mixdog 0.9.92 → 0.9.93

package/src/runtime/agent/orchestrator/agent-trace.mjs

@@ -38,6 +38,22 @@ function extractCachedTokens(usage) {
     return 0;
 }
 
+function extractCacheWriteTokens(usage) {
+    const candidates = [
+        usage?.input_tokens_details?.cache_write_tokens,
+        usage?.prompt_tokens_details?.cache_write_tokens,
+        usage?.inputTokensDetails?.cacheWriteTokens,
+        usage?.promptTokensDetails?.cacheWriteTokens,
+        usage?.cache_write_tokens,
+        usage?.cacheWriteTokens,
+    ];
+    for (const value of candidates) {
+        const n = Number(value);
+        if (Number.isFinite(n)) return n;
+    }
+    return 0;
+}
+
 // Lightweight fingerprint of the conversation prefix. Hashes the first 4096
 // characters of JSON.stringify(messages) — enough to detect prefix mutation
 // across iterations (which invalidates the provider prompt cache) without
@@ -267,6 +283,7 @@ export {
     appendAgentTrace,
     drainAgentTrace,
     estimateProviderPayloadBytes,
+    extractCacheWriteTokens,
     extractCachedTokens,
     messagePrefixHash,
     traceAgentFetch,

package/src/runtime/agent/orchestrator/context/collect.mjs

@@ -275,7 +275,7 @@ export function buildSkillToolEnvelope(name, content, skillDir) {
     };
 }
 
-function compactSkillManifestText(value, max = 180) {
+function compactSkillManifestText(value, max = 100) {
     const text = String(value || '').replace(/\s+/g, ' ').trim();
     return text.length > max ? `${text.slice(0, Math.max(1, max - 3))}...` : text;
 }
@@ -528,6 +528,7 @@ export function buildSkillToolDefs(skills, { ownerIsAgentSession = false } = {})
                     name: { type: 'string', description: 'Skill name' },
                 },
                 required: ['name'],
+                additionalProperties: false,
             },
         },
     ];

package/src/runtime/agent/orchestrator/providers/anthropic-effort.mjs

@@ -208,7 +208,15 @@ export function applyAnthropicEffortToBody(
         // modelSupportsEffort() allowlist so older models never receive it.
         // Set unconditionally (independent of `normalized`) so effort-capable
         // turns always carry adaptive thinking + round-trip signatures.
-        body.thinking = { type: 'adaptive', display: 'summarized' };
+        // MIXDOG_ANTHROPIC_THINKING_DISPLAY=omitted (operator/bench knob):
+        // CC-parity mode — no thinking blocks come back, so nothing is
+        // replayed into later requests (saves the 1h cache-write + re-read on
+        // accumulated thinking) at the cost of losing visible reasoning and
+        // cross-iteration thinking continuity. Default stays summarized.
+        const display = (process.env.MIXDOG_ANTHROPIC_THINKING_DISPLAY || '').trim() === 'omitted'
+            ? 'omitted'
+            : 'summarized';
+        body.thinking = { type: 'adaptive', display };
         // Adaptive/4.7+ models reject any non-default sampling param with a 400.
         delete body.temperature;
         delete body.top_p;

