tinker-agent 1.9.0 → 1.11.0

package/src/session/session-schema.ts

@@ -442,7 +442,9 @@ const schemaDefinitions: readonly SchemaDefinition[] = [
       WHERE role IN ('user', 'assistant', 'tool')
         AND content IS NOT NULL
         AND length(content) > 0
-        AND NOT (role = 'tool' AND name = 'Recall')`,
+        AND NOT (
+          role = 'tool' AND name IN ('Recall', 'RecallSearch', 'RecallGet')
+        )`,
   },
   {
     type: "table",
@@ -462,7 +464,9 @@ const schemaDefinitions: readonly SchemaDefinition[] = [
       WHEN NEW.role IN ('user', 'assistant', 'tool')
         AND NEW.content IS NOT NULL
         AND length(NEW.content) > 0
-        AND NOT (NEW.role = 'tool' AND NEW.name = 'Recall')
+        AND NOT (
+          NEW.role = 'tool' AND NEW.name IN ('Recall', 'RecallSearch', 'RecallGet')
+        )
       BEGIN
         INSERT INTO message_fts(rowid, content)
         VALUES (NEW.rowid, NEW.content);
@@ -595,7 +599,12 @@ const schemaDefinitions: readonly SchemaDefinition[] = [
               AND pf.kind = 'user' AND pf.state = 'closed'
               AND pf.first_ordinal = NEW.keep_from_ordinal
               AND pf.last_ordinal = NEW.keep_from_ordinal
-              AND t.status <> 'open'
+              AND (
+                t.status <> 'open' OR (
+                  NOT EXISTS (SELECT 1 FROM iterations WHERE outcome = 'open') AND
+                  NOT EXISTS (SELECT 1 FROM protocol_frames WHERE state = 'open')
+                )
+              )
           ) AND
           EXISTS (
             SELECT 1 FROM messages m
@@ -850,6 +859,170 @@ export const SESSION_SCHEMA_V9_FINGERPRINT = sha256(
   }),
 );
 
