benchflow 0.7.8.dev2335__tar.gz → 0.7.8.dev2339__tar.gz

{benchflow-0.7.8.dev2335 → benchflow-0.7.8.dev2339}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: benchflow
-Version: 0.7.8.dev2335
+Version: 0.7.8.dev2339
 Summary: Multi-turn agent benchmarking with ACP — run any agent, any model, any provider.
 Project-URL: Homepage, https://github.com/benchflow-ai/benchflow
 Project-URL: Repository, https://github.com/benchflow-ai/benchflow

{benchflow-0.7.8.dev2335 → benchflow-0.7.8.dev2339}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "benchflow"
-version = "0.7.8.dev2335"
+version = "0.7.8.dev2339"
 description = "Multi-turn agent benchmarking with ACP — run any agent, any model, any provider."
 readme = "README.md"
 requires-python = ">=3.12"

{benchflow-0.7.8.dev2335 → benchflow-0.7.8.dev2339}/src/benchflow/acp/client.py

@@ -1,5 +1,6 @@
 """ACP client — benchflow acts as the client, agents are ACP servers."""
 
+import asyncio
 import logging
 from collections.abc import Awaitable, Callable
 from typing import Any
@@ -137,6 +138,10 @@ class ACPClient:
     async def _read_until_response(self, request_id: int) -> dict[str, Any]:
         """Read messages, handling notifications, until we get the response we want."""
         while True:
+            # Buffered transports can receive inline, and session capture is
+            # synchronous. Give cancellation and watchdog tasks a turn even
+            # while the peer's notification backlog remains non-empty.
+            await asyncio.sleep(0)
             msg = await self._transport.receive()
             logger.debug(
                 f"ACPClient recv: id={msg.get('id')} method={msg.get('method', '')} "

{benchflow-0.7.8.dev2335 → benchflow-0.7.8.dev2339}/src/benchflow/acp/runtime.py

@@ -30,7 +30,7 @@ from benchflow.acp.timeout_cleanup import (
     cancel_and_drain_prompt_task,
     cancel_prompt_after_timeout,
 )
-from benchflow.acp.types import McpServerSpec
+from benchflow.acp.types import McpServerSpec, PromptResult
 from benchflow.acp.watchdog import IdleWatchdog
 from benchflow.agents.codex_config import apply_codex_launch_config
 from benchflow.agents.protocol import ACPSessionAdapter
@@ -800,6 +800,28 @@ def _agent_prompt_timeout_error(session, timeout: int) -> AgentPromptTimeoutErro
     )
 
 
+async def _timed_prompt(
+    acp_client: ACPClient, prompt: str
+) -> tuple[PromptResult, float]:
+    """Record completion in the prompt task, before a delayed observer runs."""
+    result = await acp_client.prompt(prompt)
+    return result, asyncio.get_running_loop().time()
+
+
+def _completed_prompt_result(
+    prompt_task: asyncio.Task[tuple[PromptResult, float]],
+    session,
+    *,
+    deadline: float,
+    timeout: int,
+) -> PromptResult:
+    """A delayed watchdog must distinguish late completion from late observation."""
+    result, completed_at = prompt_task.result()
+    if completed_at > deadline:
+        raise _agent_prompt_timeout_error(session, timeout)
+    return result
+
+
 async def _prompt_with_wall_clock_budget(
     acp_client: ACPClient,
     session,
@@ -807,12 +829,15 @@ async def _prompt_with_wall_clock_budget(
     timeout: int,
 ):
     """Run a prompt until either it finishes or BenchFlow's budget expires."""
-    prompt_task = asyncio.create_task(acp_client.prompt(prompt))
+    deadline = asyncio.get_running_loop().time() + timeout
+    prompt_task = asyncio.create_task(_timed_prompt(acp_client, prompt))
     cleanup_attempted = False
     try:
         done, _pending = await asyncio.wait({prompt_task}, timeout=timeout)
         if done:
-            return prompt_task.result()
+            return _completed_prompt_result(
+                prompt_task, session, deadline=deadline, timeout=timeout
+            )
         cleanup_attempted = True
         if await cancel_prompt_after_timeout(acp_client, prompt_task):
             raise _agent_prompt_timeout_error(session, timeout)
@@ -831,7 +856,7 @@ async def _prompt_with_idle_watchdog(
     idle_timeout: int,
 ):
     """Run one ACP prompt with wall-clock and idle-watchdog budgets."""
-    prompt_task = asyncio.create_task(acp_client.prompt(prompt))
+    prompt_task = asyncio.create_task(_timed_prompt(acp_client, prompt))
     cleanup_attempted = False
     loop = asyncio.get_running_loop()
     watchdog = IdleWatchdog.start(
@@ -864,7 +889,9 @@ async def _prompt_with_idle_watchdog(
                     f"Agent prompt exceeded wall-clock budget {timeout}s"
                 )
 