package/src/runtime/agent/orchestrator/providers/anthropic-oauth.mjs

@@ -64,6 +64,18 @@ import {
     stampAnthropicStreamOutcome,
 } from './anthropic-sse.mjs';
 import { buildAnthropicBetaHeaders, supportsAnthropicFastMode } from './anthropic-betas.mjs';
+import { gzipSync } from 'node:zlib';
+
+// Request-body gzip gate (see the fetch site below). Env kill-switch
+// (MIXDOG_ANTHROPIC_REQ_GZIP=0) plus a process-wide latch flipped on the
+// first 400 response to a compressed request. Small bodies skip compression:
+// below ~8KB the CPU + header cost outweighs the upload saving.
+const ANTHROPIC_REQ_GZIP_MIN_BYTES = 8 * 1024;
+let _anthropicReqGzipLatch = false;
+function _anthropicReqGzipDisabled() {
+    return _anthropicReqGzipLatch || process.env.MIXDOG_ANTHROPIC_REQ_GZIP === '0';
+}
+function _disableAnthropicReqGzip() { _anthropicReqGzipLatch = true; }
 import {
     applyAnthropicEffortToBody,
     effortValuesForModel,
@@ -654,7 +666,16 @@ export class AnthropicOAuthProvider {
                 // provider-visible cache breakpoint off the cached one — the
                 // exact COLD-turn bug this change fixes. Order is fixed:
                 // build → sanitize (once) → mark → JSON.stringify.
-                const response = await fetch(API_URL, {
+                // Request-body gzip (probe-verified 2026-08-04: /v1/messages
+                // returns 200 for Content-Encoding: gzip, 400 for zstd). Large
+                // turn bodies (system prompt + history, typically 50-100KB+)
+                // compress ~5-10x, trimming upload time off every call's
+                // header wait. Latch OFF process-wide on the first 400 seen on
+                // a compressed request and retry that attempt uncompressed, so
+                // a server-side behavior change can never wedge the session.
+                const rawBody = Buffer.from(JSON.stringify(requestBody));
+                const useGzip = !_anthropicReqGzipDisabled() && rawBody.length >= ANTHROPIC_REQ_GZIP_MIN_BYTES;
+                const sendAttempt = (gz) => fetch(API_URL, {
                     method: 'POST',
                     headers: {
                         'Authorization': `Bearer ${accessToken}`,
@@ -669,11 +690,18 @@ export class AnthropicOAuthProvider {
                         'user-agent': `claude-cli/${resolveCliVersion()} (external, sdk-cli)`,
                         'x-app': 'cli',
                         'Content-Type': 'application/json',
+                        ...(gz ? { 'Content-Encoding': 'gzip' } : {}),
                     },
-                    body: JSON.stringify(requestBody),
+                    body: gz ? gzipSync(rawBody) : rawBody,
                     signal: controller.signal,
                     dispatcher: getLlmDispatcher(),
                 });
+                let response = await sendAttempt(useGzip);
+                if (useGzip && response.status === 400) {
+                    _disableAnthropicReqGzip();
+                    try { await response.arrayBuffer(); } catch { /* drain best-effort */ }
+                    response = await sendAttempt(false);
+                }
 
                 traceAgentFetch({
                     sessionId,
@@ -780,25 +808,13 @@ export class AnthropicOAuthProvider {
         // clock starting at the first stall (see createStallRetryBudget).
         const stallRetryBudget = createStallRetryBudget();
 
-        const recoverNonStreaming = async (midState, streamingError, controller) => {
-            const exposedChars = Number(midState?.emittedTextChars) || 0;
-            if (!onTextReset || exposedChars <= 0
-                || midState.emittedToolCall || midState.partialToolCall || midState.emittedThinking) {
-                try { streamingError.liveTextEmitted = true; streamingError.unsafeToRetry = true; } catch {}
-                throw streamingError;
-            }
-            let resetAccepted = false;
-            try {
-                resetAccepted = await onTextReset({
-                    chars: exposedChars,
-                    reason: 'anthropic-streaming-fallback',
-                }) === true;
-            } catch {}
-            if (!resetAccepted) {
-                try { streamingError.liveTextEmitted = true; streamingError.unsafeToRetry = true; } catch {}
-                throw streamingError;
-            }
-            try { controller?.abort?.(streamingError); } catch {}
+        // Core non-streaming re-issue: abort the dead stream and repeat the
+        // SAME request with stream:false. Shared by the exposed-text recovery
+        // (which must first get the owner's onTextReset acknowledgement) and
+        // the no-exposure stall fallback below (trivially safe — nothing was
+        // relayed or dispatched, so there is nothing to withdraw or replay).
+        const issueNonStreamingFallback = async (controller, abortReason) => {
+            try { controller?.abort?.(abortReason); } catch {}
             try { onStageChange?.('requesting', { transport: 'non-streaming-fallback' }); } catch {}
             let fallback = await requestWithRetry(creds.accessToken, { ...body, stream: false });
             if (fallback.response.status === 401) {
@@ -825,6 +841,27 @@ export class AnthropicOAuthProvider {
             }
         };
 
