but a covered pin yields when another user message still survives behind it (`firstUserDropSafe`: the earliest non-covered, non-rendered-summary message after the pin must itself be a plain user text core — the only shape the downstream orphan-stripping passes cannot remove). In that case the fold applies fully: the covered first user drops like any other covered message, and the rebuilt wire opens with the surviving user (with the rendered summary anchored in front of it, re-voiced or stripped downstream per mode). Only the _first_ user message is pinned — later covered user messages are pruned normally.
 
-- **Why:** strict providers reject conversations with no user message (e.g., Anthropic requires the conversation to start from the user role). Pinning guarantees the rebuilt wire retains at least one user message whenever the input had one. Deliberate since prune's first implementation (v0.0.2) — the ordering of the two checks is part of the contract, not incidental. Regression-tested by `tests/state-prune.test.ts` ("prune preserves first user message even when covered") and `tests/orphan-fixes.test.ts` ("prune: first user message pruned when covered (no duplication)").
+- **Why:** strict providers reject conversations with no user message (e.g., Anthropic requires the conversation to start from the user role). The pin guarantees the rebuilt wire retains at least one user message whenever the input had one. Deliberate since prune's first implementation (v0.0.2) — the ordering of the two checks is part of the contract, not incidental. The original unconditional form was an over-guarantee: it pinned the _specific_ first message rather than the property "a user leads". Once a covered message became the view's first user — the client trimmed earlier history before resending, or the fold targeted the opening message directly — the pin defeated coverage forever: the block stayed active while its payload re-sent itself verbatim every turn, reporting success (billion-context#1869). The conditional yield restores coverage for exactly those shapes while preserving the guarantee everywhere else.
+- **Residual limitation (deliberate):** if no user message survives behind the covered pin (e.g. `[U1-covered, A1, U2-covered…]` where only assistant/tool cores remain), the pin holds and the fold of that range is a no-op on the wire — shipping a non-user-leading frame would reject strict providers, which outweighs the compression gain. Consumers should treat "folded the opening message and nothing user-shaped remains" as a known degenerate case.
 - **Consequences for consumers:**
-  - Consumers cannot assert byte-level disappearance of the first user message after compression; post-compress wire assertions must expect the rendered summary **plus** the pinned message verbatim.
-  - Token-size and prefix-cache stability estimates must account for the pinned message staying verbatim (it is often the task description and can be long).
+  - Post-compress wire assertions about the first user message depend on what survives behind it: with a surviving user, expect byte-level disappearance plus the rendered summary; in the degenerate case above, expect the pinned message verbatim alongside the summary.
+  - Token-size and prefix-cache stability estimates must account for the pinned message staying verbatim in the degenerate case (it is often the task description and can be long).
   - Boundary resolution compensates: `blockVisibleInRange` (`src/boundaries.ts`) treats a block as present in a range via its rendered summary **or** its earliest surviving raw — required precisely because the summary anchors _before_ the pinned raw.
+- **Regression-tested by** `tests/state-prune.test.ts` (both the drop and the degenerate-keep shapes), `tests/orphan-fixes.test.ts` ("prune: first user message pruned when covered (no duplication)"), and `tests/issue1476-reid.test.ts` (pinned-echo id/ref stability across post-fold passes).

package/dist/index.js

@@ -209,6 +209,15 @@ function pairSafeAnchorIndex(messages, index) {
   }
   return safe;
 }
+function firstUserDropSafe(messages, firstUserIndex, coveredBases) {
+  for (let i = firstUserIndex + 1; i < messages.length; i++) {
+    const message = messages[i];
+    if (isCovered(message.id, coveredBases)) continue;
+    if (isRenderedSummaryMessage(message)) continue;
+    return message.role === "user" && message.contentType === "text";
+  }
+  return false;
+}
 function rebuildMessages(messages, coveredBases, firstUserIndex, anchors) {
   const safeAnchors = anchors.map((anchor) => ({
     ...anchor,
@@ -224,8 +233,11 @@ function rebuildMessages(messages, coveredBases, firstUserIndex, anchors) {
       result.push(renderSummary(pending.shift()));
     }
     if (index === firstUserIndex && firstUserIndex >= 0) {
-      result.push(messages[index]);
-      continue;
+      const pinned = messages[index];
+      if (!isCovered(pinned.id, coveredBases) || !firstUserDropSafe(messages, index, coveredBases)) {
+        result.push(pinned);
+        continue;
+      }
     }
     if (isCovered(messages[index].id, coveredBases)) continue;
     if (isRenderedSummaryMessage(messages[index]) && anchoredSummaryIds.has(messages[index].id))