mixdog 0.9.87 → 0.9.88

package/src/runtime/agent/orchestrator/session/lifecycle-scan.mjs

@@ -1,66 +1,82 @@
 /**
- * Cheap, bounded top-level-only scan for the `closed`/`generation`
- * lifecycle fields in a serialized session JSON document — a substitute
- * for JSON.parse on the session-store save-guard hot path.
+ * Authoritative top-level lifecycle read (`id` / `closed` / `generation`) for
+ * a serialized session JSON document.
  *
- * Why not JSON.parse: `generation` is a top-level field on every persisted
- * session (added by _ensureLifecycleFields on first save), so a raw
- * substring pre-check (`raw.includes('"generation"')`) is true for nearly
- * every guarded write — paying full-parse-and-allocate cost (building the
- * entire messages array, unescaping every string) on the hot path even
- * though only two scalar fields are ever consulted.
+ * ONE verdict, no fallbacks. Every caller of this module makes a destructive
+ * or ownership-deciding choice (drop a save, delete a file, close a session,
+ * deliver cross-process input), so the module answers with exactly two
+ * outcomes:
  *
- * Why not a regex-only check: a stored message body can itself contain the
- * literal text `{"closed":true}` (a tool result, a pasted JSON blob, an
- * assistant-authored snippet) inside `messages[i].content`. A substring or
- * naively-anchored regex cannot tell that occurrence apart from the real
- * top-level lifecycle field, so it is spoofable. This scanner walks the raw
- * text as a real (bracket-depth + string-escape aware) tokenizer, but only
- * *interprets* key/value pairs at depth 1 (directly inside the root
- * object); every nested object/array/string value — including the entire
- * `messages` array — is skipped by depth counting alone, never allocated
- * or parsed. That keeps it both spoof-proof (nested `"closed"` can never be
- * mistaken for the top-level one) and cheap (no JS object/array/string
- * allocation for content we don't care about).
+ *   • a lifecycle record — the document is a single, complete, well-formed
+ *     JSON object whose top-level lifecycle fields are unambiguous;
+ *   • LIFECYCLE_SCAN_CONFLICT — "unreadable": ANY doubt at all.
  *
- * Returns `{ closed, generation }` (either key absent if the field wasn't
- * present at depth 1) or `null` if `raw` is not a well-formed top-level
- * JSON object (caller should treat that the same as a parse failure).
+ * There is deliberately no third "couldn't tell, parse it yourself" state.
+ * The previous incarnation was a hand-rolled depth-1 tokenizer that returned
+ * `null` for everything it did not positively confirm and let each caller
+ * fall back to `JSON.parse` — which silently resolves duplicate keys
+ * LAST-WINS, so a record like `{"id":"mine",…,"id":"other"}` (or a malformed
+ * separator the scanner refused) was accepted as this session's own state by
+ * the very code paths the scanner existed to protect. The fallback WAS the
+ * vulnerability. It is gone.
  *
- * Scope contract: this is not a general JSON validator. `raw` is always our
- * own JSON.stringify output (or truncated/concatenated fragments thereof
- * from partial writes) — never hand-authored or third-party JSON. It is
- * only responsible for detecting the failure modes a writer like ours can
- * actually produce: mid-write truncation, nested-field spoofing, mismatched
- * brackets, and trailing garbage from a botched/partial write. It does NOT
- * validate separator-level well-formedness (missing/trailing commas,
- * missing colons beyond the one check above, etc.) since JSON.stringify
- * cannot emit those — a well-formed prefix is assumed between structural
- * checks. Anything the scanner doesn't positively confirm returns `null`,
- * and the caller falls back to `JSON.parse` for the definitive answer.
+ * Strategy (simplification over more parser patches):
+ *   1. strict full `JSON.parse` — the only validator. It rejects truncation,
+ *      missing/trailing commas, missing colons, trailing garbage after the
+ *      root object, and any non-object root, with no bespoke grammar of ours
+ *      to get subtly wrong;
+ *   2. an explicit top-level duplicate-key walk, because `JSON.parse` alone
+ *      is last-wins and cannot report that a key appeared twice. ANY repeated
+ *      top-level key is a conflict — not just the lifecycle three: consumers
+ *      of this record RESERIALIZE it (the tombstone/detach barriers rewrite
+ *      the whole document) and ACT on other top-level fields (`status`,
+ *      `updatedAt`, `owner`, `messages` drive sweep maturity, blank-scratch
+ *      reaping and transcript reads), so a last-wins `status`/`updatedAt`
+ *      would silently decide a delete or a rewrite. The walk runs on a
+ *      document ALREADY proven well-formed by step 1, so it only counts
+ *      depth-1 keys (skipping nested objects/arrays/strings by bracket
+ *      depth) and never has to double as a validator;
+ *   3. type validation of the three lifecycle fields. Our writer only ever
+ *      emits a non-empty string `id`, a boolean `closed` and a numeric
+ *      `generation`; anything else present under those names is not a record
+ *      we can speak for → unreadable.
+ *
+ * Duplicate detection is type- and order-independent by construction: the
+ * walk counts key OCCURRENCES before any value is interpreted, so
+ * `{"id":7,"id":"sess_a"}` (non-string first) and `{"closed":false,
+ * "closed":true}` conflict exactly like the string-first case.
+ *
+ * NESTED duplicates stay compatible on purpose: a duplicate key inside
+ * `messages[i].content` (a pasted JSON blob, a tool result) is message DATA.
+ * It is skipped by bracket depth, is never an ownership or action input, and
+ * the whole nested value is reserialized verbatim by JSON.stringify from the
+ * parsed document — the last-wins resolution there cannot move a lifecycle,
+ * sweep or delete decision.
+ *
+ * The parsed document is returned alongside the lifecycle fields (`doc`) so
+ * consumers that need the whole record (the sweep reads owner/status/
+ * timestamps/messages) reuse THIS parse instead of parsing again — a second
+ * parse would be both slower and a second, divergent authority.
  */
 
