mixdog 0.9.91 → 0.9.93

package/src/runtime/agent/orchestrator/providers/openai-ws-stream.mjs

@@ -16,6 +16,7 @@
 import { randomBytes } from 'crypto';
 import { performance } from 'node:perf_hooks';
 import {
+    extractCacheWriteTokens,
     extractCachedTokens,
     appendAgentTrace,
 } from '../agent-trace.mjs';
@@ -1090,6 +1091,7 @@ export async function _streamResponse({
                             inputTokens: u.input_tokens || 0,
                             outputTokens: u.output_tokens || 0,
                             cachedTokens: extractCachedTokens(u),
+                            cacheWriteTokens: extractCacheWriteTokens(u),
                             // openai-oauth reports input_tokens as the total
                             // prompt volume (cached portion is a subset, not
                             // additive). Alias into the cross-provider

package/src/runtime/agent/orchestrator/providers/retry-classifier.mjs

@@ -314,6 +314,41 @@ export function jitterDelayMs(ms, ratio = PROVIDER_RETRY_JITTER_RATIO, mode = 's
   return Math.max(0, Math.round(base + offset))
 }
 
+// ── Stall-retry wall-clock budget (send-scoped) ──────────────────────────────
+// Mid-stream 'stream_stalled' recoveries retry in place, which is right for a
+// one-off blip but lets a chronically dying stream burn a whole task budget
+// slowly (observed live: one send stretched 149s→298s→556s across stall
+// retries before the agent deadline killed the task). Reference stacks bound
+// this instead of retrying forever: Claude Code caps each request at ~300s
+// wall clock (API_TIMEOUT_MS) and Codex kills a stream after one 300s silent
+// gap (stream_idle_timeout). This guard is the equivalent for our in-place
+// recovery: the clock starts at the FIRST stall of a send, and stall-classified
+// retries are allowed only inside that window; past it the stall error
+// surfaces so loop-level transport retry issues a FRESH request. Healthy
+// streams never consult the clock (no stall → no budget reads), so long
+// thinking/output can never trip it.
+export const STREAM_STALL_RETRY_BUDGET_MS = (() => {
+  const v = Number(process.env.MIXDOG_STREAM_STALL_BUDGET_MS)
+  return Number.isFinite(v) && v > 0 ? Math.floor(v) : 300_000
+})()
+
+// One instance per provider send() call (NOT per attempt — the whole point is
+// bounding the cross-attempt stall window). `now` is injectable for tests.
+export function createStallRetryBudget(budgetMs = STREAM_STALL_RETRY_BUDGET_MS, now = Date.now) {
+  let firstStallAt = 0
+  return {
+    // Record a stall-classified retry candidate. Returns true while the
+    // send's stall window still has budget; false once exhausted (the caller
+    // surfaces the error instead of retrying in place).
+    allowStallRetry() {
+      const t = now()
+      if (!firstStallAt) firstStallAt = t
+      return (t - firstStallAt) <= budgetMs
+    },
+    get firstStallAt() { return firstStallAt },
+  }
+}
+
 // ── Shared network-resilience interface ──────────────────────────────────────
 // One home for the logic shared across providers: mid-stream classifier
 // (WS + SSE), transport fallback predicate, stream-safety stamp latches,

