maka-agent 0.2.0-dev.31.20260913 → 0.2.0-dev.32.20260914

package/node_modules/@maka/runtime/dist/ai-sdk-turn.js

@@ -39,6 +39,7 @@ import { REQUEST_SANDBOX_BOUNDARY_TOOL_NAME, SANDBOX_BOUNDARY_DENIED_FOR_TURN, S
 import { buildRuntimeEventModelReplayPlan, buildSteeringEnvelope, collectToolActivityTurnIds, compatibleProviderReasoningReplayEventIds, formatTextWithInlineRefs, steeringMessagesMissingFromBase, steeringModelMessage, } from './model-history.js';
 import { toolSchemaCharsForDiagnostics, requestCompositionToolSchemas, stableHash, toolCatalogHash, } from './request-shape.js';
 import { toolAvailabilityHash } from './tool-availability.js';
+import { hasFinalizedReasoning } from './ai-sdk-message-projection.js';
 import { renderSwarmModePrompt } from './swarm-mode.js';
 import { renderGraphModePrompt } from './graph-mode.js';
 import { modelUsesNativeOpenAiResponses } from './model-runtime.js';
@@ -345,13 +346,6 @@ function joinPromptFragments(fragments) {
 }
 const MAX_WAITING_CODE_MODE_CELLS = 1;
 const MAX_PROVIDER_ATTEMPTS_PER_STEP = 10;
-const MAX_IDLE_WATCHDOG_RETRIES_PER_STEP = 1;
-const MAX_INCOMPLETE_STREAM_RETRIES_PER_STEP = 1;
-// A mid-stream cut after partial thinking seals one transcript fragment per
-// retry. A gateway that systematically kills long thinking streams (the
-// 2026-08-28 incident shape) would otherwise spend the full attempt budget
-// accumulating fragments before failing anyway, so fail fast after one.
-const MAX_SEALED_THINKING_RETRIES_PER_STEP = 1;
 const PROVIDER_RETRY_BASE_DELAY_MS = 1_000;
 const PROVIDER_RETRY_MAX_DELAY_MS = 32_000;
 const PROVIDER_RETRY_JITTER_FACTOR = 0.25;
@@ -375,9 +369,6 @@ function providerRetryReason(kind) {
             return 'unknown';
     }
 }
-function isIncompleteProviderFinishReason(reason) {
-    return reason === undefined || reason === 'other' || reason === 'unknown';
-}
 /**
  * The mutable state of ONE `send()`.
  *
@@ -611,11 +602,6 @@ export class AiSdkTurn {
         let stepTextPartStartOffset = 0;
         let stepThinkingParts = [];
         let stepThinkingPartsById = new Map();
-        let stepContentOrder = [];
-        const recordStepContent = (kind) => {
-            if (!stepContentOrder.includes(kind))
-                stepContentOrder.push(kind);
-        };
         // Flush the current step's AssistantMessage (text + thinking) and the paired
         // terminal thinking/text events, then clear the per-step accumulators.
         // Persist when the step produced text OR reasoning — a thinking-only step
@@ -631,17 +617,37 @@ export class AiSdkTurn {
             stepTextPartStartOffset = 0;
             stepThinkingParts = [];
             stepThinkingPartsById = new Map();
-            stepContentOrder = [];
         };
-        const flushStep = async () => {
+        const flushStep = async (interrupted = false) => {
             const hasThinking = stepThinkingParts.length > 0;
             if (stepText.length === 0 && !hasThinking) {
                 resetStep();
                 return;
             }
-            const stepId = currentStepMessageId;
-            if (hasThinking) {
-                for (const part of stepThinkingParts) {
+            // A provider may finalize one reasoning item before the next item fails.
+            // Keep completed and interrupted parts in separate transcript rows so
+            // missing-ledger recovery preserves the same model visibility.
+            const fragments = [];
+            for (const part of stepThinkingParts) {
+                const partInterrupted = interrupted && !hasFinalizedReasoning(part);
+                let fragment = fragments.at(-1);
+                if (!fragment || fragment.interrupted !== partInterrupted) {
+                    fragment = { thinking: [], text: '', interrupted: partInterrupted };
+                    fragments.push(fragment);
+                }
+                fragment.thinking.push(part);
+            }
+            if (stepText.length > 0) {
+                let fragment = fragments.at(-1);
+                if (!fragment || fragment.interrupted !== interrupted) {
+                    fragment = { thinking: [], text: '', interrupted };
+                    fragments.push(fragment);
+                }
+                fragment.text = stepText;
+            }
+            for (const [index, fragment] of fragments.entries()) {
+                const stepId = index === 0 ? currentStepMessageId : this.deps.newId();
+                for (const part of fragment.thinking) {
                     queue.push({
                         type: 'thinking_complete',
                         id: this.deps.newId(),
@@ -649,6 +655,7 @@ export class AiSdkTurn {
                         ts: this.deps.now(),
                         messageId: stepId,
                         text: part.text,
+                        ...(fragment.interrupted ? { interrupted: true } : {}),
                         ...(part.signature !== undefined ? { signature: part.signature } : {}),
                         // No sanitiser here, unlike the tool call below: these options are
                         // not the provider's object. `translateChunk` rebuilds reasoning
@@ -661,24 +668,25 @@ export class AiSdkTurn {
                             : {}),
                     });
                 }
+                queue.push({
+                    type: 'text_complete',
+                    id: this.deps.newId(),
+                    turnId,
+                    ts: this.deps.now(),
+                    messageId: stepId,
+                    text: fragment.text,
+                    ...(fragment.interrupted ? { interrupted: true } : {}),
+                    ...(index === fragments.length - 1 && stepTextProviderOptions !== undefined
+                        ? { providerOptions: stepTextProviderOptions }
+                        : {}),
+                });
             }
-            queue.push({
-                type: 'text_complete',
