dsh-context-compression-improved 0.5.0 → 0.5.2

package/packages/selector/src/preset-overlay.ts

@@ -116,6 +116,16 @@ export function standingStampMs(identity: string): number {
   return standingStampMsAtWindow(identity, 0)
 }
 
+/**
+ * True for the filesystem errors a concurrent publish can raise on Windows:
+ * `MoveFileEx` reports a lost race — or a reader holding the destination open —
+ * as EPERM/EBUSY/EACCES, where POSIX `rename` simply replaces the destination.
+ */
+function isPublishRace(error: unknown): boolean {
+  const code = (error as { code?: unknown } | null)?.code
+  return code === 'EPERM' || code === 'EBUSY' || code === 'EACCES' || code === 'EEXIST'
+}
+
 const COMPRESSION_IDS = new Set([
   'compaction',
   'compaction-basic',
@@ -224,7 +234,7 @@ class PresetOverlayStore {
       // still private. No reader can observe a colliding {mtimeMs,size}
       // between rename and a later corrective utimes call.
       await this.disambiguateStamp(staging, identity)
-      await rename(staging, path)
+      await this.publish(staging, path)
     } catch (error) {
       // A failed publish must not leak its staging file into the store; the
       // cleanup must never mask the original failure either.
@@ -238,6 +248,55 @@ class PresetOverlayStore {
     return { ...preset, path }
   }
 
+  /** In-flight publish chains, one per destination path. */
+  private readonly publishChains = new Map<string, Promise<void>>()
+
+  /**
+   * Publish one stamped staging file to its final path, serialized per path.
+   *
+   * POSIX `rename` replaces an existing destination atomically, so concurrent
+   * composers of one identity are naturally idempotent there. Windows
+   * `MoveFileEx` instead fails the loser of that race with EPERM/EBUSY, which
+   * surfaced as `standingKeyFor()` throwing during concurrent composition.
+   * Every composer of one identity writes identical bytes and re-derives the
+   * same deterministic identity stamp, so a destination that already observes
+   * this staging file's {mtimeMs, size} key IS the intended end state: confirm
+   * it and treat the lost race as success. Every other outcome still throws, so
+   * a silently reused generation stays forbidden, and the caller still removes
+   * the staging file when this rejects.
+   */
+  private publish(staging: string, path: string): Promise<void> {
+    const previous = this.publishChains.get(path) ?? Promise.resolve()
+    const queued = previous.catch(() => undefined).then(async () => {
+      try {
+        await rename(staging, path)
+        return
+      } catch (error) {
+        if (!isPublishRace(error)) throw error
+        try {
+          const intended = await this.metadataIo.read(staging)
+          const published = await this.metadataIo.read(path)
+          // Sub-second precision survives a wrapped seconds field, but NTFS
+          // rounds it to 100ns, so compare the standing key within that
+          // rounding rather than by exact float equality.
+          if (published.size === intended.size
+            && Math.abs(published.mtimeMs - intended.mtimeMs) < 2) {
+            await rm(staging, { force: true })
+            return
+          }
+        } catch {
+          // The destination is unreadable: report the original publish failure.
+        }
+        throw error
+      }
+    })
+    const tracked = queued.finally(() => {
+      if (this.publishChains.get(path) === tracked) this.publishChains.delete(path)
+    })
+    this.publishChains.set(path, tracked)
+    return tracked
+  }
+
   /** Observed {mtimeMs,size} keys published by this store, per identity. */
   private readonly standingKeys = new Map<string, string>()
 

