🤖 feat: add token-budget context window rollovers

[ThomasK33]

Summary

Add an opt-in Token-budget context windows experiment that replaces automatic LLM summarization with hard context-window rollovers. Earlier messages remain in the transcript and on disk; agents recover details on demand through a bounded session_history tool and carry concise working notes through an optional extra memory entry while token-budget mode is active.

Implementation

• Evaluate budget after settled tool steps and on send, then atomically persist a reset boundary, hidden lead-in, and triggering input. Preserve queue attribution and prevent duplicate rollovers after interruptions or append acknowledgment failures.
• Warn before the rollover threshold and optionally append /memories/workspace/context-notes.md as a ninth entry while token-budget mode is active. Ordinary hot-memory selection and budgets stay unchanged; the extra has a separate bounded allowance and is never duplicated. Effective mode and Memory/HotSet changes keep the cache coherent.
• Preserve ordinary media-shaped tool JSON in history retrieval; omit only validated media in the corresponding semantic positions. Exhausted missing-item reads fail explicitly, while intermediate scan pages remain successful and resumable.
• Add bounded list_windows, literal search, and paged read_item recovery with authenticated cursors, aggregate byte/row caps, oversized-row handling, and manual-reset privacy floors. Private cross-process append receipts preserve cursors through tracked appends and expire them after observable untracked changes; fixed stamps cannot detect same-size rewrites with unchanged metadata. Automatic rewrites preserve raw reset evidence. Manual reset floors remain unskippable when requesting older context windows.
• Before rollover cleanup or append, prepare the complete pinned candidate with the existing builder. Reject oversized system/memory/advertised-tool payloads while preserving the old window; persist exact accepted rows and start the same prepared request without replaying assembly. Scope admission abort forwarding to preparation, retaining accepted-wake delivery on failed rollback and normal interruption/disposal behavior.
• Conservatively account for omitted JSON structure and escape expansion in token guards. In-process emergency retries restore only the original accepted baseline of copied file snapshots after a current-owner commit, so later updates continue without rereading snapshots or retaining unrelated old-window files.
• Preflight fully assembled requests, including fallback models, against the hard context ceiling. Count ordinary strings/JSON as text and reserve media allowances for genuine media boundaries. Size only advertised Tool Search schemas without pruning executable tools; recheck transformed messages and activated schemas before each provider step. Late overflow blocks without an emergency rollover, preserving completed results. Restore validated persisted usage after restart. Rejected inputs and owned snapshots are empty assistant capsules excluded even by preceding provider assembly, with originals retained solely for display/edit/export. Keep manual/idle compaction available; continuous compaction and effective RLM take precedence.
• Keep session_history under ordinary inherited tool policy: built-in agents retain access through wildcard grants, while narrow custom agents opt in. Missing access blocks rollover before sealing existing context.
• Add experiment settings, rollover dividers, warnings/countdowns, mobile stories, ADR-0005, and user/tool documentation.

Validation and dogfooding

• Earlier full regression pass: 1,294 tests, including lifecycle, stream settlement, request assembly, real-disk history recovery, policy, and memory regressions.
• Latest reset-floor/provenance revision: 3,737 passing tests across 106 suites, both static gates, and independent safety/merge review. This includes the latest reconnect/replay ownership merge, preparation/retry/cancellation integration, active-schema checks, semantic media counting, and reset-window kind/privacy regressions. Real-Node/real-tokenizer checks verify off/on/off selection of 8/9/8 entries, unchanged normal selections and their full byte budget, and a bounded ninth excerpt. Earlier tool-policy tests and smoke cover inheritance, explicit grants, omissions, and on-send/emergency rollover gates.
• 10 passing Storybook cases and make static-check-full; repeated make static-check immediately before push. Nix-only format checks were skipped because Nix is unavailable locally.
• Isolated live backend with a controlled Anthropic-compatible provider: warning → notes write → two automatic rollovers → prior-window list/search. This validates the real request/tool/lifecycle paths, not external model reasoning.
• Live read_item calls used snake_case inputs and recovered seven character pages that exactly reconstruct an 872-character historical item. Default 8,000-character reads are separately covered by automated tests.
• Desktop 1900×1080 and phone 375×667 checked through the Storybook manager; keyboard warning expansion and expanded tool details fit without horizontal overflow. Rejected inputs remain visible but are not offered for retry; editing and a smaller draft remain available even when the persisted row is an empty capsule.
• Recorded real-disk smoke under Node with two backend processes: cooperative append preserves the cursor; same-length interior rewrite plus untracked append expires it; ordinary stream completion, edit/fork, and percentage truncation preserve malformed reset privacy floors; legacy filtering excludes rejected inputs and owned payloads without relying on the new rejection flag.

Live rollover recording

live-validated-rollovers.webm

Live history paging recording

read-item-paging.webm

375px phone verification

• Latest recorded proof uses real Node/tokenizer and disk-backed history: textual data URLs reach the hard ceiling while typed media retains its allowance, and post-reset windows report reset kind without exposing old content. Six real StreamManager/history cases with a mocked provider verify inactive catalogs, fitting/oversized activation, search-off, thinking rebuilds, and fallback limits. This is integration evidence, not live-provider reasoning.

• 26 full-builder admission cases cover complete pinned system/schema admission before reset, deferred catalogs, both rollover paths, cancellation/revocation/disposal, failed append, actual prepared runtime use after sandbox discard, lazy fallback limits, cache/goal/sequence semantics, and both rollback outcomes. Recorded on the final production revision with controlled provider/model discovery.

• Latest recorded proof compares punctuation-only JSON against real Node tokenization, reads/searches media-shaped ordinary JSON through disk-backed history, checks missing-item failure status, and exercises five real-file emergency-tracking scenarios. Structural accounting is a conservative allowance, not exact serialized-token measurement.

• Real-Node checks and chat/archive/mixed-boundary regressions verify that skips cannot cross a manual reset. The provenance fixture now guarantees an observable timestamp change while retaining its real same-size rewrite and epoch-invalidation assertion; 2,000 repeats passed across normal storage and tmpfs. Separate Node/Bun probes demonstrated unchanged-metadata collisions, documented as a bounded-receipt limitation—not a production detection fix.