+        const recoverNonStreaming = async (midState, streamingError, controller) => {
+            const exposedChars = Number(midState?.emittedTextChars) || 0;
+            if (!onTextReset || exposedChars <= 0
+                || midState.emittedToolCall || midState.partialToolCall || midState.emittedThinking) {
+                try { streamingError.liveTextEmitted = true; streamingError.unsafeToRetry = true; } catch {}
+                throw streamingError;
+            }
+            let resetAccepted = false;
+            try {
+                resetAccepted = await onTextReset({
+                    chars: exposedChars,
+                    reason: 'anthropic-streaming-fallback',
+                }) === true;
+            } catch {}
+            if (!resetAccepted) {
+                try { streamingError.liveTextEmitted = true; streamingError.unsafeToRetry = true; } catch {}
+                throw streamingError;
+            }
+            return issueNonStreamingFallback(controller, streamingError);
+        };
+
         try {
         for (let attemptIndex = 0; attemptIndex <= MAX_MIDSTREAM_RETRIES; attemptIndex++) {
             let response, controller, cancelHandler;
@@ -1057,6 +1094,27 @@ export class AnthropicOAuthProvider {
                     continue;
                 }
                 const classifier = _classifyMidstreamError(err, midState);
+                // CC-parity stall recovery (2026-08-03 v3 postmortem): a
+                // stalled stream that exposed NOTHING (no text/thinking
+                // relayed, no tool emitted) is re-issued NON-STREAMING instead
+                // of retrying the same streaming shape. Effort-mode models can
+                // legitimately think in silence past any streaming idle
+                // window; an in-place streaming retry re-runs the same silent
+                // generation into the same timer (observed live: deterministic
+                // 4×~138s beheading, ~552s per turn), while the non-streaming
+                // transport simply waits for the full body (bounded by
+                // PROVIDER_NONSTREAM_TOTAL_TIMEOUT_MS). Claude Code does
+                // exactly this on its watchdog aborts. Replay is trivially
+                // safe here — nothing was relayed or dispatched.
+                if (classifier === 'stream_stalled'
+                    && _outcome?.replayUnsafe !== true
+                    && !midState.emittedText
+                    && !midState.emittedToolCall
+                    && !midState.partialToolCall
+                    && !midState.emittedThinking) {
+                    try { process.stderr.write('[anthropic-oauth] stream stalled with no exposure — retrying non-streaming\n'); } catch {}
+                    return await issueNonStreamingFallback(controller, err);
+                }
                 if (classifier === 'stream_stalled' && !stallRetryBudget.allowStallRetry()) {
                     try { process.stderr.write(`[anthropic-oauth] stall retry budget exhausted (${STREAM_STALL_RETRY_BUDGET_MS}ms since first stall) — surfacing for fresh-request retry\n`); } catch {}
                     try { controller?.abort?.(err); } catch { /* best-effort teardown */ }

package/src/runtime/agent/orchestrator/providers/anthropic.mjs

@@ -320,25 +320,11 @@ export class AnthropicProvider {
             };
         };
 
-        const recoverNonStreaming = async (midState, streamingError, streamController) => {
-            const exposedChars = Number(midState?.emittedTextChars) || 0;
-            if (!onTextReset || exposedChars <= 0
-                || midState.emittedToolCall || midState.partialToolCall || midState.emittedThinking) {
-                try { streamingError.liveTextEmitted = true; streamingError.unsafeToRetry = true; } catch {}
-                throw streamingError;
-            }
-            let resetAccepted = false;
-            try {
-                resetAccepted = await onTextReset({
-                    chars: exposedChars,
-                    reason: 'anthropic-streaming-fallback',
-                }) === true;
-            } catch {}
-            if (!resetAccepted) {
-                try { streamingError.liveTextEmitted = true; streamingError.unsafeToRetry = true; } catch {}
-                throw streamingError;
-            }
-            try { streamController.abort?.(streamingError); } catch {}
+        // Core non-streaming re-issue shared by the exposed-text recovery
+        // (onTextReset-gated) and the no-exposure stall fallback (trivially
+        // safe — nothing was relayed or dispatched). Mirrors anthropic-oauth.
+        const issueNonStreamingFallback = async (streamController, abortReason) => {
+            try { streamController.abort?.(abortReason); } catch {}
             try { onStageChange?.('requesting', { transport: 'non-streaming-fallback' }); } catch {}
             const nonStreamingParams = { ...params, stream: false };
             const message = await withRetry(
@@ -362,6 +348,27 @@ export class AnthropicProvider {
             return buildReturnFromParse(normalizeAnthropicNonStreamingResponse(message, useModel));
         };
 