+const PRE_SPLIT_RECALL_SCHEMA_V9_FINGERPRINT =
+  "27c61d806778689f88211b6eaa6dd9dc3a730dfd4133c862006140576b2ecd10";
+
+const PRE_ACTIVE_TURN_RETIREMENT_SCHEMA_V9_FINGERPRINT =
+  "263a0415b343a922efc65aab4a3387a8b31de18e82245ce67b9296b7a02f4a26";
+
+const ACTIVE_TURN_RETIREMENT_TRIGGER_FRAGMENT = `AND (
+                t.status <> 'open' OR (
+                  NOT EXISTS (SELECT 1 FROM iterations WHERE outcome = 'open') AND
+                  NOT EXISTS (SELECT 1 FROM protocol_frames WHERE state = 'open')
+                )
+              )`;
+
+const preActiveTurnRetirementSchemaDefinitions = replaceSchemaDefinitionSql(
+  schemaDefinitions,
+  "trigger",
+  "context_revisions_validate_insert",
+  (sql) =>
+    replaceExactSqlFragment(
+      sql,
+      ACTIVE_TURN_RETIREMENT_TRIGGER_FRAGMENT,
+      "AND t.status <> 'open'",
+    ),
+);
+
+const preSplitRecallSchemaDefinitions = replaceSchemaDefinitionSql(
+  replaceSchemaDefinitionSql(
+    preActiveTurnRetirementSchemaDefinitions,
+    "view",
+    "recall_documents",
+    () => `CREATE VIEW recall_documents AS
+      SELECT rowid AS docid, content
+      FROM messages
+      WHERE role IN ('user', 'assistant', 'tool')
+        AND content IS NOT NULL
+        AND length(content) > 0
+        AND NOT (role = 'tool' AND name = 'Recall')`,
+  ),
+  "trigger",
+  "messages_recall_index",
+  () => `CREATE TRIGGER messages_recall_index
+      AFTER INSERT ON messages
+      WHEN NEW.role IN ('user', 'assistant', 'tool')
+        AND NEW.content IS NOT NULL
+        AND length(NEW.content) > 0
+        AND NOT (NEW.role = 'tool' AND NEW.name = 'Recall')
+      BEGIN
+        INSERT INTO message_fts(rowid, content)
+        VALUES (NEW.rowid, NEW.content);
+      END`,
+);
+
+export function upgradeRecallIndexContract(database: Database): boolean {
+  const applicationId = Number(singlePragmaValue(database, "PRAGMA application_id"));
+  const userVersion = Number(singlePragmaValue(database, "PRAGMA user_version"));
+  if (
+    applicationId !== SESSION_APPLICATION_ID ||
+    userVersion !== SESSION_SCHEMA_VERSION
+  ) {
+    return false;
+  }
+  const meta = database
+    .query(
+      `SELECT schema_version, schema_fingerprint
+       FROM session_meta WHERE singleton = 1`,
+    )
+    .get() as { schema_version: unknown; schema_fingerprint: unknown } | null;
+  if (
+    meta === null ||
+    Number(meta.schema_version) !== SESSION_SCHEMA_VERSION ||
+    meta.schema_fingerprint !== PRE_SPLIT_RECALL_SCHEMA_V9_FINGERPRINT
+  ) {
+    return false;
+  }
+  const recallView = schemaDefinitions.find(
+    (definition) =>
+      definition.type === "view" && definition.name === "recall_documents",
+  );
+  const recallTrigger = schemaDefinitions.find(
+    (definition) =>
+      definition.type === "trigger" && definition.name === "messages_recall_index",
+  );
+  const metadataTrigger = schemaDefinitions.find(
+    (definition) =>
+      definition.type === "trigger" &&
+      definition.name === "session_meta_monotonic_update",
+  );
+  if (
+    recallView === undefined ||
+    recallTrigger === undefined ||
+    metadataTrigger === undefined
+  ) {
+    throw new Error("Recall index schema definitions are missing.");
+  }
+  database.exec("DROP TRIGGER messages_recall_index");
+  database.exec("DROP VIEW recall_documents");
+  database.exec(recallView.sql);
+  database.exec(recallTrigger.sql);
+  rebuildRecallIndex(database);
+  database.exec("DROP TRIGGER session_meta_monotonic_update");
+  database
+    .query(
+      `UPDATE session_meta SET schema_fingerprint = ?
+       WHERE singleton = 1 AND schema_fingerprint = ?`,
+    )
+    .run(
+      PRE_ACTIVE_TURN_RETIREMENT_SCHEMA_V9_FINGERPRINT,
+      PRE_SPLIT_RECALL_SCHEMA_V9_FINGERPRINT,
+    );
+  database.exec(metadataTrigger.sql);
+  return true;
+}
+
+export function upgradeActiveTurnRetirementContract(database: Database): boolean {
+  const applicationId = Number(singlePragmaValue(database, "PRAGMA application_id"));
+  const userVersion = Number(singlePragmaValue(database, "PRAGMA user_version"));
+  if (
+    applicationId !== SESSION_APPLICATION_ID ||
+    userVersion !== SESSION_SCHEMA_VERSION
+  ) {
+    return false;
+  }
+  const meta = database
+    .query(
+      `SELECT schema_version, schema_fingerprint
+       FROM session_meta WHERE singleton = 1`,
+    )
+    .get() as { schema_version: unknown; schema_fingerprint: unknown } | null;
+  if (
+    meta === null ||
+    Number(meta.schema_version) !== SESSION_SCHEMA_VERSION ||
+    meta.schema_fingerprint !== PRE_ACTIVE_TURN_RETIREMENT_SCHEMA_V9_FINGERPRINT
+  ) {
+    return false;
+  }
+  const revisionTrigger = schemaDefinitions.find(
+    (definition) =>
+      definition.type === "trigger" &&
+      definition.name === "context_revisions_validate_insert",
+  );
+  const metadataTrigger = schemaDefinitions.find(
+    (definition) =>
+      definition.type === "trigger" &&
+      definition.name === "session_meta_monotonic_update",
+  );
+  if (revisionTrigger === undefined || metadataTrigger === undefined) {
+    throw new Error("Active-turn retirement schema definitions are missing.");
+  }
+  database.exec("DROP TRIGGER context_revisions_validate_insert");
+  database.exec(revisionTrigger.sql);
+  database.exec("DROP TRIGGER session_meta_monotonic_update");
+  database
+    .query(
+      `UPDATE session_meta SET schema_fingerprint = ?
+       WHERE singleton = 1 AND schema_fingerprint = ?`,
+    )
+    .run(
+      SESSION_SCHEMA_V9_FINGERPRINT,
+      PRE_ACTIVE_TURN_RETIREMENT_SCHEMA_V9_FINGERPRINT,
+    );
+  database.exec(metadataTrigger.sql);
+  return true;
+}
+
 export function configureWritableDatabase(database: Database): void {
   database.exec("PRAGMA foreign_keys = ON");
   const journal = singlePragmaValue(database, "PRAGMA journal_mode = WAL");
@@ -893,7 +1066,61 @@ export function reinstallSessionCloneTriggers(database: Database): void {
   }
 }
 
