dsh-switchman 1.11.5 → 1.11.6

package/host/context-trim/surface.js

@@ -84,7 +84,7 @@
  * and every no-op with pending work is logged to decisions.log.
  */
 
-import { refOf, summaryMessageOf } from "./view.js";
+import { refOf, summaryMessageOf, isFoldSummaryMessage, FOLD_SUMMARY_ID_PREFIX } from "./view.js";
 
 /** Ladder-block probe (tier ≥ 2): a distillation whose surface material is
  * the REPLACEMENT NODES of its consumed blocks, not a raw ref range. */
@@ -545,6 +545,147 @@ export function createSurfaceFoldPass(deps = {}) {
 		}
 	}
 
+	function nudgeTextOf(message) {
+		try {
+			const content = message?.content;
+			if (typeof content === "string") return content;
+			if (!Array.isArray(content)) return "";
+			return content.map((part) => typeof part?.text === "string" ? part.text : "").join("");
+		} catch {
+			return "";
+		}
+	}
+	let nudgeCounter = 0; // unique suffix per speak: colliding explicit ids would collide in ref resolution
+	function nudgeMessage(sessionId, text) {
+		const token = String(sessionId ?? "").replace(/[^A-Za-z0-9_-]/gu, "_").slice(0, 128) || "session";
+		return {
+			id: "trim_nudge_" + token + "_" + (++nudgeCounter),
+			role: "user",
+			content: [{ type: "text", text: String(text ?? "") }],
+			source: { kind: "user" },
+		};
+	}
+	/** Surface nudge availability excludes sessions with an open compaction pair. */
+	function nudgeSupported(sessionId) {
+		try {
+			const session = sessionOf(sessionId);
+			return surfaceCapable(session) && !lockOpenCached(sessionId, session);
+		} catch {
+			return false;
+		}
+	}
+	/** Append one advisory nudge as a suffix-only user message. Returns
+	 * { seq, error }: seq is null when the host rejected the append, and error
+	 * carries the rejection message so the skip row can name the real cause
+	 * (a bare append-failed row once hid a v4 turn-discipline rejection). */
+	function nudgeAppend(sessionId, text) {
+		const session = sessionOf(sessionId);
+		if (!surfaceCapable(session)) return { seq: null, error: null };
+		try {
+			const event = session.append("user/message", nudgeMessage(sessionId, text), { surfaceOp: "append" });
+			return { seq: Number.isFinite(event?.seq) ? event.seq : null, error: null };
+		} catch (error) {
+			return { seq: null, error: String(error?.message ?? error) };
+		}
+	}
+	/** Prune advisory nudge nodes with point-sized compaction events. Only
+	 * seqs still live on the surface are pruned: a fold may already have
+	 * consumed one, and re-shadowing a vanished seq fails the v4 validator.
+	 * Each seq gets its own prune event (start === end) so a non-contiguous
+	 * set can never cover unlisted live turns — matching the contiguous
+	 * range/seq pairing of the ladder and T1 passes. The metering prune is
+	 * paired with its replacement (shadow-price protocol, mirroring the
+	 * host's compaction-tool-result-pruner): the surfaceOp replace on the
+	 * replacement is what actually retires the node from surface.nodes —
+	 * a bare compaction/prune never moves the live surface, so without
+	 * the pair the same nudge was re-found and re-pruned on EVERY boundary
+	 * (one duplicate fold-marker event per step, 2026-11-14). */
+	/** Retired-nudge stub: id and text intentionally miss both nudgeScan
+	 * signatures (id prefix "trim_nudge_", text prefix "[SWITCHMAN:TRIM]
+	 * Advisory nudge") so a retired stub is never re-discovered. */
+	function retiredNudgeMessage(sessionId) {
+		const token = String(sessionId ?? "").replace(/[^A-Za-z0-9_-]/gu, "_").slice(0, 128) || "session";