+        const recoverNonStreaming = async (midState, streamingError, streamController) => {
+            const exposedChars = Number(midState?.emittedTextChars) || 0;
+            if (!onTextReset || exposedChars <= 0
+                || midState.emittedToolCall || midState.partialToolCall || midState.emittedThinking) {
+                try { streamingError.liveTextEmitted = true; streamingError.unsafeToRetry = true; } catch {}
+                throw streamingError;
+            }
+            let resetAccepted = false;
+            try {
+                resetAccepted = await onTextReset({
+                    chars: exposedChars,
+                    reason: 'anthropic-streaming-fallback',
+                }) === true;
+            } catch {}
+            if (!resetAccepted) {
+                try { streamingError.liveTextEmitted = true; streamingError.unsafeToRetry = true; } catch {}
+                throw streamingError;
+            }
+            return issueNonStreamingFallback(streamController, streamingError);
+        };
+
         try {
             for (let attemptIndex = 0; attemptIndex <= MAX_MIDSTREAM_RETRIES; attemptIndex++) {
                 const streamController = createAbortController();
@@ -597,6 +604,20 @@ export class AnthropicProvider {
                         continue;
                     }
                     const classifier = _classifyMidstreamError(err, midState);
+                    // CC-parity stall recovery (ported from anthropic-oauth,
+                    // 2026-08-03): a stalled stream that exposed NOTHING is
+                    // re-issued non-streaming instead of retrying the same
+                    // streaming shape into the same idle window. Replay is
+                    // trivially safe — nothing was relayed or dispatched.
+                    if (classifier === 'stream_stalled'
+                        && _outcome?.replayUnsafe !== true
+                        && !midState.emittedText
+                        && !midState.emittedToolCall
+                        && !midState.partialToolCall
+                        && !midState.emittedThinking) {
+                        try { process.stderr.write(`[${this.name}] stream stalled with no exposure — retrying non-streaming\n`); } catch {}
+                        return await issueNonStreamingFallback(streamController, err);
+                    }
                     if (classifier === 'stream_stalled' && !stallRetryBudget.allowStallRetry()) {
                         try {
                             process.stderr.write(

package/src/runtime/agent/orchestrator/providers/lib/anthropic-request-utils.mjs

@@ -268,10 +268,27 @@ export function applyAnthropicCacheMarkers(sanitizedMessages, {
         const tailIdx = sanitizedMessages.length - 1;
         return hasUserText(sanitizedMessages[tailIdx]) ? tailIdx : -1;
     };
+    // True-tip anchor: when the request ends with a PERSISTED user text turn
+    // (the current prompt — it re-appears verbatim in every later request's
+    // prefix), mark it first. Without this, mid-session turn-first requests
+    // (multi-turn only; single-turn sessions are already covered by
+    // firstRequestUserPromptIdx) leave the fresh prompt unmarked: its tokens
+    // bill once at $5/M uncached, then again as a cache write when a later
+    // anchor advances past them — cost bounded by the prompt's size, so it
+    // matters for large pasted prompts. (2026-08-03 A/B note: session totals'
+    // totalUncachedInputTokens = input + cacheWrite by design, see
+    // uncachedInputTokensForProvider; billing-uncached input measured via
+    // usage.json was already ~0 on single-turn bench tasks before and after
+    // this change.) Synthetic system-reminder tails are excluded by
+    // hasUserText, so per-call volatile content still never keys the cache.
+    const currentTailUserIdx = () => {
+        const tailIdx = sanitizedMessages.length - 1;
+        return hasUserText(sanitizedMessages[tailIdx]) ? tailIdx : -1;
+    };
     if (messageTtl !== null) {
         const slots = Math.max(0, Math.min(4, Number(messageSlots) || 0));
         const marked = new Set();
-        const candidates = [latestToolResultTailIdx(), previousUserTextAnchorIdx(), firstRequestUserPromptIdx()];
+        const candidates = [currentTailUserIdx(), latestToolResultTailIdx(), previousUserTextAnchorIdx(), firstRequestUserPromptIdx()];
         for (const idx of candidates) {
             if (slots <= 0) break;
             if (idx < 0 || marked.has(idx)) continue;

package/src/runtime/agent/orchestrator/providers/openai-oauth-http-sse.mjs

@@ -7,7 +7,10 @@
  * (scripts/openai-oauth-http-sse-toolcall-smoke.mjs) and fallback headers.
  */
 import { randomBytes } from 'crypto';
+import zlib from 'node:zlib';
 import {
+    extractCacheWriteTokens,
+    extractCachedTokens,
     traceAgentFetch,
     traceAgentSse,
     traceAgentUsage,
@@ -47,6 +50,21 @@ const CODEX_REQUEST_MAX_RETRIES = 4;
 const CODEX_REQUEST_BACKOFF_MS = Object.freeze([200, 400, 800, 1600]);
 const CODEX_RETRY_JITTER_RATIO = 0.1;
 