+export function verifyReadableSessionSchema(
+  database: Database,
+  sessionId?: SessionId,
+): "current" | "migratable" {
+  verifySessionSchemaVersion(database, sessionId);
+  const meta = database
+    .query(
+      `SELECT schema_version, schema_fingerprint
+       FROM session_meta WHERE singleton = 1`,
+    )
+    .get() as { schema_version: unknown; schema_fingerprint: unknown } | null;
+  if (
+    meta === null ||
+    Number(meta.schema_version) !== SESSION_SCHEMA_VERSION ||
+    typeof meta.schema_fingerprint !== "string"
+  ) {
+    throw new SessionError(
+      "SESSION_SCHEMA_INVALID",
+      "verify_readable_schema",
+      "Session schema metadata is invalid.",
+      { sessionId },
+    );
+  }
+
+  let expectedDefinitions: readonly SchemaDefinition[];
+  let compatibility: "current" | "migratable";
+  if (meta.schema_fingerprint === SESSION_SCHEMA_V9_FINGERPRINT) {
+    expectedDefinitions = schemaDefinitions;
+    compatibility = "current";
+  } else if (
+    meta.schema_fingerprint === PRE_ACTIVE_TURN_RETIREMENT_SCHEMA_V9_FINGERPRINT
+  ) {
+    expectedDefinitions = preActiveTurnRetirementSchemaDefinitions;
+    compatibility = "migratable";
+  } else if (meta.schema_fingerprint === PRE_SPLIT_RECALL_SCHEMA_V9_FINGERPRINT) {
+    expectedDefinitions = preSplitRecallSchemaDefinitions;
+    compatibility = "migratable";
+  } else {
+    throw new SessionError(
+      "SESSION_SCHEMA_INVALID",
+      "verify_readable_schema",
+      "Session schema is neither current nor a recognized migration source.",
+      { sessionId },
+    );
+  }
+  verifySessionSchemaDefinitions(database, expectedDefinitions, sessionId);
+  return compatibility;
+}
+
 export function verifySessionSchema(database: Database, sessionId?: SessionId): void {
+  verifySessionSchemaVersion(database, sessionId);
+  verifySessionSchemaDefinitions(database, schemaDefinitions, sessionId);
+}
+
+function verifySessionSchemaVersion(database: Database, sessionId?: SessionId): void {
   const applicationId = Number(singlePragmaValue(database, "PRAGMA application_id"));
   const userVersion = Number(singlePragmaValue(database, "PRAGMA user_version"));
   if (
@@ -907,7 +1134,13 @@ export function verifySessionSchema(database: Database, sessionId?: SessionId):
       { sessionId },
     );
   }
+}
 
