mixdog 0.9.53 → 0.9.55

package/src/runtime/agent/orchestrator/providers/openai-oauth-ws.mjs

@@ -103,8 +103,8 @@ const HANDSHAKE_MAX_ATTEMPTS = MIDSTREAM_WS_TRANSIENT_RETRY_LIMIT + 1;
 const HANDSHAKE_BACKOFF_BASE_MS = 200;
 const HANDSHAKE_BACKOFF_CAP_MS = 3200;
 
-export function _classifyHandshakeError(err) {
-    return classifyHandshakeError(err);
+export function _classifyHandshakeError(err, { retry429 = true } = {}) {
+    return classifyHandshakeError(err, { retry429 });
 }
 
 /**
@@ -518,6 +518,7 @@ export async function _acquireWithRetry({
     _acquire = acquireWebSocket,
     _sleepFn = _defaultSleep,
     maxAttempts = HANDSHAKE_MAX_ATTEMPTS,
+    retry429 = true,
 } = {}) {
     let lastErr = null;
     let lastClassifier = null;
@@ -538,7 +539,7 @@ export async function _acquireWithRetry({
             return await _acquire({ auth, poolKey, cacheKey, codexHeaders, forceFresh, externalSignal });
         } catch (err) {
             lastErr = err;
-            const classifier = _classifyHandshakeError(err);
+            const classifier = _classifyHandshakeError(err, { retry429 });
             lastClassifier = classifier;
             // Permanent (or unknown → default-deny): stop immediately.
             if (!classifier) {
@@ -762,6 +763,9 @@ export async function sendViaWebSocket({
             });
         } catch {}
     };
+    // Only Codex OAuth follows retry_429:false. This shared transport also
+    // backs xAI, whose existing 429 handshake retry behavior must remain.
+    const retry429 = traceProvider !== 'openai-oauth';
 
     for (let attemptIndex = 0; attemptIndex <= MAX_MIDSTREAM_RETRIES; attemptIndex++) {
         const handshakeStart = performance.now();
@@ -783,6 +787,7 @@ export async function sendViaWebSocket({
                 // No nested connect retry budget: the outer stream loop owns
                 // all retries for this logical request.
                 maxAttempts: 1,
+                retry429,
                 onRetry: (info) => {
                     handshakeRetries += 1;
                     sendSpan.handshakeRetries += 1;
@@ -801,7 +806,7 @@ export async function sendViaWebSocket({
             // application error carrying the same HTTP status.
             try { err.wsFailurePhase = 'handshake'; } catch {}
             const classifier = err?.retryClassifier
-                || _classifyHandshakeError(err)
+                || _classifyHandshakeError(err, { retry429 })
                 || (err?.code === 'EWSACQUIRETIMEOUT' ? 'acquire_timeout' : null);
             const classifiers = [...handshakeRetryClassifiers];
             if (classifier && !classifiers.includes(classifier)) classifiers.push(classifier);

package/src/runtime/agent/orchestrator/providers/retry-classifier.mjs

@@ -224,11 +224,35 @@ export function retryAfterMsFromError(err) {
     if (Number.isFinite(n) && n >= 0) return n
   }
   const retryAfter = _headerValue(headers, 'retry-after')
-  if (retryAfter == null || retryAfter === '') return null
-  const seconds = Number(retryAfter)
-  if (Number.isFinite(seconds) && seconds >= 0) return Math.ceil(seconds * 1000)
-  const dateMs = Date.parse(String(retryAfter))
-  if (!Number.isNaN(dateMs)) return Math.max(0, dateMs - Date.now())
+  if (retryAfter != null && retryAfter !== '') {
+    const seconds = Number(retryAfter)
+    if (Number.isFinite(seconds) && seconds >= 0) return Math.ceil(seconds * 1000)
+    const dateMs = Date.parse(String(retryAfter))
+    if (!Number.isNaN(dateMs)) return Math.max(0, dateMs - Date.now())
+  }
+  // Google RPC RetryInfo encodes retryDelay as a protobuf Duration. Preserve
+  // the same precedence as Retry-After: a server-provided retry window means
+  // RESOURCE_EXHAUSTED is request-local, not a permanent quota refusal.
+  const detailLists = [
+    err?.details,
+    err?.error?.details,
+    err?.data?.error?.details,
+  ]
+  for (const details of detailLists) {
+    if (!Array.isArray(details)) continue
+    for (const detail of details) {
+      const delay = detail?.retryDelay
+      if (typeof delay === 'string') {
+        const match = delay.trim().match(/^(\d+(?:\.\d+)?)s$/)
+        if (match) return Math.ceil(Number(match[1]) * 1000)
+      } else if (delay && typeof delay === 'object') {
+        const seconds = Number(delay.seconds || 0)
+        const nanos = Number(delay.nanos || 0)
+        const ms = seconds * 1000 + nanos / 1_000_000
+        if (Number.isFinite(ms) && ms >= 0) return Math.ceil(ms)
+      }
+    }
+  }
   return null
 }
 