+// Request-body zstd gate (see sendViaHttpSse). Namespace import: on Node
+// runtimes without zlib zstd bindings the named export would fail at module
+// load, so the call site typeof-guards zlib.zstdCompressSync instead.
+const OPENAI_REQ_ZSTD_MIN_BYTES = 8 * 1024;
+let _openaiReqZstdLatch = false;
+function _openaiReqZstdDisabled() {
+    return _openaiReqZstdLatch || process.env.MIXDOG_OPENAI_REQ_ZSTD === '0';
+}
+function _disableOpenaiReqZstd() { _openaiReqZstdLatch = true; }
+function _zstdHeaders(headers, bodyForSend) {
+    return bodyForSend.encoding
+        ? { ...headers, 'Content-Encoding': bodyForSend.encoding }
+        : headers;
+}
+
 export function _envFlag(name, fallback = true) {
     const raw = process.env[name];
     if (raw == null || raw === '') return fallback;
@@ -72,11 +90,6 @@ function _parseJsonObject(value) {
     }
 }
 
-function _extractCachedTokens(usage) {
-    const details = usage?.input_tokens_details || usage?.prompt_tokens_details || {};
-    return Number(details.cached_tokens ?? details.cached ?? usage?.cached_tokens ?? 0) || 0;
-}
-
 function _sseEventsFromBuffer(buffer) {
     const frames = [];
     let rest = buffer.replace(/\r\n/g, '\n');
@@ -231,6 +244,19 @@ export async function sendViaHttpSse({
     const responsesUrl = auth?.type === 'openai-direct'
         ? OPENAI_DIRECT_RESPONSES_URL
         : CODEX_RESPONSES_URL;
+    // Request-body zstd (codex parity: core client.rs
+    // responses_request_compression enables zstd for the codex backend on the
+    // OpenAI provider — the server decompresses Content-Encoding: zstd).
+    // openai-direct is excluded: only the codex backend is verified. Env
+    // kill-switch plus a process-wide latch flipped on the first 400 seen on
+    // a compressed request, which then replays that attempt uncompressed.
+    const _rawReqBytes = Buffer.from(JSON.stringify(body));
+    let _reqBodyForSend = auth?.type !== 'openai-direct'
+        && !_openaiReqZstdDisabled()
+        && typeof zlib.zstdCompressSync === 'function'
+        && _rawReqBytes.length >= OPENAI_REQ_ZSTD_MIN_BYTES
+        ? { bytes: zlib.zstdCompressSync(_rawReqBytes), encoding: 'zstd' }
+        : { bytes: _rawReqBytes, encoding: null };
     let response;
     for (let attempt = 0; attempt <= CODEX_REQUEST_MAX_RETRIES; attempt++) {
         const headerTimeout = createTimeoutSignal(
@@ -253,8 +279,8 @@ export async function sendViaHttpSse({
             } catch {}
             response = await fetchFn(responsesUrl, {
                 method: 'POST',
-                headers,
-                body: JSON.stringify(body),
+                headers: _zstdHeaders(headers, _reqBodyForSend),
+                body: _reqBodyForSend.bytes,
                 signal: headerTimeout.signal,
                 dispatcher: getLlmDispatcher(),
             });
@@ -267,6 +293,15 @@ export async function sendViaHttpSse({
             headerTimeout.cleanup();
         }
 