+function verifySessionSchemaDefinitions(
+  database: Database,
+  expectedDefinitions: readonly SchemaDefinition[],
+  sessionId?: SessionId,
+): void {
   const actual = database
     .query(
       `SELECT type, name, sql FROM sqlite_schema
@@ -918,7 +1151,7 @@ export function verifySessionSchema(database: Database, sessionId?: SessionId):
   const actualByName = new Map(
     actual.map((entry) => [`${entry.type}:${entry.name}`, normalizeSql(entry.sql)]),
   );
-  for (const expected of schemaDefinitions) {
+  for (const expected of expectedDefinitions) {
     const actualSql = actualByName.get(`${expected.type}:${expected.name}`);
     if (actualSql !== normalizeSql(expected.sql)) {
       throw new SessionError(
@@ -1053,3 +1286,34 @@ function singlePragmaValue(database: Database, sql: string): unknown {
 function normalizeSql(sql: string): string {
   return sql.replace(/\s+/g, " ").trim().replace(/;$/, "").toLowerCase();
 }
+
+function replaceSchemaDefinitionSql(
+  definitions: readonly SchemaDefinition[],
+  type: SchemaDefinition["type"],
+  name: string,
+  replace: (sql: string) => string,
+): readonly SchemaDefinition[] {
+  const target = definitions.find(
+    (definition) => definition.type === type && definition.name === name,
+  );
+  if (target === undefined) {
+    throw new Error(`Schema definition is missing: ${type} ${name}.`);
+  }
+  return definitions.map((definition) =>
+    definition === target
+      ? { ...definition, sql: replace(definition.sql) }
+      : definition,
+  );
+}
+
+function replaceExactSqlFragment(
+  sql: string,
+  currentFragment: string,
+  previousFragment: string,
+): string {
+  const replaced = sql.replace(currentFragment, previousFragment);
+  if (replaced === sql) {
+    throw new Error("Schema definition does not contain its historical fragment.");
+  }
+  return replaced;
+}

package/src/session/session-store.ts

@@ -28,7 +28,10 @@ import {
   createModelContextProfile,
   type ModelContextProfile,
 } from "../model/model-context-profile";
-import type { ModelMessageProtocol } from "../model/model-client";
+import {
+  MODEL_MESSAGE_PROTOCOL_ADAPTERS,
+  type ModelMessageProtocol,
+} from "../model/model-client";
 import type { InputTokenEstimatorCompatibility } from "../model/input-token-estimator";
 import type { ToolDefinition, ToolRawResult } from "../tools/types";
 import { sha256, stableJsonStringify } from "../model/model-request-preflight";
@@ -45,7 +48,6 @@ import {
   ContextRevisionCompiler,
   createInitialContextRevision,
 } from "../context/context-revision-compiler";
-import { recallFirstRetirementPolicyV1 } from "../context/context-policy";
 import {
   ContextSwapRenderer,
   SWAP_OBSERVATION_FORMAT,
@@ -90,7 +92,10 @@ import { ImageAssetStore } from "../image/image-asset-store";
 import type { MeasuredContextAnchor } from "../agent/context-meter";
 import type { ProjectInstructionManifest } from "../instructions/project-instructions";
 import { SUPPORTED_RECALL_RETIREMENT_CONTRACT_VERSIONS } from "../context/recall-retirement-contract";
-import type { ClosedTurnBoundary } from "../context/prefix-retirement-planner";
+import type {
+  ActiveTurnBoundary,
+  ClosedTurnBoundary,
+} from "../context/prefix-retirement-planner";
 import {
   AdmissionStaleError,
   InMemorySessionLedger,
@@ -106,11 +111,14 @@ import { SessionLease } from "./session-lock";
 import {
   SESSION_SCHEMA_V9_FINGERPRINT,
   SESSION_SCHEMA_VERSION,
+  upgradeActiveTurnRetirementContract,
+  upgradeRecallIndexContract,
   configureWritableDatabase,
   createSessionSchema,
   dropSessionCloneTriggers,
   rebuildRecallIndex,
   reinstallSessionCloneTriggers,
+  verifyReadableSessionSchema,
   verifyRecallIndex,
   verifySessionSchema,
   verifySqliteIntegrity,
@@ -231,6 +239,7 @@ export type CommitSwapRevisionInput = {
   nextActiveOverrideManifestSha256: string;
   canonicalSequenceSha256: string;
   renderedMessageSha256: string;
+  activeTurnId?: TurnId;
 };
 
 export type CommitSwapRevisionFaultStage =
@@ -288,6 +297,7 @@ export type CommitPrefixRetirementRevisionInput = {
   nextActiveOverrideManifestSha256: string;
   canonicalSequenceSha256: string;
   renderedMessageSha256: string;
+  activeTurnId?: TurnId;
 };
 