+		return {
+			id: "trim_retired_nudge_" + token + "_" + (++nudgeCounter),
+			role: "user",
+			content: [{ type: "text", text: "[SWITCHMAN:TRIM] (advisory nudge retired — pressure is back below the fold line)" }],
+			source: { kind: "user" },
+		};
+	}
+	function nudgePrune(sessionId, seqs) {
+		try {
+			const session = sessionOf(sessionId);
+			if (!surfaceCapable(session) || !Array.isArray(seqs)) return false;
+			const nodes = session.surface.nodes;
+			if (!Array.isArray(nodes)) return false;
+			const live = [...new Set(seqs.filter((seq) => Number.isFinite(seq)))].filter((seq) => nodes.includes(seq));
+			if (live.length === 0) return true; // already consumed by a fold: nothing to undo
+			if (live.includes(nodes[0])) {
+				let headEvent;
+				try {
+					headEvent = typeof session.eventAt === "function" ? session.eventAt(nodes[0]) : undefined;
+				} catch {
+					headEvent = undefined;
+				}
+				const headMessage = headEvent === undefined ? null : messageOfEvent(session, headEvent);
+				// Fail closed: an unreadable head node or the protected system head
+				// must never be shadowed ("compaction cannot shadow the protected
+				// system head").
+				if (headMessage === null || headMessage === undefined || headMessage.role === "system") return false;
+			}
+			for (const seq of live) {
+				const event = session.append("compaction/prune", {
+					shadowedRange: { start: seq, end: seq },
+					shadowedSeqs: [seq],
+					shadowedTokenCount: 1,
+				});
+				if (!Number.isFinite(event?.seq)) return false;
+				// Shadow-price pairing: the replacement — not the metering
+				// prune — retires the node from the live surface.
+				let retired;
+				try {
+					retired = session.append("user/message", retiredNudgeMessage(sessionId), {
+						surfaceOp: { op: "replace", startSeq: seq, endSeq: seq },
+						sourceEventSeqs: [seq],
+					});
+				} catch {
+					return false;
+				}
+				if (!Number.isFinite(retired?.seq)) return false;
+			}
+			return true;
+		} catch {
+			return false;
+		}
+	}
+	/** Find visible advisory nudges from the tail, bounded to recent surface nodes. */
+	function nudgeScan(sessionId) {
+		try {
+			const session = sessionOf(sessionId);
+			if (!surfaceCapable(session) || typeof session.eventAt !== "function") return [];
+			const nodes = session.surface.nodes;
+			const first = Math.max(0, nodes.length - 50);
+			const found = [];
+			for (let index = nodes.length - 1; index >= first; index--) {
+				const seq = nodes[index];
+				let event;
+				try {
+					event = session.eventAt(seq);
+				} catch {
+					continue;
+				}
+				const message = event === undefined ? null : messageOfEvent(session, event);
+				if (message === null || message === undefined) continue;
+				const hasNudgeId = typeof message.id === "string" && message.id.startsWith("trim_nudge_");
+				const hasNudgeText = nudgeTextOf(message).startsWith("[SWITCHMAN:TRIM] Advisory nudge");
+				if (hasNudgeId || hasNudgeText) found.push(seq);
+			}
+			return found;
+		} catch {
+			return [];
+		}
+	}
+
 	/** In-memory idempotence belt over the durable block marker: the same
 	 * (session, range, contentGeneration) is never replaced twice even if a
 	 * crash lost the ledger persist. Bounded like the other registries. */
@@ -612,6 +753,21 @@ export function createSurfaceFoldPass(deps = {}) {
 		return mark !== null && typeof mark === "object" && typeof mark.reason === "string" && mark.reason !== "" ? mark : null;
 	}
 