-                id: this.deps.newId(),
-                turnId,
-                ts: this.deps.now(),
-                messageId: stepId,
-                text: stepText,
-                ...(stepTextProviderOptions !== undefined
-                    ? { providerOptions: stepTextProviderOptions }
-                    : {}),
-            });
             this.finalAssistantText = stepText.length > 0 ? stepText : undefined;
             resetStep();
         };
         let tokenUsage;
         let tokenUsageCostUsd;
-        // Per-send sum of every COMPLETED step's usage, merged at each finish-step
+        // Per-send sum of every completed step's usage, merged at settlement
         // boundary. When the send aborts (mid-turn exhaust, user stop, stream
         // error) the SDK's cumulative `usage` promise may not resolve, but this sum is
         // real provider-reported evidence for the steps that did finish — IF every
@@ -945,7 +953,9 @@ export class AiSdkTurn {
                         idleTimeoutMs: this.deps.backend.streamIdleTimeoutMs,
                         ...this.deps.backend.streamWatchdogTimer,
                         onTimeout: (timeout) => {
-                            const error = new Error(formatStreamWatchdogError(timeout));
+                            const error = Object.assign(new Error(formatStreamWatchdogError(timeout)), {
+                                code: 'MODEL_STREAM_TIMEOUT',
+                            });
                             watchdogTimeoutState.current = { phase: timeout.phase, error };
                             providerRequestAbortController.abort(error);
                         },
@@ -1020,7 +1030,9 @@ export class AiSdkTurn {
                     // folded through the same reducer before it becomes messages. Without
                     // this, a result archived at step N is rebuilt in full at step N+1 and
                     // the ledger's account of what the model sees stops being true.
-                    const foldedReplayEvents = await this.deps.compaction.foldEffectiveModelHistory(replayEvents, pruned.projectionSnapshot);
+                    const foldedReplayEvents = projectionCheckpoint
+                        ? await this.deps.compaction.foldEffectiveModelHistory(replayEvents, pruned.projectionSnapshot)
+                        : pruned.events;
                     const replayPlan = buildRuntimeEventModelReplayPlan(foldedReplayEvents, {
                         toolActivityTurnIds: collectToolActivityTurnIds([
                             ...(input.runtimeContext ?? []),
@@ -1068,11 +1080,6 @@ export class AiSdkTurn {
                 const requestProjection = shapedProjection;
                 const completedProviderSteps = [];
                 let requestMessages = messages;
-                // The compaction module runs at most once per send. This tracks the
-                // reactive entry; the proactive one sets the same flag on the mid-turn
-                // state, and each consults the other, so a send that already folded
-                // reports the oversized message instead of folding again (#4559).
-                let overflowRetryUsed = false;
                 let result;
                 let providerOutcome;
                 let finishReason = 'stop';
@@ -1153,41 +1160,27 @@ export class AiSdkTurn {
                         : undefined;
                     providerRequestTracker?.setStep(runtimeSteps, requestCompositionId);
                     let attemptMessages = projectedMessages;
-                    let providerAttempt = 1;
-                    let idleWatchdogRetryCount = 0;
-                    let incompleteStreamRetryCount = 0;
-                    let sealedThinkingRetryCount = 0;
+                    let providerAttempt = 0;
                     const returnedToolCalls = [];
-                    let providerToolActivityCount = 0;
                     const providerToolInputs = new Map();
                     let providerStepUsage;
                     for (;;) {
+                        providerAttempt += 1;
+                        // Local calls are only admitted after a successful provider outcome.
+                        // A new physical request must not inherit the failed one's intents.
+                        returnedToolCalls.length = 0;
                         providerRequestAbortController = new AbortController();
                         watchdogTimeoutState.current = null;
                         startWatchdog();
                         // Monotonic facts for this physical request. The step accumulators
                         // are cleared after flushStep(), so they cannot decide whether a
                         // later stream failure is safe to retry.
-                        let attemptSawText = false;
-                        let attemptSawThinking = false;
+                        let attemptSawVisibleContent = false;
                         let attemptSawToolActivity = false;
-                        let attemptSawContinuationMetadata = false;
-                        let attemptReachedStepBoundary = false;
-                        const attemptHasNoObservableOutput = () => !attemptSawText &&
-                            !attemptSawThinking &&
-                            !attemptSawToolActivity &&
-                            !attemptSawContinuationMetadata &&
-                            !attemptReachedStepBoundary;
-                        // Thinking is the only output that can be sealed into its own
-                        // message before a retry: flushStep() closes the fragment under
-                        // the current message id and the retry streams into a fresh one,
-                        // so the user never sees spliced or duplicated content. Text,
-                        // tool activity, continuation metadata, and step boundaries stay
-                        // non-recoverable for the reasons each of them is tracked.
