pi-mega-compact 0.8.24 → 0.8.26

package/extensions/mega-dashboard.ts

@@ -146,12 +146,21 @@ export interface DashboardSnapshot {
     liveTrimFires: number;
     liveTrimReplays: number;
   };
-  /** S38.8: error-retry state for dashboard "retries" tile. */
+  /** S38.8: error-retry state for dashboard "retries" tile.
+   *  R7 (retry redesign): sessionRetryCount / sessionMax / poisonedCount are
+   *  ADDITIVE fields — older dashboards that don't read them stay
+   *  backward-compatible. */
   retries?: {
     errorRetryCount: number;
     consecutiveErrors: number;
     maxConsecutiveErrors: number;
     errorRetryHardStop: boolean;
+    /** R2: total S38 nudges fired this session across ALL bursts. */
+    sessionRetryCount: number;
+    /** R2: session-global cap (errorRetrySessionMax). 0 = disabled. */
+    sessionMax: number;
+    /** R3/R7: number of poisoned-context events this session. */
+    poisonedCount: number;
   };
 }
 

package/extensions/mega-events/agent-handlers.ts

@@ -14,11 +14,12 @@ import {
 	memoryReviewCadence,
 	type MegaConfig,
 } from "../mega-config.js";
-import { recordScore } from "../../src/store/sqlite.js";
+import { recordScore, recordTurn } from "../../src/store/sqlite.js";
 import { evaluateAndUnlockAchievements } from "../../src/store/sqlite/game-achievements.js";
+import { ensureConversationId } from "../../src/store/sqlite/turns.js";
 import { isMegaCache } from "../../src/game/scoring.js";
 import { resolveRepoRoot } from "../mega-config.js";
-import { classifyError } from "./error-classifier.js";
+import { classifyError, errorRetryBackoffMs, extractErrorSignature } from "./error-classifier.js";
 import { safeSendUserMessage } from "./send-safe.js";
 import { vectorStats } from "../../src/vectorStore.js";
 
@@ -230,6 +231,15 @@ export function registerAgentHandlers(
 		runtime.currentTurn = event.turnIndex;
 		runtime.rt.lengthStopPending = false; // S28: re-arm defensively each user turn
 		runtime.rt.errorRetryCount = 0; // S38: reset error-retry counter each user turn
+		// R4 (turn_end hygiene): a genuine new user prompt consumes any queued
+		// retry nudge (deliverAs:'followUp') — pi dispatches it as the prompt for
+		// this turn. Clearing retryNudgePending re-arms the dedup gate so the
+		// next error turn can fire a fresh nudge (subject to backoff).
+		// NOTE: the poisoned-repeat tracker (lastErrorText / errorTextRepeatCount)
+		// is NOT reset here — a retry turn consuming the queued nudge is still the
+		// same error sequence. The tracker resets on a SUCCESSFUL turn (null) or
+		// when a different error text appears, not on the turn boundary.
+		runtime.rt.retryNudgePending = false;
 		runtime.dashboard.event("turn_start", { turnIndex: event.turnIndex });
 		runtime.snapshot(ctx);
 	});
@@ -238,6 +248,26 @@ export function registerAgentHandlers(
 		runtime.dashboard.event("turn_end", { turnIndex: event.turnIndex });
 		runtime.snapshot(ctx);
 
+		// S43 (per-turn tracking): record one turn row with the cached metrics so
+		// the turn layer is queryable + forkable. Best-effort + non-fatal: a write
+		// failure never breaks the agent loop.
+		try {
+			const convId = ensureConversationId(runtime.rt.sessionId, runtime.currentStateDir);
+			recordTurn({
+				conversationId: convId,
+				sessionId: runtime.rt.sessionId,
+				turnIndex: event.turnIndex,
+				endedAt: Date.now(),
+				startedAt: undefined,
+				ctxTokens: runtime.lastCtxTokens ?? undefined,
+				ctxPercent: runtime.lastCtxPercent ?? undefined,
+				pressureBand: runtime.pressureBand ?? undefined,
+				modelId: runtime.currentModel?.modelId ?? undefined,
+			}, runtime.currentStateDir);
+		} catch {
+			/* non-fatal: per-turn tracking never breaks the agent loop */
+		}
+
 		// S33: game-mode scoring — record turns + cache metrics per repo, and arm
 		// the MEGA CACHE flare (oopsie gag) when the real dedup hit rate exceeds
 		// 100%. Gated behind game_mode_on (no scoring when off). Best-effort +
@@ -319,9 +349,11 @@ export function registerAgentHandlers(
 
 		// S38: broader error-retry safety net. S28 only catches stopReason==='length';
 		// this catches ALL other error types (provider failure, network timeout, 5xx,
-		// 429, auth, compaction-noop) that surface at turn_end. Non-fatal: wrapped in
-		// try/catch so a classifier/retry failure never breaks the agent loop.