-        return prompt_task.result()
+        return _completed_prompt_result(
+            prompt_task, session, deadline=watchdog.deadline, timeout=timeout
+        )
     finally:
         # Always cancel + drain the prompt task on exit, including the
         # external-cancellation path (CancelledError from sleep). Bound the

{benchflow-0.7.8.dev2335 → benchflow-0.7.8.dev2339}/src/benchflow/sandbox/lockdown.py

@@ -112,7 +112,10 @@ def _agent_egress_firewall_cmd(sandbox_user: str) -> str:
         'iptables -C OUTPUT -m owner --uid-owner "$agent_uid" '
         "-j REJECT 2>/dev/null || "
         'iptables -A OUTPUT -m owner --uid-owner "$agent_uid" -j REJECT; '
-        "if [ -s /proc/net/if_inet6 ]; then "
+        # procfs reports zero stat size even when this interface has content.
+        # Install IPv6 rules whenever the kernel exposes the stack, including
+        # before a non-loopback interface acquires an address.
+        "if [ -e /proc/net/if_inet6 ]; then "
         "command -v ip6tables >/dev/null 2>&1 || "
         "{ echo 'IPv6 enabled but ip6tables unavailable' >&2; exit 86; }; "
         'ip6tables -C OUTPUT -o lo -m owner --uid-owner "$agent_uid" '

{benchflow-0.7.8.dev2335 → benchflow-0.7.8.dev2339}/src/benchflow/trajectories/_capture.py

@@ -8,7 +8,7 @@ from pathlib import Path
 from typing import Any
 
 from benchflow.acp.session import ACPSession
-from benchflow.trajectories.types import redact_acp_trajectory_jsonl
+from benchflow.trajectories._snapshot import RedactedJSONLSnapshot
 
 logger = logging.getLogger(__name__)
 
@@ -148,6 +148,7 @@ class TrajectoryWriter:
         # so a follow-up reader can't pick up an orphaned partial file.
         self._tmp.unlink(missing_ok=True)
         self._last_payload: str | None = None
+        self._snapshot = RedactedJSONLSnapshot()
 
     def __call__(self, session: ACPSession) -> None:
         self.flush(session)
@@ -167,7 +168,7 @@ class TrajectoryWriter:
         to the previous one — keeps a no-op chunk (an unchanged
         tool_call status poll) from churning the filesystem.
         """
-        payload = redact_acp_trajectory_jsonl(events)
+        payload = self._snapshot.serialize(events)
         if payload == self._last_payload:
             return
         self._tmp.write_text(payload)
@@ -182,7 +183,7 @@ class TrajectoryWriter:
         lands on disk even if the live streaming writer had already
         written the same content.
         """
-        payload = redact_acp_trajectory_jsonl(trajectory)
+        payload = self._snapshot.serialize(trajectory)
         self._tmp.write_text(payload)
         os.replace(self._tmp, self.path)
         self._last_payload = payload

{benchflow-0.7.8.dev2335 → benchflow-0.7.8.dev2339}/src/benchflow/trajectories/_llm_capture.py