package/src/runtime/agent/orchestrator/session/agent-loop.mjs

@@ -227,7 +227,17 @@ export async function agentLoop(provider, messages, model, tools, onToolCall, cw
     // turn's push (deferBodies below) collapse to markers now — the model has
     // already seen them on that turn's follow-up send. Failed bodies stay
     // verbatim for retry.
-    compactSettledToolCallBodies(messages);
+    // Out-of-loop transcript mutations (post-turn/manual compaction in
+    // manager/compaction-runner.mjs) run where no send opts exist; they park a
+    // one-shot intent on the session so the FIRST send of the next turn tags
+    // its expected cache break instead of an unexplained prefix mismatch.
+    if (!opts.cacheBreakIntent && typeof sessionRef?.pendingCacheBreakIntent === 'string') {
+        opts.cacheBreakIntent = sessionRef.pendingCacheBreakIntent;
+        delete sessionRef.pendingCacheBreakIntent;
+    }
+    if (compactSettledToolCallBodies(messages) && !opts.cacheBreakIntent) {
+        opts.cacheBreakIntent = 'deferred_body_compaction';
+    }
     // ---- Codex turn stop hook (refs/codex core/src/session/turn.rs:372-404) --
     // A no-tool assistant message is TERMINAL. Only a structured provider
     // follow-up signal (end_turn=false / pause_turn), pending input, tool
@@ -444,6 +454,7 @@ export async function agentLoop(provider, messages, model, tools, onToolCall, cw
             Math.floor(maxLoopIterations * 0.9),
         ];
     while (true) {
+        const _iterT0 = Date.now();
         throwIfAborted();
         if (iterations >= maxLoopIterations) {
             // Final-answer turn: instead of breaking mid-transcript (which
@@ -525,7 +536,10 @@ export async function agentLoop(provider, messages, model, tools, onToolCall, cw
                 const _m = messages[_i];
                 if (_m && _m.role === 'tool' && typeof _m.content === 'string' && _m.content.includes('⚠')) {
                     const _stripped = stripSoftWarns(_m.content);
-                    if (_stripped !== _m.content) _m.content = _stripped;
+                    if (_stripped !== _m.content) {
+                        _m.content = _stripped;
+                        if (!opts.cacheBreakIntent) opts.cacheBreakIntent = 'soft_warn_strip';
+                    }
                 }
             }
             sendTools = snapshotProviderRequestTools({
@@ -642,15 +656,18 @@ export async function agentLoop(provider, messages, model, tools, onToolCall, cw
                 transportRetriesUsed: _transportRetriesUsed, signal,
             }),
         );
+        const _sendEndedAt = Date.now();
         if (_sendResult.action === 'retry') {
-            delete opts.cacheBreakIntent;
+            // Keep opts.cacheBreakIntent: the failed send never consumed the
+            // tag, and the reactive-compact retry that follows IS the tagged
+            // transition — deleting it here made retry-side cache_break rows
+            // log intentional_transition: null.
             contextOverflowRetryUsed = true;
             reactiveOverflowRetryPending = true;
             continue;
         }
         if (_sendResult.action === 'retry_transport') {
             _transportRetriesUsed += 1;
-            delete opts.cacheBreakIntent;
             continue;
         }
         response = _sendResult.response;
@@ -1019,7 +1036,9 @@ export async function agentLoop(provider, messages, model, tools, onToolCall, cw
         // Settle earlier deferred bodies before this turn's message lands:
         // every previous call already has its result row, so successful bodies
         // compact to markers while failed ones keep their full retry text.
-        compactSettledToolCallBodies(messages);
+        if (compactSettledToolCallBodies(messages) && !opts.cacheBreakIntent) {
+            opts.cacheBreakIntent = 'deferred_body_compaction';
+        }
         messages.push(_assistantTurnMsg);
         try { opts.onAssistantMessageCommitted?.(_assistantTurnMsg); } catch {}
         const _callsToExecute = calls;
@@ -1038,6 +1057,7 @@ export async function agentLoop(provider, messages, model, tools, onToolCall, cw
             continue;
         }
         try { opts.onToolPhaseStarted?.(); } catch {}
+        const _toolsT0 = Date.now();
         ({ dedupStubTotal: _dedupStubTotal, editCount: _editCount } = await processToolBatch({
             calls: _callsToExecute, messages, tools, cwd, sessionId, sessionRef, signal, opts,
             iterations, assistantTurnMsg: _assistantTurnMsg,
@@ -1050,6 +1070,15 @@ export async function agentLoop(provider, messages, model, tools, onToolCall, cw
         }));
         // Settle the stop hook on the batch that actually executed.
         _toolFailureStopHook.endBatch(_callsToExecute);
+        // Loop-phase timing (diagnostics): where non-model time goes per
+        // iteration — presend (repair/compact/snapshot), send (provider
+        // round-trip incl. streaming), tools (batch execution). Gated by the
+        // same env as [turn-timing] so bench runs opt in via -AgentEnv.
+        if (process.env.MIXDOG_TURN_TIMING === '1') {
+            try {
+                process.stderr.write(`[loop-timing] iter=${nextIteration} presend=${sendStartedAt - _iterT0}ms send=${_sendEndedAt - sendStartedAt}ms tools=${Date.now() - _toolsT0}ms calls=${_callsToExecute.length}\n`);
+            } catch { /* diagnostics only */ }
+        }
         _toolBatchJustCompleted = true;
         _continuationsSinceToolBatch = 0;
         _lastToolBatchHadSleep = _callsToExecute.some(isSleepLikeToolCall);