-		// PREVENT-PI-003: retry nudge fires via pi.sendUserMessage (user-role).
+		// 429, auth, compaction-noop, poisoned-context) that surface at turn_end.
+		// Non-fatal: wrapped in try/catch so a classifier/retry failure never breaks
+		// the agent loop. PREVENT-PI-003: retry nudge fires via pi.sendUserMessage
+		// (user-role). R1-R4 (retry redesign) bound the loop: in-flight dedup,
+		// gating backoff, session-global cap, poisoned-context detection.
 		try {
 			// (1) S28 owns length — skip the classifier entirely for it.
 			const sr = (event.message as { stopReason?: string } | undefined)?.stopReason;
@@ -329,17 +361,51 @@ export function registerAgentHandlers(
 				// S28 handles; nothing for S38 to do here.
 			} else {
 				const category = classifyError(event.message);
-				if (category === null) {
+				// R3: stateful poisoned-context signal — repeated identical error text
+				// across consecutive turns. The classifier is stateless, so this
+				// upgrade happens here. A 'transient' (or 'poisoned-context') turn
+				// whose normalized error signature matches the previous one bumps
+				// errorTextRepeatCount; once it crosses the threshold, the category
+				// is upgraded to 'poisoned-context' (the request is deterministic).
+				// Conservative: only upgrade, never downgrade, and only for transient
+				// (a 'permanent' auth error repeating is still permanent).
+				let effectiveCategory = category;
+				const errSig = extractErrorSignature(event.message);
+				if (category === 'transient' || category === 'poisoned-context') {
+					if (errSig) {
+						if (runtime.rt.lastErrorText === errSig) {
+							runtime.rt.errorTextRepeatCount++;
+						} else {
+							runtime.rt.lastErrorText = errSig;
+							runtime.rt.errorTextRepeatCount = 1;
+						}
+						if (
+							runtime.rt.errorTextRepeatCount >= config.poisonedContextRepeatThreshold &&
+							category === 'transient'
+						) {
+							effectiveCategory = 'poisoned-context';
+						}
+					}
+				} else {
+					// Non-transient (success, cancelled, compaction-noop, context-overflow,
+					// permanent): a fresh non-identical signal clears the repeat tracker.
+					runtime.rt.lastErrorText = undefined;
+					runtime.rt.errorTextRepeatCount = 0;
+				}
+				if (effectiveCategory === null) {
 					// (3) success / normal flow / unknown-but-non-retryable — reset.
 					runtime.rt.errorRetryCount = 0;
 					runtime.rt.consecutiveErrors = 0; // S38.6: circuit-breaker reset on success
-				} else if (category === 'compaction-noop') {
+					// R4: a successful assistant turn consumes any queued nudge.
+					runtime.rt.retryNudgePending = false;
+				} else if (effectiveCategory === 'compaction-noop') {
 					// (4) pi race / manual compact catch — NOT retryable. The compaction
 					// already succeeded via pi's native path; retrying would race again
 					// (FAIL-2026071701). Log a diagnostic, reset the counter, and surface
 					// the original error WITHOUT firing a retry nudge.
 					runtime.rt.errorRetryCount = 0;
 					runtime.rt.consecutiveErrors = 0; // S38.6: circuit-breaker reset
+					runtime.rt.retryNudgePending = false; // R4: terminal for this burst
 					runtime.dashboard.event('compaction_noop_diagnostic', {
 						turnIndex: event.turnIndex,
 						sessionId: runtime.rt.sessionId,
@@ -348,13 +414,14 @@ export function registerAgentHandlers(
 						sessionId: runtime.rt.sessionId,
 						turnIndex: event.turnIndex,
 					});
-				} else if (category === 'cancelled') {
+				} else if (effectiveCategory === 'cancelled') {
 					// (4c) User ESC / Ctrl-C — stopReason === 'aborted'. NOT retryable:
 					// nudging would restart a task the user explicitly stopped.