@@ -5,6 +5,7 @@ from __future__ import annotations
 import os
 from pathlib import Path
 
+from benchflow.trajectories._snapshot import RedactedJSONLSnapshot
 from benchflow.trajectories.types import Trajectory
 
 
@@ -23,12 +24,15 @@ class LiveLLMTrajectoryWriter:
         self._tmp = self.path.with_suffix(self.path.suffix + ".tmp")
         self._tmp.unlink(missing_ok=True)
         self._last_payload: str | None = None
+        self._snapshot = RedactedJSONLSnapshot()
 
     def write(self, trajectory: Trajectory | None) -> bool:
         """Publish *trajectory* when it is non-empty and changed."""
         if trajectory is None or not trajectory.exchanges:
             return False
-        payload = trajectory.to_jsonl(redact_keys=True)
+        payload = self._snapshot.serialize(
+            exchange.model_dump(mode="json") for exchange in trajectory.exchanges
+        )
         if payload == self._last_payload:
             return False
         self._tmp.write_text(payload)

benchflow-0.7.8.dev2339/src/benchflow/trajectories/_snapshot.py

@@ -0,0 +1,39 @@
+"""Reuse redacted records while preserving complete trajectory snapshots."""
+
+from __future__ import annotations
+
+import json
+from collections.abc import Iterable
+from typing import Any
+
+from benchflow.trajectories.types import redact_trajectory_obj
+
+
+class RedactedJSONLSnapshot:
+    """Serialize current records, redacting only changed or new records.
+
+    Each writer owns its cache; raw JSON is retained only in memory and only
+    for the current snapshot. Comparing serialized values, rather than object
+    identity, catches nested in-place changes. Reordering and truncation are
+    handled by replacing the cache with the current sequence on every call.
+    """
+
+    def __init__(self) -> None:
+        self._entries: list[tuple[str, str]] = []
+
+    def serialize(self, records: Iterable[dict[str, Any]]) -> str:
+        entries: list[tuple[str, str]] = []
+        for index, record in enumerate(records):
+            raw = json.dumps(record, default=str)
+            if index < len(self._entries) and raw == self._entries[index][0]:
+                redacted = self._entries[index][1]
+            else:
+                # Normalize non-JSON leaves before applying the same canonical
+                # value redactor as the uncached serializers. Never redact the
+                # serialized text: that can corrupt backslash escapes.
+                redacted = json.dumps(redact_trajectory_obj(json.loads(raw)))
+            entries.append((raw, redacted))
+
+        payload = "\n".join(redacted for _raw, redacted in entries)
+        self._entries = entries
+        return payload