package/src/runtime/agent/orchestrator/session/eager-dispatch.mjs

@@ -1,18 +1,18 @@
 // Eager tool-dispatch controller, extracted from agent-loop.mjs. Owns the
 // per-turn pending promise map, the intra-turn in-flight signature set, and
-// the mutation epoch. FULL-PARALLEL policy: every tool call starts executing
-// the instant the provider streams its tool_use event (or at batch start),
-// shell/MCP/writes included — the model owns ordering by splitting dependent
-// work into separate turns. Only apply_patch (ordered mutation) waits for the
-// serial batch loop.
+// the mutation epoch. Read-only calls may start while the provider is still
+// streaming. Side-effect calls stream-start too until the first apply_patch
+// appears in the stream (they are definitively in segment 0); after that they
+// wait for their segment bounded by apply_patch barriers. Patches execute
+// serially as barriers, so a failed patch can skip every later side effect.
 import { normalizeToolEnvelope } from './tool-envelope.mjs';
 import { isInvalidToolArgsMarker } from '../providers/openai-compat-stream.mjs';
-import { _intraTurnSig, _isMutationTool, _isReadTool, _isScopedCacheableTool, _isShellTool, _stripMcpPrefix } from './loop/tool-classify.mjs';
+import { _intraTurnSig, _isMutationTool, _isOrderedGateSkippable, _isReadTool, _isScopedCacheableTool, _stripMcpPrefix } from './loop/tool-classify.mjs';
 import { tryReadCached, tryScopedToolCached } from './read-dedup.mjs';
 import { preDispatchDenyForSession } from './loop/pre-dispatch-deny.mjs';
 import { executeTool } from './loop/tool-exec.mjs';
 import { crossTurnSignature } from './loop/completion-guards.mjs';
-import { getToolKind, isParallelDispatchable, isToolCallDedupEligible } from './loop/tool-helpers.mjs';
+import { getToolKind, isEagerDispatchable, isParallelDispatchable, isToolCallDedupEligible } from './loop/tool-helpers.mjs';
 
 export function createEagerDispatcher({
     tools, cwd, sessionId, sessionRef, signal, opts,
@@ -40,18 +40,11 @@ export function createEagerDispatcher({
         // resets at the turn boundary without leaking across getIterations().
         const _eagerInFlightSigs = new Map();
         const epoch = { mutation: 0 };
-        // Patch→shell ordering insurance: a shell call that appears AFTER an
-        // apply_patch in the same assistant turn must not eager-start before
-        // that patch has executed (serial body runs both in call order).
-        // Reads are already safe via the mutationEpoch re-execution gate;
-        // only shell's side effects would consume pre-patch file state.
-        let _streamSawMutation = false;
-        const _hasEarlierMutation = (calls, index) => {
-            for (let k = 0; k < index; k += 1) {
-                if (_isMutationTool(calls[k]?.name)) return true;
-            }
-            return false;
-        };
+        // True once an apply_patch tool_use has been seen in THIS turn's
+        // stream. Before that, every side-effect call streamed so far sits
+        // before the first patch in call order (segment 0), so it may start
+        // immediately — a patch that arrives later cannot gate an EARLIER call.
+        let _streamSeenMutation = false;
         const startEagerTool = (call) => {
             if (!call?.id || pending.has(call.id) || !isParallelDispatchable(call.name)) return null;
             // Never eager-execute a call whose arguments failed to parse
@@ -107,7 +100,7 @@ export function createEagerDispatcher({
             if (_dedupEligible) _eagerInFlightSigs.set(_sig, call.id);
             entry.promise = (async () => {
                 try {
-                    return { ok: true, value: await executeToolFn(call.name, call.arguments, cwd, sessionId, sessionRef, { toolCallId: call.id, signal, notifyFn: opts.notifyFn, toolApprovalHook: opts.onToolApproval, iteration: getNextIteration() }) };
+                    return { ok: true, value: await executeToolFn(call.name, call.arguments, cwd, sessionId, sessionRef, { toolCallId: call.id, signal, notifyFn: opts.notifyFn, toolApprovalHook: opts.onToolApproval, iteration: getNextIteration(), deferShellCwdCommit: true }) };
                 } catch (error) {
                     return { ok: false, error };
                 }
@@ -168,16 +161,21 @@ export function createEagerDispatcher({
             return entry;
         };
         const startEagerRun = (calls, startIndex, dupSet) => {
+            const _nextOrderedMutationIndex = calls.findIndex(
+                (call, index) => index >= startIndex && _isMutationTool(call?.name),
+            );
             for (let j = startIndex; j < calls.length; j += 1) {
                 const call = calls[j];
-                // Full-parallel: only the ordered mutation (apply_patch) is
-                // skipped — it executes in the serial batch body. No barrier:
-                // later calls keep starting in parallel past it.
+                // Side effects may eager-start in the current segment but not
+                // across the next apply_patch barrier. Known read-only work
+                // may cross it and is protected by mutation-epoch re-execution.
                 if (!call?.id || !isParallelDispatchable(call.name)) continue;
                 if (dupSet && dupSet.has(call.id)) continue;
-                // Patch→shell insurance: leave a shell that follows an
-                // apply_patch to the serial body so it runs after the patch.
-                if (_isShellTool(call.name) && _hasEarlierMutation(calls, j)) continue;
+                if (
+                    _nextOrderedMutationIndex >= 0
+                    && j >= _nextOrderedMutationIndex
+                    && _isOrderedGateSkippable(call.name)
+                ) continue;
                 // A null return here is NOT a state barrier. It means a
                 // non-barrier stub — intra-turn in-flight dup, repeat-failure /
                 // cross-turn dedup, pre-dispatch-deny, invalid-args, or a cache
@@ -188,9 +186,17 @@ export function createEagerDispatcher({
             }
         };
         const onToolCall = (call) => {
-            if (_isMutationTool(call?.name)) { _streamSawMutation = true; return; }
-            if (!isParallelDispatchable(call?.name)) return;
-            if (_streamSawMutation && _isShellTool(call.name)) return;
+            if (_isMutationTool(call?.name)) {
+                _streamSeenMutation = true;
+                return;
+            }
+            // Declared read-only calls always overlap streaming (epoch guard
+            // re-executes them if a later patch lands). Side-effect calls may
+            // stream-start only while NO apply_patch has streamed yet: their
+            // call-order position is already fixed before the first barrier,
+            // matching exactly what startEagerRun would do post-batch. Once a
+            // patch has streamed, later side effects wait for their segment.
+            if (!isEagerDispatchable(call?.name, tools) && _streamSeenMutation) return;
             startEagerTool(call);
         };
     return { pending, epoch, startEagerTool, startEagerRun, onToolCall };