-                        const attemptCanRecoverWithSealedThinking = () => !attemptSawText &&
-                            !attemptSawToolActivity &&
-                            !attemptSawContinuationMetadata &&
-                            !attemptReachedStepBoundary;
+                        let attemptSawToolInput = false;
+                        let attemptSawReplayBarrier = false;
+                        const attemptHasNoObservableOutput = () => !attemptSawVisibleContent && !attemptSawToolActivity && !attemptSawReplayBarrier;
+                        const attemptCanReplay = () => !attemptSawToolActivity && !attemptSawReplayBarrier;
                         this.memorySourceMessages = [...attemptMessages];
                         this.memorySourceEventMessagePositions =
                             this.deps.messageProjection.memoryEventMessagePositions(attemptMessages);
@@ -1240,185 +1233,18 @@ export class AiSdkTurn {
                                 // trailer and consume the one authoritative outcome below.
                                 break;
                             }
-                            const incompleteFinish = (event.kind === 'finish' || event.kind === 'step-finish') &&
-                                isIncompleteProviderFinishReason(event.finishReason);
-                            if ((event.kind === 'finish' || event.kind === 'step-finish') && !incompleteFinish) {
-                                attemptReachedStepBoundary = true;
-                            }
-                            if (event.kind === 'step-finish') {
-                                // AI SDK can synthesize `finish-step(other)` when the provider
-                                // stream reaches EOF without a terminal frame. That is not a
-                                // completed model step and must not consume the step budget or
-                                // checkpoint imaginary usage before the safe retry below.
-                                if (!incompleteFinish) {
-                                    // Step boundary: AI SDK 7 delimits steps with `finish-step`
-                                    // (and `step-finish` for legacy replay fixtures); the adapter
-                                    // reduces both to this event. A duplicate boundary is harmless:
-                                    // the second flush no-ops (accumulators already cleared) and one
-                                    // extra id rotation just discards an unused id.
-                                    runtimeSteps += 1;
-                                    const stepUsage = event.usage;
-                                    providerStepUsage = stepUsage;
-                                    if (!stepUsage)
-                                        sawUnusableStepUsage = true;
-                                    // Silent eviction / rewrite check (#4559): this step only
-                                    // appended (no fold, no prune, no image omission) yet the
-                                    // provider counted no more input tokens than for the previous
-                                    // request. Not-greater, not strictly-fewer: a provider that
-                                    // truncates to a fixed window (Ollama's `num_ctx`) reports the
-                                    // same total on every later request while Maka keeps
-                                    // appending, so a plateau is the signal, and an equal count
-                                    // after an append is already impossible without provider-side
-                                    // eviction or rewriting. Input against input: the previous
-                                    // reply's reasoning may not be resent, so input + output is
-                                    // not the floor of the next input on every wire.
-                                    const completedRequestIndex = runtimeSteps - 1;
-                                    // A finalization step resolves an empty tool set, so its
-                                    // request legitimately drops several thousand schema tokens
-                                    // with no fold, prune or image omission. Maka shaped that
-                                    // request; the provider did not drop anything.
-                                    const toolSchemaShrank = lastStepActiveToolCount !== undefined &&
-                                        activeToolsForRequest.length < lastStepActiveToolCount;
-                                    // Across the send boundary the comparison is the same one,
-                                    // against the last request a provider accepted before this
-                                    // send. A provider that truncates to a fixed window reports
-                                    // the same input on every later request while the user keeps
-                                    // adding turns, and a send of one or two steps never sees
-                                    // that from the inside: the live evidence plateaus at 3,716
-                                    // input tokens across eight turns with nothing reported
-                                    // (#4623). The first request of a send therefore compares
-                                    // against the persisted anchor, which is route-validated
-                                    // where it is read; a fold before that request would explain
-                                    // a smaller input by itself, so it disables the comparison.
-                                    const acrossSends = completedRequestIndex === 0;
-                                    const priorInput = acrossSends
-                                        ? midTurnState?.compactionAppliedThisSend === true
-                                            ? undefined
-                                            : midTurnState?.priorAcceptedInputTokens
-                                        : lastStepInputTokens;
-                                    if (!this.deps.session.contextProviderDroppingReported &&
-                                        !toolSchemaShrank &&
-                                        midTurnState &&
-                                        priorInput !== undefined &&
-                                        midTurnState.replacedStepNumber !== completedRequestIndex &&
-                                        pruneAppliedAtStep !== completedRequestIndex &&
-                                        midTurnState.omittedImageToolResults.size === 0 &&
-                                        stepUsage !== undefined &&
-                                        Number.isFinite(stepUsage.inputTokens) &&
-                                        stepUsage.inputTokens > 0 &&
-                                        // Across sends the test is equality, not "did not grow".
-                                        // Inside a send Maka knows it only appended, so any
-                                        // shortfall is the provider's. Across the boundary it does
-                                        // not: a manual compaction leaves the pre-compaction anchor
-                                        // behind, a turn can carry a smaller tool set, and a user
-                                        // can edit or branch history. All three shrink the input
-                                        // legitimately, and none of them lands on exactly the same
-                                        // count. A provider truncating to a fixed window does, on
-                                        // every later request.
-                                        (acrossSends
-                                            ? stepUsage.inputTokens === priorInput
-                                            : stepUsage.inputTokens <= priorInput)) {
-                                        this.deps.session.contextProviderDroppingReported = true;
-                                        await this.recordSystemNote('context_provider_dropping', turnId, {
-                                            inputTokens: stepUsage.inputTokens,
-                                            priorInputTokens: priorInput,
-                                        });
-                                    }
-                                    // Fail closed: reset on every step boundary so a missing final
-                                    // step's usage does not leave a stale value from an earlier step.
-                                    // The reply needed more room than the declared window had
-                                    // left after this request's own input. Both halves are the
-                                    // provider's numbers, read after the fact: the reserve that
-                                    // should have kept them apart was measured from a smaller
-                                    // previous reply. Say so once per send; the next request
-                                    // folds anyway because the baseline now exceeds the window.