@@ -615,15 +639,16 @@ function _sleepChunkWithAbort(ms, signal, sleepFn, abortMessage) {
 
 // E) Handshake classifier (moved here from openai-oauth-ws). Default-deny:
 //    anything not recognized as transient returns null. HTTP 401 is reserved
-//    for auth recovery and 426 for immediate HTTPS fallback; every other HTTP
-//    handshake status follows Codex's retryable UnexpectedStatus policy.
-export function classifyHandshakeError(err) {
+//    for auth recovery and 426 for immediate HTTPS fallback. The OpenAI OAuth
+//    caller opts out of 429 retries (Codex retry_429:false); all other callers
+//    retain the historical retryable UnexpectedStatus policy.
+export function classifyHandshakeError(err, { retry429 = true } = {}) {
   if (!err) return null
   const code = err.code || ''
   const msg = String(err.message || '')
   const status = Number(err.httpStatus || 0)
 
-  if (status === 401 || status === 426) return null
+  if (status === 401 || status === 426 || (status === 429 && !retry429)) return null
   if (status > 0) {
     return `http_${status}`
   }
@@ -729,6 +754,20 @@ export async function withRetry(fn, opts = {}) {
         'x-should-retry',
       )
       if (String(shouldRetryHeader || '').toLowerCase() === 'false') throw caught
+      // Anthropic's non-standard positive override outranks ordinary status
+      // classification. Keep subscription OAuth 429 fail-fast ownership:
+      // retry429:false is the Max/Pro gate and must not wait for that window.
+      if (opts.provider === 'anthropic'
+        && String(shouldRetryHeader || '').toLowerCase() === 'true'
+        && !(status === 429 && opts.retry429 === false)) {
+        if (attempt === maxAttempts - 1) throw caught
+        const retryAfterMs = retryAfterMsFromError(caught)
+        if (retryAfterMs != null) {
+          nextDelayMs = Math.max(0, retryAfterMs)
+          nextDelayReason = 'retry-after'
+        }
+        continue
+      }
       // Claude Code's optional model fallback fires on the third 529. This
       // remains opt-in: providers pass fallbackModel only when the caller set
       // one. The hard progress veto above must run first so fallback can never
@@ -740,15 +779,16 @@ export async function withRetry(fn, opts = {}) {
         }
       }
       if (status === 429) {
+        if (opts.retry429 === false) throw caught
+        const ra = retryAfterMsFromError(caught)
         // A deterministic quota refusal cannot recover by replaying the same
-        // request. This check must precede generic HTTP 429 handling so shared
-        // OpenAI-compatible/Gemini message-only quota errors remain terminal.
-        if (isPermanentQuotaError(caught)) throw caught
+        // request. An explicit server retry window outranks message-text quota
+        // heuristics: RESOURCE_EXHAUSTED + Retry-After/RetryInfo is transient.
+        if (ra == null && isPermanentQuotaError(caught)) throw caught
         // Retry only this request. Admission concurrency is fixed and is never
         // reduced by rate limits. Respect Retry-After when present; otherwise
         // use the ordinary jittered backoff. Output/tool stamps above remain a
         // hard replay boundary.
-        const ra = retryAfterMsFromError(caught)
         if (attempt === maxAttempts - 1) throw caught
         if (ra != null) {
           nextDelayMs = Math.max(0, ra)