+	/** Terminal supersede test: EVERY captured event seq has left the live
+	 * surface, so the fold's material is already off the wire (host
+	 * compaction consumed the range, or an earlier ship whose marker was
+	 * later lost). Such a capture can never validate again —
+	 * the block terminates as surfaceSuperseded instead of living forever
+	 * in the generation-keyed incomplete-seqs retry loop. */
+	function captureFullyShadowed(nodes, block) {
+		// An unreadable/empty surface is fail-safe: nothing is proven gone,
+		// so never terminalize on it (a valid block would be lost forever).
+		if (!Array.isArray(nodes) || nodes.length === 0) return false;
+		if (!Array.isArray(block?.surfaceSeqs) || block.surfaceSeqs.length === 0) return false;
+		const live = new Set(nodes);
+		return block.surfaceSeqs.every((seq) => !live.has(seq));
+	}
+
 	/** One no-op row (only when the pass had pending work — a vacuous sweep
 	 * with nothing to ship stays silent, matching the early-return style of
 	 * the fold cycle's own action=none rows). Whole-pass reasons (disabled /
@@ -657,6 +813,8 @@ export function createSurfaceFoldPass(deps = {}) {
 		})();
 		const pending = blocks.filter((block) => {
 			if (block?.surfaceReplaced !== null && block?.surfaceReplaced !== undefined) return false;
+			// Terminal supersede (see captureFullyShadowed): never pending again.
+			if (block?.surfaceSuperseded !== null && block?.surfaceSuperseded !== undefined) return false;
 			const tomb = tombstoneOf(block);
 			if (tomb === null) return true;
 			// Re-open only when the surface content changed since the skip.
@@ -720,6 +878,21 @@ export function createSurfaceFoldPass(deps = {}) {
 				}
 				const waiting = consumed.find((entry) => entry.surfaceReplaced === null || entry.surfaceReplaced === undefined);
 				if (waiting !== undefined) {
+					if (waiting?.surfaceSuperseded !== null && waiting?.surfaceSuperseded !== undefined) {
+						// The consumed block's material left the surface entirely: its
+						// replacement node can never materialize, so the distillation
+						// is terminal too (same proof as the T1 supersede — no
+						// generation-keyed retry can revive either block).
+						block.surfaceSuperseded = { reason: "ladder-consumed-superseded", at: Date.now() };
+						delete block.surfaceSkip;
+						try {
+							store.persist(ledger);
+						} catch {
+							/* best effort */
+						}
+						skip(sessionId, "superseded-ladder-consumed", via, `block=${block.id} consumed=${waiting.id}`, false);
+						continue;
+					}
 					if (tombstoneOf(waiting) !== null) {
 						// A consumed block is hard-skipped on this generation: its
 						// replacement node can never materialize, so the ladder span
@@ -753,7 +926,7 @@ export function createSurfaceFoldPass(deps = {}) {
 				const idIndexOf = new Map();
 				for (let i = 0; i < nodeMessages.length; i++) {
 					const message = nodeMessages[i];
-					if (message !== null && typeof message === "object" && typeof message.id === "string" && message.id.startsWith("acp_summary_")) {
+					if (isFoldSummaryMessage(message)) {
 						idIndexOf.set(message.id, i);
 					}
 				}
@@ -765,7 +938,7 @@ export function createSurfaceFoldPass(deps = {}) {
 						atSeqs.push(atSeq);
 						continue;
 					}
-					const relocatedIdx = idIndexOf.get(`acp_summary_${entry.id}`);
+					const relocatedIdx = idIndexOf.get(`${FOLD_SUMMARY_ID_PREFIX}${entry.id}`);
 					if (relocatedIdx === undefined) {
 						unresolved = entry;
 						break;