-                                    if (!contextWindowOverrunNoteWritten &&
-                                        midTurnState?.capacity !== undefined &&
-                                        stepUsage !== undefined &&
-                                        Number.isFinite(stepUsage.inputTokens) &&
-                                        stepUsage.inputTokens > 0 &&
-                                        Number.isFinite(stepUsage.outputTokens) &&
-                                        stepUsage.outputTokens > 0 &&
-                                        stepUsage.inputTokens + stepUsage.outputTokens > midTurnState.capacity) {
-                                        contextWindowOverrunNoteWritten = true;
-                                        await this.recordSystemNote('context_window_overrun', turnId, {
-                                            usedTokens: stepUsage.inputTokens + stepUsage.outputTokens,
-                                            declaredContextWindow: midTurnState.capacity,
-                                        });
-                                    }
-                                    // Nothing declared, and the provider accepted a request past
-                                    // the window this model reports. Every other signal in this
-                                    // design stays dark there: no rejection to recover from, no
-                                    // plateau to read, and no declaration to arm the proactive
-                                    // threshold, so the session degrades quietly and
-                                    // indefinitely (#4634). Report the two real numbers and
-                                    // leave the decision with the user: a reported window is a
-                                    // hint, and Maka still declares nothing on their behalf.
-                                    //
-                                    // Once per crossing, not once per send. On these providers
-                                    // usage keeps growing past the line (305K → 322K observed),
-                                    // so the note fires on the transition: the previous accepted
-                                    // total was still inside the reported window and this one is
-                                    // not. The baseline carries that previous total across
-                                    // sessions through the persisted anchor, so a resumed
-                                    // session does not repeat a crossing it already reported.
-                                    if (!contextReportedWindowNoteWritten &&
-                                        midTurnState !== undefined &&
-                                        midTurnState.capacity === undefined &&
-                                        stepUsage !== undefined &&
-                                        Number.isFinite(stepUsage.inputTokens) &&
-                                        stepUsage.inputTokens > 0 &&
-                                        Number.isFinite(stepUsage.outputTokens)) {
-                                        const reported = resolveSelectedModelContextWindow(this.deps.backend.connection, this.deps.backend.modelId);
-                                        const used = stepUsage.inputTokens + Math.max(0, stepUsage.outputTokens);
-                                        // `baselineTokens` still describes the request before this
-                                        // one: the capacity hook sets it from the previous step, or
-                                        // from the persisted anchor on a send's first request.
-                                        const previousTotal = midTurnState.baselineTokens;
-                                        const crossedNow = reported !== undefined &&
-                                            used > reported &&
-                                            (previousTotal === undefined || previousTotal <= reported);
-                                        if (reported !== undefined && crossedNow) {
-                                            contextReportedWindowNoteWritten = true;
-                                            await this.recordSystemNote('context_reported_window_exceeded', turnId, {
-                                                usedTokens: used,
-                                                reportedContextWindow: reported,
-                                            });
-                                        }
-                                    }
-                                    lastStepInputTokens = stepUsage?.inputTokens;
-                                    lastStepOutputTokens = stepUsage?.outputTokens;
-                                    lastStepActiveToolCount = activeToolsForRequest.length;
-                                    // A `finishReason: length` is deliberately not a trigger. The
-                                    // reply may have been cut because the provider ran out of
-                                    // window room, or because the provider's own output cap is
-                                    // lower than the one Maka sends. Those are indistinguishable
-                                    // from outside, and an indistinguishable signal must not
-                                    // drive an action; the cut reply is visible to the user
-                                    // either way (#4559).
-                                    if (stepUsage) {
-                                        completedStepUsage = mergeNormalizedUsage(completedStepUsage, stepUsage);
-                                        this.deps.session.cumulativeUsageCheckpoint = mergeNormalizedUsage(this.deps.session.cumulativeUsageCheckpoint, stepUsage);
-                                        await this.deps.backend.recordUsageCheckpoint?.({
-                                            ...this.deps.session.cumulativeUsageCheckpoint,
-                                            costUsd: this.deps.providerTelemetry.normalizedUsageCostUsd(this.deps.session.cumulativeUsageCheckpoint),
-                                        });
-                                    }
-                                }
-                            }
                             if (event.kind === 'text-start') {
                                 if (stepText.length > 0 && event.providerItemBoundary === true) {
+                                    attemptSawReplayBarrier = true;
                                     await flushStep();
                                     currentStepMessageId = this.deps.newId();
                                 }
                                 stepTextPartStartOffset = stepText.length;
                             }
                             else if (event.kind === 'text') {
-                                if (event.text.length > 0)
-                                    recordStepContent('text');
                                 stepText += event.text;
                                 if (event.text.length > 0)
-                                    attemptSawText = true;
+                                    attemptSawVisibleContent = true;
                                 queue.push({
                                     type: 'text_delta',
                                     id: this.deps.newId(),
@@ -1430,7 +1256,7 @@ export class AiSdkTurn {
                             }
                             else if (event.kind === 'text-end') {
                                 if (event.providerOptions !== undefined) {
-                                    attemptSawContinuationMetadata = true;
+                                    attemptSawReplayBarrier = true;
                                     stepTextProviderOptions = mergeTextProviderOptions(stepTextProviderOptions, stripUndefinedDeep(event.providerOptions), stepTextPartStartOffset);
                                 }
                                 if (event.providerItemBoundary === true) {
@@ -1440,7 +1266,7 @@ export class AiSdkTurn {
                             }