-function isWs(ch) {
-    return ch === ' ' || ch === '\t' || ch === '\n' || ch === '\r';
+// Single authoritative rejection marker: ambiguous OR malformed OR
+// wrong-typed. Frozen and deliberately carrying no `id`/`closed`/`generation`
+// so a lenient consumer that forgets the check still reads nothing usable.
+export const LIFECYCLE_SCAN_CONFLICT = Object.freeze({ conflict: 'unreadable' });
+
+/** True for the rejection marker (and for anything that isn't a record). */
+export function isLifecycleUnreadable(result) {
+    return !result || typeof result !== 'object' || result.conflict !== undefined;
 }
 
-// True iff raw[i..] is nothing but whitespace to EOF. Enforces the "single
-// complete root JSON object" contract: trailing garbage after the root `}`
-// (e.g. a concatenated second document, or corruption) must not be silently
-// accepted as if `raw` were exactly one well-formed object.
-function isTrailingWhitespaceOnly(raw, i) {
-    const len = raw.length;
-    while (i < len) {
-        if (!isWs(raw[i])) return false;
-        i++;
-    }
-    return true;
+function isWs(ch) {
+    return ch === ' ' || ch === '\t' || ch === '\n' || ch === '\r';
 }
 
 // Advances past a JSON string literal starting at raw[i] === '"'.
-// Escape handling only needs to skip exactly one char after each `\` —
-// even for `\u0041`-style escapes, the trailing hex digits can never be
-// `"` or `\`, so a naive 2-char skip never misses the real closing quote.
+// Escape handling only needs to skip exactly one char after each `\` — even
+// for `\u0041`-style escapes the trailing hex digits can never be `"` or `\`,
+// so a naive 2-char skip never misses the real closing quote.
 function skipString(raw, i) {
     const len = raw.length;
     i++; // opening quote
@@ -73,11 +89,8 @@ function skipString(raw, i) {
     return i;
 }
 