 					// Reset both counters (a cancel is not an error for circuit-breaker
 					// purposes). Emit a diagnostic so the dashboard shows it.
 					runtime.rt.errorRetryCount = 0;
 					runtime.rt.consecutiveErrors = 0;
+					runtime.rt.retryNudgePending = false; // R4: terminal for this burst
 					runtime.dashboard.event('error_retry_cancelled', {
 						turnIndex: event.turnIndex,
 						sessionId: runtime.rt.sessionId,
@@ -363,7 +430,7 @@ export function registerAgentHandlers(
 						sessionId: runtime.rt.sessionId,
 						turnIndex: event.turnIndex,
 					});
-				} else if (category === 'context-overflow') {
+				} else if (effectiveCategory === 'context-overflow') {
 					// (4b) context-window overflow 400 ("too long... even after compaction").
 					// NOT a blind retry: re-submitting the same oversized prompt would just
 					// re-400 and busy-loop. Reset the counters (this turn is terminal, not
@@ -376,6 +443,7 @@ export function registerAgentHandlers(
 					// separate nudge here.
 					runtime.rt.errorRetryCount = 0;
 					runtime.rt.consecutiveErrors = 0;
+					runtime.rt.retryNudgePending = false; // R4: terminal for this burst
 					runtime.dashboard.event('context_overflow', {
 						turnIndex: event.turnIndex,
 						sessionId: runtime.rt.sessionId,
@@ -405,13 +473,76 @@ export function registerAgentHandlers(
 							}, 500);
 						}
 					}
+				} else if (effectiveCategory === 'poisoned-context') {
+					// R3: poisoned context — a DETERMINISTIC request-rejection that
+					// retrying cannot fix (0-token 'error', generic "request failed",
+					// 400 non-overflow, or repeated identical error text). NO blind
+					// retry nudge — re-submitting the same poisoned prompt re-triggers
+					// the same rejection (the 2026-07-28 incident: ~60-message spam).
+					// Instead: (a) dashboard event + warn log naming the suspected
+					// poison; (b) ONE user-role advise message (/clear or /new) per
+					// session, throttled; (c) if config.auto, ONE guarded compact per
+					// error signature (same race-guarded deferred path as context-
+					// overflow) — only if not already attempted for this signature.
+					runtime.rt.errorRetryCount = 0; // poisoned is terminal for this burst
+					runtime.rt.consecutiveErrors++; // still counts toward the circuit breaker
+					runtime.rt.poisonedCount++; // R7: dashboard counter
+					const sig = errSig || 'unknown';
+					// (a) dashboard + log
+					runtime.dashboard.event('poisoned_context', {
+						signature: sig,
+						repeatCount: runtime.rt.errorTextRepeatCount,
+						turnIndex: event.turnIndex,
+						sessionId: runtime.rt.sessionId,
+					});
+					runtime.logger.warn('poisoned-context', {
+						sessionId: runtime.rt.sessionId,
+						turnIndex: event.turnIndex,
+						signature: sig,
+						repeatCount: runtime.rt.errorTextRepeatCount,
+					});
+					// (b) one-per-session advise message (throttled by poisonedAdviseSent)
+					if (!runtime.rt.poisonedAdviseSent) {
+						runtime.rt.poisonedAdviseSent = true;
+						// PREVENT-PI-003: user-role sendUserMessage only.
+						await safeSendUserMessage(
+							pi,
+							'[mega-compact] this session\'s context may be poisoned (the provider is rejecting every request). Run /clear or /new to start a fresh context.',
+						);
+					}
+					// (c) one guarded compact per error signature (attempt to remove
+					// the poisoned region). Race-guarded + deferred, mirroring the
+					// context-overflow path. Only if not already attempted for this
+					// signature (poisonedCompactSignatures).