Risks and implementation notes

• Rollover deliberately discards earlier messages from the active provider request, not from stored history. Recovery depends on bounded history access; an explicitly disabled session_history tool blocks threshold rollover instead of silently losing access.
• Hard text guards use resolved real encodings; provider-family fallbacks and media/framing allowances remain estimates. Unknown model limits cannot receive the same preflight guarantee.
• The implementation follows existing provenance/admission rules: branch-summary registrations are cleared only after publication, and the initiating send reconciles its own context-mutation epoch. Warnings use a durable prefix row plus a correlated queued continuation.
• The append receipt assumes cooperative writers honor the history lock and that the receipt is private. It detects untracked changes between transactions/pages, not hostile filesystem writes racing inside a certified append syscall/stat interval (documented in ADR-0005).
• Older builds intentionally hide rejected capsule contents while retaining originals for upgrade. Truncation markers keep legacy decoded hashes alongside versioned byte hashes for crash recovery across versions.
• This is opt-in; manual reset and compaction compatibility paths have dedicated regressions.

---

📋 Implementation Plan

Token-budget context windows (Codex-style) for xum — synthesized plan

Goal

Opt-in token-budget context strategy replacing lossy LLM summarization for automatic context management with:

1. Hard window rollover — near the limit, start a fresh provider context (reset boundary). Prior transcript stays on disk / UI / export.
2. session_history tool — list prior windows, search them, page items back in, all bounded.
3. Cross-window notes — conventional /memories/workspace/context-notes.md, optionally appended as a ninth <hot_memories> entry while token-budget mode is active.
4. Proactive budget warning — one durable, in-band message per window before rollover, telling the agent to flush state into notes.

Non-goals (v1): changing /compact, idle compaction, continuous/RLM compaction (they take precedence; rollover disabled when on); per-turn "N tokens left" injection; post-compaction diff/skill carryover across rollovers (D8); a new durable-event kind (the warning is a chat row, replayable by construction); a transcript migration or DB.

Verified seams (explorer-confirmed, file:line)

Seam	Where	Fact that shapes the design
Boundaries	docs/adr/0003…, src/common/constants/contextBoundary.ts, compactionBoundary.ts:151-170	Reset boundary (contextBoundaryKind:"reset") → exclusive provider slice; compaction → inclusive. Both found by byte needles (HistoryService.BOUNDARY_NEEDLES L794) and rotate sealed epochs to chat-archive.jsonl (rotateSealedHistoryUnlocked L1760).
Reset writer	workspaceService.resetContext L12413-12620	createMuxMessage(createContextResetBoundaryMessageId(),"assistant","",{contextBoundaryKind:RESET}), advanceContextMutationEpoch, clearUsageState, clearPostCompactionState, sandbox scope discard; rejects while a turn is active.
On-send trigger	agentSession.sendMessage L3786 checkBeforeSend → L3813 shouldCompactBeforeSend → L3844-3921 builds compaction request; user message is not persisted on that branch (L3896); otherwise persisted at L4051. Provider history loaded later in streamWithHistory L5504 (getHistoryFromLatestBoundary).	A pre-send rollover can append rows and then let the same sendMessage continue.
Mid-stream trigger	forward("usage-delta") L6369-6461 → checkMidStream → interruptForCompaction L5201 (stopStream({abortReason:"system"}), waitForIdle, sendMessage("Continue",…)).	Listener timing based; we do not reuse it for the decision.
Step-end stop	streamManager.createStopWhenCondition L2214-2264; SDK evaluates after all sibling tool results settle; StopCondition may be async and sees steps[i].usage / toolResults. Existing predicate request.hasQueuedMessages?.("tool-end").	Authoritative budget decision lives here.
Partial flush	completeToolCall → flushPartialWrite L2728 → writePartial L1244. Stream end → commitPartial (write-locked).	Tool results are durable before stop condition runs.
context_exceeded	streamManager.categorizeError L4920-5008 string/code match; agentSession.handleStreamError L6181-6228: normal turns fail terminally (non-retryable).	Emergency rollover hook (Phase 3b).
Queue	messageQueue.addOnce(message, options, dedupeKey, internal) L482; dispatchMode default "tool-end"; agentSession.hasQueuedMessages(mode) L7200; sendQueuedMessages L7508 → sendMessage. Heartbeat enqueue precedent workspaceService.ts:15250-15272 (muxMetadata, queueDispatchMode, internal:{synthetic, queueDedupeKey, skipAutoResumeReset, yieldToQueuedMessages}).	Reused verbatim for warning / continue dispatch.
Thresholds	autoCompactionCheck.ts:37-44,119,124: {shouldShowWarning, shouldForceCompact, usagePercentage, thresholdPercentage}; force = threshold+5%, warn = threshold−10%; getContextTokens = input+cached+cacheCreate. compactionMonitor.getThreshold() < 1 gates auto.	Reuse; add contextTokens/maxTokens to result.
Experiments	agentSession.ts:4944-4947 pattern options?.experiments?.x ?? aiService.isExperimentEnabled(EXPERIMENT_IDS.X); ExperimentsSection.tsx.	Same pattern for TOKEN_BUDGET.
Message schema	message.ts:935-978: synthetic, uiVisible, compacted strict union, contextBoundaryKind, muxMetadata; orpc muxMetadata: z.any() (L174).	New discriminators go in muxMetadata only.
History reads	iterateFullHistory(ws, dir, visitor) L1278: 256 KiB chunks, early exit, no giant-line cap (carryover grows unbounded); in-process mutex only for reads; historySequence monotonic across chat+archive (L2165), legacy rows may lack it. getHistoryBoundaryWindow fallback reads both files fully.	Needs a bounded scanner variant.
Hot set	src/common/constants/memory.ts: 8 items / 48 KiB / 12k tokens / 16 KiB per item; rankHotSetCandidates L57 (pinned first; unpinned 0-access filtered L62); selectHotMemories L105; appended in turnContextAssembler.ts:819-821; gated by memory + memory-hot-set.	Ordinary selection stays unchanged; active token-budget notes are additive.
Tools	toolDefinitions.ts:2301-2309 (ptcExcluded?: string), getAvailableTools options L3577; ToolConfiguration has workspaceId but no historyService; built in turnRequestBuilder.buildToolsForModel L1967-2005; TOOL_REGISTRY getToolComponent.ts:75; TOOL_NAME_TO_ICON ToolPrimitives.tsx:243.
Carryover	modelMessageTransform.injectPostCompactionAttachments anchors on compaction boundaries only.	D8.
ADRs	docs/adr/0003…, 0004… exist → new one is 0005.