benchflow-0.7.8.dev2339/tests/test_acp_buffered_timeout.py

@@ -0,0 +1,122 @@
+"""Regressions for buffered ACP starvation and delayed timeout observation."""
+
+import asyncio
+import json
+import time
+
+import pytest
+
+from benchflow.acp.client import ACPClient
+from benchflow.acp.container_transport import ContainerTransport
+from benchflow.acp.runtime import (
+    _prompt_with_idle_watchdog,
+    _prompt_with_wall_clock_budget,
+)
+from benchflow.acp.session import ACPSession
+from benchflow.acp.types import PromptResult
+from benchflow.diagnostics import AgentPromptTimeoutError
+from benchflow.sandbox.process.daytona import DaytonaPtyProcess
+
+
+class BufferedPty(DaytonaPtyProcess):
+    """Use the actual queue reader without creating a sandbox or connection."""
+
+    def __init__(self):
+        super().__init__(None, "", "")
+
+    async def writeline(self, data):
+        pass
+
+    def enqueue(self, message):
+        self._line_buffer.put_nowait(json.dumps(message).encode() + b"\n")
+
+
+@pytest.mark.asyncio
+async def test_buffered_daytona_notifications_allow_other_tasks_to_run():
+    """Guards commit 4196c4a: a populated PTY queue must not starve the loop."""
+    process = BufferedPty()
+    session = ACPSession("buffered")
+    for _ in range(32):
+        process.enqueue(
+            {
+                "jsonrpc": "2.0",
+                "method": "session/update",
+                "params": {
+                    "sessionId": session.session_id,
+                    "update": {
+                        "sessionUpdate": "agent_message_chunk",
+                        "content": {"type": "text", "text": "."},
+                    },
+                },
+            }
+        )
+    process.enqueue(
+        {"jsonrpc": "2.0", "id": 100001, "result": {"stopReason": "end_turn"}}
+    )
+    client = ACPClient(ContainerTransport(process, command="never-started"))
+    client._session = session
+
+    async def observe_backlog():
+        await asyncio.sleep(0)
+        return len(session.message_chunks)
+
+    result, seen = await asyncio.gather(client.prompt("go"), observe_backlog())
+
+    assert 0 < seen < 32
+    assert result.stop_reason == "end_turn"
+    assert session.full_message == "." * 32
+
+
+class BlockingClient:
+    def __init__(self, block_sec):
+        self.block_sec = block_sec
+
+    async def prompt(self, prompt):
+        # Models synchronous capture during an otherwise inline buffered read.
+        time.sleep(self.block_sec)
+        return PromptResult(stop_reason="end_turn")
+
+
+async def run_prompt(client, session, idle_watchdog):
+    if idle_watchdog:
+        return await _prompt_with_idle_watchdog(
+            client, session, "go", timeout=1, idle_timeout=600
+        )
+    return await _prompt_with_wall_clock_budget(client, session, "go", timeout=1)
+
+
+@pytest.mark.asyncio
+@pytest.mark.parametrize("idle_watchdog", [False, True])
+async def test_completion_after_wall_deadline_is_timeout(idle_watchdog):
+    """Guards commit 4196c4a: late completion cannot escape a starved watchdog."""
+    session = ACPSession("late-completion")
+    session.record_user_prompt("go")
+
+    with pytest.raises(AgentPromptTimeoutError, match="wall-clock budget 1s"):
+        await run_prompt(BlockingClient(1.1), session, idle_watchdog)
+
+    timeouts = [event for event in session.events if event["type"] == "agent_timeout"]
+    assert len(timeouts) == 1
+    assert timeouts[0]["timeout_sec"] == 1
+    assert timeouts[0]["terminal_trajectory_complete"] is True
+
+
+@pytest.mark.asyncio
+@pytest.mark.parametrize("idle_watchdog", [False, True])
+async def test_early_completion_observed_after_deadline_still_succeeds(idle_watchdog):
+    """Guards commit 4196c4a: observer delay is not prompt execution time."""
+    session = ACPSession("late-observation")
+    session.record_user_prompt("go")
+
+    async def block_after_prompt_completes():
+        await asyncio.sleep(0)
+        time.sleep(1.1)
+
+    blocker = asyncio.create_task(block_after_prompt_completes())
+    try:
+        result = await run_prompt(BlockingClient(0), session, idle_watchdog)
+    finally:
+        await blocker
+
+    assert result.stop_reason == "end_turn"
+    assert not any(event["type"] == "agent_timeout" for event in session.events)