+					if (config.auto && !runtime.rt.poisonedCompactSignatures.has(sig)) {
+						runtime.rt.poisonedCompactSignatures.add(sig);
+						const nowP = Date.now();
+						const cooldownMsP = config.raceGuardStrict ? 30_000 : 10_000;
+						const sinceCompactP = nowP - (runtime.rt.lastNativeCompactAt ?? 0);
+						if (sinceCompactP >= cooldownMsP && !piCompactWouldNoop(ctx)) {
+							runtime.debounceUntil = nowP + 0;
+							const stampP = runtime.rt.lastNativeCompactAt;
+							const liveSidP = runtime.rt.sessionId;
+							setTimeout(() => {
+								try {
+									if (runtime.rt.sessionId !== liveSidP) return; // session reset
+									const sinceP = Date.now() - (runtime.rt.lastNativeCompactAt ?? 0);
+									if (runtime.rt.lastNativeCompactAt !== stampP && sinceP < cooldownMsP) return;
+									if (piCompactWouldNoop(ctx)) return;
+									ctx.compact({ customInstructions: undefined }); // guardrails-allow PREVENT-PI-004: local ctx.compact() — no network; deferred + re-validated. One guarded compact after a poisoned-context detection.
+								} catch {
+									/* non-fatal */
+								}
+							}, 500);
+						}
+					}
 				} else {
 					// (5) transient or permanent — retry with exponential backoff.
 					// S38.7: hard-stop switch — bypass ALL retry logic when set.
 					if (config.errorRetryHardStop) {
 						runtime.rt.errorRetryCount = 0;
 						runtime.dashboard.event('error_retry_disabled', {
-							category,
+							category: effectiveCategory,
 							turnIndex: event.turnIndex,
 							reason: 'hard-stop',
 						});
@@ -433,7 +564,7 @@ export function registerAgentHandlers(
 						return; // early exit — circuit breaker tripped
 					}
 					const max =
-						category === 'transient'
+						effectiveCategory === 'transient'
 							? config.autoRetryTransientMax
 							: config.autoRetryPermanentMax;
 					// max === 0 disables the category entirely (revert to S28-only).
@@ -444,39 +575,93 @@ export function registerAgentHandlers(
 							if (runtime.rt.errorRetryCount > max) {
 								// Exhausted — surface the error, reset for the next burst.
 								runtime.dashboard.event('error_retry_exhausted', {
-									category,
+									category: effectiveCategory,
 									count: runtime.rt.errorRetryCount,
 									max,
 									turnIndex: event.turnIndex,
 								});
 								runtime.logger.info('error-retry-exhausted', {
 									sessionId: runtime.rt.sessionId,
-									category,
+									category: effectiveCategory,
 									count: runtime.rt.errorRetryCount,
 									max,
 								});
 								runtime.rt.errorRetryCount = 0;
 							} else {
-								// S38: fire the retry nudge. Each error turn fires its own
-								// nudge up to `max` — we intentionally do NOT debounce on the
-								// backoff window (errorRetryUntil) here, because that would
-								// suppress turns 2..max on a fast-erroring provider (the exact
-								// scenario this feature targets) and the user could see zero
-								// retries followed by error_retry_exhausted. The per-turn cap
-								// (errorRetryCount <= max) plus the session circuit breaker
-								// (consecutiveErrors > maxConsecutiveErrors) already bound the
-								// loop, so a tight turn_end storm cannot busy-loop unbounded.
-								// errorRetryUntil + errorRetryBackoffMs() are retained on the
-								// runtime for future/optional pacing but are not gating.
+								// R2: session-global cap — total S38 nudges per session across
+								// ALL bursts. Independent of the per-burst max and the circuit
+								// breaker. Hitting it is terminal for the session: log +
+								// dashboard event, stop nudging. `0` disables (reverts to
+								// per-burst + circuit-breaker only).
+								if (
+									config.errorRetrySessionMax > 0 &&
+									runtime.rt.errorRetrySessionCount >= config.errorRetrySessionMax
+								) {
+									runtime.dashboard.event('error_retry_session_exhausted', {
+										count: runtime.rt.errorRetrySessionCount,
+										max: config.errorRetrySessionMax,
+										category: effectiveCategory,
+										turnIndex: event.turnIndex,
+									});
+									runtime.logger.warn('error-retry-session-exhausted', {
+										sessionId: runtime.rt.sessionId,
+										count: runtime.rt.errorRetrySessionCount,
+										max: config.errorRetrySessionMax,
+										category: effectiveCategory,
+									});
+									runtime.rt.errorRetryCount = 0;
+									return; // terminal for the session — no nudge
+								}
+								// R1: in-flight nudge dedup — a nudge queued via
+								// deliverAs:'followUp' must not be re-sent until it has been
+								// consumed by an actual new agent turn (turn_start resets
+								// retryNudgePending). Without this, a fast-erroring provider +
+								// a per-turn nudge → N nudges queue up and pi dispatches N
+								// retry turns, each re-submitting the same failing prompt
+								// (the 2026-07-28 incident). errorRetryCount still advances
+								// (this IS an error turn), so the per-burst max + circuit
+								// breaker still bound the burst.