Decisions

D1 — Rollover = reset boundary + separate synthetic user lead-in. Boundary row: role:"assistant", contextBoundaryKind:"reset", muxMetadata:{type:"context-window-rollover", rolloverId, reason:"on-send"|"mid-stream"|"context-exceeded", previousWindowId, flushOpportunity:boolean, contextTokens, maxTokens}. Immediately after: role:"user", synthetic:true, uiVisible:false, muxMetadata:{type:"context-window-lead-in", rolloverId} with deterministic guidance (notes file if present is preloaded; session_history if available; prior window id; for mid-stream: "your previous turn was interrupted by a context rollover; continue the task"). Slicing stays ADR-0003 (exclusive at reset). Boundary, lead-in and the continuation (user/Continue) row are written in one appendManyToHistory call (D3). Not a compaction-shaped row (compacted union is strict → downgrade risk; ADR-0003 forbids fake summaries).

D2 — Gate: EXPERIMENT_IDS.TOKEN_BUDGET = "tokenBudget" (global toggle in ExperimentsSection). Read via the L4944 pattern. Precedence: continuousCompaction or RLM on → rollover disabled (log.debug), summarization as today. getThreshold() >= 1 (auto disabled) → no proactive warning or threshold rollover, but the D4.4 hard-ceiling preflight/block still applies while the experiment is on. session_history availability (author-approved revision): with the experiment on, session_history is registered as a read-only, workspace-scoped tool and follows ordinary inherited agent/caller tool policy. Access requires an explicit tool name or matching wildcard grant; enabling the experiment never widens a narrow allowlist. Built-in Exec and Plan grant it through .*, and Explore inherits that grant. Omission or a later matching deny blocks rollover before existing context is sealed, returning "context_budget_blocked" with guidance (enable session_history, /compact, /clear --soft). A fitting request in an empty/internal-only window remains allowed. Rejected: a special baseline grant, silently summarizing, or rolling over without retrieval.

D2.1 — Request-middleware admission. Before rollover cleanup or publication, reconcile lazy workspace plugin hooks without constructing models/tools and capture an immutable ordered snapshot of applicable request-assembly registrations. Generic tool-mutating middleware is uncertified and blocks rollover before existing context is sealed; it is never overridden by restoring a denied tool. Explicit workspace scopes are enforced in dispatch. Context-only adapters receive no tool references and write back system text alone, so sandboxed context hooks remain supported. Run the admitted snapshot through primary/fallback requests, thinking context, emergency and in-process automatic retries; registration changes affect subsequent admissions. The snapshot is never serialized. Plugin revocation/epoch checks remain live and dropped mounts are reacquired. Ordinary non-rollover requests retain live middleware behavior. Validate blocked/benign uncertified chains, workspace isolation, lazy first-rollover context, registration races, fallback/retry continuity, revocation, and context-only projection.

D3 — One rollover path; the settled-step decision stops the stream directly and only requests the rollover.

• Authoritative decision in stopWhen. StreamRequestConfig gets onStepSettled?: (step: {usage, outputTokens, toolResultChars, imageParts}) => Promise<"continue"|"warn"|"rollover">; createStopWhenCondition awaits it and returns true itself for "warn"/"rollover" — independent of hasQueuedMessages("tool-end"), so a queue holding only a turn-end entry can never let the stream run past the ceiling. AgentSession implements it using the model actually streaming (from the stream context, not the primary model): normalize usage exactly as updateUsageStateFromModelUsage, compute projected = contextTokens + outputTokens + ceil(toolResultChars / 4) + IMAGE_TOKEN_ESTIMATE × imageParts, evaluate evaluateStepBudget (Phase 2) against checkAutoCompaction thresholds and the hard ceiling (modelContextLimit − OUTPUT_RESERVE_TOKENS):
  • "block" when the measured hard projection reaches the ceiling with automatic handling disabled: stop at the settled boundary without warning, rollover, Continue, retry metadata, or quarantine of already-executed input; preserve all sibling tool results.
  • "rollover" (automatic handling enabled and projected ≥ forceThreshold || projected ≥ hardCeiling) → latch this.pendingRollover = {rolloverId, reason:"mid-stream", flushOpportunity: projected < hardCeiling}; if messageQueue.isEmpty(), addOnce("Continue", {...internal-resume options as built at L5231-5249, queueDispatchMode:"tool-end"}, CONTEXT_CONTINUE_DEDUPE_KEY, {synthetic:true, skipAutoResumeReset:true, …}); otherwise the already-queued real input is dispatched first and receives the rollover (it would have needed it anyway). Stream ends at the step boundary; commitPartial commits the assistant row with all tool results paired; sendQueuedMessages dispatches.
  • "warn" only when shouldShowWarning && !warningEmittedInWindow && projected + WARNING_RESERVE_TOKENS < hardCeiling (the warning turn must itself fit; otherwise the evaluator returns "rollover" with flushOpportunity:false). If messageQueue.isEmpty(), addOnce(warningText, …, CONTEXT_WARNING_DEDUPE_KEY, …) with muxMetadata:{type:"context-budget-warning", contextTokens, maxTokens}; if not empty, the warning is emitted on-send as a prefix row (D6) ahead of the queued input. Latch the in-memory claim for this window.
  • usage-delta keeps updating usage state but no longer makes decisions. interruptForCompaction is untouched (still used when the experiment is off).
• Rollover executes only in sendMessage (on-send), as prefix rows of the same append. Branch before L3844: if (tokenBudgetActive && rolloverEligible (D4.1) && (this.pendingRollover || evaluateStepBudget(projectedOnSend (D4.3)) === "rollover")) → preflight (D4.2) → build prefixRows = [boundary, leadIn] (plus the on-send warning row when applicable) → continue the same sendMessage; at the existing user-message persist point (L4051) first run applyContextResetSideEffects() (below; idempotent, benign if the append then fails), then call appendManyToHistory([...prefixRows, userMessage]) so boundary, lead-in and the user's (or Continue) message land in one write — no lost user input. If either step throws, the send fails visibly before any provider build. After the append: clear the latch, emit chat-events; history is loaded from the new boundary at L5504. Skip turn snapshots for the boundary rows as the compaction branch already does.
• applyContextResetSideEffects(reason): extracted from resetContext L12535-12614 and shared with it: advanceContextMutationEpoch, clearUsageState(), clearPostCompactionState(), clearPendingBranchSummary, discard context-scoped PTC/sandbox scope and stale refinement/retry state. Preserved: session history, costs/lifetime usage, MemoryService data, task handles and intentional background jobs, queued real inputs, goal acknowledgment state (rollover does not call requireUserAcknowledgment; that is user-clear semantics). Asserts: no active stream, turnPhase admits, boundary is a reset marker, three historySequences strictly increasing.