 export type CommitPrefixRetirementRevisionFaultStage =
@@ -564,8 +574,13 @@ export class SessionStore implements SessionLedgerCommitter {
     let database: Database | undefined;
     try {
       database = openWritableDatabase(databasePath);
-      verifySessionSchema(database, input.sessionId);
       verifySqliteIntegrity(database, input.sessionId);
+      verifyReadableSessionSchema(database, input.sessionId);
+      const recallIndexContractUpgraded = runTransaction(database, () =>
+        upgradeRecallIndexContract(database!),
+      );
+      runTransaction(database, () => upgradeActiveTurnRetirementContract(database!));
+      verifySessionSchema(database, input.sessionId);
       const store = new SessionStore(database, lease, {
         sessionId: input.sessionId,
         workspaceRoot,
@@ -573,6 +588,7 @@ export class SessionStore implements SessionLedgerCommitter {
         databasePath,
         clock,
       });
+      store.recallIndexRebuilt = recallIndexContractUpgraded;
       const meta = store.readMeta();
       if (meta.initializationState !== "ready" && input.allowIncomplete !== true) {
         throw new SessionError(
@@ -644,6 +660,9 @@ export class SessionStore implements SessionLedgerCommitter {
           case "begin_turn":
             this.commitBeginTurn(mutation, now);
             break;
+          case "append_steering_users":
+            this.commitSteeringUsers(mutation, now);
+            break;
           case "append_assistant":
             this.commitAssistant(mutation, now);
             break;
@@ -926,25 +945,38 @@ export class SessionStore implements SessionLedgerCommitter {
   }
 
   assertContextRevisionIdle(): void {
+    this.assertContextRevisionBoundary();
+  }
+
+  assertContextRevisionBoundary(activeTurnId?: TurnId): void {
     this.requireOpen();
     const row = this.database
       .query(
         `SELECT
           (SELECT COUNT(*) FROM turns WHERE status = 'open') AS open_turns,
+          (SELECT turn_id FROM turns WHERE status = 'open' LIMIT 1) AS open_turn_id,
           (SELECT COUNT(*) FROM iterations WHERE outcome = 'open') AS open_iterations,
           (SELECT COUNT(*) FROM protocol_frames WHERE state = 'open') AS open_frames`,
       )
       .get() as Record<string, unknown> | null;
+    const openTurnCount =
+      row === null ? -1 : numberFromSql(row.open_turns, "open_turns");
+    const openTurnId =
+      row === null
+        ? null
+        : (nullableStringFromSql(row.open_turn_id, "open_turn_id") as TurnId | null);
     if (
       row === null ||
-      numberFromSql(row.open_turns, "open_turns") !== 0 ||
+      (activeTurnId === undefined
+        ? openTurnCount !== 0
+        : openTurnCount !== 1 || openTurnId !== activeTurnId) ||
       numberFromSql(row.open_iterations, "open_iterations") !== 0 ||
       numberFromSql(row.open_frames, "open_frames") !== 0
     ) {
       throw new SessionError(
         "SESSION_INTEGRITY_FAILED",
-        "assert_context_revision_idle",
-        "Context revision requires a fully idle session store.",
+        "assert_context_revision_boundary",
+        "Context revision requires an idle store or a closed active-turn iteration boundary.",
         { sessionId: this.sessionId },
       );
     }
@@ -955,16 +987,35 @@ export class SessionStore implements SessionLedgerCommitter {
     this.assertContextRevisionIdle();
     const canonical = this.loadProtocolView();
     this.validator.validate(canonical, { fullIntegrity: true });
-    return this.readClosedTurnBoundaries(canonical);
+    return this.readRetirementBoundaries(canonical).closedTurns;
   }
 