-// Advances past one JSON value (string/object/array/number/true/false/null)
-// starting at raw[i]. Objects/arrays are skipped via universal bracket-depth
-// counting (any `{`/`[` opens, any `}`/`]` closes) with string-awareness so
-// braces inside string content never perturb the count — never descends
-// into the structure to interpret its keys.
+// Advances past one JSON value. Objects/arrays are skipped by string-aware
+// bracket-depth counting — never descended into, never allocated.
 function skipValue(raw, i) {
     const len = raw.length;
     const c = raw[i];
@@ -99,79 +112,96 @@ function skipValue(raw, i) {
     return i;
 }
 
-export function scanTopLevelLifecycle(raw) {
+/**
+ * True when EVERY depth-1 key occurs exactly once.
+ *
+ * PRECONDITION: `raw` already parsed cleanly as a JSON object (see
+ * readTopLevelLifecycleRecord). That is what lets this be a counter rather
+ * than a validator: separator/grammar correctness was already decided by
+ * JSON.parse. Returns false on ANY repeated top-level key, or when the walk
+ * cannot complete (which cannot happen for a well-formed document — treated
+ * as unreadable rather than assumed unique).
+ */
+function hasUniqueTopLevelKeys(raw) {
+    // A Set (not an object) so a document key named `constructor`/`__proto__`
+    // is counted as data, never as an inherited property.
+    const seen = new Set();
     const len = raw.length;
     let i = 0;
     while (i < len && isWs(raw[i])) i++;
-    if (raw[i] !== '{') return null;
+    if (raw[i] !== '{') return false;
     i++;
-    const result = {};
-    let found = 0;
     while (i < len) {
         while (i < len && isWs(raw[i])) i++;
-        if (i >= len) return null;
-        if (raw[i] === '}') {
-            i++;
-            return isTrailingWhitespaceOnly(raw, i) ? result : null;
-        }
+        if (i >= len) return false;
+        if (raw[i] === '}') return true;
         if (raw[i] === ',') { i++; continue; }
-        if (raw[i] !== '"') return null;
+        if (raw[i] !== '"') return false;
         const keyStart = i;
         i = skipString(raw, i);
         let key;
-        try { key = JSON.parse(raw.slice(keyStart, i)); } catch { return null; }
+        try { key = JSON.parse(raw.slice(keyStart, i)); } catch { return false; }
         while (i < len && isWs(raw[i])) i++;
-        if (raw[i] !== ':') return null;
+        if (raw[i] !== ':') return false;
         i++;
         while (i < len && isWs(raw[i])) i++;
-        if (i >= len) return null;
-        if (key === 'closed' || key === 'generation') {
-            const valStart = i;
-            i = skipValue(raw, i);
-            try { result[key] = JSON.parse(raw.slice(valStart, i)); } catch { return null; }
-            found++;
-            // Both lifecycle fields resolved. We no longer need to interpret
-            // further keys, but we MUST still confirm the root object is not
-            // truncated (e.g. a session file cut off mid-write as
-            // `{"closed":true,"generation":1,"messages":[`) before trusting
-            // `result` — otherwise a truncated-but-field-bearing prefix would
-            // be treated as well-formed. Finish with a cheap depth-only walk
-            // (no key/value JSON.parse) to the matching close of the root
-            // object; only return `result` once that close is actually
-            // reached before EOF.
-            if (found === 2) {
-                // Track exact bracket types (not just depth) so a mismatched
-                // pair anywhere — including the root itself, e.g. malformed
-                // `{"closed":true,"generation":1]` closing the root object
-                // with `]` instead of `}` — is rejected rather than silently
-                // accepted because *a* bracket happened to bring the count to
-                // zero. `stack[0]` is always '}' (the root object we opened
-                // at function entry); the walk must consume exactly that to