package/src/runtime/agent/orchestrator/session/loop/stop-hooks.mjs

@@ -14,6 +14,8 @@
 
 export const STOP_HOOK_SOURCE = 'tool-failure-stop-hook';
 
+import { isInformationalShellExitOne } from '../result-classification.mjs';
+
 // Only a genuinely EXECUTED result resolves a failure, i.e. kind 'normal'.
 // Cache hits ('cache-hit' / 'scoped-cache-hit') replay an earlier result
 // without running anything, and dedup/guard skips ('skipped') execute nothing
@@ -59,6 +61,13 @@ export function createToolFailureStopHook() {
             // nothing was dispatched — they must not arm the hook.
             if (message.guardSkip === true) return;
             if (message.toolKind === 'error') {
+                // Informational exit-1 probes (grep-family no-match inside a
+                // compound command: useful stdout, blank stderr) stay 'error'
+                // for display/history, but blocking the terminal message over
+                // them forces a pointless re-verify turn — observed live
+                // (kv-store-grpc: /proc PID scan exit 1 → hook misfire, +2
+                // turns). Neutral here: neither arms nor clears.
+                if (isInformationalShellExitOne(message.content)) return;
                 batchFailure = true;
                 if (message.toolCallId) failedCallIds.add(message.toolCallId);
             } else if (EXECUTED_SUCCESS_TOOL_KINDS.has(message.toolKind)) {