@@ -795,7 +968,7 @@ export function createSurfaceFoldPass(deps = {}) {
 				// picked up a stranger's acp_summary node is not this fold's
 				// material (the length check alone cannot tell them apart).
 				if (spanExact) {
-					const expectedIds = new Set(consumed.map((entry) => `acp_summary_${entry.id}`));
+				const expectedIds = new Set(consumed.map((entry) => `${FOLD_SUMMARY_ID_PREFIX}${entry.id}`));
 					for (let i = ladderFirstIdx; i <= ladderLastIdx; i++) {
 						const message = nodeMessages[i];
 						if (message === null || message === undefined || typeof message.id !== "string" || !expectedIds.has(message.id)) {
@@ -807,7 +980,7 @@ export function createSurfaceFoldPass(deps = {}) {
 				if (spanExact) {
 					for (let i = ladderFirstIdx; i <= ladderLastIdx; i++) {
 						const message = nodeMessages[i];
-						if (message === null || message === undefined || typeof message.id !== "string" || !message.id.startsWith("acp_summary_")) {
+					if (!isFoldSummaryMessage(message)) {
 							spanExact = false;
 							break;
 						}
@@ -906,6 +1079,23 @@ export function createSurfaceFoldPass(deps = {}) {
 				const located = locateOnSurface(pairs, block);
 				if (located === null) {
 					if (Array.isArray(block.surfaceSeqs)) {
+						if (captureFullyShadowed(nodes, block)) {
+							// Every captured seq has left the live surface: the range was
+							// already shadowed wholesale (host compaction, a prior ship
+							// whose marker was later lost). The material is
+							// off the wire and this capture can never validate again —
+							// terminate the block instead of re-tombstoning it on every
+							// generation bump (the pending filter drops it for good).
+							block.surfaceSuperseded = { reason: "shadowed", at: Date.now() };
+							delete block.surfaceSkip;
+							try {
+								store.persist(ledger);
+							} catch {
+								/* best effort */
+							}
+							skip(sessionId, "superseded-shadowed", via, `block=${block.id}`, false);
+							continue;
+						}
 						block.surfaceSkip = { reason: "incomplete-seqs", contentGeneration: liveGeneration, at: Date.now() };
 						skip(sessionId, "incomplete-seqs", via, `block=${block.id}`, false);
 					} else {
@@ -930,6 +1120,23 @@ export function createSurfaceFoldPass(deps = {}) {
 						&& nodes[located[0]] === storedFirst
 						&& nodes[located[1]] === storedLast;
 					if (!endpointsMatch) {
+						if (captureFullyShadowed(nodes, block)) {
+							// Every captured seq has left the live surface: the range was
+							// already shadowed wholesale (host compaction, a prior ship
+							// whose marker was later lost). The material is
+							// off the wire and this capture can never validate again —
+							// terminate the block instead of re-tombstoning it on every
+							// generation bump (the pending filter drops it for good).
+							block.surfaceSuperseded = { reason: "shadowed", at: Date.now() };
+							delete block.surfaceSkip;
+							try {
+								store.persist(ledger);
+							} catch {
+								/* best effort */
+							}
+							skip(sessionId, "superseded-shadowed", via, `block=${block.id} relocated-range`, false);
+							continue;
+						}
 						block.surfaceSkip = { reason: "incomplete-seqs", contentGeneration: liveGeneration, at: Date.now() };
 						skip(sessionId, "incomplete-seqs", via, `block=${block.id} relocated-range`, false);
 						continue;
@@ -1136,5 +1343,5 @@ export function createSurfaceFoldPass(deps = {}) {
 		warn(`[context-trim] agent/turn-stopping hook failed: ${error?.message ?? error}`);
 	}
 