Why not stopStream + interruptForCompaction (Fable) or a separate journal file (Astra)?

• Graceful stop via stopWhen finishes the step: tool calls and results are committed together by the normal stream-end → commitPartial path. An abort mid-step can leave the pairing to recovery. Dispatch reuses the heartbeat mechanism (queue), so ordering with real user input is already solved.
• With prefix rows, every transition is one atomic history append with no external side effect: (a) nothing on disk, or (b) boundary + lead-in + continuation together. There is no intermediate persisted state to journal. The only in-memory state (pendingRollover, queued Continue) is derivable: after a restart the completed old turn is on disk and the next sendMessage re-evaluates usage seeded from history (seedUsageStateFromHistory) and rolls over then. A journal would add a second source of truth to reconcile without adding a state it could protect. rolloverId is stamped on all three rows for auditing/tests.

D4 — Loop guard + fresh-request preflight (no chain of empty windows).

1. Already-fresh guard. A rollover is eligible only if the active window contains ≥1 provider-eligible row that is not token-budget internal (muxMetadata.type ∉ {context-window-lead-in, context-budget-warning}, not compaction-request, not rlmPreservedTailCopy). An internal-only window is treated as already fresh: no second boundary, the message is sent normally if it fits (D4.2), log.warn once. This is also the recovery rule for an incomplete rollover batch (D5).
   Emergency rollover eligibility excludes all continuation-owned preludes, including synthetic assistant/family rows, so a crash-resumed already-fresh batch cannot create another rollover. Real older context still permits one recovery transition.

2. Fresh-request preflight (cheap, pre-history). Against the resolved model for this send (modelForStream, after fallback-route resolution at L3786): await estimateFreshRequestTokensForModel(...) ≥ hardCeiling → no rollover, no provider call; sendMessage returns a visible error Result "context_budget_blocked" ("This message plus the system context does not fit in a fresh context window for ; shorten it, remove attachments, or use a larger model") — same surface as existing pre-send validation errors. Without measured system/schema overhead, use the existing model-scaled SYSTEM_FLOOR_TOKENS_ESTIMATE fallback. Historical request input includes old user/history content and must not be reused as fixed overhead. The final assembled preflight remains authoritative. Fresh and assembled hard text guards use real resolved encodings with a per-call approximation bypass. Oversized strings use codepoint-safe chunks and boundary slack; encoding failures fail closed. Provider-family encodings and media/framing allowances remain estimates, with provider overflow handling as a backstop.
   Recheck the complete already-materialized file/skill/MCP/family prelude batch before reset cleanup or publication. Expand dynamic inputs once per send, count their actual payload rather than invocation text, preserve snapshot/file-tracking eligibility on rejected retries, and revalidate cancellation/admission after asynchronous counting. Over-budget batches retain only safe rejection capsules and apply manual goal safety without sealing existing context. Emergency recovery applies the same admission to the complete copied/deduplicated retry prelude against the actual failing model and captured provider configuration before cleanup or reset publication.

3. On-send projection includes the unsent tail. projectedOnSend = seededContextTokens + outputTokens(lastAssistant) + estimate(tool results of the last assistant row) + estimate(user message + attachments); the last step's provider usage never counts its own trailing tool results, so this is what makes the post-restart case (D5) and the mid-stream latch produce the same decision from history alone.

4. Per-attempt hard preflight after final assembly (Phase 2/3). In turnRequestBuilder.build, after system prompt, tools, memory and messages are assembled for the attempt's resolved model, run checkAssembledRequestBudgetForModel using the attempt’s resolved model/capability encoding, sanitized wire text/tool schemas, and media/framing allowances and compare with that model's hardCeiling. Over → typed build outcome {kind:"context_budget_exceeded", model, estimate, hardCeiling} returned before any network call, handled in agentSession ahead of generic failure/retry: if tokenBudgetActive and the window is rollover-eligible (D4.1) → emergency rollover (flushOpportunity:false, continuation = same user message) and rebuild once; otherwise → "context_budget_blocked" visible result. Runs for the initial attempt and every fallback attempt. Phase 3b (provider context_exceeded) remains the backstop for estimator misses, not the primary mechanism. Omitted JSON punctuation and escape expansion receive a conservative one-token-per-byte allowance; real leaf encoding and media exclusions remain intact. Ordinary strings and JSON count as text even when they resemble data URLs or media objects; only genuine SDK/model media at explicit part boundaries and supported sanitized tool wrappers receive media allowances. With Tool Search, count only the actual advertised schema subset while retaining all tools for execution. Recheck each provider step after thinking/media transforms using the pinned attempt limit and actual model, including newly activated schemas. Per-step violations use terminal ContextBudgetBlockedError (including fallback step zero), preserving completed tool results without an emergency-rollover/catalog loop; builder preflight remains the recoverable seam. Before any on-send or emergency rollover clears context state or appends a boundary, use that same builder seam to prepare the complete pinned future request (system/middleware, fresh memory context, advertised schemas, exact candidate rows). Rejecting admission disposes preparation resources while preserving the old window and its context-scoped state. Persist the exact accepted rows and start the same one-shot prepared request; do not repeat tool/system/hook or prelude assembly, register an assistant placeholder/stream before acceptance, or preconstruct fallbacks. Promote the candidate memory cache only after successful append; late-bind durable sequence and operation/thinking callbacks at start. Preview only prospective goal-tool availability without goal writes, preserving queued-user consent. Limit the admission abort link to candidate preparation and discard a candidate already aborted before detachment. After preparation, explicit admission/rollback guards decide cancellation versus retained delivery, including failed-rollback acceptance; accepted-turn interruption/disposal remains live.

5. If a window rolls over after a single assistant turn, log.warn (limit too small for system prompt + hot set).

6. Auto disabled (getThreshold() >= 1) under tokenBudget: no proactive warning/rollover, but D4.4 still applies — an over-ceiling request is blocked visibly rather than knowingly sent. With the experiment off, behavior is unchanged.

7. Rejected manual intervention still applies goal safety. When rejection retention reports an actionable manual message, apply the same goal pause/acknowledgment and continuation cleanup as pricing rejection. Synthetic/internal and blank input are not manual interventions. Validate with real goal/history services.