package/src/runtime/agent/orchestrator/session/manager/ask-session.mjs

@@ -6,7 +6,7 @@
 import { createHash } from 'crypto';
 import { getProvider } from '../../providers/registry.mjs';
 import { normalizeCompactType, DEFAULT_COMPACT_TYPE } from '../compact.mjs';
-import { loadSession, saveSessionAsync } from '../store.mjs';
+import { loadSession, saveSessionAsync, saveSessionAsyncDeferred } from '../store.mjs';
 import { createAbortController } from '../../../../shared/abort-controller.mjs';
 import { logLlmCall } from '../../../../shared/llm/usage-log.mjs';
 import { appendAgentTrace } from '../../agent-trace.mjs';
@@ -23,7 +23,15 @@ import {
     buildSessionStartBlock,
     hasUserConversationMessage,
 } from './prompt-utils.mjs';
-import { _mergePendingMessageEntries, drainPendingMessages } from './pending-messages.mjs';
+import {
+    _mergePendingMessageEntries,
+    acknowledgePendingMessages,
+    finalizePendingMessageDelivery,
+    drainPendingMessages,
+    hydratePendingMessages,
+    recordPendingMessageDelivery,
+    releasePendingMessages,
+} from './pending-messages.mjs';
 import { persistIterationMetrics, applyAskTerminalUsageTotals } from './usage-metrics.mjs';
 import {
     updateSessionStage,
@@ -102,6 +110,9 @@ export async function askSession(sessionId, prompt, context, onToolCall, cwdOver
         process.stderr.write(`[agent-trace] t0-ask-start sessionHash=${createHash('sha256').update(String(sessionId)).digest('hex').slice(0, 8)} role=? iteration=0 promptSrc=${_promptSrc} prefetchFiles=${_prefetchFiles} callers=${_prefetchCallers} references=${_prefetchRefs}\n`);
     }
     const unlock = await acquireSessionLock(sessionId);
+    // Start crash-spool hydration without delaying the user turn. A completed
+    // background hydration joins the id-deduped memory drain below.
+    const takeoverHydration = hydratePendingMessages(sessionId);
     const _lockWaitedMs = Date.now() - _askStartedAt;
     if (process.env.MIXDOG_DEBUG_AGENT) {
         process.stderr.write(`[agent-trace] lock-acquired waitedMs=${_lockWaitedMs}\n`);
@@ -126,11 +137,14 @@ export async function askSession(sessionId, prompt, context, onToolCall, cwdOver
       // preserved and the spawn/connecting startup race disappears.
       for (;;) {
         let _pwstTurnDrained = null;
+        let _turnPendingEntries = [];
         // After the first turn, the next prompt comes from the drained queue.
         // (On the first iteration _pendingTail is empty and `prompt` is the
         // caller's original message.)
         if (_pendingTail.length > 0) {
-            prompt = _pendingTail.shift();
+            const pendingTurn = _pendingTail.shift();
+            prompt = pendingTurn.content;
+            _turnPendingEntries = pendingTurn.entries;
             // Queued follow-ups are plain user turns — no caller context /
             // prefetch is re-applied (those belonged to the original ask).
             context = null;
@@ -144,12 +158,19 @@ export async function askSession(sessionId, prompt, context, onToolCall, cwdOver
                 const _mergedPre = _mergePendingMessageEntries(_preDrained);
                 if (_mergedPre?.content) {
                     prompt = _mergedPre.content;
+                    _turnPendingEntries = _preDrained;
                     context = null;
                     explicitPrefetch = null;
                 }
             }
         }
         if (!hasModelVisiblePromptContent(prompt)) {
+            void takeoverHydration.then((count) => {
+                if (count <= 0) return;
+                setImmediate(() => {
+                    askSession(sessionId, '', null, onToolCall, cwdOverride, null, askOpts).catch(() => {});
+                });
+            });
             _unlinkParentAbortListener(_getRuntimeEntry(sessionId));
             return _result;
         }
@@ -334,6 +355,22 @@ export async function askSession(sessionId, prompt, context, onToolCall, cwdOver
                 _turnInterruption.recordTextDelta(chunk);
                 if (typeof askOpts?.onTextDelta === 'function') askOpts.onTextDelta(chunk);
             };
+            const _trackTextReset = async (detail) => {
+                // Replacement is opt-in and transactional: a delta-only
+                // consumer cannot retract already exposed bytes, so absence,
+                // false, or rejection must preserve the original partial and
+                // force the provider's terminal no-replay behavior.
+                if (typeof askOpts?.onTextReset !== 'function') return false;
+                let acknowledged = false;
+                try {
+                    acknowledged = await askOpts.onTextReset(detail) === true;
+                } catch {
+                    return false;
+                }
+                if (!acknowledged) return false;
+                _turnInterruption.tombstoneText(detail?.chars);
+                return true;
+            };
             const _trackReasoningDelta = (chunk) => {
                 _turnInterruption.recordReasoningDelta(chunk);
                 if (typeof askOpts?.onReasoningDelta === 'function') askOpts.onReasoningDelta(chunk);
@@ -363,6 +400,7 @@ export async function askSession(sessionId, prompt, context, onToolCall, cwdOver
                     fast: session.fast === true,
                     sessionId,
                     onTextDelta: _trackTextDelta,
+                    onTextReset: _trackTextReset,
                     onReasoningDelta: _trackReasoningDelta,
                     onAssistantText: _trackAssistantText,
                     onAssistantMessageCommitted: () => _turnInterruption.markAssistantMessageCommitted(),