+        // zstd rejection fallback: a 400 on a compressed request latches
+        // compression OFF process-wide and replays this attempt uncompressed.
+        if (response && response.status === 400 && _reqBodyForSend.encoding) {
+            _disableOpenaiReqZstd();
+            _reqBodyForSend = { bytes: _rawReqBytes, encoding: null };
+            await response.arrayBuffer().catch(() => {});
+            response = undefined;
+            continue;
+        }
         const retryableStatus = response && response.status >= 500 && response.status <= 599;
         // Typed transient transport failures only (errno / SDK connection
         // type). An unknown pre-response failure throws immediately instead of
@@ -783,7 +818,8 @@ export async function sendViaHttpSse({
                     usage = {
                         inputTokens: resp.usage.input_tokens || 0,
                         outputTokens: resp.usage.output_tokens || 0,
-                        cachedTokens: _extractCachedTokens(resp.usage),
+                        cachedTokens: extractCachedTokens(resp.usage),
+                        cacheWriteTokens: extractCacheWriteTokens(resp.usage),
                         promptTokens: resp.usage.input_tokens || 0,
                         raw: serviceTier ? { ...resp.usage, service_tier: serviceTier } : resp.usage,
                     };

package/src/runtime/agent/orchestrator/providers/openai-ws-events.mjs

@@ -39,6 +39,9 @@ export function _combineUsageWithWarmup(actual, warmup, { separateMainContext =
         inputTokens: _usageNum(actual.inputTokens) + _usageNum(warmup.inputTokens),
         outputTokens: _usageNum(actual.outputTokens) + _usageNum(warmup.outputTokens),
         cachedTokens: _usageNum(actual.cachedTokens) + _usageNum(warmup.cachedTokens),
+        ...(actual.cacheWriteTokens != null || warmup.cacheWriteTokens != null
+            ? { cacheWriteTokens: _usageNum(actual.cacheWriteTokens) + _usageNum(warmup.cacheWriteTokens) }
+            : {}),
         promptTokens: _usageNum(actual.promptTokens) + _usageNum(warmup.promptTokens),
         warmupInputTokens: _usageNum(warmup.inputTokens),
         warmupCachedTokens: _usageNum(warmup.cachedTokens),

package/src/runtime/agent/orchestrator/providers/openai-ws-stream.mjs

@@ -16,6 +16,7 @@
 import { randomBytes } from 'crypto';
 import { performance } from 'node:perf_hooks';
 import {
+    extractCacheWriteTokens,
     extractCachedTokens,
     appendAgentTrace,
 } from '../agent-trace.mjs';
@@ -1090,6 +1091,7 @@ export async function _streamResponse({
                             inputTokens: u.input_tokens || 0,
                             outputTokens: u.output_tokens || 0,
                             cachedTokens: extractCachedTokens(u),
+                            cacheWriteTokens: extractCacheWriteTokens(u),
                             // openai-oauth reports input_tokens as the total
                             // prompt volume (cached portion is a subset, not
                             // additive). Alias into the cross-provider