D5 — Crash-safe recovery contract (derived from history, no replayed side effects).
Intended persisted states: A = old window complete, no rollover rows; B = [boundary, lead-in, continuation] appended in one call (same rolloverId). In-memory only: pendingRollover latch, queued Continue/warning. Ordering inside the rollover send: (1) applyContextResetSideEffects() before the append — every step is idempotent and benign if the append then fails (usage re-seeds from history, discarded PTC scope/post-compaction state is context-scoped and would be dropped by the boundary anyway); (2) appendManyToHistory(B); (3) clear latch, emit chat events; (4) streamWithHistory. If (1) or (2) throws, sendMessage fails visibly before any provider build — never stream with stale carryover/PTC state.

• Crash in A (incl. after stopWhen returned true and commitPartial ran, before the queued Continue was dispatched): the old assistant turn is complete on disk with tool pairs intact (commitPartial is write-locked and atomic; an interrupted stream follows existing partial recovery). The queue is not resurrected; the turn is paused visibly (assistant row complete, no divider yet). The next real sendMessage recomputes D4.3 from history — including the trailing tool results that caused the stop — and rolls over then. No auto-resume of tasks after restart in v1 — a deliberate choice: nothing the user typed is lost and no side effect is replayed.

• Crash/partial write during B (appendFile of several lines may persist a complete prefix, and tolerant parsing drops a truncated trailing line): the window on disk is [boundary] or [boundary, lead-in] → D4.1 treats it as already fresh; the next user message is appended normally into that window, no second boundary. Recovery is the D4.1 rule itself; no marker needed because the only lost row is the continuation, whose send already failed visibly. Test this exact case (truncate chat.jsonl after row 1 and after row 2).

• After B: normal stopped-turn semantics. A second boundary requires a new non-internal row in the window (D4.1) and the latch is cleared under the same sendMessage that appended B, so duplicates are impossible by construction.

• Supersession: explicit /clear (either kind), /compact, edit, delete, interrupt, heartbeat compaction, or fork clears pendingRollover and the warning claim and drops the queued Continue via its dedupe key (hook where clearUsageState()/advanceContextMutationEpoch already run). resetContext rejects while a turn is active; rollover only runs from sendMessage under the existing admission gates, so the two never interleave.

• Emergency (giant single tool result / model switch / provider context_exceeded): same path with flushOpportunity:false; the giant result is committed to the old window before the boundary (never deleted, never re-executed); the lead-in names it as retrievable via session_history.

• Tests fault-inject spyOn(historyService,"appendManyToHistory").mockRejectedValueOnce, truncate the last line of chat.jsonl after a rollover, and simulate restart (new AgentSession over the same createTestHistoryService()), asserting ≤1 boundary per rolloverId, no orphan tool call, no duplicate Continue, no lost user text in the success path.

• In-process emergency retries retain only the original canonical tracking baseline for the accepted file snapshot actually copied into the retry. Restore synchronously after a successful, still-current rollover commit; never reread the snapshot, use a newer tracked hash, or restore unrelated old-window files. Rejected/deferred snapshots do not establish a baseline; compaction clears it with normal tracking state.

• Preserve trunk’s centralized PreparationAttempt, scoped/generation-guarded retry, and awaitable cancellation/disposal contracts. Budget-failure callbacks settle through the preparation owner before terminal policy; asynchronous emergency handoffs recheck current-turn admission, and direct/resumed requests retain the admitted snapshot and rollover metadata.

• Append provenance is bounded fixed-stamp evidence, not content-identity proof. Same-size rewrites with unchanged observed identity/size/timestamps, including benign same-tick filesystem collisions, cannot be detected without stronger filesystem/write isolation or whole-prefix verification. The unknown-write epoch-invalidation fixture must make the stamp change observable while retaining real-write, same-size, changed-content, and epoch-invalidation assertions; do not claim a production fix for the unchanged-stamp limitation.

D6 — Warning: once per window; rollover wins over warning. Text: "Context window ~N% used (X of Y tokens). If you have state worth keeping, write/update /memories/workspace/context-notes.md now (essential state first, ≤ 8 KiB), then continue the current task without commentary." Emitted either mid-stream (D3 queue) or on-send as a pre-turn role:"user", synthetic:true, uiVisible:true row before the user's message. Latch = history-derived (a context-budget-warning row exists in the active window) plus in-memory claim. Omit the notes sentence when memory is off or read-only; say writes are unavailable and name session_history.

D7 — Additive context notes (author-approved revision). Preserve ordinary hot-memory ranking, eligibility, eight-item selection, and byte/token budgets unchanged. When effective token-budget mode is active, append an existing /memories/workspace/context-notes.md after that normal selection as one optional extra entry, allowing up to nine total. Do not duplicate notes already selected normally. Bound only the additional excerpt by the existing CONTEXT_NOTES_RESERVED_BYTES = 8 * 1024 and CONTEXT_NOTES_RESERVED_TOKENS = 2_000 allowance, including its formatting; do not shrink or evict ordinary entries to fit it. Missing, unreadable, binary, or unfittable notes must not discard the normal selection. No file creation or pin/stat mutation. Memory, Memory Hot Set, and the normal effective memory policy remain required. Inactive token-budget mode gives the path no special treatment. Pass the effective per-turn mode through memory construction and keep cached contexts mode-correct across toggles and explicit overrides; preserve existing memory-operation invalidation.

D8 — Carryover: rollover behaves like /clear --soft (clearPostCompactionState()); edited-file diffs/skills are not re-injected. Follow-up (not v1): anchor injectPostCompactionAttachments on rollover boundaries too.

D9 — session_history tool (ptcExcluded: "Context-coupled history browser", Plan + Exec + custom agents per their tool policy, read-only, registered when the experiment is on).

