[nissa-seru]

Why. When a provider refuses a request's settings, it refuses it whatever history the request carries, but the breaker took such a refusal for the history's fault whenever it came back typed as an invalid_request at HTTP 400, as one did in one of our runs. So it set aside the agent's newest turns, up to three, under a marker saying the API kept refusing them, and kept failing.

Before the poison-history breaker starts setting aside an agent's history in a run of failures, this makes it send the failed request once more with its messages replaced by one short message, and start only if the provider answers that. On main, the breaker acts on an invalid_request at HTTP 400 by its type and status alone, and a provider's refusal of a request's settings can come back that way. When it does, a request the provider refuses whatever its history costs the agent its newest turns, and each retry without them is refused the same way.

A request the provider refuses whatever its history, such as one with a setting it doesn't take

• base (main): from the third failure in a row, the breaker sets aside the newest turn, writes one marker and retries, up to its cap of 3. In our run with a stand-in provider refusing every request with "OpenAI Codex backend does not support max_output_tokens; OrcaRouter will not silently ignore it", three messages in a row were all set aside, under a marker saying the model API kept refusing them.
• head: the breaker first sends the failed request with its messages replaced by "Reply with one word.". Refused the same way, nothing is set aside and no retry is queued. A history-kept ops alert and an [inference-rewind] stderr line say the request fails without its history too. In the same run, all three messages stayed.

A request whose history is what the provider refuses

• base (main): the breaker sets aside the newest turn and retries, as above.
• head: the probe is answered, and the breaker sets aside the newest turn as before, unless the agent moved on while the probe was out, as when a message is stored in its history. Then the answer is set aside: nothing is shed, no retry is queued, and the next failure decides. Later failures in the same run of failures shed without another probe.

A probe that fails some other way, such as a 429

• base (main): there's no probe, and the breaker sheds.
• head: nothing is shed and no retry is queued, and the alert and the line say the probe couldn't tell whether the history is the cause.

A rule 0.22.1's changelog states, which this changes

• 0.22.1: "A 422 from an OpenAI-compatible server that answers a validation failure with it, such as a FastAPI one, arrives as invalid_request and still sheds."
• head: a validation failure the provider answers the same way without the history, as it answers a setting it refuses, no longer sheds. One of the history itself still sheds, once its probe is answered. So the changelog fragment is .changed.

While a configuration stays refused, each failure from the third in a row on sends one probe and raises one history-kept alert, as long as nothing has been shed in that run of failures. In our runs with five messages in a row, at 310f38128c and at 8c22c460d3, that was three probes. stop() aborts a probe that's still out. history-kept is a new ops-alert kind, and no exported API changes.

@antra-tess, we're letting you know because it changes what an agent's context holds: where the request fails without its history too, the agent now keeps the turns the breaker would have set aside, and reads no rewind marker for them.

Every run used a stand-in membrane, so whether a given provider answers the probe for a given configuration isn't shown, and the cross-package check didn't run here.

• Changelog fragment added: changelog.d/breaker-probe.changed.md.

Credits

Alfred-2451 made the change, with its shape set by Ada-1017, and Ogden-2688 read it. Milo-2653 weighed its parts, raised the case a window move makes, and read the changes since. Daniel-2612 ran the tests at 310f38128c, wrote this description and put it in this shape. Alfred-2451 ran the catch-ups' and the round's tests and updated the description for each, and Esther-2584 read the second catch-up's merge.

Details for agents

Head acfe54a741, with main at 6c7810995c merged in at 305abf0e13. Line references are at 310f38128c, the head before the first catch-up, on main's 71193a9fef, unless named. On main at 6c7810995c, as of November 9, the breaker acts when shedMayHelp holds (src/framework.ts:3975–3978, :36025–36040) and sends no probe: main has no probeBeforeShed and no history-kept.

Problem

At 71193a9fef, the breaker acts on a failure that shedMayHelp passes (src/framework.ts:3389–:3392), whose lines pass an invalid_request at HTTP 400 among others. It takes the failure's type and status only. A refusal of the request's settings can come back that way. One of our runs of connectome-host got the refusal quoted above from its provider, typed invalid_request at HTTP 400. The call after it in that run succeeded, so that run never reached the breaker.