-	return { sweep, captureFoldSeqs, enabledNow, supported };
+	return { sweep, captureFoldSeqs, enabledNow, supported, nudgeSupported, nudgeAppend, nudgePrune, nudgeScan };
 }

package/host/context-trim/trigger.js

@@ -32,7 +32,7 @@
  * which keeps the decision unit-testable (golden thresholds).
  */
 
-import { estimateTokensOf, refPositions, segmentBounds } from "./view.js";
+import { estimateTokensOf, isFoldSummaryMessage, refPositions, segmentBounds } from "./view.js";
 
 /** Hard minimum wall-clock interval between side-model folds. */
 export const FOLD_MIN_INTERVAL_MS = 60_000;
@@ -50,10 +50,16 @@ export const LADDER_MIN_INTERVAL_MS = 120_000;
  * first segment boundary strictly after the frontier AND after the task
  * intent (the first user message — bili's protected zone: the session's
  * opening task statement is never folded) to the last segment end that
- * still clears the protected tail. Returns { startIdx, endIdx } or null
- * when nothing is foldable (empty history, everything folded, or
- * protected tail covers it all). */
-export function computeFoldableRange(messages, ledger, protectedTail) {
+ * still clears the protected tail. Prior fold summaries (acp_summary_*,
+ * which the surface pass relocates right after the intent segment) are
+ * NEVER inside the range: they stay live on the surface and consolidate
+ * only through ladder T2/T3 distillation. This exclusion is load-bearing —
+ * the frontier message is itself shadowed once its fold ships, so without
+ * it the fallback start slid onto the last summary and every later fold
+ * re-absorbed the previous summary (the rolling-absorb regression).
+ * Returns { startIdx, endIdx } or null when nothing is foldable (empty
+ * history, everything folded, or protected tail covers it all). */
+export function computeFoldableRange(messages, ledger, protectedTail, options = {}) {
 	if (!Array.isArray(messages) || messages.length === 0) return null;
 	const tail = Number.isInteger(protectedTail) && protectedTail > 0 ? protectedTail : 0;
 	const tailStart = messages.length - tail;
@@ -75,19 +81,30 @@ export function computeFoldableRange(messages, ledger, protectedTail) {
 	// Task-intent protection: the first user message states the task; the
 	// segment containing it is never folded (its summary would become the
 	// only carrier of the task for the rest of the session — the dominant
-	// early-drift failure this guard prevents).
-	const firstUserIdx = messages.findIndex((message) => message?.role === "user");
-	if (firstUserIdx >= 0) {
-		for (const [start, end] of segmentBounds(messages)) {
-			if (start <= firstUserIdx && firstUserIdx <= end) {
-				startFrom = Math.max(startFrom, end + 1);
-				break;
+	// early-drift failure this guard prevents). Opt-out: trimProtectTaskIntent
+	// =false lets the intent segment fold like any other raw content; the
+	// system-head clamp above is unaffected — it applies only when the head is actually a system message.
+	if (options?.protectTaskIntent !== false) {
+		const firstUserIdx = messages.findIndex((message) => message?.role === "user");
+		if (firstUserIdx >= 0) {
+			for (const [start, end] of segmentBounds(messages)) {
+				if (start <= firstUserIdx && firstUserIdx <= end) {
+					startFrom = Math.max(startFrom, end + 1);
+					break;
+				}
 			}
 		}
 	}
 	let best = null;
 	for (const [start, end] of segmentBounds(messages)) {
 		if (start < startFrom) continue; // behind the frontier / intent
+		if (isFoldSummaryMessage(messages[start])) {
+			// A summary is its own segment (plain user message, no tool pair).
+			// Ahead of the first raw segment: skip the summary run. After raw
+			// segments have begun: stop — never bridge a span across one.
+			if (best !== null) break;
+			continue;
+		}
 		if (end >= tailStart) break; // segment would cut into the protected tail
 		if (best === null) best = { startIdx: start, endIdx: end };
 		else best.endIdx = end; // extend the contiguous span

package/host/context-trim/view.js

@@ -250,18 +250,33 @@ export function renderSummaryText(block) {
 	return `[SWITCHMAN:TRIM] ${block.summary}`;
 }
 
+/** Wire-id prefix of every fold-summary synthetic message. The single
+ * definition: summaryMessageOf builds ids from it, isFoldSummaryMessage
+ * recognizes them, and ladder relocation re-derives the same ids. */
+export const FOLD_SUMMARY_ID_PREFIX = "acp_summary_";
+
 /** The ONE synthetic message replacing a folded range (brief: synthetic
  * user message; id carries the acp_summary_ prefix downstream tooling
  * skips). Pure — same block, same bytes. The ladder replaces messages BY
  * this id (id-suffix = block id), which is why ids must stay stable. */
 export function summaryMessageOf(block) {
 	return {
-		id: `acp_summary_${block.id}`,
+		id: `${FOLD_SUMMARY_ID_PREFIX}${block.id}`,
 		role: "user",
 		content: [{ type: "text", text: renderSummaryText(block) }],
 	};
 }
 