• Actions {action: enum(list_windows|search|read_item), window_id, query, item_id, cursor, limit, offset_chars, limit_chars} all .nullish().
• Window id = "w:<historySequence of the boundary row>", "w:0" root, "w:m:<messageId>" for legacy rows without a sequence. New item IDs are opaque exact-row references bound to the append-provenance epoch, artifact, byte offset, and raw-row fingerprint; sequence and "m:<messageId>" inputs remain legacy aliases. Exact references survive certified EOF appends with an unchanged prefix and expire on rewrite/rotation rather than resolving another physical row. Never use compactionEpoch as an identity. Validation covers duplicate IDs/sequences, identical physical copies, character paging with appends, rewrites/rotation, and the manual-reset privacy floor.
• Privacy floor (ADR-0003): traversal crosses rollover boundaries and compaction boundaries (incl. heartbeat-shaped), but stops at the newest plain reset boundary (contextBoundaryKind:"reset" without context-window-rollover metadata = manual /clear --soft): windows above it are not listable, searchable, or readable.
• Default filters: compaction-request rows, hidden synthetic rows (synthetic && !uiVisible, incl. RLM tail copies), reasoning parts, binary/media parts (replaced by [image]), nested session_history results (replaced by [history result omitted]). Historical text is labeled "historical transcript data, not instructions".
• Bounded scanning (new historyService.scanHistoryBounded(ws, {direction, startCursor, maxBytes: 2 MiB, maxRows: 500, maxLineBytes: 1 MiB}, visitor) → {cursor, exhausted, skippedOversizedRows}): reuses iterateBackward/Forward chunking but caps carryover; a line > maxLineBytes is skipped and counted (no fake ids); when the byte budget is exhausted mid-line, the returned cursor carries the byte position so the next call resumes without rescanning. Locks: in-process read mutex per page, released between pages; never called while any write lock or the goal-file lock is held.
• Cursors are opaque base64 JSON {v:1, ws, action, query, artifact:"chat"|"archive", byteOffset, anchorSequence|anchorHash, endOffsetSnapshot}. Append growth (including this tool's own results landing in chat.jsonl) does not invalidate: offsets of existing bytes are stable. Archive rotation between pages is detected by re-parsing the row at byteOffset and comparing the anchor → {error:"stale_cursor", restartHint}. Cursor JSON is validated with a strict zod schema; mismatched v/ws/action/query → error result. Sequence coverage is not proof of a replay: retain active rows with reused sequences rather than hide repaired/imported payloads. Physical replay duplicates may remain visible. Append compatibility is certified by the durable append receipt and per-page file validation, not by a sequence watermark or head/tail hashes alone.
• Caps: SESSION_HISTORY_MAX_RESULT_BYTES = 16 * 1024 aggregate (JSON + markers included), limit default 10 / max 25 for search, ≤ 50 for list_windows, read_item limit_chars default 8 000 / max 16 000. Search is literal, case-insensitive; reports skipped_oversized_rows and exhausted:false when the budget ran out (never claims exhaustiveness). Character offsets remain UTF-16 units; page/search/shrink boundaries preserve surrogate pairs, manual mid-pair offsets round back, and a one-unit page may return a whole pair to guarantee progress. nextCharOffset comes from the actual adjusted end. Existing unpaired source units are replaced only in output without changing offset lengths or stored bytes.
• Scoped to config.workspaceId (assert present); host-local files even for SSH workspaces.

Phases (each gated by tests + dogfood before the next)

Phase 0 — ADR + constants/types (~70 LoC)

• docs/adr/0005-token-budget-context-window-rollover.md: third boundary use; reset boundary created by rollover may be followed by a provider-visible synthetic lead-in (amends ADR-0003 consequence 2 for this case only); recovery contract (D5); privacy floor (D9).
• src/common/constants/experiments.ts TOKEN_BUDGET; src/common/constants/contextBudget.ts (notes path, reserved bytes/tokens, dedupe keys, OUTPUT_RESERVE_TOKENS, IMAGE_TOKEN_ESTIMATE, SYSTEM_FLOOR_TOKENS_ESTIMATE, tool caps, scan caps).
• src/common/types/message.ts: muxMetadata variants context-window-rollover, context-window-lead-in, context-budget-warning (+ type guards isTokenBudgetInternalMessage, isRolloverBoundary).

Phase 1 — Bounded session_history tool (~380 LoC)

Ship the recovery path before any automatic reset (Astra ordering).

• historyService.scanHistoryBounded + cursor codec (src/node/services/historyCursor.ts).
• src/common/utils/messages/contextWindows.ts: pure bucketing/rendering (bucketWindows(rows), renderItemPreview, privacy-floor predicate, filters; reuse extractMessageText).
• src/node/services/tools/session_history.ts; toolDefinitions.ts schema + getAvailableTools({enableSessionHistory}); tools.ts historyService?: HistoryService on ToolConfiguration; wire in turnRequestBuilder.buildToolsForModel; TOOL_NAME_TO_ICON.session_history = History; GenericToolCall fallback.
• Tests (session_history.test.ts, historyService.scanBounded.test.ts, real history on disk): windows across mixed legacy/reset/compaction/rollover boundaries; privacy floor; legacy rows without sequence addressable; search/limit/window filter; read_item paging; 1 MiB+ row skipped with count; 2 MiB budget exhaustion → resumable cursor without rescanning (assert bytes read); cursor survives appends made by the tool's own result; archive rotation between pages → stale_cursor; aggregate ≤ 16 KiB (assert); hidden/media/nested-result omission; wrong-workspace cursor rejected.
• Dogfood gate: seed a long history, ask "what did the first test say about X?" → list_windows → search → read_item; page a long item; screenshot tool card at 375 px and desktop.

Phase 2 — Additive notes + budget evaluator (~180 LoC)

• memoryHotSet.selectHotMemories: unchanged ordinary selection followed by the optional bounded notes append (D7). Tests: eight competing pins and normal byte/token budgets stay intact; notes become a ninth entry only while effective token-budget mode is active; inactive mode matches ordinary behavior; zero-access notes, deduplication, malformed/unreadable files, independent excerpt limits, and mode-correct caches/overrides. Memory-off and policy-disabled preloading remain disabled; readonly memory does not authorize writes.
• src/common/utils/compaction/contextBudget.ts: pure evaluateStepBudget({contextTokens, outputTokens, toolResultChars, imageParts, modelContextLimit, threshold, warningEmitted}) → {decision:"continue"|"warn"|"rollover"|"block", flushOpportunity, projected, hardCeiling}, estimateFreshRequestTokens, estimateAssembledRequestTokens(payload) (D4.4), estimateToolResultChars(step). Extend AutoCompactionCheckResult with contextTokens/maxTokens.
• turnRequestBuilder.build: after assembly, run estimateAssembledRequestTokens for the attempt's model and return the typed context_budget_exceeded outcome (no network) when over the hard ceiling (~40 LoC; wiring of the outcome into agentSession lands in Phase 3).
• turnContextAssembler <memory-tool-guidance>: one sentence about the notes file when the experiment is on (gate is tested, wording is not).
• Tests: evaluator boundaries (warn band, force band, hard ceiling wins, warning that would not fit → rollover with flushOpportunity:false, unknown limit → "continue" + log.warn, never zero-as-unlimited); turnRequestBuilder returns the typed outcome for an over-ceiling assembled payload and makes no provider call.