                             else if (event.kind === 'thinking-start') {
                                 if (event.providerOptions !== undefined) {
-                                    attemptSawContinuationMetadata = true;
+                                    attemptSawReplayBarrier = true;
                                 }
                                 const part = {
                                     text: '',
@@ -1455,12 +1281,10 @@ export class AiSdkTurn {
                             }
                             else if (event.kind === 'thinking') {
                                 if (event.text.length > 0)
-                                    recordStepContent('thinking');
-                                if (event.text.length > 0)
-                                    attemptSawThinking = true;
+                                    attemptSawVisibleContent = true;
                                 if (event.providerOptions !== undefined) {
                                     if (event.providerOptionsOrigin !== 'maka_transport') {
-                                        attemptSawContinuationMetadata = true;
+                                        attemptSawReplayBarrier = true;
                                     }
                                 }
                                 const partId = event.reasoningPartId ?? responsesReasoningItemId(event.providerOptions);
@@ -1516,7 +1340,7 @@ export class AiSdkTurn {
                                 });
                             }
                             else if (event.kind === 'thinking-signature') {
-                                attemptSawContinuationMetadata = true;
+                                attemptSawReplayBarrier = true;
                                 let part = event.reasoningPartId
                                     ? stepThinkingPartsById.get(event.reasoningPartId)
                                     : stepThinkingParts.at(-1);
@@ -1529,17 +1353,17 @@ export class AiSdkTurn {
                                 }
                                 part.signature = event.signature;
                             }
-                            else if (event.kind === 'provider-tool-input') {
+                            else if (event.kind === 'tool-input') {
+                                attemptSawToolInput = true;
                                 // The provider has started its own tool. Even without a
                                 // final tool-call/result event, retrying can repeat external
                                 // work that the Runtime cannot observe or reconcile.
-                                attemptSawToolActivity = true;
+                                if (event.providerExecuted)
+                                    attemptSawToolActivity = true;
                             }
                             else if (event.kind === 'tool-call') {
-                                attemptSawToolActivity = true;
-                                recordStepContent('tools');
                                 if (event.toolCall.providerExecuted) {
-                                    providerToolActivityCount += 1;
+                                    attemptSawToolActivity = true;
                                     providerToolInputs.set(event.toolCall.toolCallId, event.toolCall.input);
                                     queue.push({
                                         type: 'tool_start',
@@ -1566,7 +1390,6 @@ export class AiSdkTurn {
                             }
                             else if (event.kind === 'provider-tool-result') {
                                 attemptSawToolActivity = true;
-                                providerToolActivityCount += 1;
                                 const providerOutput = stripUndefinedDeep(event.output);
                                 queue.push({
                                     type: 'tool_result',
@@ -1581,44 +1404,185 @@ export class AiSdkTurn {
                                 });
                                 providerToolInputs.delete(event.toolCallId);
                             }
-                            else if (event.kind === 'step-finish' && !incompleteFinish) {
-                                // The step's text/thinking deltas are all in (the stream is
-                                // drained in order), so flush this step's AssistantMessage and
-                                // rotate to a fresh id for the next step. Tool settlement
-                                // below receives this step's pre-rotation id, so durable replay
-                                // can regroup calls with this reasoning/text.
-                                await flushStep();
-                                if (midTurnState) {
-                                    // Durability clock: step N's thinking/text completion events
-                                    // are enqueued by flushStep just above, so only after this
-                                    // boundary can a seq-ack wait for step N mean anything. Wake
-                                    // waiters AFTER the increment or they would re-check a stale
-                                    // count and sleep.
-                                    midTurnState.flushedSteps += 1;
-                                    queue.wake();
-                                }
-                            }
                         }
                         watchdogState.current?.stop();
                         // This timeout belongs to the physical request that just settled.
                         // Consume it before recovery/flush work: a later persistence error
                         // must not be reported as the already-handled watchdog timeout.
-                        const settledWatchdogTimeout = consumeWatchdogTimeout();
+                        consumeWatchdogTimeout();
                         providerOutcome = await result.outcome;
-                        const incompleteStreamTerminal = providerOutcome.kind === 'truncated';
-                        const incompleteStreamHasNoObservableOutput = incompleteStreamTerminal &&
-                            !attemptSawText &&
-                            !attemptSawThinking &&
-                            !attemptSawToolActivity &&
-                            !attemptSawContinuationMetadata;
-                        const attemptFailure = settledWatchdogTimeout?.error ??
-                            (providerOutcome.kind === 'completed' ? undefined : providerOutcome.failure);
-                        if (attemptFailure && !this.aborted) {
-                            const failure = settledWatchdogTimeout || providerOutcome.kind === 'completed'
-                                ? this.deps.modelAdapter.normalizeFailure(attemptFailure)
-                                : providerOutcome.failure;
+                        if (providerOutcome.kind === 'completed') {
+                            runtimeSteps += 1;
+                            const stepUsage = providerOutcome.usage;
+                            providerStepUsage = stepUsage;
+                            if (!stepUsage)
+                                sawUnusableStepUsage = true;
+                            // Silent eviction / rewrite check (#4559): this step only
+                            // appended (no fold, no prune, no image omission) yet the
+                            // provider counted no more input tokens than for the previous
+                            // request. Not-greater, not strictly-fewer: a provider that
+                            // truncates to a fixed window (Ollama's `num_ctx`) reports the
+                            // same total on every later request while Maka keeps
+                            // appending, so a plateau is the signal, and an equal count
+                            // after an append is already impossible without provider-side
+                            // eviction or rewriting. Input against input: the previous
+                            // reply's reasoning may not be resent, so input + output is
+                            // not the floor of the next input on every wire.