-                // finish, and any closer that doesn't match the innermost
-                // opener is a structural error.
-                const stack = ['}'];
-                while (i < len) {
-                    const ch = raw[i];
-                    if (ch === '"') { i = skipString(raw, i); continue; }
-                    if (ch === '{') { stack.push('}'); i++; continue; }
-                    if (ch === '[') { stack.push(']'); i++; continue; }
-                    if (ch === '}' || ch === ']') {
-                        if (stack.pop() !== ch) return null; // mismatched bracket pair
-                        i++;
-                        if (stack.length === 0) {
-                            // Root object closed with '}' — only trust it if
-                            // nothing but whitespace follows to EOF.
-                            return isTrailingWhitespaceOnly(raw, i) ? result : null;
-                        }
-                        continue;
-                    }
-                    i++;
-                }
-                return null; // ran off the end (or hit EOF) before the root object closed: truncated
-            }
-        } else {
-            i = skipValue(raw, i);
-        }
+        if (i >= len) return false;
+        // Recorded BEFORE the value is looked at, so a duplicate is detected
+        // regardless of the value types or which copy comes first.
+        if (seen.has(key)) return false;
+        seen.add(key);
+        i = skipValue(raw, i);
+    }
+    return false;
+}
+
+/**
+ * Read `raw` as a session record.
+ * Returns LIFECYCLE_SCAN_CONFLICT (unreadable) or
+ * `{ doc, id, closed, generation }` where each lifecycle field is `undefined`
+ * when the document simply does not carry it (legacy records predate them).
+ */
+export function readTopLevelLifecycleRecord(raw) {
+    if (typeof raw !== 'string') return LIFECYCLE_SCAN_CONFLICT;
+    let doc;
+    // Strict and complete: trailing bytes, truncation, missing/trailing
+    // commas and every other separator fault are rejected here.
+    try { doc = JSON.parse(raw); } catch { return LIFECYCLE_SCAN_CONFLICT; }
+    if (!doc || typeof doc !== 'object' || Array.isArray(doc)) return LIFECYCLE_SCAN_CONFLICT;
+    // JSON.parse is last-wins for duplicate keys; this is where that is caught
+    // — for EVERY top-level key, since consumers reserialize and act on the
+    // whole record, not only on the lifecycle three.
+    if (!hasUniqueTopLevelKeys(raw)) return LIFECYCLE_SCAN_CONFLICT;
+    const has = (key) => Object.prototype.hasOwnProperty.call(doc, key);
+    const record = { doc, id: undefined, closed: undefined, generation: undefined };
+    if (has('id')) {
+        // Identity we cannot positively confirm is worse than no identity: a
+        // consumer must not read an empty/non-string id as "probably ours".
+        if (typeof doc.id !== 'string' || !doc.id) return LIFECYCLE_SCAN_CONFLICT;
+        record.id = doc.id;
     }
-    return null; // ran off the end without a closing '}': malformed/truncated
+    if (has('closed')) {
+        if (typeof doc.closed !== 'boolean') return LIFECYCLE_SCAN_CONFLICT;
+        record.closed = doc.closed;
+    }
+    if (has('generation')) {
+        if (typeof doc.generation !== 'number' || !Number.isFinite(doc.generation)) return LIFECYCLE_SCAN_CONFLICT;
+        record.generation = doc.generation;
+    }
+    return record;
+}
+
+/**
+ * Lifecycle fields only (no parsed document) for callers that consult nothing
+ * else. Same two outcomes: the fields present at top level, or
+ * LIFECYCLE_SCAN_CONFLICT.
+ */
+export function scanTopLevelLifecycle(raw) {
+    const record = readTopLevelLifecycleRecord(raw);
+    if (isLifecycleUnreadable(record)) return LIFECYCLE_SCAN_CONFLICT;
+    const out = {};
+    if (record.id !== undefined) out.id = record.id;
+    if (record.closed !== undefined) out.closed = record.closed;
+    if (record.generation !== undefined) out.generation = record.generation;
+    return out;
 }