package/src/runtime/agent/orchestrator/session/loop/stored-tool-args.mjs

@@ -59,6 +59,9 @@ function compactStoredToolArgString(value, key = '', opts = {}) {
     const isLong = isBody || STORED_TOOL_ARG_LONG_KEY_RE.test(key);
     const limit = isLong ? STORED_TOOL_ARG_LIMIT : Infinity;
     if (value.length <= limit) return value;
+    // A marker is about to replace verbatim text — report the mutation so
+    // sweep callers can tag the resulting prefix-cache break.
+    try { opts.onCompacted?.(); } catch { /* observability only */ }
     const hash = createHash('sha256').update(value).digest('hex').slice(0, 16);
     // Body markers carry the recovery instruction inline: the compaction
     // detectors only require the `[mixdog compacted ...]` shape (no ']' or
@@ -115,14 +118,19 @@ export function compactToolCallsForHistory(calls, opts = {}) {
 //     contract as restoreToolCallBodyForId);
 //   - a call with no result row yet (current batch / interrupted turn) is
 //     left untouched.
+// Returns true when at least one body was actually collapsed to a marker
+// (i.e. the transcript prefix changed), so callers can tag the intentional
+// cache break instead of logging an unexplained input_prefix_mismatch.
 export function compactSettledToolCallBodies(messages) {
-    if (!Array.isArray(messages)) return;
+    if (!Array.isArray(messages)) return false;
     const resultKinds = new Map();
     for (const message of messages) {
         if (message?.role === 'tool' && message.toolCallId) {
             resultKinds.set(message.toolCallId, message.toolKind || 'normal');
         }
     }
+    let changed = false;
+    const sweepOpts = { onCompacted: () => { changed = true; } };
     for (const message of messages) {
         if (message?.role !== 'assistant' || !Array.isArray(message.toolCalls)) continue;
         for (const call of message.toolCalls) {
@@ -130,9 +138,10 @@ export function compactSettledToolCallBodies(messages) {
             if (!call.arguments || typeof call.arguments !== 'object') continue;
             const kind = call.id ? resultKinds.get(call.id) : undefined;
             if (kind === undefined || kind === 'error') continue;
-            call.arguments = compactStoredToolArgValue(call.arguments);
+            call.arguments = compactStoredToolArgValue(call.arguments, '', 0, sweepOpts);
         }
     }
+    return changed;
 }
 
 // Restore retry-safe long command/script text for ONE failed tool call inside a

package/src/runtime/agent/orchestrator/session/loop/tool-classify.mjs

@@ -15,12 +15,11 @@ export function _isMutationTool(name) {
     const n = _stripMcpPrefix(name);
     return n === 'apply_patch';
 }
-// Side-effect-free read-only tools that stay parallel even after an earlier
-// ordered mutation failed in the same batch. Everything NOT in this set is
-// treated as ordered-gate-skippable (see _isOrderedGateSkippable): apply_patch,
-// shell/bash_session, write/edit-style tools, and any (non-mixdog) MCP tool
-// whose effects are unknown. Kept separate from _isMutationTool, which stays
-// apply_patch-only for epoch-mutation counting and eager-dispatch gating.
+// Side-effect-free read-only tools that may eager-start across an upcoming
+// apply_patch barrier and may keep running after an earlier patch fails.
+// Everything NOT in this set waits for its side-effect segment and is skipped
+// after a failed patch. Kept separate from _isMutationTool, which stays
+// apply_patch-only for epoch counting.
 const ORDERED_GATE_SAFE_READONLY_TOOLS = new Set([
     'read',
     'find',

package/src/runtime/agent/orchestrator/session/loop/tool-exec.mjs

@@ -226,8 +226,37 @@ export async function executeTool(name, args, cwd, callerSessionId, sessionRef,
         return result;
     }
     if (name === 'apply_patch') {
-        const patchArgs = typeof args === 'string' ? { patch: args } : args;
-        return executePatchTool(name, patchArgs, cwd, { sessionId: callerSessionId, toolCallId: executeOpts.toolCallId || null });
+        const patchArgs = typeof args === 'string' ? { patch: args } : { ...(args || {}) };
+        // post_shell: optional verification command executed through the normal
+        // one-shot shell path ONLY after the patch applies cleanly; a failed
+        // patch skips it. Patch text and shell output return as ONE tool
+        // result, so patch+verify costs a single call. Runtime-only knob:
+        // stripped before executePatchTool sees the args.
+        const postShell = typeof patchArgs.post_shell === 'string' && patchArgs.post_shell.trim()
+            ? patchArgs.post_shell.trim()
+            : null;
+        delete patchArgs.post_shell;
+        const patchResult = await executePatchTool(name, patchArgs, cwd, {
+            sessionId: callerSessionId,
+            toolCallId: executeOpts.toolCallId || null,
+        });
+        if (!postShell) return patchResult;
+        const patchNorm = normalizeToolEnvelope(patchResult);
+        const patchText = typeof patchNorm.result === 'string' ? patchNorm.result : String(patchNorm.result ?? '');
+        // Text-based failure detection only: legacy string returns normalize
+        // to explicitSuccess:false even on success, so that flag is unusable here.
+        const patchFailed = /^Error[\s:[]/.test(patchText.trimStart());
+        if (patchFailed) {
+            return `${patchText}\n--- post_shell skipped: patch failed ---`;
+        }
+        const shellRes = await executeBuiltinTool('shell', { command: postShell }, cwd, completionToolOpts);
+        const shellNorm = normalizeToolEnvelope(shellRes);
+        const shellText = typeof shellNorm.result === 'string' ? shellNorm.result : String(shellNorm.result ?? '');
+        const shellFailed = /^Error[\s:[]/.test(shellText.trimStart());
+        const header = shellFailed
+            ? '--- post_shell FAILED (patch is applied; fix and re-verify) ---'
+            : '--- post_shell ---';
+        return `${patchText}\n\n${header}\n${shellText}`;
     }
     if (isBuiltinTool(name)) {
         // clientHostPid threaded for the same per-terminal job-scope reason as