+								if (runtime.rt.retryNudgePending) {
+									runtime.dashboard.event('error_retry_dedup_skip', {
+										category: effectiveCategory,
+										count: runtime.rt.errorRetryCount,
+										max,
+										turnIndex: event.turnIndex,
+									});
+									return; // pending nudge not yet consumed — skip
+								}
+								// R1: gating backoff — errorRetryUntil is now GATING
+								// (previously documented as non-gating). A nudge cannot fire
+								// before the previous backoff elapses. This paces retries
+								// (5s/10s/20s/30s by default) so a fast-erroring provider
+								// doesn't slam N nudges in <1s.
+								const now = Date.now();
+								if (now < runtime.rt.errorRetryUntil) {
+									runtime.dashboard.event('error_retry_backoff_skip', {
+										category: effectiveCategory,
+										count: runtime.rt.errorRetryCount,
+										max,
+										turnIndex: event.turnIndex,
+									});
+									return; // backoff not elapsed — skip
+								}
+								// Fire the retry nudge. Set pending (R1 dedup) + backoff
+								// (R1 pacing) + session count (R2 cap) BEFORE the await so a
+								// re-entrant turn_end during the send can't double-fire.
+								runtime.rt.retryNudgePending = true;
+								runtime.rt.lastErrorRetryAt = now;
+								runtime.rt.errorRetryUntil =
+									now + errorRetryBackoffMs(runtime.rt.errorRetryCount, config.errorRetryBackoffMs);
+								runtime.rt.errorRetrySessionCount++;
 								runtime.dashboard.event('error_retry', {
-									category,
+									category: effectiveCategory,
 									count: runtime.rt.errorRetryCount,
 									max,
 									turnIndex: event.turnIndex,
 								});
 								runtime.logger.info('error-retry', {
 									sessionId: runtime.rt.sessionId,
-									category,
+									category: effectiveCategory,
 									count: runtime.rt.errorRetryCount,
 									max,
 								});

package/extensions/mega-events/context-handler.ts

@@ -29,12 +29,43 @@ import {
 	pressureRatio,
 	type MegaConfig,
 } from "../mega-config.js";
-import { createHash } from "node:crypto";
+import { computeContentDigest } from "../../src/dedup/digest.js";
+
+/**
+ * Recursively canonicalize a value for deterministic JSON serialization:
+ * - Objects: keys sorted alphabetically, values recursively canonicalized
+ * - Arrays: elements recursively canonicalized (array ORDER is preserved)
+ * - Primitives: returned as-is
+ *
+ * F5 fix: shallow-sorted JSON.stringify(content, Object.keys(content).sort())
+ * omitted nested keys not in the top-level keys array and only sorted one level.
+ * This recursively sorts every object at every depth so semantically-equal
+ * differently-ordered content hashes identically.
+ */
+function canonicalize(value: unknown): unknown {
+	if (value === null || value === undefined) return value;
+	if (typeof value !== "object") return value;
+	if (Array.isArray(value)) return value.map(canonicalize);
+	// Plain object: sort keys, recursively canonicalize values.
+	const sorted = Object.keys(value as Record<string, unknown>).sort();
+	const out: Record<string, unknown> = {};
+	for (const k of sorted) {
+		out[k] = canonicalize((value as Record<string, unknown>)[k]);
+	}
+	return out;
+}
 
 /**
  * Convert a pi AgentMessage to a RawTranscriptRow for the DB mirror.
- * content_bytes is canonical JSON (sorted keys) for deterministic hashing.
- * Returns null if the message has no usable content.
+ * content_bytes is canonical JSON (sorted keys, recursive) for deterministic
+ * storage; contentHash is the canonical digest (normalize + hash) that matches
+ * what dedupTranscript computes so the two pipelines use the same linkage key.
+ *
+ * F4 fix: the hash key MUST match on both sides of the append/dedup split.