To see what the breaker does with that refusal, we ran the framework end to end at 71193a9fef with a stand-in provider. It answers two exchanges, then refuses every request with that error. From the third failure in a row on (inferenceFailureEscalationThreshold, :3893), the breaker set aside the newest turn, wrote one marker and retried, until its cap of 3:

• Three messages in a row: it set aside the third message, then on its retries the second and the first. The agent's context kept the two answered exchanges, its failure notes, and a marker that begins "[refusal-rewind] The 3 most recent turn(s) were set aside because the model API kept refusing the requests that carried them".
• One message, then two wakes with nothing new: it set aside the message, then the agent's second answer, then the second message before it.
• The same error typed unsupported: nothing was set aside.

No turn after the two answered exchanges completed in any of them. In the first two, each retry without the turns set aside was refused the same way.

Changes

• The probe. When the breaker would shed and nothing has been shed yet in this run of failures, it first sends the failed request with its messages replaced by one message, "Reply with one word." (probeBeforeShed, src/framework.ts:32042; withoutHistory, :3415). It's admitted as the agent's own auxiliary calls are (ownAuxiliaryMembraneFor, :32095), with membrane's own retries off, and it's asked as the failed request's newest participant other than the agent.
• A conversation fork's or an ephemeral run's probe goes through the membrane its context manager was given: the conversation membrane for a fork (:17758), the ephemeral membrane for a run (:10945, and :11280 for a resumed one). Neither takes a provider gate. When the framework lets the fork or run go, it withdraws the probe, whose answer is then set aside. Any other agent's probe, a resident's among them, goes through auxiliaryMembraneFor, which takes a provider gate.
• The probe is answered: the breaker sheds as before, newest first, with one marker and a retry, up to the cap. Later failures in the same run of failures shed without another probe (:32036).
• The probe fails with the failure's own type and status: nothing is shed and no retry is queued. A history-kept ops alert (:32085) and an [inference-rewind] stderr line say the request fails without its history too, with the probe's own answer.
• The probe fails any other way, such as a 429, another status or an aborted call: nothing is shed and no retry is queued, and the alert and the line say the probe couldn't tell whether the history is the cause.
• On either verdict, the alert and the line also say that no retry was queued, so the agent tries again only when something next wakes it (:35346 at 8c22c460d3). Each verdict has its own webhook cooldown, so one doesn't hold the other back (:35353 there).
• When acting on the probe's answer fails, as when the rewind marker can't be written after a shed, an [inference-rewind] stderr line says the breaker failed while acting on its probe's answer and may already have shed part of the history (:32087).
• The probe's answer is set aside when the agent moved on while it was out: a message was added to its history or a row edited or removed, the rows a shed would act on moved, as an undo or a redo moves a presented window's, another turn holds it, its failure count moved, even back to the same number, a surgery holds the store, the store's branch changed, the agent was replaced or let go, or the framework is stopping. The next failure decides afresh.
• A probe whose agent's failure count moves is withdrawn at once: a failure counted, the streak reset by a completed turn, or the agent's failure accounting forgotten marks that agent's probes still out, and aborts them (staleBreakerProbes, :35370 at 8c22c460d3). So a later failure's probe doesn't run beside an earlier one.
• stop() aborts a probe that's still out, and waits for it within its wait on maintenance, before the store closes (:5602, :5733–:5736).
• No probe and no shed after stop() has begun, after the agent was let go or replaced, or for a failure with no request on the wire (:32033–:32035).
• What the probe carries: each field of the failed request except its messages and onCacheWireReceipt, so it opens no kv-unified submission. The fields are named in a table, PROBE_FIELDS (:3394–:3413), declared satisfies Record<keyof NormalizedRequest, 'kept' | 'left out' | 'replaced'>. Nothing of the probe is stored in the agent's context.
• Its cost while a configuration stays refused: each failure from the third in a row on sends one probe and raises one history-kept alert, as long as nothing has been shed in that run of failures. In our runs with five messages in a row, at 310f38128c and at 8c22c460d3, that was three probes, at the third, fourth and fifth failures (Tests).
• Comments and docs: stop()'s doc now lists its wait on code_execution scripts, a wait this change doesn't add, and says "With a budget, a stop() can take up to seven of them" (:5380), where it said six. The comment at the hard-down alert now says its trace goes out on every call and only its webhook post is throttled (:32005).
• No exported API changes. history-kept is a new ops-alert kind.

ae8100f725's commit message says "Nothing on the failure path writes to the store once the probe is out." That doesn't hold. When a turn's stream fails, driveStream reports the failure to the breaker inside its try or catch (:26791 for a stream that threw), and its finally (:26811) then flushes the messages held for the turn's end (:26973–:26974). So that flush can store a message while the probe is out. When it does, the probe's listener on the history (:32050) notes the write and the probe's answer is set aside, so nothing is shed and the next failure decides.