Phase 3 — Rollover + warning + recovery (~430 LoC) — the switch-over gate

• streamManager.ts: onStepSettled request field; createStopWhenCondition awaits it and returns true on "warn"/"rollover" before the existing queue check (~20 LoC).
• src/node/services/contextWindowRollover.ts: buildLeadInText, buildBudgetWarningText, hasRolloverEligibleMessages, estimateToolResultChars(step).
• agentSession.ts: onStepSettled implementation (D3), pendingRollover latch + supersession clears, sendMessage branch (D3/D4.1–4.3, prefix rows in the single append), handling of the context_budget_exceeded build outcome (D4.4: emergency rollover once or blocked result), "context_budget_blocked" Result, on-send warning row (D6). Extract applyContextResetSideEffects from workspaceService.resetContext and call it from both.
• agentTools.ts/toolAssembly.ts: register session_history under the experiment and filter it through ordinary inherited tool policy (D2); blocked result when history access is omitted or disabled and existing context would be sealed.
• Phase 3b (required — it is the fallback-model backstop, D4.3): in handleStreamError for context_exceeded on a normal turn with the experiment on and no deltas streamed → perform rollover (reason:"context-exceeded", flushOpportunity:false, continuation = the same user message re-appended in the fresh window, original row left in place) and retry streamWithHistory once; D4.1 prevents loops. Must run before the string-matched legacy compaction retry paths (maybeRetryCompactionOnContextExceeded only applies to compaction turns).
• UI: CompactionBoundaryMessage.tsx label "Context window rollover"; context-budget-warning rows via CollapsibleMachineMessage (branch in MessageRenderer.tsx/displayedMessageBuilder.ts); verify at 375 px.
• Tests (contextWindowRollover.test.ts, agentSession.tokenBudget.test.ts with createTestHistoryService() + mock AI router, streamManager.test.ts):
  • boundary+lead-in ordering/metadata/sequences; provider slice excludes boundary, includes lead-in; on-send persists user message after lead-in; payload after rollover contains no pre-boundary rows (via sliceMessagesForProviderFromLatestContextBoundary).
  • settled-step: a step whose tool results push projection past force threshold ends the stream at the step boundary with tool pairs intact, enqueues exactly one Continue, next sendMessage rolls over; queue already holding a tool-end message → no Continue enqueued, rollover still happens on dispatch; hard-ceiling jump from a single giant tool result → flushOpportunity:false, no warning.
  • warning once per window, not after rollover, suppressed when rollover wins; on-send and mid-stream variants; mid-stream skipped when a tool-end message is already queued.
  • D4: internal-only window → treated as fresh (no second boundary, message sent normally); oversized fresh request → blocked result, no provider call; over-ceiling assembled payload (D4.4) → emergency rollover once, then blocked on a second over-ceiling build; fallback attempt to a smaller model gets its own D4.4 evaluation; experiment off → unchanged path; continuous/RLM precedence; auto disabled → no warning/rollover but D4.4 still blocks; session_history omitted or disabled by effective policy → blocked before sealing old context; explicit/wildcard grants → tool included; built-in Exec/Plan/Explore retain access through inherited policy.
  • D4.3: after simulated restart, on-send projection counts the trailing tool results of the last assistant row and rolls over.
  • Phase 3b: provider context_exceeded on a normal turn → one rollover + retry; second context_exceeded in the fresh window → terminal failure (no loop).
  • stopWhen returns true on "rollover" even when the queue holds only a turn-end entry; that entry is dispatched and receives the rollover.
  • D5 fault injection: appendManyToHistory rejects → no rows, latch preserved, next send retries; restart between boundary and continuation → paused, no second boundary, next user message sends in fresh window; manual /clear --soft clears latch.
  • replay: replayRequestBuilder reconstructs the post-rollover request identically (lead-in/warning are ordinary rows).
• Dogfood gate: two real rollovers (one during a multi-tool batch, one from an oversized tool output), warning → agent writes notes → after rollover <hot_memories> contains them (check devtools.jsonl), no compaction request written, older messages still paged in UI; restart the sandbox between boundary and continuation and show paused-not-corrupt.

Phase 4 — Settings + docs (~30 LoC + docs)

• ExperimentsSection.tsx toggle (description names the precedence and session_history requirement).
• ContextUsageBar/Section: label the window as "rolls over at N%" instead of "compacts" when the experiment is on (text only, no new controls).
• User docs page (register in docs.json); ADR index if present.

Invariants & defensive checks

• Exactly two rows per rolloverId (reset boundary then lead-in), strictly increasing historySequence; assert after write; at most one boundary per rolloverId on disk (test).
• Rollover only from sendMessage (or the Phase 3b error handler, after the stream has terminated) with no active stream; never from a stream callback. stopWhen only stops and enqueues.
• Boundary, lead-in and continuation are one append; a boundary is never persisted without its continuation in the success path.
• Never delete or re-execute a tool result; rollover never splits a tool call from its result (graceful step stop only).
• Provider payload after rollover has no row with historySequence ≤ boundary.
• ≤1 context-budget-warning per window; assert before append.
• session_history: assert(config.workspaceId); never returns rows older than the newest manual reset boundary; aggregate ≤ 16 KiB; scan ≤ 2 MiB / 500 rows / 1 MiB per line per call; never under a write lock.
• Rollover never fires when experiment off, continuous/RLM on, or auto disabled; no provider call is made when D4 blocks; a request estimated over the hard ceiling for the attempt's model is never sent while the experiment is on.
• applyContextResetSideEffects runs before the append and is idempotent; a failed append fails the send visibly before any provider build.
• Unknown model context limit ⇒ no rollover decision (log.warn), never treated as 0 or ∞.

Compatibility

• Downgrade: rows are a plain reset boundary + synthetic user rows; unknown muxMetadata.type preserved and rendered as generic hidden/synthetic rows; no new top-level fields, compacted union untouched. Lead-in wording is conditional ("if a session_history tool is available…").
• Upgrade: no migration; experiment defaults off; existing summary/reset histories unchanged.