+ * Using computeContentDigest here (normalize → hash) ensures content_ref set
+ * by dedupTranscript always resolves to an existing dedup_mirror row even for
+ * whitespace/case-variant content. F5 fix: recursive canonicalize replaces the
+ * broken shallow-sorted JSON.stringify replacer.
  */
 function toRawTranscriptRow(
 	msg: AgentMessage,
@@ -50,12 +81,17 @@ function toRawTranscriptRow(
 	};
 	const content = m.content;
 	if (content == null || content === "") return null;
-	// Canonical form: sort object keys for deterministic hashing.
+	// Canonical bytes: string content → normalize for consistent byte content;
+	// object content → recursive canonicalize then JSON (no replacer).
 	const contentBytes =
 		typeof content === "string"
-			? content
-			: JSON.stringify(content, Object.keys(content as object).sort());
-	const contentHash = createHash("sha256").update(contentBytes).digest("hex");
+			? content // F5: strings are primitives; their byte content is fixed
+			: JSON.stringify(canonicalize(content));
+	// F4 fix: use the same digest as dedupTranscript so contentHash is consistent
+	// on both sides of the append/dedup split. computeContentDigest normalizes
+	// (strip ANSI, NFC, case-fold, collapse whitespace) then hashes → the same
+	// key is stored in raw_transcript.content_hash AND used as the dedup link.
+	const { contentHash } = computeContentDigest(contentBytes);
 	return {
 		contentHash,
 		sessionId,

package/extensions/mega-events/error-classifier.ts

@@ -4,6 +4,12 @@
  * Classifies turn-end error/stop signals into retry categories.
  * Ordering matters: compaction-noop is matched BEFORE generic transient
  * so a pi race / manual compact catch is never misclassified.
+ *
+ * R3 (retry redesign): a new 'poisoned-context' category for DETERMINISTIC
+ * request-rejection failures that retrying cannot fix. See agent-handlers.ts
+ * for the poisoned handling (no blind retry; one /clear advise; one guarded
+ * compact per signature). Conservative: when unsure between transient and
+ * poisoned, choose transient (bounded by R1 dedup + R2 session cap).
  */
 
 /** S38.2: classify a turn-end error/stop signal into a retry category.
@@ -12,7 +18,7 @@
  * exclusively (its agent_end nudge path is separate and must not be doubled).
  *
  * @param message  the event.message (a pi AgentMessage) or an error string
- * @returns 'transient' | 'permanent' | 'compaction-noop' | 'context-overflow' | 'cancelled' | null (success/unknown)
+ * @returns 'transient' | 'permanent' | 'compaction-noop' | 'context-overflow' | 'cancelled' | 'poisoned-context' | null (success/unknown)
  */
 export function classifyError(message: unknown):
 	| 'transient'
@@ -20,9 +26,18 @@ export function classifyError(message: unknown):
 	| 'compaction-noop'
 	| 'context-overflow'
 	| 'cancelled'
+	| 'poisoned-context'
 	| null {
 	// Resolve a searchable text blob from a pi AgentMessage or raw string.
 	let text = '';
+	// R3: usage-token signal. Only when `usage` is explicitly present with
+	// inputTokens=0 AND outputTokens=0 do we know the turn never reached the
+	// model. An ABSENT usage field means "unknown" (the event didn't carry
+	// token counts) — we do NOT treat that as the 0-token poisoned signal,
+	// because mid-response stream deaths and partial-content turns routinely
+	// omit usage while still being transient (preserves all pre-R3 tests).
+	let usagePresent = false;
+	let totalTokens = 0;
 	if (typeof message === 'string') {
 		text = message;
 	} else if (message && typeof message === 'object') {
@@ -30,6 +45,7 @@ export function classifyError(message: unknown):
 			stopReason?: string;
 			content?: unknown;
 			error?: unknown;
+			usage?: { inputTokens?: number; outputTokens?: number } | undefined;
 		};
 		const sr = typeof m.stopReason === 'string' ? m.stopReason : '';
 		// S28 guard: length stopReason is handled exclusively by the S28 path.
@@ -39,6 +55,15 @@ export function classifyError(message: unknown):
 		if (sr === 'aborted') return 'cancelled';
 		// Success / normal tool flow — not an error, nothing to retry.
 		if (sr === 'stop' || sr === 'toolUse' || sr === 'tool_use') return null;
+		// R3: extract usage tokens for the 0-token poisoned-context signal.