package/src/runtime/agent/orchestrator/session/manager/compaction-runner.mjs

@@ -25,6 +25,7 @@ import {
     compactTypeForSession,
 } from './context-meta.mjs';
 import { resolveSemanticSummaryModel } from '../loop/compact-policy.mjs';
+import { traceAgentCompact, messagePrefixHash } from '../../agent-trace.mjs';
 import { uncachedInputTokensForProvider } from './usage-metrics.mjs';
 import { pruneOffloadSession } from '../tool-result-offload.mjs';
 import { _getPendingMessagesForSession } from './pending-messages.mjs';
@@ -302,6 +303,7 @@ export async function runSessionCompaction(session, opts = {}) {
         semanticCompact: false,
     };
     const budget = targetBudgetTokens;
+    const compactStartedAt = Date.now();
     try { await opts.onStageChange?.('compacting'); } catch { /* best-effort */ }
     const provider = opts.provider || getProvider(session.provider) || null;
     let compacted;
@@ -486,6 +488,31 @@ export async function runSessionCompaction(session, opts = {}) {
             lastRecallFastTrackError: recallFastTrackError?.message || null,
             lastError: compactError?.message || semanticCompactError?.message || recallFastTrackError?.message || String(compactError || semanticCompactError || recallFastTrackError || 'compact failed'),
         };
+        // compact_meta parity with the loop's pre-send pass: the out-of-loop
+        // (post-turn/manual) compaction failure was previously invisible to
+        // trace analytics.
+        traceAgentCompact({
+            sessionId: opts.sessionId || session.id || null,
+            stage: mode === 'auto' ? 'post_turn' : 'manual',
+            trigger: mode,
+            compact_type: compactType,
+            compact_changed: false,
+            before_count: messages.length,
+            after_count: messages.length,
+            context_window: positiveContextWindow(session.contextWindow) || null,
+            budget_tokens: boundary,
+            boundary_tokens: boundary,
+            target_budget_tokens: budget,
+            reserve_tokens: reserveTokens,
+            pressure_tokens: pressureTokens,
+            trigger_tokens: triggerTokens,
+            message_tokens_est: beforeMessageTokens,
+            duration_ms: Date.now() - compactStartedAt,
+            provider: session.provider || null,
+            model: session.model || null,
+            error: session.compaction.lastError,
+            error_code: 'compact_failed',
+        });
         return {
             changed: false,
             error: session.compaction.lastError,
@@ -574,6 +601,39 @@ export async function runSessionCompaction(session, opts = {}) {
         compactCount: (session.compaction?.compactCount || 0) + (changed ? 1 : 0),
     };
     if (changed) invalidateProviderContextBaseline(session);
+    // Observability parity with the loop's pre-send pass: record the
+    // out-of-loop mutation as compact_meta and park a one-shot intent so the
+    // next turn's first send tags its cache break instead of logging an
+    // unexplained input_prefix_mismatch (observed live: a 403k→10k post-turn
+    // compact traced as intentional_transition: null with no compact_meta).
+    let beforePrefixHash = null;
+    try { beforePrefixHash = messagePrefixHash(messages); } catch { /* best-effort */ }
+    traceAgentCompact({
+        sessionId: pruneSessionId || null,
+        stage: mode === 'auto' ? 'post_turn' : 'manual',
+        trigger: mode,
+        compact_type: compactType,
+        compact_changed: changed,
+        input_prefix_hash: beforePrefixHash,
+        before_count: messages.length,
+        after_count: compacted.length,
+        before_bytes: beforeEncoded ? Buffer.byteLength(beforeEncoded, 'utf8') : null,
+        after_bytes: afterEncoded ? Buffer.byteLength(afterEncoded, 'utf8') : null,
+        context_window: positiveContextWindow(session.contextWindow) || null,
+        budget_tokens: boundary,
+        boundary_tokens: boundary,
+        target_budget_tokens: budget,
+        reserve_tokens: reserveTokens,
+        pressure_tokens: pressureTokens,
+        trigger_tokens: triggerTokens,
+        message_tokens_est: beforeMessageTokens,
+        duration_ms: Date.now() - compactStartedAt,
+        provider: session.provider || null,
+        model: session.model || null,
+    });
+    if (changed) {
+        session.pendingCacheBreakIntent = mode === 'auto' ? 'post_turn_compaction' : 'manual_compaction';
+    }
     return {
         changed,
         reason: unchangedReason,