package/src/runtime/agent/orchestrator/session/agent-loop.mjs

@@ -227,7 +227,17 @@ export async function agentLoop(provider, messages, model, tools, onToolCall, cw
     // turn's push (deferBodies below) collapse to markers now — the model has
     // already seen them on that turn's follow-up send. Failed bodies stay
     // verbatim for retry.
-    compactSettledToolCallBodies(messages);
+    // Out-of-loop transcript mutations (post-turn/manual compaction in
+    // manager/compaction-runner.mjs) run where no send opts exist; they park a
+    // one-shot intent on the session so the FIRST send of the next turn tags
+    // its expected cache break instead of an unexplained prefix mismatch.
+    if (!opts.cacheBreakIntent && typeof sessionRef?.pendingCacheBreakIntent === 'string') {
+        opts.cacheBreakIntent = sessionRef.pendingCacheBreakIntent;
+        delete sessionRef.pendingCacheBreakIntent;
+    }
+    if (compactSettledToolCallBodies(messages) && !opts.cacheBreakIntent) {
+        opts.cacheBreakIntent = 'deferred_body_compaction';
+    }
     // ---- Codex turn stop hook (refs/codex core/src/session/turn.rs:372-404) --
     // A no-tool assistant message is TERMINAL. Only a structured provider
     // follow-up signal (end_turn=false / pause_turn), pending input, tool
@@ -526,7 +536,10 @@ export async function agentLoop(provider, messages, model, tools, onToolCall, cw
                 const _m = messages[_i];
                 if (_m && _m.role === 'tool' && typeof _m.content === 'string' && _m.content.includes('⚠')) {
                     const _stripped = stripSoftWarns(_m.content);
-                    if (_stripped !== _m.content) _m.content = _stripped;
+                    if (_stripped !== _m.content) {
+                        _m.content = _stripped;
+                        if (!opts.cacheBreakIntent) opts.cacheBreakIntent = 'soft_warn_strip';
+                    }
                 }
             }
             sendTools = snapshotProviderRequestTools({
@@ -645,14 +658,16 @@ export async function agentLoop(provider, messages, model, tools, onToolCall, cw
         );
         const _sendEndedAt = Date.now();
         if (_sendResult.action === 'retry') {
-            delete opts.cacheBreakIntent;
+            // Keep opts.cacheBreakIntent: the failed send never consumed the
+            // tag, and the reactive-compact retry that follows IS the tagged
+            // transition — deleting it here made retry-side cache_break rows
+            // log intentional_transition: null.
             contextOverflowRetryUsed = true;
             reactiveOverflowRetryPending = true;
             continue;
         }
         if (_sendResult.action === 'retry_transport') {
             _transportRetriesUsed += 1;
-            delete opts.cacheBreakIntent;
             continue;
         }
         response = _sendResult.response;
@@ -1021,7 +1036,9 @@ export async function agentLoop(provider, messages, model, tools, onToolCall, cw
         // Settle earlier deferred bodies before this turn's message lands:
         // every previous call already has its result row, so successful bodies
         // compact to markers while failed ones keep their full retry text.
-        compactSettledToolCallBodies(messages);
+        if (compactSettledToolCallBodies(messages) && !opts.cacheBreakIntent) {
+            opts.cacheBreakIntent = 'deferred_body_compaction';
+        }
         messages.push(_assistantTurnMsg);
         try { opts.onAssistantMessageCommitted?.(_assistantTurnMsg); } catch {}
         const _callsToExecute = calls;

package/src/runtime/agent/orchestrator/session/eager-dispatch.mjs

@@ -1,18 +1,18 @@
 // Eager tool-dispatch controller, extracted from agent-loop.mjs. Owns the
 // per-turn pending promise map, the intra-turn in-flight signature set, and
-// the mutation epoch. FULL-PARALLEL policy: every tool call starts executing
-// the instant the provider streams its tool_use event (or at batch start),
-// shell/MCP/writes included — the model owns ordering by splitting dependent
-// work into separate turns. Only apply_patch (ordered mutation) waits for the
-// serial batch loop.
+// the mutation epoch. Read-only calls may start while the provider is still
+// streaming. Side-effect calls stream-start too until the first apply_patch
+// appears in the stream (they are definitively in segment 0); after that they
+// wait for their segment bounded by apply_patch barriers. Patches execute
+// serially as barriers, so a failed patch can skip every later side effect.
 import { normalizeToolEnvelope } from './tool-envelope.mjs';
 import { isInvalidToolArgsMarker } from '../providers/openai-compat-stream.mjs';
-import { _intraTurnSig, _isMutationTool, _isReadTool, _isScopedCacheableTool, _isShellTool, _stripMcpPrefix } from './loop/tool-classify.mjs';
+import { _intraTurnSig, _isMutationTool, _isOrderedGateSkippable, _isReadTool, _isScopedCacheableTool, _stripMcpPrefix } from './loop/tool-classify.mjs';
 import { tryReadCached, tryScopedToolCached } from './read-dedup.mjs';
 import { preDispatchDenyForSession } from './loop/pre-dispatch-deny.mjs';
 import { executeTool } from './loop/tool-exec.mjs';
 import { crossTurnSignature } from './loop/completion-guards.mjs';
-import { getToolKind, isParallelDispatchable, isToolCallDedupEligible } from './loop/tool-helpers.mjs';
+import { getToolKind, isEagerDispatchable, isParallelDispatchable, isToolCallDedupEligible } from './loop/tool-helpers.mjs';
 