Tests

Unless their own paragraph below says otherwise, the runs here were at a clean checkout of 310f38128c, the head before the first catch-up, on Linux x86_64 with Node 24.22.2 and npm 11.19.1, after npm install, which installed @animalabs/membrane 0.8.0, @animalabs/context-manager 0.24.2, @animalabs/chronicle 0.5.1, @animalabs/mcpl-core 0.4.0 and typescript 7.0.2. npx tsc exits 0 with no errors, and each run is node --test on the built files, two at a time.

New and changed tests:

• test/breaker-probe.test.ts, new, end to end on a stand-in membrane. It covers three messages in a row with the stream's failure reported and thrown, a failure the breaker leaves alone, a refused row still shed after its probe is answered a minute later, with the retry answered and no second probe, a 429 probe, three more couldn't-tell cases, a message arriving, a message stored and an edit while the probe is out, stop() while the probe is out, stop() with a budget and a probe that settles late, and no kv submission from the probe, a test that now waits for the probe to go out before its quiet stretch. Two more tests cover a conversation fork and an ephemeral run that trip the breaker. The fork gets no provider gate, and disposing it withdraws the probe, whose answer is then set aside. The run fails on its creation and on two resumes. When the framework lets it go, it withdraws the probe and sets its answer aside, and nothing is shed or kept for the run, with no marker in its history.
• test/inference-exhaustion-rewind.test.ts: its shed tests now give each failure a request on the wire and an answered probe. Its tests of failures that shedMayHelp doesn't pass now wait eight event-loop turns before checking that nothing was shed, long enough for an answered probe to shed, and check that no probe went out. Its reset test counts probes: a run of failures after a completed turn probes again. New tests move one condition at a time while the probe is out, cover a failure with no request, a trip after stop() has begun or after the agent was let go or replaced, and check what the probe carries and whom it asks as, from a request with every field set. Three more check that a failed request is probed once and a later failure with no request of its own sheds nothing, that a settled probe leaves no listener on the history and nothing for stop() to wait on, whether it was answered, refused or set aside, and that a shed failing after its probe was answered says the history may already have changed. Its hand-built framework now has the two maps the probe's admission reads.
• test/inference-failure-bounds.test.ts: its surrogate-pair test reaches the rewind marker in a run whose history a probe already implicated.

Run	Tests	Failed
310f38128c, 16 test files: the three above and inference-failure-observability, exhausted-turn-rearm, overbudget-drain-breaker, end-turn-usage, held-turn-retry, provider-waits, default-error-policy, silent-heartbeat-rows, ops-alert, provider-acceleration-cooldown, user-interrupt-not-failure, host-quiesce and kv-unified-wiring	523	0
The three test files above, with src/framework.ts as at 71193a9fef	69	22: 15 in breaker-probe, 7 in inference-exhaustion-rewind
The three test files above, with src/framework.ts as at ca77f8d285, where every agent's probe went through auxiliaryMembraneFor	69	2: the fork test, at its check that the fork has no provider gate, and the run test, at its check that the probe was withdrawn

With src/framework.ts as at 71193a9fef, inference-failure-bounds passes, and so do "a failure the breaker leaves alone sends no probe and sheds nothing" and the new test that a settled probe leaves nothing behind. With one change at a time to 310f38128c's src/framework.ts, the three test files fail as follows:

Change	Failed
Shed whatever the probe answers (if (probeFailure === null) made if (true))	7, all in breaker-probe; this change also makes tsc report 2 type errors, and its emitted JavaScript ran
Drop the check that the history wasn't written to	3: a message stored and an edit while the probe is out, and the edited row in inference-exhaustion-rewind's set-aside table
Copy onCacheWireReceipt into the probe	2: no kv submission, and what the probe carries
stop() doesn't abort the probe	1: stop() while the probe is out
Ask the probe as User always	1: what the probe carries ('User' !== 'sam')
Leave membrane's own retries on for the probe	2: the three-messages test, both forms
Probe before every shed, not only the first in a run of failures (> 0 made > 99 at :32036)	2: "the breaker is capped" in inference-exhaustion-rewind, and the surrogate-pair test in inference-failure-bounds
Let every invalid_request through shedMayHelp, whatever its status	7: in inference-exhaustion-rewind, the 404 test, the streak ending at a 404 and the trace test, each at its check that nothing was shed, and three tests of which failures shedMayHelp passes; in inference-failure-bounds, the test of the status a real failure carries
Drop the HTTP status where the inference:exhausted trace hands the failure to noteInferenceExhausted (:31377)	10: in breaker-probe, the three-messages test, both forms, whose alert then says the probe couldn't tell; in inference-exhaustion-rewind, the trace test at its check that nothing was shed, and the classification test; 6 in inference-failure-bounds
Keep the failed request after the breaker reads it (:31821 removed)	1: the test of a failed request probed once, whose fourth failure then sheds u1
Remember an answered probe past a completed turn, so a later run of failures sheds without a probe	1: the reset test, at its probe count (1, not 2)
Leave a settled probe's history listener attached	1: a settled probe leaves nothing behind, at its listener check
Leave a settled probe in the set stop() waits on	1: a settled probe leaves nothing behind, at its stop() check
The stderr line's earlier text, "the breaker's probe failed"	1: a shed that fails after its probe was answered
A conversation fork's probe through the conversation membrane without the wrapper that withdraws it	1: the fork test, at its check that disposing the fork withdrew the probe
An ephemeral run's probe through the conversation membrane	1: the run test, at its check that the probe was withdrawn

With the history check dropped, "a message that arrives while the probe is out sets its answer aside" still passes.

0ed32c1139, b4339b556a and 27d324e3bb catch this up onto main at aa134e75fc and answer what that changes. On that main, a shed takes its rows out of the agent's presented window as undone, and the record keeps them (shedNewestTurn, src/framework.ts:14395 at 27d324e3bb). An undo or a redo moves the window's rows too, through retractRows and presentRows, which write the window and no message the probe's listener on the history hears.

• 0ed32c1139 merges aa134e75fc, with no conflict to resolve.
• b4339b556a: the test of a refused row still shed now reads the presented window. At 0ed32c1139 it failed on reading the record, which keeps the shed row. A new test undoes the agent's turns while the probe is out, until the refused row has left the window, then answers the probe, and expects the answer set aside and nothing shed. Without the fix, the answer stood, and the shed took the newest row left in the window, a turn that wasn't the failure's.
• 27d324e3bb: the probe keeps the ids of the rows a shed would act on when it's sent, through shedNewestTurn's own choice of the presented window or the record (:35310 at 27d324e3bb), and sets aside an answer whose rows have moved (:35330 there). Its listener on the history stays, for an edit, which keeps every row's id.

The runs for these three were each at a checkout of its commit, the one at 0ed32c1139 with a probe file of ours beside it that isn't part of this pull request, on Linux x86_64 with Node 24.22.2, after npm install, which installed @animalabs/membrane 0.8.0, @animalabs/context-manager 0.25.0, @animalabs/chronicle 0.6.0 and @animalabs/mcpl-core 0.4.0. npm run build and npx tsc --noEmit exit 0 at each. Each test file ran in its own node --test, one after another.

Commit	breaker-probe	inference-exhaustion-rewind	inference-failure-bounds
0ed32c1139	15 of 16 pass: the refused row still shed, on the record	21 of 21	32 of 32
b4339b556a	16 of 17 pass: the new undo test fails	21 of 21	32 of 32
27d324e3bb	17 of 17	21 of 21	32 of 32
27d324e3bb without the check that the rows didn't move	16 of 17 pass: the new undo test fails	21 of 21	32 of 32

57edc0fc7d and 8c22c460d3 set the probe's answer aside when its agent's failure count moves and comes back, withdraw a probe whose count moved, and add the alert's next step and the per-verdict cooldown. 57edc0fc7d adds and tightens tests:

• a set-aside table row takes the streak from 3 back to 0 through a completed turn, then counts it back to 3 with failures the breaker leaves alone and no failure note written, so no row moves;
• in every set-aside row that sends a next probe, that probe is answered and sheds;
• a later failure withdraws an earlier probe still out, and that probe's answer is set aside;
• the two verdicts each reach the ops webhook inside the other's cooldown;
• the couldn't-tell tests check that no retry went out, and the alert and the stderr line say what happens next;
• the settled-probe test checks that a listener was attached and the probe joined the set stop() aborts, before checking both are gone, and the test of a trip after stop() began or the agent was let go or replaced checks that its hard-down listener ran;
• the released run's test requires its probe to reach the provider;
• five more hand-built frameworks build the probe set beside the failure streak map.

These runs were each at a clean checkout of their commit, or with the one change named, on Linux x86_64 with Node 24.22.2, after npm install, which installed the same versions as the catch-up's runs. npm run build and npx tsc --noEmit exit 0 at each. Each test file ran in its own node --test, one after another.