benchflow-0.7.8.dev2339/tests/test_agent_egress_firewall.py

@@ -0,0 +1,80 @@
+"""Execute the firewall setup against Linux's real zero-size procfs interface.
+
+Guards against the skipped IPv6 rules present in commit 4196c4a. Firewall
+binaries are recording stubs; these tests never alter the host firewall.
+"""
+
+import os
+import subprocess
+from pathlib import Path
+
+import pytest
+
+from benchflow.sandbox.lockdown import _agent_egress_firewall_cmd
+
+pytestmark = pytest.mark.skipif(
+    not Path("/proc/net/if_inet6").exists(),
+    reason="requires the Linux IPv6 procfs interface",
+)
+
+
+@pytest.fixture
+def firewall(tmp_path):
+    binaries = tmp_path / "bin"
+    binaries.mkdir()
+    log = tmp_path / "calls"
+    commands = {
+        "id": "printf '1000\\n'\n",
+        "iptables": 'printf "ipv4 %s\\n" "$*" >> "$FIREWALL_LOG"\n[ "$1" != -C ]\n',
+        "ip6tables": 'printf "ipv6 %s\\n" "$*" >> "$FIREWALL_LOG"\n[ "$1" != -C ]\n',
+    }
+    for name, body in commands.items():
+        executable = binaries / name
+        executable.write_text("#!/bin/sh\n" + body)
+        executable.chmod(0o755)
+    return binaries, log
+
+
+def run_firewall(binaries, log):
+    return subprocess.run(
+        ["/bin/sh", "-c", _agent_egress_firewall_cmd("agent")],
+        env={**os.environ, "PATH": str(binaries), "FIREWALL_LOG": str(log)},
+        text=True,
+        capture_output=True,
+        timeout=10,
+        check=False,
+    )
+
+
+def test_zero_size_procfs_still_installs_ipv6_rules(firewall):
+    binaries, log = firewall
+    assert Path("/proc/net/if_inet6").stat().st_size == 0
+
+    result = run_firewall(binaries, log)
+
+    assert result.returncode == 0, result.stderr
+    calls = log.read_text().splitlines()
+    for family in ("ipv4", "ipv6"):
+        assert (
+            f"{family} -I OUTPUT 1 -o lo -m owner --uid-owner 1000 -j ACCEPT" in calls
+        )
+        assert f"{family} -A OUTPUT -m owner --uid-owner 1000 -j REJECT" in calls
+
+
+def test_ipv6_stack_without_ip6tables_fails_closed(firewall):
+    binaries, log = firewall
+    (binaries / "ip6tables").unlink()
+
+    result = run_firewall(binaries, log)
+
+    assert result.returncode == 86
+    assert "IPv6 enabled but ip6tables unavailable" in result.stderr
+
+
+def test_ipv6_rule_installation_failure_is_not_ignored(firewall):
+    binaries, log = firewall
+    (binaries / "ip6tables").write_text("#!/bin/sh\nexit 1\n")
+
+    result = run_firewall(binaries, log)
+
+    assert result.returncode != 0