package/packages/selector/src/profiles.ts

@@ -135,11 +135,6 @@ export interface PresetOptionsSettings {
   readonly estimatorBaseUrl?: string
   readonly estimatorApiKey?: string
   readonly estimatorTimeoutMs?: number
-  /** Review-mode overrides (beta); mirrors the runtime PresetOptions.reviewMode. */
-  readonly reviewMode?: boolean
-  readonly reviewTimeoutTurns?: number
-  readonly cacheHitDiscountAlpha?: number
-  readonly reviewHighImpactTokens?: number
   /** Advisory advisor channel; `''` (the default) keeps the advisor off. */
   readonly advisorMode?: '' | 'host' | 'direct'
   readonly advisorTimeoutMs?: number
@@ -160,12 +155,15 @@ export function decodePresetOptionsSettings(value: unknown): PresetOptionsSettin
   const allowed = new Set([
     'dedupeToolResults', 'summaryLocator', 'prefixStabilizer', 'readState', 'estimatorMode',
     'estimatorProvider', 'estimatorModel', 'estimatorBaseUrl', 'estimatorApiKey', 'estimatorTimeoutMs',
+    // Legacy keys of the retired review gate: still ACCEPTED so an existing
+    // settings document keeps decoding (rejecting them would report the whole
+    // card unreadable), and ignored — nothing reads them any more.
     'reviewMode', 'reviewTimeoutTurns', 'cacheHitDiscountAlpha', 'reviewHighImpactTokens',
     'advisorMode', 'advisorTimeoutMs', 'advisorRefreshTurns', 'advisorScoreThreshold', 'advisorSampleLimit',
     'advisorMinTokens',
   ])
   if (Object.keys(value).some(key => !allowed.has(key))) return undefined
-  for (const key of ['dedupeToolResults', 'summaryLocator', 'prefixStabilizer', 'readState', 'reviewMode'] as const) {
+  for (const key of ['dedupeToolResults', 'summaryLocator', 'prefixStabilizer', 'readState'] as const) {
     const entry = value[key]
     if (entry !== undefined && typeof entry !== 'boolean') return undefined
   }
@@ -187,23 +185,6 @@ export function decodePresetOptionsSettings(value: unknown): PresetOptionsSettin
       || estimatorTimeoutMs < 100 || estimatorTimeoutMs > 60_000)) {
     return undefined
   }
-  const reviewTimeoutTurns = value.reviewTimeoutTurns
-  if (reviewTimeoutTurns !== undefined
-    && (typeof reviewTimeoutTurns !== 'number' || !Number.isSafeInteger(reviewTimeoutTurns) || reviewTimeoutTurns < 1)) {
-    return undefined
-  }
-  const cacheHitDiscountAlpha = value.cacheHitDiscountAlpha
-  if (cacheHitDiscountAlpha !== undefined
-    && (typeof cacheHitDiscountAlpha !== 'number' || !Number.isFinite(cacheHitDiscountAlpha)
-      || cacheHitDiscountAlpha <= 0 || cacheHitDiscountAlpha >= 1)) {
-    return undefined
-  }
-  const reviewHighImpactTokens = value.reviewHighImpactTokens
-  if (reviewHighImpactTokens !== undefined
-    && (typeof reviewHighImpactTokens !== 'number' || !Number.isSafeInteger(reviewHighImpactTokens)
-      || reviewHighImpactTokens < 0)) {
-    return undefined
-  }
   const advisorTimeoutMs = value.advisorTimeoutMs
   if (advisorTimeoutMs !== undefined
     && (typeof advisorTimeoutMs !== 'number' || !Number.isSafeInteger(advisorTimeoutMs)
@@ -246,10 +227,6 @@ export function decodePresetOptionsSettings(value: unknown): PresetOptionsSettin
   if (value.estimatorBaseUrl !== undefined) decoded.estimatorBaseUrl = value.estimatorBaseUrl as string
   if (value.estimatorApiKey !== undefined) decoded.estimatorApiKey = value.estimatorApiKey as string
   if (estimatorTimeoutMs !== undefined) decoded.estimatorTimeoutMs = estimatorTimeoutMs as number
-  if (value.reviewMode !== undefined) decoded.reviewMode = value.reviewMode as boolean
-  if (reviewTimeoutTurns !== undefined) decoded.reviewTimeoutTurns = reviewTimeoutTurns as number
-  if (cacheHitDiscountAlpha !== undefined) decoded.cacheHitDiscountAlpha = cacheHitDiscountAlpha as number
-  if (reviewHighImpactTokens !== undefined) decoded.reviewHighImpactTokens = reviewHighImpactTokens as number
   if (advisorMode !== undefined) decoded.advisorMode = advisorMode as '' | 'host' | 'direct'
   if (advisorTimeoutMs !== undefined) decoded.advisorTimeoutMs = advisorTimeoutMs as number
   if (advisorRefreshTurns !== undefined) decoded.advisorRefreshTurns = advisorRefreshTurns as number