-  private readClosedTurnBoundaries(
+  loadRetirementBoundaries(activeTurnId?: TurnId): {
+    readonly closedTurns: readonly ClosedTurnBoundary[];
+    readonly activeTurn?: ActiveTurnBoundary;
+  } {
+    this.requireOpen();
+    this.assertContextRevisionBoundary(activeTurnId);
+    const canonical = this.loadProtocolView();
+    this.validator.validate(canonical, {
+      allowOpenTail: activeTurnId !== undefined,
+      fullIntegrity: true,
+    });
+    return this.readRetirementBoundaries(canonical, activeTurnId);
+  }
+
+  private readRetirementBoundaries(
     canonical: ProtocolContextView,
-  ): readonly ClosedTurnBoundary[] {
+    activeTurnId?: TurnId,
+  ): {
+    readonly closedTurns: readonly ClosedTurnBoundary[];
+    readonly activeTurn?: ActiveTurnBoundary;
+  } {
     const rows = this.database
       .query("SELECT * FROM turns ORDER BY turn_number")
       .all() as Array<Record<string, unknown>>;
     const boundaries: ClosedTurnBoundary[] = [];
+    let activeTurn: ActiveTurnBoundary | undefined;
     let expectedOrdinal = 2;
     for (let index = 0; index < rows.length; index += 1) {
       const row = requireItem(rows, index, "turn row");
@@ -972,8 +1023,8 @@ export class SessionStore implements SessionLedgerCommitter {
       const turnNumber = numberFromSql(row.turn_number, "turn_number");
       const status = enumFromSql(
         row.status,
-        ["completed", "failed", "cancelled", "interrupted"] as const,
-        "closed turn status",
+        ["open", "completed", "failed", "cancelled", "interrupted"] as const,
+        "turn status",
       );
       const frames = canonical.frames.filter((frame) => frame.turnId === turnId);
       const messages = canonical.messages.filter(
@@ -981,6 +1032,29 @@ export class SessionStore implements SessionLedgerCommitter {
       );
       const firstMessage = messages[0];
       const lastMessage = messages.at(-1);
+      if (status === "open") {
+        if (
+          activeTurnId === undefined ||
+          turnId !== activeTurnId ||
+          index !== rows.length - 1 ||
+          turnNumber !== index + 1 ||
+          messages.length < 1 ||
+          frames.length < 1 ||
+          firstMessage?.role !== "user" ||
+          firstMessage.ordinal !== expectedOrdinal ||
+          lastMessage?.ordinal !== canonical.messages.length ||
+          frames.some((frame) => frame.state !== "closed")
+        ) {
+          throw new Error(`Turn ${turnId} has an invalid active boundary.`);
+        }
+        activeTurn = Object.freeze({
+          turnId,
+          turnNumber,
+          firstOrdinal: expectedOrdinal,
+        });
+        expectedOrdinal = canonical.messages.length + 1;
+        continue;
+      }
       let nextFrameOrdinal = expectedOrdinal;
       for (const frame of frames) {
         if (
@@ -1019,7 +1093,13 @@ export class SessionStore implements SessionLedgerCommitter {
     if (expectedOrdinal !== canonical.messages.length + 1) {
       throw new Error("Closed turn boundaries do not cover canonical history.");
     }
-    return Object.freeze(boundaries);
+    if ((activeTurnId === undefined) !== (activeTurn === undefined)) {
+      throw new Error("Active retirement boundary does not match the open turn.");
+    }
+    return Object.freeze({
+      closedTurns: Object.freeze(boundaries),
+      ...(activeTurn === undefined ? {} : { activeTurn }),
+    });
   }
 
   commitSwapRevision(
@@ -1043,7 +1123,7 @@ export class SessionStore implements SessionLedgerCommitter {
         ) {
           throw new Error("Context revision commit base is stale.");
         }
-        this.assertContextRevisionIdle();
+        this.assertContextRevisionBoundary(input.activeTurnId);
 