benchflow-0.7.8.dev2339/tests/test_redacted_snapshot.py

@@ -0,0 +1,222 @@
+"""Guards capture caching against full re-redaction in commit 4196c4a."""
+
+from __future__ import annotations
+
+import copy
+import json
+from unittest.mock import Mock
+
+import pytest
+
+from benchflow.trajectories import _snapshot
+from benchflow.trajectories._capture import TrajectoryWriter
+from benchflow.trajectories._llm_capture import LiveLLMTrajectoryWriter
+from benchflow.trajectories._snapshot import RedactedJSONLSnapshot
+from benchflow.trajectories.types import (
+    LLMExchange,
+    LLMRequest,
+    LLMResponse,
+    Trajectory,
+    redact_acp_trajectory_jsonl,
+)
+
+
+@pytest.fixture
+def redactor(monkeypatch):
+    spy = Mock(wraps=_snapshot.redact_trajectory_obj)
+    monkeypatch.setattr(_snapshot, "redact_trajectory_obj", spy)
+    return spy
+
+
+def test_snapshot_reuses_equal_records_and_detects_nested_same_length_edit(redactor):
+    """Guards 4196c4a: streamed updates must not rescan unchanged tool output."""
+    snapshot = RedactedJSONLSnapshot()
+    records = [
+        {"type": "tool_call", "content": [{"text": "large prior output"}]},
+        {"type": "agent_message", "text": "first"},
+    ]
+    assert snapshot.serialize(records) == redact_acp_trajectory_jsonl(records)
+    assert redactor.call_count == 2
+    assert snapshot.serialize(copy.deepcopy(records)) == redact_acp_trajectory_jsonl(
+        records
+    )
+    assert redactor.call_count == 2
+
+    records[0]["content"][0]["text"] = "TOKEN=hidden-data!"
+    assert snapshot.serialize(records) == redact_acp_trajectory_jsonl(records)
+    assert redactor.call_count == 3
+    assert "hidden-data!" not in snapshot.serialize(records)
+
+
+def test_snapshot_invalidates_shared_objects_reorder_truncation_and_new_secrets(
+    redactor,
+):
+    """Guards 4196c4a: immutable keys prevent stale or aliased redacted rows."""
+    snapshot = RedactedJSONLSnapshot()
+    shared = {"api_key": "first-synthetic-value"}
+    records = [shared, shared, {"text": "last"}]
+    snapshot.serialize(records)
+
+    shared["api_key"] = "other-synthetic-value"
+    payload = snapshot.serialize(records)
+    assert payload == redact_acp_trajectory_jsonl(records)
+    assert redactor.call_count == 5
+    records.reverse()
+    assert snapshot.serialize(records) == redact_acp_trajectory_jsonl(records)
+    assert redactor.call_count == 7
+
+    records.clear()
+    assert snapshot.serialize(records) == ""
+    assert snapshot._entries == []
+    records.append({"raw_output": {"authorization": "Bearer new-synthetic-value"}})
+    payload = snapshot.serialize(records)
+    assert payload == redact_acp_trajectory_jsonl(records)
+    assert "new-synthetic-value" not in payload
+    assert redactor.call_count == 8
+
+
+def test_snapshot_preserves_canonical_normalization_and_escaped_secrets(tmp_path):
+    """Guards 4196c4a and PR #849: caching must retain valid escaped JSON."""
+    records = [
+        {
+            "path": tmp_path / "artifact.txt",
+            "raw_output": json.dumps({"api_key": "synthetic-value"}),
+            "text": 'raise ValueError("TOKEN=synthetic\\\\value")',
+        }
+    ]
+    snapshot = RedactedJSONLSnapshot()
+    for _ in range(2):
+        payload = snapshot.serialize(records)
+        assert payload == redact_acp_trajectory_jsonl(records)
+        assert json.loads(payload)["path"] == str(tmp_path / "artifact.txt")
+        assert "synthetic-value" not in payload
+
+
+def test_snapshot_failed_serialization_does_not_commit_partial_cache(monkeypatch):
+    """Guards 4196c4a: a failed update must retain the last complete cache."""
+    snapshot = RedactedJSONLSnapshot()
+    records = [{"text": "old one"}, {"text": "old two"}]
+    previous = snapshot.serialize(records)
+    original = _snapshot.redact_trajectory_obj
+
+    def fail_second(record):
+        if record["text"] == "new two":
+            raise ValueError("synthetic redaction failure")
+        return original(record)
+
+    monkeypatch.setattr(_snapshot, "redact_trajectory_obj", fail_second)
+    with pytest.raises(ValueError, match="synthetic redaction failure"):
+        snapshot.serialize([{"text": "new one"}, {"text": "new two"}])
+    spy = Mock(wraps=original)
+    monkeypatch.setattr(_snapshot, "redact_trajectory_obj", spy)