+                            const completedRequestIndex = runtimeSteps - 1;
+                            // A finalization step resolves an empty tool set, so its
+                            // request legitimately drops several thousand schema tokens
+                            // with no fold, prune or image omission. Maka shaped that
+                            // request; the provider did not drop anything.
+                            const toolSchemaShrank = lastStepActiveToolCount !== undefined &&
+                                activeToolsForRequest.length < lastStepActiveToolCount;
+                            // Across the send boundary the comparison is the same one,
+                            // against the last request a provider accepted before this
+                            // send. A provider that truncates to a fixed window reports
+                            // the same input on every later request while the user keeps
+                            // adding turns, and a send of one or two steps never sees
+                            // that from the inside: the live evidence plateaus at 3,716
+                            // input tokens across eight turns with nothing reported
+                            // (#4623). The first request of a send therefore compares
+                            // against the persisted anchor, which is route-validated
+                            // where it is read; a fold before that request would explain
+                            // a smaller input by itself, so it disables the comparison.
+                            const acrossSends = completedRequestIndex === 0;
+                            const priorInput = acrossSends
+                                ? midTurnState?.compactionAppliedThisSend === true
+                                    ? undefined
+                                    : midTurnState?.priorAcceptedInputTokens
+                                : lastStepInputTokens;
+                            if (!this.deps.session.contextProviderDroppingReported &&
+                                !toolSchemaShrank &&
+                                midTurnState &&
+                                priorInput !== undefined &&
+                                midTurnState.replacedStepNumber !== completedRequestIndex &&
+                                pruneAppliedAtStep !== completedRequestIndex &&
+                                midTurnState.omittedImageToolResults.size === 0 &&
+                                stepUsage !== undefined &&
+                                Number.isFinite(stepUsage.inputTokens) &&
+                                stepUsage.inputTokens > 0 &&
+                                // Across sends the test is equality, not "did not grow".
+                                // Inside a send Maka knows it only appended, so any
+                                // shortfall is the provider's. Across the boundary it does
+                                // not: a manual compaction leaves the pre-compaction anchor
+                                // behind, a turn can carry a smaller tool set, and a user
+                                // can edit or branch history. All three shrink the input
+                                // legitimately, and none of them lands on exactly the same
+                                // count. A provider truncating to a fixed window does, on
+                                // every later request.
+                                (acrossSends
+                                    ? stepUsage.inputTokens === priorInput
+                                    : stepUsage.inputTokens <= priorInput)) {
+                                this.deps.session.contextProviderDroppingReported = true;
+                                await this.recordSystemNote('context_provider_dropping', turnId, {
+                                    inputTokens: stepUsage.inputTokens,
+                                    priorInputTokens: priorInput,
+                                });
+                            }
+                            // Fail closed: reset on every step boundary so a missing final
+                            // step's usage does not leave a stale value from an earlier step.
+                            // The reply needed more room than the declared window had
+                            // left after this request's own input. Both halves are the
+                            // provider's numbers, read after the fact: the reserve that
+                            // should have kept them apart was measured from a smaller
+                            // previous reply. Say so once per send; the next request
+                            // folds anyway because the baseline now exceeds the window.
+                            if (!contextWindowOverrunNoteWritten &&
+                                midTurnState?.capacity !== undefined &&
+                                stepUsage !== undefined &&
+                                Number.isFinite(stepUsage.inputTokens) &&
+                                stepUsage.inputTokens > 0 &&
+                                Number.isFinite(stepUsage.outputTokens) &&
+                                stepUsage.outputTokens > 0 &&
+                                stepUsage.inputTokens + stepUsage.outputTokens > midTurnState.capacity) {
+                                contextWindowOverrunNoteWritten = true;
+                                await this.recordSystemNote('context_window_overrun', turnId, {
+                                    usedTokens: stepUsage.inputTokens + stepUsage.outputTokens,
+                                    declaredContextWindow: midTurnState.capacity,
+                                });
+                            }
+                            // Nothing declared, and the provider accepted a request past
+                            // the window this model reports. Every other signal in this
+                            // design stays dark there: no rejection to recover from, no
+                            // plateau to read, and no declaration to arm the proactive
+                            // threshold, so the session degrades quietly and
+                            // indefinitely (#4634). Report the two real numbers and
+                            // leave the decision with the user: a reported window is a
+                            // hint, and Maka still declares nothing on their behalf.
+                            //
+                            // Once per crossing, not once per send. On these providers
+                            // usage keeps growing past the line (305K → 322K observed),
+                            // so the note fires on the transition: the previous accepted
+                            // total was still inside the reported window and this one is
+                            // not. The baseline carries that previous total across
+                            // sessions through the persisted anchor, so a resumed
+                            // session does not repeat a crossing it already reported.
+                            if (!contextReportedWindowNoteWritten &&
+                                midTurnState !== undefined &&
+                                midTurnState.capacity === undefined &&
+                                stepUsage !== undefined &&
+                                Number.isFinite(stepUsage.inputTokens) &&
+                                stepUsage.inputTokens > 0 &&
+                                Number.isFinite(stepUsage.outputTokens)) {
+                                const reported = resolveSelectedModelContextWindow(this.deps.backend.connection, this.deps.backend.modelId);
+                                const used = stepUsage.inputTokens + Math.max(0, stepUsage.outputTokens);
+                                // `baselineTokens` still describes the request before this
+                                // one: the capacity hook sets it from the previous step, or
+                                // from the persisted anchor on a send's first request.