package/src/runtime/agent/orchestrator/session/loop/stop-hooks.mjs

@@ -0,0 +1,88 @@
+// Codex-style turn stop hook (refs/codex core/src/session/turn.rs:372-404).
+//
+// Codex semantics: a sampling request that needs no follow-up ends the turn.
+// Before breaking, the turn runs its stop hooks; a hook may block ONCE by
+// returning continuation fragments, which are recorded as a prompt message
+// before sampling resumes (`stop_hook_active = true`, never cleared inside the
+// turn). Nothing else can force another turn: no mandatory terminal tool, no
+// completion strikes, no lexical inspection of the assistant text.
+//
+// The single hook implemented here preserves the original failed-apply_patch
+// protection: while a real tool failure is unresolved, the first terminal
+// assistant message is blocked once with a structural continuation prompt.
+// Afterwards ordinary final text (or further tool calls) is accepted.
+
+export const STOP_HOOK_SOURCE = 'tool-failure-stop-hook';
+
+// Only a genuinely EXECUTED result resolves a failure, i.e. kind 'normal'.
+// Cache hits ('cache-hit' / 'scoped-cache-hit') replay an earlier result
+// without running anything, and dedup/guard skips ('skipped') execute nothing
+// either, so both are neutral: they neither arm nor clear the hook.
+const EXECUTED_SUCCESS_TOOL_KINDS = new Set(['normal']);
+
+function bareToolName(name) {
+    const raw = String(name || '');
+    return raw.startsWith('mcp__') ? raw.split('__').pop() : raw;
+}
+
+export function toolFailureContinuationPrompt(failedTool) {
+    const which = failedTool ? `\`${failedTool}\`` : 'a tool call';
+    return `[mixdog-runtime] Stop hook: ${which} failed and no tool call has succeeded since.`
+        + ' Re-run the fixed action (or a verifying tool) if it is recoverable; otherwise say in your'
+        + ' final message that it stays unresolved and why. This hook fires once — your next message ends the turn.';
+}
+
+/**
+ * Structural unresolved-tool-failure stop hook.
+ *  - observeToolResult(message) / endBatch(calls): a batch containing any
+ *    failed tool result arms it; a later batch with a genuinely executed
+ *    success clears it.
+ *  - takeContinuationPrompt(): returns the continuation prompt the FIRST time
+ *    a terminal assistant message arrives while a failure is unresolved, then
+ *    stays silent for the rest of the turn (Codex `stop_hook_active`).
+ */
+export function createToolFailureStopHook() {
+    let unresolvedFailure = false;
+    let lastFailedTool = null;
+    let batchFailure = false;
+    let batchSuccess = false;
+    let failedCallIds = new Set();
+    let active = false;
+    return {
+        get unresolvedFailure() { return unresolvedFailure; },
+        get lastFailedTool() { return lastFailedTool; },
+        get active() { return active; },
+        observeToolResult(message) {
+            if (!message || message.role !== 'tool') return;
+            // Guard skips (repeat-failure guard) are tagged as errors so every
+            // downstream consumer keeps treating the call as unresolved, but
+            // nothing was dispatched — they must not arm the hook.
+            if (message.guardSkip === true) return;
+            if (message.toolKind === 'error') {
+                batchFailure = true;
+                if (message.toolCallId) failedCallIds.add(message.toolCallId);
+            } else if (EXECUTED_SUCCESS_TOOL_KINDS.has(message.toolKind)) {
+                batchSuccess = true;
+            }
+        },
+        endBatch(calls) {
+            if (batchFailure) {
+                unresolvedFailure = true;
+                const failed = (Array.isArray(calls) ? calls : [])
+                    .find((call) => call?.id && failedCallIds.has(call.id));
+                if (failed) lastFailedTool = bareToolName(failed.name);
+            } else if (batchSuccess) {
+                unresolvedFailure = false;
+                lastFailedTool = null;
+            }
+            batchFailure = false;
+            batchSuccess = false;
+            failedCallIds = new Set();
+        },
+        takeContinuationPrompt() {
+            if (active || !unresolvedFailure) return null;
+            active = true;
+            return toolFailureContinuationPrompt(lastFailedTool);
+        },
+    };
+}

package/src/runtime/agent/orchestrator/session/loop/termination.mjs

@@ -24,6 +24,31 @@ export function isOutputLimitStopReason(reason) {
         && OUTPUT_LIMIT_STOP_REASONS.has(reason.trim().toLowerCase());
 }
 