@@ -625,8 +663,14 @@ export async function askSession(sessionId, prompt, context, onToolCall, cwdOver
                 trimmed: messagesDropped > 0,
                 messagesDropped,
             };
+            // The provider accepted this queued turn: only now remove its
+            // durable ids. A crash before here leaves them for at-least-once
+            // replay; duplicate memory/spool copies share the same id.
+            recordPendingMessageDelivery(session, _turnPendingEntries);
             _pwstTurnDrained = drainPendingMessages(sessionId);
+            let terminalRelayed = false;
             if (_pwstTurnDrained.length === 0 && typeof askOpts?.onTerminalResult === 'function') {
+                terminalRelayed = true;
                 try {
                     askOpts.onTerminalResult(terminalResultPreview, {
                         sessionId,
@@ -640,16 +684,24 @@ export async function askSession(sessionId, prompt, context, onToolCall, cwdOver
             // answer. This lets queued follow-up prompts resume immediately;
             // if they need compaction, their own spinner shows compacting first.
             // Fire-and-forget terminal save. The result is already produced and
-            // (for agent surfaces) relayed via onTerminalResult above, and
-            // saveSessionAsync() has already published the in-memory snapshot via
-            // setLiveSession(), so read-your-writes holds in-process without
-            // awaiting disk. Never block the terminal unwind on the write — that
-            // would strand the owning background task in `running` and suppress
-            // its completion notification. A slow write finishes in the
-            // background.
-            saveSessionAsync(session, { expectedGeneration: askGeneration }).catch((err) => {
-                try { process.stderr.write(`[session] terminal save failed: ${err?.message || err}\n`); } catch {}
+            // (for agent surfaces) relayed via onTerminalResult above. When
+            // completion was relayed to the UI, yield before postMessage
+            // structured-clones the full session. Queued follow-up turns retain
+            // the original immediate-save ordering; they did not inject a
+            // terminal card and may mutate this same session on the next loop.
+            const saveTerminalSession = terminalRelayed
+                ? saveSessionAsyncDeferred
+                : saveSessionAsync;
+            const terminalSave = saveTerminalSession(session, { expectedGeneration: askGeneration });
+            finalizePendingMessageDelivery(
+                session,
+                _turnPendingEntries,
+                terminalSave,
+                () => saveSessionAsync(session, { expectedGeneration: askGeneration }),
+            ).catch((err) => {
+                    try { process.stderr.write(`[session] terminal save failed: ${err?.message || err}\n`); } catch {}
             });
+            _turnPendingEntries = [];
             activeSession = session;
             runtime.session = session;
             // Tag empty-synthesis BEFORE markSessionDone so the watchdog
@@ -666,6 +718,11 @@ export async function askSession(sessionId, prompt, context, onToolCall, cwdOver
             // live-turn alias so contextStatus() stops estimating from the
             // stale in-flight array once the turn unwinds.
             if (activeSession) activeSession.liveTurnMessages = null;
+            // Restore before ANY finalization path. In particular, cancellation
+            // can race the acknowledged non-streaming restart and surface as a
+            // SessionClosedError; its interruption snapshot must include the
+            // one partial response that was already exposed.
+            const restoredResetText = _turnInterruption.restoreTombstonedText();
             if (err instanceof SessionClosedError) {
                 const currentRuntime = _getRuntimeEntry(sessionId);
                 if (!currentRuntime?.closed) {
@@ -677,8 +734,10 @@ export async function askSession(sessionId, prompt, context, onToolCall, cwdOver
                         });
                         activeSession.messages = finalized.messages;
                         if (!finalized.responsePreserved) {
+                            releasePendingMessages(sessionId, _turnPendingEntries);
                             activeSession.sessionStartMetaInjected = _sessionStartMetaInjectedBeforeTurn;
                         } else {
+                            recordPendingMessageDelivery(activeSession, _turnPendingEntries);
                             // The opaque provider continuation now points at a
                             // request that ended mid-turn. Force full transcript
                             // replay on the next send instead of reusing it.
@@ -687,23 +746,77 @@ export async function askSession(sessionId, prompt, context, onToolCall, cwdOver
                         activeSession.updatedAt = Date.now();
                         activeSession.lastUsedAt = Date.now();
                         try {
-                            await saveSessionAsync(activeSession, { expectedGeneration: askGeneration });
+                            const durableSave = saveSessionAsync(activeSession, { expectedGeneration: askGeneration });
+                            if (finalized.responsePreserved) {
+                                await finalizePendingMessageDelivery(
+                                    activeSession, _turnPendingEntries, durableSave,
+                                    () => saveSessionAsync(activeSession, { expectedGeneration: askGeneration }),