+                                const previousTotal = midTurnState.baselineTokens;
+                                const crossedNow = reported !== undefined &&
+                                    used > reported &&
+                                    (previousTotal === undefined || previousTotal <= reported);
+                                if (reported !== undefined && crossedNow) {
+                                    contextReportedWindowNoteWritten = true;
+                                    await this.recordSystemNote('context_reported_window_exceeded', turnId, {
+                                        usedTokens: used,
+                                        reportedContextWindow: reported,
+                                    });
+                                }
+                            }
+                            lastStepInputTokens = stepUsage?.inputTokens;
+                            lastStepOutputTokens = stepUsage?.outputTokens;
+                            lastStepActiveToolCount = activeToolsForRequest.length;
+                            // A `finishReason: length` is deliberately not a trigger. The
+                            // reply may have been cut because the provider ran out of
+                            // window room, or because the provider's own output cap is
+                            // lower than the one Maka sends. Those are indistinguishable
+                            // from outside, and an indistinguishable signal must not
+                            // drive an action; the cut reply is visible to the user
+                            // either way (#4559).
+                            if (stepUsage) {
+                                completedStepUsage = mergeNormalizedUsage(completedStepUsage, stepUsage);
+                                this.deps.session.cumulativeUsageCheckpoint = mergeNormalizedUsage(this.deps.session.cumulativeUsageCheckpoint, stepUsage);
+                                await this.deps.backend.recordUsageCheckpoint?.({
+                                    ...this.deps.session.cumulativeUsageCheckpoint,
+                                    costUsd: this.deps.providerTelemetry.normalizedUsageCostUsd(this.deps.session.cumulativeUsageCheckpoint),
+                                });
+                            }
+                            await flushStep();
+                            if (midTurnState) {
+                                // Durability clock: step N's thinking/text completion events
+                                // are enqueued by flushStep just above, so only after this
+                                // boundary can a seq-ack wait for step N mean anything. Wake
+                                // waiters AFTER the increment or they would re-check a stale
+                                // count and sleep.
+                                midTurnState.flushedSteps += 1;
+                                queue.wake();
+                            }
+                        }
+                        if (providerOutcome.kind === 'failed' && !this.aborted) {
+                            const failure = providerOutcome.failure;
+                            // An output-free context rejection did not sample a response.
+                            // Preserve metering for completed steps across compaction recovery.
+                            if (!providerOutcome.usage &&
+                                !(failure.kind === 'context_overflow' &&
+                                    attemptHasNoObservableOutput() &&
+                                    !attemptSawToolInput &&
+                                    returnedToolCalls.length === 0))
+                                sawUnusableStepUsage = true;
                             if (this.loopStopRequested) {
-                                terminalProviderError = settledWatchdogTimeout?.error ?? failure;
+                                terminalProviderError = failure;
                                 terminalProviderErrorReason =
                                     lastCompletedStepHadToolResult && failure.kind === 'timeout'
                                         ? 'model_after_tool_timeout'
@@ -1629,10 +1593,11 @@ export class AiSdkTurn {
                             // more step; with the send-level budget already spent there is
                             // nothing left to grant it, so the error is terminal.
                             const stepBudgetRemains = maxSteps === undefined || runtimeSteps < maxSteps;
-                            const recovered = stepBudgetRemains && attemptHasNoObservableOutput()
+                            const recovered = stepBudgetRemains &&
+                                providerAttempt < MAX_PROVIDER_ATTEMPTS_PER_STEP &&
+                                attemptHasNoObservableOutput()
                                 ? await this.deps.compaction.recoverFromOverflowError({
-                                    error: attemptFailure,
-                                    retryAlreadyUsed: overflowRetryUsed || (midTurnState?.compactionAttemptedThisSend ?? false),
+                                    error: failure,
                                     midTurnState,
                                     turnId,
                                     stepNumber: runtimeSteps,
@@ -1651,7 +1616,6 @@ export class AiSdkTurn {
                                 })
                                 : undefined;
                             if (recovered) {
-                                overflowRetryUsed = true;
                                 attemptMessages = recovered.messages;
                                 continue;
                             }
@@ -1690,30 +1654,10 @@ export class AiSdkTurn {
                                 contextOverflowAfterCompactionNoteWritten = true;
                                 await this.recordSystemNote('context_overflow_after_compaction', turnId);
                             }
-                            const idleWatchdogRecovery = settledWatchdogTimeout?.phase === 'idle' &&
-                                idleWatchdogRetryCount < MAX_IDLE_WATCHDOG_RETRIES_PER_STEP &&
-                                attemptCanRecoverWithSealedThinking();
-                            const incompleteStreamRecovery = incompleteStreamTerminal &&
-                                incompleteStreamRetryCount < MAX_INCOMPLETE_STREAM_RETRIES_PER_STEP &&
-                                incompleteStreamHasNoObservableOutput;
-                            // Same seal-and-retry contract as the watchdog path, entered when
-                            // the failure arrives as a retryable provider/network error
-                            // instead of a local idle timeout. `!idleWatchdogRecovery` keeps
-                            // every watchdog-shaped outcome on its existing path, and
-                            // `!attemptHasNoObservableOutput()` keeps no-output retries on
-                            // the plain budget so this one is spent only on sealed fragments.