+// Provider-declared continuation signals. A response carrying one of these is
+// NOT a completed assistant turn even when it holds final-looking text: the
+// provider explicitly stated it intends to keep sampling inside the SAME user
+// turn. Two structured shapes are honored:
+//   - `endTurn === false` (Codex/Responses `end_turn=false`; see
+//     codex-rs/core/src/session/turn.rs Completed{ end_turn } → needs_follow_up)
+//   - Anthropic `stop_reason: 'pause_turn'` (server-side pause; the turn is
+//     resumed by replaying the transcript unchanged)
+// Structural only — no lexical/progress-text heuristic is consulted, and a
+// provider that omits both fields is unaffected (returns null → terminal).
+const CONTINUATION_STOP_REASONS = new Set(['pause_turn']);
+
+export function providerContinuationSignal(response) {
+    if (!response || typeof response !== 'object') return null;
+    // Only an explicit boolean false continues; undefined/null/absent means
+    // "provider did not signal" and keeps legacy terminal semantics.
+    if (response.endTurn === false || response.end_turn === false) return 'end_turn_false';
+    const stopReason = response.stopReason ?? response.stop_reason ?? null;
+    if (typeof stopReason === 'string'
+        && CONTINUATION_STOP_REASONS.has(stopReason.trim().toLowerCase())) {
+        return 'pause_turn';
+    }
+    return null;
+}
+
 // Classify WHY the loop ended so agent-tool can promote an empty/abnormal
 // finish to an explicit Lead-facing error instead of a silent empty
 // "completed". Determine "has content" exactly the way the no-tool-call

package/src/runtime/agent/orchestrator/session/loop/tool-exec.mjs

@@ -179,7 +179,7 @@ export async function executeTool(name, args, cwd, callerSessionId, sessionRef,
     if (name === 'code_graph') {
         // cwd chain: args.cwd (caller-explicit) → session cwd → undefined (handler throws)
         const graphCwd = (typeof args?.cwd === 'string' && args.cwd.trim()) ? args.cwd.trim() : cwd;
-        return executeCodeGraphToolLazy(name, args, graphCwd, null, toolOpts);
+        return executeCodeGraphToolLazy(name, args, graphCwd, executeOpts.signal || null, toolOpts);
     }
     if (isInternalTool(name)) {
         // callerSessionId propagates into server.mjs dispatchTool so that