package/packages/selector/src/pruner/state.ts

@@ -1,73 +1,50 @@
-/**
- * Consolidated per-session mutable state for {@link ToolResultPruner}.
- *
- * Every field is a WeakMap keyed by Session, keeping the service
- * stateless across sessions and safe under GC.
- */
-
-import type { Session } from '@deepseek-ai/dsh-session'
-import type { DedupeTable } from '../runtime/tokenpilot/dedup.ts'
-import type { EstimatorFailures } from '../runtime/tokenpilot/estimator.ts'
-import type { ReviewQueue, ReviewQueueStore } from '../runtime/tokenpilot/review-queue.ts'
-import type { SideChannel } from '../runtime/tokenpilot/sidechannel.ts'
-import type {
-  ContextCompressionSettings,
-  ResolvedConfig,
-} from '../runtime/types.ts'
-
-/** Four-state per-session outcome counters behind the floating-window summary row. */
-export interface ReviewSessionSummary {
-  /** Rewrites that landed through the automatic path while review mode served this session. */
-  autoApplied: number
-  /** Approved proposals whose merged batch executed with an applied receipt. */
-  reviewApplied: number
-  /** Pending proposals that expired unhandled at a turn boundary. */
-  expired: number
-  /** Approved proposals voided at the apply point (digest mismatch et al). */
-  voided: number
-}
-
-/** Mutable per-session state bag used inside {@link ToolResultPruner}. */
-export interface PrunerState {
-  /** Resolved immutable deployment configuration. */
-  readonly config: ResolvedConfig
-
-  /** Complete canonical setting document frozen when each Session first reaches this root service. */
-  readonly sessionSettings: WeakMap<Session, ContextCompressionSettings>
-  /** Original result seqs whose first-exposure KEEP/REDUCE decision has committed. */
-  readonly firstExposure: WeakMap<Session, Set<number>>
-  /** Result seqs permanently exempt from further reduction (recovery outputs and registered equivalents). */
-  readonly recoveryExemptions: WeakMap<Session, Set<number>>
-  /** Per-session canonical-content hash index backing tokenpilot-inspired dedupe. */
-  readonly dedupeTables: WeakMap<Session, DedupeTable>
-  /** Advisory estimator verdicts consumed by the read-state classification. */
-  readonly estimatorVerdicts: WeakMap<Session, Map<number, boolean>>
-  /** Per-session estimator failure backoff state. */
-  readonly estimatorFailures: WeakMap<Session, EstimatorFailures>
-  /** Runtime prerequisite warnings deduplicated per Session and failure key. */
-  readonly warnedFailures: WeakMap<Session, Set<string>>
-  /** Last Adaptive postflight attempt emitted per Session; keeps diagnostics bounded and independent. */
-  readonly postflightDiagnostics: WeakMap<Session, string>
-  /** Current pre-step chain identity, shared by this producer and downstream compaction-basic. */
-  readonly activeRequestBoundaries: WeakMap<Session, object>
-  /** Boundary identity that already attempted one fully preflighted TailTrim publication. */
-  readonly tailTrimBoundaryAttempts: WeakMap<Session, object>
-  /** Last effective policy audit key emitted for each Session. */
-  readonly policyResolutionAudits: WeakMap<Session, string>
-  /**
-   * TokenPilot-inspired R4: shared review-queue store. Starts as the in-memory
-   * fail-open fallback; swapped to the storageDomain-backed adapter when (and
-   * if) that seam opens successfully.
-   */
-  reviewStore: ReviewQueueStore
-  /** Per-session review queue carrying the frozen timeout policy. */