+                                );
+                            } else {
+                                await durableSave;
+                            }
                         } catch { /* cancellation cleanup is best-effort */ }
                         if (currentRuntime) currentRuntime.session = activeSession;
-                    }
+                    } else releasePendingMessages(sessionId, _turnPendingEntries);
                     markSessionCancelled(sessionId);
-                }
+                } else releasePendingMessages(sessionId, _turnPendingEntries);
                 // Cancellation is not an error; propagate silently so callers
                 // can render it as "cancelled" rather than a red failure.
                 throw err;
             }
-            await persistCompactedOutgoingAfterAskFailure({
-                sessionId,
-                activeSession,
-                askGeneration,
-                turnOutgoing: _turnOutgoing,
-                error: err,
-            });
+            // A reset acknowledgement removes the live partial before the
+            // non-streaming request starts. If that restart fails, restore the
+            // tombstone and persist the one exposed partial as interruption
+            // history. Failed/absent acknowledgements never tombstoned it.
+            const preserveProviderPartial = restoredResetText
+                || err?.liveTextEmitted === true
+                || err?.unsafeToRetry === true;
+            if (preserveProviderPartial && activeSession && _turnInterruption.hasResponseStarted()) {
+                const finalized = _turnInterruption.finalize({
+                    turnOutgoing: _turnOutgoing || activeSession.messages,
+                    currentUserContent: cancelledUserTurnContent,
+                    abortReason: 'provider-error',
+                });
+                activeSession.messages = finalized.messages;
+                if (finalized.responsePreserved) recordPendingMessageDelivery(activeSession, _turnPendingEntries);
+                else releasePendingMessages(sessionId, _turnPendingEntries);
+                activeSession.providerState = undefined;
+                activeSession.updatedAt = Date.now();
+                activeSession.lastUsedAt = Date.now();
+                try {
+                    const durableSave = saveSessionAsync(activeSession, { expectedGeneration: askGeneration });
+                    if (finalized.responsePreserved) {
+                        await finalizePendingMessageDelivery(
+                            activeSession, _turnPendingEntries, durableSave,
+                            () => saveSessionAsync(activeSession, { expectedGeneration: askGeneration }),
+                        );
+                    } else {
+                        await durableSave;
+                    }
+                } catch { /* provider-failure history persistence is best-effort */ }
+                const currentRuntime = _getRuntimeEntry(sessionId);
+                if (currentRuntime) currentRuntime.session = activeSession;
+            } else {
+                const promptPersisted = await persistCompactedOutgoingAfterAskFailure({
+                    sessionId,
+                    activeSession,
+                    askGeneration,
+                    turnOutgoing: _turnOutgoing,
+                    error: err,
+                });
+                if (promptPersisted) {
+                    recordPendingMessageDelivery(activeSession, _turnPendingEntries);
+                    try {
+                        const durableSave = saveSessionAsync(activeSession, { expectedGeneration: askGeneration });
+                        await finalizePendingMessageDelivery(
+                            activeSession, _turnPendingEntries, durableSave,
+                            () => saveSessionAsync(activeSession, { expectedGeneration: askGeneration }),
+                        );
+                    } catch {}
+                } else {
+                    releasePendingMessages(sessionId, _turnPendingEntries);
+                }
+            }
             markSessionError(sessionId, err && err.message ? err.message : String(err));
             throw err;
         }
@@ -724,7 +837,7 @@ export async function askSession(sessionId, prompt, context, onToolCall, cwdOver
             // drain enqueues for the next loop pass and is merged there.
             const _mergedTail = _mergePendingMessageEntries(_drained);
             if (_mergedTail?.content) {
-                _pendingTail.push(_mergedTail.content);
+                _pendingTail.push({ content: _mergedTail.content, entries: _drained });
                 // Carry the just-committed in-memory session into the follow-up
                 // turn so the queued tail sees the preceding assistant/tool
                 // context. loadSession() would return this same live snapshot
@@ -736,6 +849,15 @@ export async function askSession(sessionId, prompt, context, onToolCall, cwdOver
             }
         }
         _unlinkParentAbortListener(_getRuntimeEntry(sessionId));
+        // Pick up cross-process sends that landed after takeover hydration.
+        // This never delays completion; a non-empty sweep starts an empty
+        // follow-up ask after the current session lock is released.
+        setImmediate(() => {
+            hydratePendingMessages(sessionId).then((count) => {
+                if (count <= 0) return;
+                askSession(sessionId, '', null, onToolCall, cwdOverride, null, askOpts).catch(() => {});
+            }).catch(() => {});
+        });
         return _result;
       }
     } finally {