 export function createEagerDispatcher({
     tools, cwd, sessionId, sessionRef, signal, opts,
@@ -40,18 +40,11 @@ export function createEagerDispatcher({
         // resets at the turn boundary without leaking across getIterations().
         const _eagerInFlightSigs = new Map();
         const epoch = { mutation: 0 };
-        // Patch→shell ordering insurance: a shell call that appears AFTER an
-        // apply_patch in the same assistant turn must not eager-start before
-        // that patch has executed (serial body runs both in call order).
-        // Reads are already safe via the mutationEpoch re-execution gate;
-        // only shell's side effects would consume pre-patch file state.
-        let _streamSawMutation = false;
-        const _hasEarlierMutation = (calls, index) => {
-            for (let k = 0; k < index; k += 1) {
-                if (_isMutationTool(calls[k]?.name)) return true;
-            }
-            return false;
-        };
+        // True once an apply_patch tool_use has been seen in THIS turn's
+        // stream. Before that, every side-effect call streamed so far sits
+        // before the first patch in call order (segment 0), so it may start
+        // immediately — a patch that arrives later cannot gate an EARLIER call.
+        let _streamSeenMutation = false;
         const startEagerTool = (call) => {
             if (!call?.id || pending.has(call.id) || !isParallelDispatchable(call.name)) return null;
             // Never eager-execute a call whose arguments failed to parse
@@ -107,7 +100,7 @@ export function createEagerDispatcher({
             if (_dedupEligible) _eagerInFlightSigs.set(_sig, call.id);
             entry.promise = (async () => {
                 try {
-                    return { ok: true, value: await executeToolFn(call.name, call.arguments, cwd, sessionId, sessionRef, { toolCallId: call.id, signal, notifyFn: opts.notifyFn, toolApprovalHook: opts.onToolApproval, iteration: getNextIteration() }) };
+                    return { ok: true, value: await executeToolFn(call.name, call.arguments, cwd, sessionId, sessionRef, { toolCallId: call.id, signal, notifyFn: opts.notifyFn, toolApprovalHook: opts.onToolApproval, iteration: getNextIteration(), deferShellCwdCommit: true }) };
                 } catch (error) {
                     return { ok: false, error };
                 }
@@ -168,16 +161,21 @@ export function createEagerDispatcher({
             return entry;
         };
         const startEagerRun = (calls, startIndex, dupSet) => {
+            const _nextOrderedMutationIndex = calls.findIndex(
+                (call, index) => index >= startIndex && _isMutationTool(call?.name),
+            );
             for (let j = startIndex; j < calls.length; j += 1) {
                 const call = calls[j];
-                // Full-parallel: only the ordered mutation (apply_patch) is
-                // skipped — it executes in the serial batch body. No barrier:
-                // later calls keep starting in parallel past it.
+                // Side effects may eager-start in the current segment but not
+                // across the next apply_patch barrier. Known read-only work
+                // may cross it and is protected by mutation-epoch re-execution.
                 if (!call?.id || !isParallelDispatchable(call.name)) continue;
                 if (dupSet && dupSet.has(call.id)) continue;
-                // Patch→shell insurance: leave a shell that follows an
-                // apply_patch to the serial body so it runs after the patch.
-                if (_isShellTool(call.name) && _hasEarlierMutation(calls, j)) continue;
+                if (
+                    _nextOrderedMutationIndex >= 0
+                    && j >= _nextOrderedMutationIndex
+                    && _isOrderedGateSkippable(call.name)
+                ) continue;
                 // A null return here is NOT a state barrier. It means a
                 // non-barrier stub — intra-turn in-flight dup, repeat-failure /
                 // cross-turn dedup, pre-dispatch-deny, invalid-args, or a cache
@@ -188,9 +186,17 @@ export function createEagerDispatcher({
             }
         };
         const onToolCall = (call) => {
-            if (_isMutationTool(call?.name)) { _streamSawMutation = true; return; }
-            if (!isParallelDispatchable(call?.name)) return;
-            if (_streamSawMutation && _isShellTool(call.name)) return;
+            if (_isMutationTool(call?.name)) {
+                _streamSeenMutation = true;
+                return;
+            }
+            // Declared read-only calls always overlap streaming (epoch guard
+            // re-executes them if a later patch lands). Side-effect calls may
+            // stream-start only while NO apply_patch has streamed yet: their
+            // call-order position is already fixed before the first barrier,
+            // matching exactly what startEagerRun would do post-batch. Once a
+            // patch has streamed, later side effects wait for their segment.
+            if (!isEagerDispatchable(call?.name, tools) && _streamSeenMutation) return;
             startEagerTool(call);
         };
     return { pending, epoch, startEagerTool, startEagerRun, onToolCall };