+		const usage = m.usage;
+		usagePresent = usage != null && typeof usage === 'object';
+		if (usagePresent) {
+			const u = usage as { inputTokens?: number; outputTokens?: number };
+			totalTokens =
+				(typeof u.inputTokens === 'number' ? u.inputTokens : 0) +
+				(typeof u.outputTokens === 'number' ? u.outputTokens : 0);
+		}
 		const parts: string[] = [];
 		if (sr) parts.push(sr);
 		const c = m.content;
@@ -47,7 +72,7 @@ export function classifyError(message: unknown):
 			for (const b of c) {
 				if (b && typeof b === 'object' && 'text' in b) {
 					parts.push(String((b as { text?: string }).text ?? ''));
-			}
+				}
 			}
 		}
 		if (m.error) {
@@ -109,31 +134,114 @@ export function classifyError(message: unknown):
 	if (/too long|context window|maximum context length|context length exceeded|requires at least \d+ tokens|even after compaction|reduce the conversation|reduce your input/.test(s)) {
 		return 'context-overflow';
 	}
-	// --- transient (retryable) ---
-	if (s.includes('error') && !/\b(permanent|invalid request|malformed|bad request|auth|unauthorized|invalid (api )?key|permission)\b/.test(s)) {
-		return 'transient'; // generic pi stopReason 'error' / 'aborted'
+	// --- transient (specific markers FIRST — these override poisoned signals) ---
+	// R3: network failures (timeout, ECONNRESET, 5xx, 429) MUST stay transient
+	// even when usage is 0 tokens, because they are retryable. The specific
+	// markers below return before any poisoned signal is evaluated.
+	if (/max(imum)? output token/.test(s)) return 'transient';
+	if (/rate[\s.-]?limit|429|too many requests/.test(s)) return 'transient';
+	if (/5\d\d|internal server|bad gateway|service unavailable/.test(s)) return 'transient';
+	// 'connection aborted' is a network failure (ECONNABORTED), NOT a user ESC
+	// (which is stopReason 'aborted', handled by the early-return above). Added
+	// so "Connection aborted by peer" stays transient under R3. ECONNRESET and
+	// common errno names are included so a bare 0-token 'ECONNRESET' turn is not
+	// misclassified as poisoned (R6: ECONNRESET → transient).
+	if (/network|timeout|econnreset|econnrefused|epipe|connection (lost|refused|reset|aborted)|stream (interrupted|closed|ended|failed)|disconnected/.test(s)) return 'transient';
+	// --- poisoned-context (R3: ORDER AFTER specific transient markers, BEFORE
+	// the generic 'error' transient fallthrough) ---
+	// A DETERMINISTIC request-rejection that retrying cannot fix. Re-submitting
+	// the same prompt re-triggers the same rejection. The 2026-07-28 incident
+	// was a provider returning 0-token "Request failed — please retry." turns
+	// for every request; classifyError mapped stopReason 'error' → 'transient'
+	// and the session emitted ~9 nudge bursts (~60 context-bloating messages)
+	// before stopping.
+	//
+	// Signal 1: provider request-validation 400 that is NOT context-overflow
+	// (context-overflow already returned above). Orphaned tool result / malformed
+	// message structure / unexpected role ordering / empty content. These were
+	// previously classified 'permanent' (max 1 retry) — but a single retry
+	// re-submits the SAME malformed structure and re-400s, so they are poisoned,
+	// not permanent. Auth/permission 400s stay permanent (separate check below).
+	if (/invalid_request_error|invalid request|malformed|bad request|orphaned tool|tool (result )?(without|for )|unexpected role|role (ordering|sequence)|empty (content|message|request)/.test(s)) {
+		return 'poisoned-context';
+	}
+	// Signal 2: generic catch-all "request failed" / "request error" with no
+	// specific transient marker (transient markers already returned above).
+	// This is the exact phrasing the 2026-07-28 incident used. Without a
+	// specific retryable cause, treat the rejection as deterministic.
+	if (/request failed|request error/.test(s)) {
+		return 'poisoned-context';
+	}
+	// Signal 3: stopReason 'error' + usage explicitly 0 tokens (the turn never
+	// reached the model). Conservative: only when `usage` is PRESENT and 0 — an
+	// absent usage field means "unknown" and stays transient (mid-response
+	// deaths / partial-content turns often omit usage). The transient markers
+	// above already returned, so reaching here with 'error' text and 0 tokens
+	// means the request was rejected before any model work.