package/src/runtime/agent/orchestrator/session/manager/ask-session.mjs

@@ -5,6 +5,7 @@
 // helper it used in manager.mjs is now imported from its split module.
 import { createHash, randomUUID } from 'crypto';
 import { getProvider } from '../../providers/registry.mjs';
+import { readStreamOutcome } from '../../providers/lib/stream-outcome.mjs';
 import { normalizeCompactType, DEFAULT_COMPACT_TYPE } from '../compact.mjs';
 import { loadSession, saveSession, saveSessionAsync, saveSessionAsyncDeferred, readSessionLifecycleFromDisk } from '../store.mjs';
 import { createAbortController } from '../../../../shared/abort-controller.mjs';
@@ -57,6 +58,7 @@ import {
 } from './message-sanitize.mjs';
 import { createTurnInterruptionTracker } from './turn-interruption.mjs';
 import {
+    cancelPendingTurnCheckpoint,
     clearTurnCheckpoint,
     recoverTurnCheckpoint,
     turnMessagesForCheckpoint,
@@ -342,6 +344,13 @@ export async function askSession(sessionId, prompt, context, onToolCall, cwdOver
                     currentUserContent: cancelledUserTurnContent,
                     turnMessages: turnMessagesForCheckpoint(_turnOutgoing, cancelledUserTurnContent),
                     interruption: _turnInterruption.snapshot(),
+                }, {
+                    // The turn's first checkpoint is the crash-durability
+                    // anchor for the prompt and must land before the provider
+                    // runs; every later streaming/tool-boundary flush moves to
+                    // the async latest-wins lane so serialization+disk never
+                    // stall the engine thread mid-stream.
+                    sync: _turnCheckpointLastAt === 0,
                 });
                 if (written) _turnCheckpointLastAt = Date.now();
                 return written;
@@ -373,6 +382,7 @@ export async function askSession(sessionId, prompt, context, onToolCall, cwdOver
             _turnCheckpointStopped = true;
             if (_turnCheckpointTimer) clearTimeout(_turnCheckpointTimer);
             _turnCheckpointTimer = null;
+            cancelPendingTurnCheckpoint(sessionId);
         };
         const _sessionStartMetaInjectedBeforeTurn = preSession.sessionStartMetaInjected === true;
         let _interruptionSnapshot = null;
@@ -679,11 +689,31 @@ export async function askSession(sessionId, prompt, context, onToolCall, cwdOver
                                 if (Array.isArray(drained)) out.push(...drained);
                             } catch { /* best-effort steering drain */ }
                         }
-                        // Do NOT drain manager/pending-messages here: those
-                        // entries have no mode/priority/slash metadata, so
-                        // draining them mid-chain would bypass Claude Code's
-                        // queued_command filters. They are consumed by the
-                        // post-loop _pendingTail drain below.
+                        // Manager/pending-messages entries carry no
+                        // mode/priority/slash metadata, so they stay OUT of the
+                        // mid-chain (post-tool-batch) drain — that would bypass
+                        // Claude Code's queued_command filters. At the TERMINAL
+                        // boundary they are exactly Codex `has_pending_input`
+                        // (turn.rs:304-318): an `agent type=send` queued while
+                        // the terminal sample was in flight must be folded into
+                        // THIS turn before any stop hook runs, instead of losing
+                        // its slot to a synthetic continuation prompt. The mutex
+                        // is held for the whole ask, so this drain races nothing.
+                        // Entries consumed here join _turnPendingEntries: their
+                        // delivery/ack (and release on failure) rides this turn,
+                        // and the post-loop drain can no longer see them.
+                        if (drainOptions?.stage === 'terminal') {
+                            const _pendingNow = drainPendingMessages(sessionId);
+                            if (_pendingNow.length > 0) {
+                                const _mergedNow = _mergePendingMessageEntries(_pendingNow);
+                                if (_mergedNow?.content) {
+                                    _turnPendingEntries.push(..._pendingNow);
+                                    out.push(_mergedNow);
+                                } else {
+                                    releasePendingMessages(sessionId, _pendingNow);
+                                }
+                            }
+                        }
                         return out;
                     },
                     onSteerMessage: (text, detail) => {
@@ -1029,8 +1059,19 @@ export async function askSession(sessionId, prompt, context, onToolCall, cwdOver
             // non-streaming request starts. If that restart fails, restore the
             // tombstone and persist the one exposed partial as interruption
             // history. Failed/absent acknowledgements never tombstoned it.
+            // Provider-specific legacy flags are NOT consulted here: the
+            // canonical stream-outcome contract answers "did the provider
+            // produce output we must commit?" for every transport. Anthropic's
+            // stall/truncation errors carry neither liveTextEmitted nor
+            // unsafeToRetry — only partialContent/partialToolCalls — and used
+            // to drop the streamed summary from history on that provider.
+            const _providerOutcome = readStreamOutcome(err);
             const preserveProviderPartial = restoredResetText
-                || err?.liveTextEmitted === true
+                || _providerOutcome.observedOutput === true
+                // Positive exposure evidence only: an error with no observed
+                // output must not be mistaken for a turn that produced
+                // provider output.
+                || _providerOutcome.replayUnsafe === true
                 || err?.unsafeToRetry === true;
             let _errorStateDurable = false;
             if (preserveProviderPartial && activeSession && _turnInterruption.hasResponseStarted()) {