package/src/runtime/agent/orchestrator/session/manager/pending-messages.mjs

@@ -19,16 +19,41 @@ const PENDING_MESSAGES_MODE = 0o600;
 const PENDING_ORPHAN_TTL_MS = 7 * 24 * 60 * 60 * 1000;
 const PENDING_ORPHAN_GRACE_MS = 60 * 60 * 1000;
 // Replay window for genuine user/steering entries. A cross-surface submit is
-// meant for a LIVE owner; if nothing picked it up within this window, firing
-// it into a session resumed hours or days later reads as a surprise
-// self-injection (user report: stale spool messages replayed on re-entry).
-// Crash+restart recovery within the window still replays normally.
+// meant for a LIVE owner; entries that predate this process and exceeded the
+// window are still DELIVERED (CC parity, reference messageQueueManager.ts:
+// queued user input is never silently discarded), but annotated with an
+// explicit late-delivery header so a session resumed hours later reads them
+// as clearly-late input instead of a surprise self-injection.
 const STALE_USER_INJECTION_TTL_MS = 30 * 60 * 1000;
 
+// Ownership epoch for the staleness gate below: entries enqueued while THIS
+// process was already alive were aimed at a live owner that still exists.
+const _PENDING_PROCESS_START_MS = Date.now();
+
 function isStaleUserInjection(entry, now = Date.now()) {
     if (isCompletionNotificationEntry(entry)) return false;
     const enqueuedAt = Number(entry?.enqueuedAt) || 0;
-    return enqueuedAt > 0 && (now - enqueuedAt) > STALE_USER_INJECTION_TTL_MS;
+    if (enqueuedAt <= 0) return false;
+    // A submit that arrived AFTER this owner process booted is CURRENT input
+    // the owner was merely too busy to take yet (observed: remote sends
+    // silently discarded after 30m while the owner ground through long
+    // turns). It must deliver regardless of age. The stale window only
+    // guards entries that PREDATE this process — the resumed-session replay
+    // case the TTL was built for (surprise self-injection on re-entry).
+    if (enqueuedAt >= _PENDING_PROCESS_START_MS) return false;
+    return (now - enqueuedAt) > STALE_USER_INJECTION_TTL_MS;
+}
+
+// CC parity: never silently discard queued user input. A stale entry is
+// delivered with this explicit age-annotated header so neither the user nor
+// the model mistakes it for fresh input.
+function lateDeliveryText(text, entry, now = Date.now()) {
+    const value = String(text ?? '');
+    if (!value.trim()) return value;
+    const enqueuedAt = Number(entry?.enqueuedAt) || 0;
+    const ageMinutes = Math.max(1, Math.round((now - enqueuedAt) / 60000));
+    const age = ageMinutes >= 120 ? `~${Math.round(ageMinutes / 60)}h` : `~${ageMinutes}m`;
+    return `[late delivery: queued ${age} ago, before the current session owner started]\n${value}`;
 }
 // Marker for deferred agent/tool *completion* notifications. Such entries must
 // never be replayed into a later turn on session resume (out-of-order delivery
@@ -765,7 +790,6 @@ export function hydratePendingMessages(sessionId, options = {}) {
       let hydrated = [];
       let alreadyDelivered = [];
       let staleLedgerEntries = [];
-      const staleUserEntries = [];
       const ledgerSession = loadSession(sessionId);
       // Durable lifecycle epoch this hydration started under. Publishing claims the
       // durable entries into THIS process's memory, so it must be revalidated
@@ -797,16 +821,19 @@ export function hydratePendingMessages(sessionId, options = {}) {
                     return false;
                 }
                 if (!id || inDelivery.has(id) || acked.has(id)) return false;
-                // Stale genuine user/steering entries must not surprise-inject
-                // into a session resumed long after they were queued (user:
-                // "re-entering the session suddenly injected old messages").
-                // Completion entries keep their own resume-drop policy.
-                if (isStaleUserInjection(entry)) {
-                    staleUserEntries.push(entry);
-                    return false;
-                }
                 return true;
             });
+            // CC parity: stale genuine user/steering entries DELIVER with a
+            // late-delivery header instead of being silently dropped (the old
+            // behavior discarded them; user report: remote/steering sends
+            // silently ignored around owner restarts). Completion entries
+            // keep their own resume-drop policy (drain discards them).
+            for (const entry of hydrated) {
+                if (!isStaleUserInjection(entry)) continue;
+                if (typeof entry.message === 'string') {
+                    entry.message = lateDeliveryText(entry.message, entry);
+                }
+            }
             // Read-only claim: durable data remains until successful delivery
             // acknowledges these exact ids. A crash here therefore redelivers.
             return undefined;
@@ -828,13 +855,6 @@ export function hydratePendingMessages(sessionId, options = {}) {
         runPendingTestHook('hydrate:betweenCleanups', { sessionId });
         if (pendingLifecycleInvalidated(sessionId, startToken)) return 0;
       }
-      if (staleUserEntries.length > 0) {
-        try { process.stderr.write(`[session] dropped ${staleUserEntries.length} stale queued message(s) (older than ${Math.round(STALE_USER_INJECTION_TTL_MS / 60000)}m) sessionId=${sessionId}\n`); } catch {}
-        const cleaned = await acknowledgePendingMessages(sessionId, staleUserEntries, { expectedToken: startToken });
-        if (cleaned) cleanupConfirmed.push(...staleUserEntries);
-        runPendingTestHook('hydrate:betweenCleanups', { sessionId });
-        if (pendingLifecycleInvalidated(sessionId, startToken)) return 0;
-      }
       if (cleanupConfirmed.length > 0) {
         try {
             // One session save prunes both IDs whose replay spool was removed
@@ -968,7 +988,19 @@ function modelVisiblePendingMessages(messages) {
 }
 