Dogfooding (evidence: screenshots + short recordings via attach_file; artifacts outside the source tree)

1. KEEP_SANDBOX=1 make dev-server-sandbox DEV_SERVER_SANDBOX_ARGS="--clean-projects" as a background task; scratch project; enable API Debug Logs and experiments memory, memory-hot-set, tokenBudget; per-model threshold ~10%; cheap model.
2. Drive with agent-browser (snapshot -i → fill/click → re-snapshot); record ≤5-minute clips per checkpoint.
3. Per-phase checkpoints as listed in Phases 1–3; Phase 4: legacy /compact, /clear --soft privacy floor (windows above it invisible to the tool), experiment off, 375 px and desktop layouts, keyboard access.
4. Gates: bun test <touched suites>, make typecheck, make lint, make static-check sequentially after the last edit (re-run typecheck after any lint fix).

Net LoC estimate (product code only)

Recommended: ≈ 1 090 LoC (range 950–1 300): P0 70 · P1 380 · P2 180 · P3 430 · P4 30.
Alternatives considered: compaction-shaped rollover row (−150 LoC, rejected: downgrade/ADR risk); separate journal file + generic context-budget durable event + per-attempt estimator seam in aiService (+300–500 LoC, rejected: the single-append transition leaves no intermediate state to journal, warnings/lead-ins are ordinary replayable rows, and Phase 3b covers fallback-model overflow; see D3/D4/D5).

---

Generated with mux • Model: coder:openai/gpt-6-astra • Thinking: high

Generated with xum • Model: coder:openai/gpt-6-astra • Thinking: high • Cost: $1488.17

[mintlify]

Preview deployment for your docs. Learn more about Mintlify Previews.

Project	Status	Preview	Updated
Mux	🟢 Ready	View Preview	Sep 5, 2026, 2:03 PM

💡 Tip: Enable Automations to automatically generate PRs for you.

[ThomasK33]

@codex review

---

Generated with mux • Model: coder:openai/gpt-6-astra • Thinking: high

[chatgpt-codex-connector]

💡 Codex Security Review

Here are some automated security review suggestions for this pull request.

Reviewed commit: c90c03e611

ℹ️ About Codex security reviews in GitHub

This is an experimental Codex feature. Security reviews are triggered when:

• You comment "@codex security review"
• A regular code review gets triggered (for example, "@codex review" or when a PR is opened), and you’re opted in so security review runs alongside code review

Once complete, Codex will leave suggestions, or a comment if no findings are found.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: c90c03e611

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[ThomasK33]

@codex review

Pushed 3ce1127e246b28e29642405f7e6cddbe8b347395 and replied individually to all eight findings. Seven received behavioral/UI fixes; the cleanup-order finding retains the accepted fail-closed D5 ordering with an earlier cancellation/admission check and an explicit ADR explanation of the tradeoff.

Validation: 1,270 integrated regressions, additional final targeted tests (including emergency skill reuse), eight Storybook cases, full static checks and a final make static-check all passed. Current desktop/phone screenshots confirm tabular countdown numerals; the phone recording also checks keyboard expansion.

Updated 375px countdown verification

review-phone.webm

---

Generated with mux • Model: coder:openai/gpt-6-astra • Thinking: high

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 3ce1127e24

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[ThomasK33]

@codex review

[ThomasK33]

@codex security review

[ThomasK33]

JSON accounting, history recovery, and copied-file tracking

Published 74ed28b; replied to and resolved all four findings:

• PRRT_kwDOPxxmWM6f8XWs: conservative allowance for omitted JSON structure and escape expansion, preserving real leaf encoding and semantic media exclusions. This is not exact serialized-token accounting.
• PRRT_kwDOPxxmWM6f8XWx: in-process emergency retries restore only the copied snapshot's original canonical tracking baseline after a current-owner commit. Newer hashes and unrelated files are not substituted; no snapshot rereading or replay.
• PRRT_kwDOPxxmWM6f8XW4: ordinary media-shaped JSON remains searchable/readable; validated media is omitted only in its semantic positions.
• PRRT_kwDOPxxmWM6f8XW-: exhausted missing/stale item reads fail explicitly, while intermediate pages remain successful and resumable.

Also integrated the latest reconnect/replay ownership fix through a proper two-parent merge. The only textual conflict was the AgentSession import block; both sides were retained.

Local validation: 3,734 tests across 106 suites, both static gates, and independent safety/merge reviews passed. The recording is from this exact merged revision: real Node/tokenizer and disk-backed history, plus five real-file emergency-tracking cases with a controlled provider. Playback is accelerated; this is integration evidence, not live-provider reasoning.

Fresh CI and code/security reviews are pending.

json-tracking-merged.webm

---

Generated with mux • Model: coder:openai/gpt-6-astra • Thinking: high

Generated with xum • Model: coder:openai/gpt-6-astra • Thinking: high • Cost: $1456.53

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 74ed28b5fd

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[ThomasK33]

@codex review

[ThomasK33]

@codex security review

[ThomasK33]

Reset-floor privacy and provenance fixture clarification

Published 3e093e6 and resolved PRRT_kwDOPxxmWM6f-zNO.

Production privacy fix

Manual reset floors are evaluated before generic skippable boundaries. Older-window requests cannot cross a manual reset in chat or archive, including excessive skips and mixed rollover/compaction chains. Readable reset markers remain included; malformed evidence stays excluded; legal automatic boundaries remain skippable.

CI diagnosis and fixture-only correction

Minimal real-filesystem probes reproduced changed same-size content with identical device/inode/size/mtimeNs/ctimeNs: 190/500 Bun and 18/500 Node cases on tmpfs, without mocks. The CI failure had no stamp telemetry, so its individual cause cannot be proven directly.

The fixture now seeds an old mtime before cursor creation, performs the same real same-size rewrite, and checks changed bytes, equal size, and changed mtime before retaining the original epoch-invalidation assertion. 2,000 fixed repeats passed across normal storage and tmpfs. No production provenance logic, sleeps, added mocks, retries, or skips were introduced.

The ADR now explicitly states that a bounded stamp-only receipt cannot detect a rewrite whose observed metadata is unchanged. This is a documented limitation, not a production detection fix; stronger detection requires write isolation or whole-prefix verification.

Final local validation: 3,737 tests across 106 suites, both static gates, and independent safety review passed. The recording shows real-Node reset-skip checks, three history-floor cases, and 100 additional fixture repeats. Playback is accelerated. Production/test source is fe1f14d; the final commit adds the validated ADR clarification only.

Fresh CI and code/security reviews are pending.

reset-provenance-final.webm

---

Generated with mux • Model: coder:openai/gpt-6-astra • Thinking: high

Generated with xum • Model: coder:openai/gpt-6-astra • Thinking: high • Cost: $1488.17

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Swish!

Reviewed commit: 3e093e62d9

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".