package/src/runtime/agent/orchestrator/session/manager/message-sanitize.mjs

@@ -55,6 +55,20 @@ function sessionMessagesAdvancedBeyondCompactedOutgoing(currentSanitized, compac
     return isCompactedOutgoingFinalAssistantMessage(currentSanitized[currentSanitized.length - 1]);
 }
 
+function messageSnapshotPresent(messages, wanted) {
+    if (!wanted || !Array.isArray(messages)) return false;
+    return messages.some((message) => {
+        if (message === wanted) return true;
+        try { return JSON.stringify(message) === JSON.stringify(wanted); } catch { return false; }
+    });
+}
+
+export function compactedOutgoingPromptRetained(activeMessages, outgoingMessages) {
+    const outgoing = filterModelVisibleSessionMessages(outgoingMessages);
+    const prompt = [...outgoing].reverse().find((message) => message?.role === 'user');
+    return Boolean(prompt) && messageSnapshotPresent(filterModelVisibleSessionMessages(activeMessages), prompt);
+}
+
 export const _sessionMessagesAdvancedBeyondCompactedOutgoing = sessionMessagesAdvancedBeyondCompactedOutgoing;
 
 function applyCompactFailurePersistToSession(activeSession, {
@@ -100,24 +114,26 @@ export async function persistCompactedOutgoingAfterAskFailure({
     turnOutgoing,
     error = null,
 }) {
-    if (!activeSession || activeSession.closed === true) return;
-    if (!Array.isArray(turnOutgoing) || turnOutgoing.length === 0) return;
+    if (!activeSession || activeSession.closed === true) return false;
+    if (!Array.isArray(turnOutgoing) || turnOutgoing.length === 0) return false;
     const currentRuntime = _getRuntimeEntry(sessionId);
-    if (currentRuntime?.closed || currentRuntime?.generation !== askGeneration) return;
+    if (currentRuntime?.closed || currentRuntime?.generation !== askGeneration) return false;
     const sanitized = filterModelVisibleSessionMessages(turnOutgoing);
     const priorSanitized = filterModelVisibleSessionMessages(
         Array.isArray(activeSession.messages) ? activeSession.messages : [],
     );
     const messagesAdvanced = sessionMessagesAdvancedBeyondCompactedOutgoing(priorSanitized, sanitized);
+    const promptRetainedBefore = compactedOutgoingPromptRetained(priorSanitized, sanitized);
     const applied = applyCompactFailurePersistToSession(activeSession, {
         priorSanitized,
         sanitized,
         messagesAdvanced,
         error,
     });
-    if (!applied) return;
+    if (!applied) return promptRetainedBefore;
     try {
         await saveSessionAsync(activeSession, { expectedGeneration: askGeneration });
     } catch { /* best-effort: preserve in-memory compaction even if disk is slow */ }
     if (currentRuntime) currentRuntime.session = activeSession;
+    return compactedOutgoingPromptRetained(activeSession.messages, sanitized);
 }