+	if (usagePresent && totalTokens === 0 && /error/.test(s)) {
+		return 'poisoned-context';
+	}
+	// --- transient (generic 'error' stopReason fallthrough) ---
+	// Reaches here for a generic stopReason 'error' with no specific marker and
+	// no 0-token signal (usage absent or > 0). Stays transient — conservative.
+	if (s.includes('error') && !/\b(auth|unauthorized|invalid (api )?key|permission)\b/.test(s)) {
+		return 'transient'; // generic pi stopReason 'error'
 	}
 	// NOTE: 'aborted' stopReason is handled by the sr==='aborted' early-return above.
 	// The text-based s.includes('aborted') was removed — it was the old path that
 	// misclassified user ESC/Ctrl-C as 'transient' (5 retry nudges after cancel).
-	if (/max(imum)? output token/.test(s)) return 'transient';
-	if (/rate[\s.-]?limit|429|too many requests/.test(s)) return 'transient';
-	if (/5\d\d|internal server|bad gateway|service unavailable/.test(s)) return 'transient';
-	if (/network|timeout|connection (lost|refused|reset)|stream (interrupted|closed|ended|failed)|disconnected/.test(s)) return 'transient';
 	// --- permanent (NOT retryable beyond 1) ---
 	if (/auth|unauthorized|invalid (api )?key|permission/.test(s)) return 'permanent';
-	if (/invalid request|malformed|bad request/.test(s)) return 'permanent';
 	// Unknown — do not retry (avoid busy-looping on an unclassified signal).
 	return null;
 }
 
-/** S38.2: exponential backoff for error-retry nudges (5s,10s,20s,30s,30s cap).
- *  count is 1-based (the retry about to fire). */
-export function errorRetryBackoffMs(count: number): number {
+/** S38.2: exponential backoff for error-retry nudges.
+ *  count is 1-based (the retry about to fire). baseMs is the unit
+ *  (config.errorRetryBackoffMs, default 5000 → 5s/10s/20s/30s cap).
+ *  R1: errorRetryUntil is now GATING — a nudge cannot fire before the previous
+ *  backoff elapses (previously documented as non-gating). */
+export function errorRetryBackoffMs(count: number, baseMs = 5000): number {
 	switch (count) {
-		case 1: return 5_000;
-		case 2: return 10_000;
-		case 3: return 20_000;
-		default: return 30_000; // cap from the 4th retry onward
+		case 1: return baseMs;
+		case 2: return baseMs * 2;
+		case 3: return baseMs * 4;
+		default: return baseMs * 6; // cap from the 4th retry onward
+	}
+}
+
+/** R3: extract a normalized error-signature string from a turn_end message for
+ *  the stateful "repeated identical error text" signal. Returns the lowercased
+ *  content + error.message blob (WITHOUT the stopReason, which is constant
+ *  'error' for retryable turns) so two turns with the same error content share
+ *  a signature. Empty string when there is no error text (e.g. a bare
+ *  stopReason 'error' with no content) — the caller skips repeat detection in
+ *  that case (the stateless 0-token signal handles bare errors). */
+export function extractErrorSignature(message: unknown): string {
+	if (typeof message === 'string') return message.toLowerCase().trim();
+	if (!message || typeof message !== 'object') return '';
+	const m = message as {
+		content?: unknown;
+		error?: unknown;
+	};
+	const parts: string[] = [];
+	const c = m.content;
+	if (typeof c === 'string') parts.push(c);
+	else if (Array.isArray(c)) {
+		for (const b of c) {
+			if (b && typeof b === 'object' && 'text' in b) {
+				parts.push(String((b as { text?: string }).text ?? ''));
+			}
+		}
+	}
+	if (m.error) {
+		const err = m.error;
+		if (typeof err === 'string') parts.push(err);
+		else if (err && typeof err === 'object') {
+			const errObj = err as Record<string, unknown>;
+			if (typeof errObj.message === 'string') parts.push(errObj.message);
+			else parts.push(JSON.stringify(err));
+		}
 	}
+	return parts.join(' ').toLowerCase().trim();
 }