-  readonly reviewQueues: WeakMap<Session, ReviewQueue>
-  /** Last observed turn index per Session: the monotonic clock for review expiries. */
-  readonly reviewClocks: WeakMap<Session, number>
-  /** Estimator-reported remaining turns Ŝ per Session; advisory only. */
-  readonly estimatorRemainingTurns: WeakMap<Session, number>
-  /** Per-session advisor side channel, constructed once with the advisor overrides. */
-  readonly advisorChannels: WeakMap<Session, SideChannel>
-  /** Four-state outcome counters per Session (floating-window summary row). */
-  readonly reviewSummaries: WeakMap<Session, ReviewSessionSummary>
-}
+/**
+ * Consolidated per-session mutable state for {@link ToolResultPruner}.
+ *
+ * Every field is a WeakMap keyed by Session, keeping the service
+ * stateless across sessions and safe under GC.
+ */
+
+import type { Session } from '@deepseek-ai/dsh-session'
+import type { DedupeTable } from '../runtime/tokenpilot/dedup.ts'
+import type { EstimatorFailures } from '../runtime/tokenpilot/estimator.ts'
+import type { SideChannel } from '../runtime/tokenpilot/sidechannel.ts'
+import type {
+  ContextCompressionSettings,
+  ResolvedConfig,
+} from '../runtime/types.ts'
+
+/** Mutable per-session state bag used inside {@link ToolResultPruner}. */
+export interface PrunerState {
+  /** Resolved immutable deployment configuration. */
+  readonly config: ResolvedConfig
+
+  /** Complete canonical setting document frozen when each Session first reaches this root service. */
+  readonly sessionSettings: WeakMap<Session, ContextCompressionSettings>
+  /** Original result seqs whose first-exposure KEEP/REDUCE decision has committed. */
+  readonly firstExposure: WeakMap<Session, Set<number>>
+  /** Result seqs permanently exempt from further reduction (recovery outputs and registered equivalents). */
+  readonly recoveryExemptions: WeakMap<Session, Set<number>>
+  /** Per-session canonical-content hash index backing tokenpilot-inspired dedupe. */
+  readonly dedupeTables: WeakMap<Session, DedupeTable>
+  /** Advisory estimator verdicts consumed by the read-state classification. */
+  readonly estimatorVerdicts: WeakMap<Session, Map<number, boolean>>
+  /** Per-session estimator failure backoff state. */
+  readonly estimatorFailures: WeakMap<Session, EstimatorFailures>
+  /** Runtime prerequisite warnings deduplicated per Session and failure key. */
+  readonly warnedFailures: WeakMap<Session, Set<string>>
+  /** Last Adaptive postflight attempt emitted per Session; keeps diagnostics bounded and independent. */
+  readonly postflightDiagnostics: WeakMap<Session, string>
+  /** Current pre-step chain identity, shared by this producer and downstream compaction-basic. */
+  readonly activeRequestBoundaries: WeakMap<Session, object>
+  /** Boundary identity that already attempted one fully preflighted TailTrim publication. */
+  readonly tailTrimBoundaryAttempts: WeakMap<Session, object>
+  /** Last effective policy audit key emitted for each Session. */
+  readonly policyResolutionAudits: WeakMap<Session, string>
+  /** Last observed turn index per Session: the monotonic clock for advisory records. */
+  readonly turnClocks: WeakMap<Session, number>
+  /** Estimator-reported remaining turns Ŝ per Session; advisory only. */
+  readonly estimatorRemainingTurns: WeakMap<Session, number>
+  /** Per-session advisor side channel, constructed once with the advisor overrides. */
+  readonly advisorChannels: WeakMap<Session, SideChannel>
+}