+/** True when one wire message is a prior fold's synthetic summary
+ * (acp_summary_<blockId>). Recognition rides the id prefix only — never
+ * the source kind (the v4 validator rejects compact-checkpoint sources
+ * outside a compaction/start..end pair). Range selection and the advisory
+ * fold tool use this to KEEP summaries out of new raw folds: summaries
+ * stay live on the surface and consolidate only through ladder T2/T3. */
+export function isFoldSummaryMessage(message) {
+	return typeof message?.id === "string" && message.id.startsWith(FOLD_SUMMARY_ID_PREFIX);
+}
+
 /** Locate a block's range in a positions map at/after afterIdx. Strict:
  * both endpoint refs must resolve and the located span must equal the
  * block's stored message count (guards against re-sent histories that no
@@ -310,7 +325,7 @@ function locateBlock(positions, block, afterIdx) {
  * -> index, for every synthetic message. One index per id (a block renders
  * at most once — single consumption). */
 function summaryPositionsOf(messages) {
-	const prefix = "acp_summary_";
+	const prefix = FOLD_SUMMARY_ID_PREFIX;
 	const positions = new Map();
 	messages.forEach((message, index) => {
 		const id = message?.id;

package/host/context-watch.js

@@ -276,7 +276,11 @@ function subagentWindowTokens(ctx, state, sessionId) {
 async function primeSubagentWindow(ctx, state, route, key) {
 	try {
 		const llm = ctx.get?.("llm", false);
-		const info = await llm?.resolveModelInfo?.({ provider: route.provider, model: route.model });
+		// Host contract: resolveModelInfo(provider, model) takes TWO strings. The
+		// object shape threw NO_ADAPTER and subagent window scaling silently fell
+		// back to static tiers (found 2026-11-14; same contract every other
+		// call site already follows).
+		const info = await llm?.resolveModelInfo?.(route.provider, route.model);
 		const windowTokens = info?.context?.contextWindow;
 		const value = Number.isFinite(windowTokens) && windowTokens > 0 ? windowTokens : null;
 		state.subWindow.set(key, { value, at: Date.now() });

package/host/routes.js

@@ -111,6 +111,8 @@ const TRIM_NUMBER_FIELDS = [
 	{ field: "trimIncrementTokens", min: 1000, max: Number.POSITIVE_INFINITY, def: 25000 },
 	{ field: "trimPressurePercent", min: 5, max: 100, def: 65 },
 	{ field: "trimEmergencyPercent", min: 5, max: 100, def: 95 },
+	{ field: "trimAdvisoryPercent", min: 5, max: 100, def: 65 },
+	{ field: "trimAdvisoryCriticalPercent", min: 5, max: 100, def: 95 },
 	{ field: "trimWindowTokens", min: 0, max: Number.POSITIVE_INFINITY, def: 0 },
 	{ field: "trimProtectedTail", min: 0, max: 100, def: 10 },
 	{ field: "trimLadderT2Tokens", min: 1000, max: Number.POSITIVE_INFINITY, def: 8000 },
@@ -137,6 +139,7 @@ const BOOLEAN_FIELDS = [
 	// Context trim switches (mirrors the trim group in host/config.js).
 	"trimEnabled",
 	"trimLadderEnabled",
+	"trimProtectTaskIntent",
 	"surfaceFold",
 ];
 /** Intent numbers carry their own schema bounds (config.js), so the shared

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "dsh-switchman",
-	"version": "1.11.5",
+	"version": "1.11.6",
 	"description": "Autonomous Agent Teams doctrine for the four shipped DeepSeek Harness presets, plus language preferences, dispatch pools with model ranking, and context watermark control.",
 	"license": "MIT",
 	"keywords": [