 export function _mergePendingMessageEntries(entries) {
-    const normalized = (Array.isArray(entries) ? entries : [])
+    // CC-parity delivery priority (reference messageQueueManager.ts: user
+    // input enqueues at 'next', task notifications at 'later', and dequeue
+    // always serves 'next' first). Our single merged turn message is the
+    // analogue of that dequeue order: genuine user/steering entries are
+    // merged BEFORE deferred completion notifications so queued user input
+    // is never buried under system notification text. FIFO is preserved
+    // within each group (stable partition).
+    const source = Array.isArray(entries) ? entries : [];
+    const ordered = [
+        ...source.filter((entry) => !isCompletionNotificationEntry(entry)),
+        ...source.filter(isCompletionNotificationEntry),
+    ];
+    const normalized = ordered
         .map(normalizePendingMessageEntry)
         .filter(Boolean);
     if (normalized.length === 0) return null;
@@ -1106,7 +1138,6 @@ export function drainForeignUserInjections(sessionId) {
         }
     } catch { /* ledger unavailable — in-memory sets still guard */ }
     const taken = [];
-    let droppedStale = 0;
     // The mtime memo may ONLY be armed by a scan that actually reached a
     // lifecycle-valid decision under the spool lock. Arming it upfront meant a
     // drain refused in-lock (a close/detach/reopen landing in the window) still
@@ -1137,14 +1168,15 @@ export function drainForeignUserInjections(sessionId) {
                     && !isCompletionNotificationEntry(entry)
                     && !isLegacyUnmarkedCompletionNotification(text)
                     && text && !isInternalRuntimeNotificationText(text);
-                // Stale foreign submits are removed WITHOUT injecting: they
-                // were aimed at a live owner that no longer exists (user:
-                // stale spool messages fired on session re-entry days later).
-                if (foreignUser && isStaleUserInjection(entry)) droppedStale += 1;
+                // CC parity: stale foreign submits still deliver, carrying a
+                // late-delivery header instead of being silently removed
+                // (user report: remote sends silently discarded around owner
+                // restarts).
+                if (foreignUser && isStaleUserInjection(entry)) taken.push(lateDeliveryText(text, entry));
                 else if (foreignUser) taken.push(text);
                 else kept.push(entry);
             }
-            if (taken.length === 0 && droppedStale === 0) return undefined;
+            if (taken.length === 0) return undefined;
             if (kept.length > 0) next.sessions[sessionId] = kept;
             else {
                 delete next.sessions[sessionId];
@@ -1158,9 +1190,6 @@ export function drainForeignUserInjections(sessionId) {
         return [];
     }
     if (lifecycleDecided) _rememberForeignSpoolScan(sessionId, mtime);
-    if (droppedStale > 0) {
-        try { process.stderr.write(`[session] dropped ${droppedStale} stale foreign submit(s) (older than ${Math.round(STALE_USER_INJECTION_TTL_MS / 60000)}m) sessionId=${sessionId}\n`); } catch {}
-    }
     return taken;
 }