         const active = this.revisionCompiler.compileActive(snapshot);
         const candidateOverrides = [
@@ -1229,25 +1309,27 @@ export class SessionStore implements SessionLedgerCommitter {
         ) {
           throw new Error("Prefix retirement commit base is stale.");
         }
-        this.assertContextRevisionIdle();
-        const closedTurns = this.readClosedTurnBoundaries(snapshot.canonical);
+        this.assertContextRevisionBoundary(input.activeTurnId);
+        const retirementBoundaries = this.readRetirementBoundaries(
+          snapshot.canonical,
+          input.activeTurnId,
+        );
+        const closedTurns = retirementBoundaries.closedTurns;
         const activeTurns = closedTurns.filter(
           (turn) => turn.firstOrdinal >= baseRevision.keepFromOrdinal,
         );
-        const nextBoundary = activeTurns.find(
-          (turn) => turn.firstOrdinal === input.nextKeepFromOrdinal,
-        );
-        const retainedTurns = activeTurns.filter(
-          (turn) => turn.firstOrdinal >= input.nextKeepFromOrdinal,
-        );
+        const nextBoundary = [
+          ...activeTurns,
+          ...(retirementBoundaries.activeTurn === undefined
+            ? []
+            : [retirementBoundaries.activeTurn]),
+        ].find((turn) => turn.firstOrdinal === input.nextKeepFromOrdinal);
         const retiredTurns = activeTurns.filter(
           (turn) => turn.lastOrdinal < input.nextKeepFromOrdinal,
         );
         if (
           nextBoundary === undefined ||
           input.nextKeepFromOrdinal <= baseRevision.keepFromOrdinal ||
-          retainedTurns.length <
-            recallFirstRetirementPolicyV1.protectedRecentTurnCount ||
           retiredTurns.length !== input.retiredTurnCount ||
           retiredTurns.reduce((total, turn) => total + turn.frameCount, 0) !==
             input.retiredFrameCount ||
@@ -2769,6 +2851,32 @@ export class SessionStore implements SessionLedgerCommitter {
     requireSingleChange(this.database, updated.changes, "advance turn counter");
   }
 
+  private commitSteeringUsers(
+    mutation: Extract<LedgerMutation, { kind: "append_steering_users" }>,
+    now: string,
+  ): void {
+    const turn = this.requireTurnRow(mutation.turn.turnId);
+    if (turn.status !== "open") {
+      throw new Error(`Turn ${mutation.turn.turnId} is not open.`);
+    }
+    if (
+      mutation.frames.length === 0 ||
+      mutation.frames.length !== mutation.messages.length
+    ) {
+      throw new Error(
+        "Steering user mutation must contain matching frames and messages.",
+      );
+    }
+    for (let index = 0; index < mutation.frames.length; index += 1) {
+      insertFrame(this.database, requireItem(mutation.frames, index, "steering frame"));
+      insertMessage(
+        this.database,
+        requireItem(mutation.messages, index, "steering message"),
+      );
+    }
+    this.touch(now);
+  }
+
   private commitAssistant(
     mutation: Extract<LedgerMutation, { kind: "append_assistant" }>,
     now: string,
@@ -3608,7 +3716,7 @@ export function createSessionCompatibilityContract(input: {
     throw new Error("Session compatibility reasoning replay flag must be boolean.");
   }
   if (
-    !["openai-chat", "fake"].includes(input.messageProtocol.adapter) ||
+    !MODEL_MESSAGE_PROTOCOL_ADAPTERS.includes(input.messageProtocol.adapter) ||
     input.messageProtocol.serializationVersion.trim() === ""
   ) {
     throw new Error("Session compatibility message protocol is invalid.");
@@ -5473,7 +5581,7 @@ function decodeSessionCompatibilityContract(
   const protocol: ModelMessageProtocol = Object.freeze({
     adapter: enumFromSql(
       messageProtocol.adapter,
-      ["openai-chat", "fake"] as const,
+      MODEL_MESSAGE_PROTOCOL_ADAPTERS,
       "compatibility message adapter",
     ),
     serializationVersion: stringFromSql(

package/src/skills/skill-context.ts

@@ -298,7 +298,7 @@ export function renderSkillActivationReceipt(input: {
           `source=${source}`,
           "activation=The full historical instructions were promoted out of this tool observation.",
           "current=Consult the current active_agent_skills system section; absence means inactive.",
-          "historical=Use Recall get with source to recover the original activation observation.",
+          "historical=Use RecallGet with source to recover the original activation observation.",
         ].join("\n")
       : [
           "[Tinker Agent Skill activation rejected]",
@@ -306,7 +306,7 @@ export function renderSkillActivationReceipt(input: {
           `source=${source}`,
           `status=${input.outcome === "unavailable" ? "unavailable" : "not_dispatched"}`,
           "current=This skill was not added to the active system surface.",
-          "historical=Use Recall get with source to recover the original activation observation.",
+          "historical=Use RecallGet with source to recover the original activation observation.",
         ].join("\n");
   const originalBytes = Buffer.byteLength(input.message.content, "utf8");
   const renderedBytes = Buffer.byteLength(renderedContent, "utf8");