+    assert snapshot.serialize(records) == previous
+    spy.assert_not_called()
+
+
+def test_acp_writer_updates_tool_completion_and_forces_complete_final_write(
+    tmp_path, redactor
+):
+    """Guards 4196c4a: cached ACP updates and final writes keep complete evidence."""
+    path = tmp_path / "acp_trajectory.jsonl"
+    writer = TrajectoryWriter(path)
+    records = [
+        {"type": "user_message", "text": "task"},
+        {"type": "tool_call", "status": "in_progress", "content": []},
+    ]
+    writer.write_events(records)
+    writer.write_events(records)
+    assert redactor.call_count == 2
+    records[1]["status"] = "completed"
+    records[1]["content"].append({"api_key": "new-synthetic-secret"})
+    writer.write_events(records)
+    assert redactor.call_count == 3
+    assert path.read_text() == redact_acp_trajectory_jsonl(records)
+    assert "new-synthetic-secret" not in path.read_text()
+
+    path.write_text("external incomplete write")
+    writer.write_final(records)
+    assert path.read_text() == redact_acp_trajectory_jsonl(records)
+    assert redactor.call_count == 3
+    assert not path.with_suffix(".jsonl.tmp").exists()
+
+
+def test_llm_writer_reuses_exchanges_and_reconciles_nested_changes(tmp_path, redactor):
+    """Guards 4196c4a: new LLM exchanges must not re-redact the whole history."""
+    path = tmp_path / "llm_trajectory.jsonl"
+    writer = LiveLLMTrajectoryWriter(path)
+    first = LLMExchange(
+        request=LLMRequest(body={"messages": [{"content": "question"}]}),
+        response=LLMResponse(body={"content": "first answer"}),
+    )
+    trajectory = Trajectory(session_id="cache-test", exchanges=[first])
+    assert writer.write(trajectory)
+    assert not writer.write(trajectory)
+    assert redactor.call_count == 1
+    trajectory.exchanges.append(first.model_copy(deep=True))
+    assert writer.write(trajectory)
+    assert redactor.call_count == 2
+    trajectory.exchanges[1].response.body["content"] = "TOKEN=synthetic-secret"
+    assert writer.reconcile(trajectory)
+    assert redactor.call_count == 3
+    assert path.read_text() == trajectory.to_jsonl(redact_keys=True)
+    assert "synthetic-secret" not in path.read_text()
+    assert first.response.body["content"] == "first answer"
+
+    trajectory.exchanges.reverse()
+    assert writer.reconcile(trajectory)
+    trajectory.exchanges.pop()
+    assert writer.reconcile(trajectory)
+    assert path.read_text() == trajectory.to_jsonl(redact_keys=True)
+    assert len(path.read_text().splitlines()) == 1
+    assert not path.with_suffix(".jsonl.tmp").exists()
+
+
+@pytest.mark.parametrize("kind", ["acp", "llm"])
+def test_writer_retries_failed_atomic_replace_using_cached_records(
+    kind, tmp_path, monkeypatch, redactor
+):
+    """Guards 4196c4a: a cached failed write must still publish on retry."""
+    path = tmp_path / f"{kind}_trajectory.jsonl"
+    content = {"text": "original output"}
+    if kind == "acp":
+        writer = TrajectoryWriter(path)
+        records = [{"type": "tool_call", "raw_output": content}]
+
+        def write():
+            writer.write_events(records)
+
+        def expected():
+            return redact_acp_trajectory_jsonl(records)
+
+    else:
+        writer = LiveLLMTrajectoryWriter(path)
+        exchange = LLMExchange(request=LLMRequest(), response=LLMResponse(body=content))
+        content = exchange.response.body
+        trajectory = Trajectory(session_id="retry-test", exchanges=[exchange])
+
+        def write():
+            writer.write(trajectory)
+
+        def expected():
+            return trajectory.to_jsonl(redact_keys=True)
+
+    write()
+    previous = path.read_text()
+    content["text"] = "TOKEN=new-synthetic-secret"
+
+    def fail_replace(*args):
+        raise OSError("synthetic atomic replacement failure")
+
+    with monkeypatch.context() as patch:
+        patch.setattr("os.replace", fail_replace)
+        with pytest.raises(OSError, match="synthetic atomic replacement failure"):
+            write()
+    assert path.read_text() == previous
+    assert json.loads(previous)
+    assert redactor.call_count == 2
+
+    write()
+    assert path.read_text() == expected()
+    assert "new-synthetic-secret" not in path.read_text()
+    assert redactor.call_count == 2
+    assert not path.with_suffix(".jsonl.tmp").exists()