-                            const sealedThinkingRecovery = !idleWatchdogRecovery &&
-                                failure.retryable &&
-                                sealedThinkingRetryCount < MAX_SEALED_THINKING_RETRIES_PER_STEP &&
-                                attemptCanRecoverWithSealedThinking() &&
-                                !attemptHasNoObservableOutput();
                             // The stopping gate also supplies the durable reason. An absent
                             // decision means this attempt is allowed to retry.
                             let retry;
-                            if (!(attemptHasNoObservableOutput() ||
-                                idleWatchdogRecovery ||
-                                incompleteStreamRecovery ||
-                                sealedThinkingRecovery)) {
+                            if (!attemptCanReplay()) {
                                 retry = {
                                     decision: 'declined',
                                     because: attemptSawToolActivity ? 'side_effects' : 'observable_output',
@@ -1728,33 +1672,20 @@ export class AiSdkTurn {
                             else if (failure.kind === 'context_overflow') {
                                 retry = { decision: 'declined', because: 'policy' };
                             }
-                            else if (!(failure.retryable || idleWatchdogRecovery || incompleteStreamRecovery)) {
-                                retry =
-                                    incompleteStreamTerminal &&
-                                        incompleteStreamRetryCount >= MAX_INCOMPLETE_STREAM_RETRIES_PER_STEP
-                                        ? { decision: 'exhausted', attempts: providerAttempt }
-                                        : { decision: 'declined', because: 'policy' };
+                            else if (!failure.retryable) {
+                                retry = { decision: 'declined', because: 'policy' };
                             }
                             if (!retry) {
-                                if (idleWatchdogRecovery)
-                                    idleWatchdogRetryCount += 1;
-                                if (sealedThinkingRecovery)
-                                    sealedThinkingRetryCount += 1;
-                                if (incompleteStreamRecovery)
-                                    incompleteStreamRetryCount += 1;
-                                if ((idleWatchdogRecovery || sealedThinkingRecovery) &&
-                                    stepThinkingParts.length > 0) {
-                                    await flushStep();
-                                    currentStepMessageId = this.deps.newId();
-                                }
+                                // Preserve the failed fragment for the transcript, but exclude
+                                // it from model history when a later tool step reloads the ledger.
+                                await flushStep(true);
+                                currentStepMessageId = this.deps.newId();
                                 // The failed request did not return authoritative usage. Keep
                                 // effectiveness recoverable, but fail final metering closed.
                                 sawUnusableStepUsage = true;
                                 const delayMs = providerRetryDelayMs(providerAttempt, failure.retryAfterMs);
                                 const nextAttempt = providerAttempt + 1;
-                                const maxAttempts = idleWatchdogRecovery || incompleteStreamRecovery || sealedThinkingRecovery
-                                    ? nextAttempt
-                                    : MAX_PROVIDER_ATTEMPTS_PER_STEP;
+                                const maxAttempts = MAX_PROVIDER_ATTEMPTS_PER_STEP;
                                 const reason = providerRetryReason(failure.kind);
                                 queue.push({
                                     type: 'provider_retry',
@@ -1769,14 +1700,13 @@ export class AiSdkTurn {
                                     reason,
                                 });
                                 await this.deps.providerRetrySleep(delayMs, turnAbortController.signal);
-                                providerAttempt = nextAttempt;
                                 queue.push({
                                     type: 'provider_retry',
                                     id: this.deps.newId(),
                                     turnId,
                                     ts: this.deps.now(),
                                     phase: 'started',
-                                    attempt: providerAttempt,
+                                    attempt: nextAttempt,
                                     maxAttempts,
                                     reason,
                                 });
@@ -1786,7 +1716,7 @@ export class AiSdkTurn {
                             // safe fold): surface the real provider error via the terminal
                             // handler after settling any authoritative usage — never a
                             // fabricated success.
-                            terminalProviderError = settledWatchdogTimeout?.error ?? failure;
+                            terminalProviderError = failure;
                             terminalRetry = { error: terminalProviderError, retry };
                             terminalProviderErrorReason =
                                 lastCompletedStepHadToolResult && failure.kind === 'timeout'
@@ -1803,10 +1733,7 @@ export class AiSdkTurn {
                     if (this.aborted) {
                         throw Object.assign(new Error('aborted'), { name: 'AbortError' });
                     }
-                    // Catch-all: flush any residual step content if the provider closed the
-                    // stream without a trailing `finish-step` for the last step.
                     const providerStepId = currentStepMessageId;
-                    await flushStep();
                     if (providerOutcome.kind !== 'completed')
                         throw providerOutcome.failure;
                     finishReason = providerOutcome.finishReason;
@@ -2109,11 +2036,11 @@ export class AiSdkTurn {
                 streamStatus = this.aborted ? 'aborted' : 'error';
                 streamErrorClass = this.deps.modelAdapter.classifyError(currentWatchdogTimeout()?.error ?? err);
                 // Flush the in-flight step's partial text/thinking before the terminal
-                // abort/error events. Earlier steps already flushed at their
-                // `finish-step`; this keeps their and this step's streamed-out output on
+                // abort/error events. Earlier steps already flushed at settlement;
+                // this keeps their and this step's streamed-out output on
                 // BOTH exits — user stop and provider error / watchdog timeout — so the
                 // transcript keeps what the user actually saw.
-                await flushStep().catch(() => { });
+                await flushStep(!this.aborted).catch(() => { });
                 if (this.aborted) {
                     queue.push({
                         type: 'abort',