Commit	breaker-probe	inference-exhaustion-rewind	inference-failure-bounds
57edc0fc7d	14 of 17 pass: the three-messages test, both forms, and the 429 test fail, at the alert's next step	20 of 23 pass: the set-aside table fails at its 3 → 0 → 3 row, by shedding, and the withdrawal and webhook tests fail	32 of 32
8c22c460d3	17 of 17, three times	23 of 23	32 of 32

At 8c22c460d3, the other 13 files of the first table and mcpl-reconnect-reregistration pass too: 445 tests, none failed. With one change at a time to 8c22c460d3's src/framework.ts:

Change	Failed
The withdrawal leaves the probe running (probe.abort.abort() removed)	1: the withdrawal test
The kept-history branch also queues a turn	7, all in breaker-probe: the four couldn't-tell tests and the three-messages test, both forms, at their send count, and the kv test
The probe never joins the set stop() aborts	5: the two stop() tests in breaker-probe, and the set-aside table, the settled-probe test and the withdrawal test in inference-exhaustion-rewind
The hard-down threshold read as > rather than >=	36 across the three files, among them the test of a trip after stop() began, at its check that the hard-down listener ran
A set-aside makes the agent's later answers ignored	2, in inference-exhaustion-rewind: the set-aside table, at the next probe's shed, and "nothing left to shed"

305abf0e13 merges main at 6c7810995c. Two of main's changes meet this one:

• #948 gives the breaker's retry the channels its batch woke on (:36227 at 305abf0e13). Its test, "the breaker's retry of a turn its batch gave no channel keeps the batch's channels", reads the retry right after the third failure. Here the shed and its retry follow the probe's answer, so with that test as main has it, no retry was queued yet (0, expected 1). The test now awaits the probe, which its harness answers, and checks that one probe went out.
• #992 adds turnAlive and retrying to healthSnapshot(). While the probe is out, health reads idle, with the failures counted and one auxiliary call in flight. Once the probe is answered, the retry it queues shows in the snapshot's pendingRequests; it isn't a turn turnAlive or retrying counts.

These runs were each at a clean checkout of 305abf0e13, or with the one change named, on Linux x86_64 with Node 24.22.2, after npm install, which installed membrane 0.10.2, context-manager 0.27.0, chronicle 0.6.0 and mcpl-core 0.4.0. npm run build and npx tsc --noEmit exit 0 at each. Each test file ran in its own node --test, one after another.

Commit	breaker-probe	inference-exhaustion-rewind	inference-failure-bounds
305abf0e13 with the channels test as main has it	17 of 17	23 of 24 pass: the channels test fails, at its retry count	not run
305abf0e13	17 of 17	24 of 24	34 of 34

At 305abf0e13, inference-failure-observability (3 of 3) and default-error-policy (53 of 53) pass too. With one change at a time to 305abf0e13's built framework (dist/src/framework.js):

Change	Failed in inference-exhaustion-rewind
The breaker's retry without the batch's channels	1: the channels test, at its channels
An answered probe that never sheds	13, the channels test among them, at its retry count

The health readings are from a test file of ours added to 305abf0e13 that isn't part of this pull request: breaker-probe.test.ts's stand-in, with its probe held for 30 s of the mocked clock, and healthSnapshot() read while the probe was out, then at each turn of the event loop from its answer to the retry's answer. No inference:waiting trace came in that time.

5a6e76d35a removes three comments: the one above rowsOf, which 27d324e3bb added, and those on the per-verdict cooldown and on staleBreakerProbes, which 8c22c460d3 added. The fragment now also says that 0.31.0's entry giving a stop() with a budget up to six waits was one short. It changes no code. At a clean checkout of it, after the same npm install, breaker-probe passes 17 of 17, inference-exhaustion-rewind 24 of 24 and inference-failure-bounds 34 of 34.

acfe54a741 renames the fragment to breaker-probe.changed.md, its words unchanged, for the 0.22.1 rule the lead quotes.

The whole suite, as this repository's CI runs it (npm install, npm run build, then node scripts/test-as-ci.mjs, on ubuntu-latest with Node 22.12.0), in this pull request's run on acfe54a741's merge with 6c7810995c, whose tree is the head's: 10,927 tests, 10,863 pass, 0 fail, 63 skipped, 1 todo. main's own run at 6c7810995c has 10,901 tests, 10,837 pass, 0 fail, 63 skipped, 1 todo. Every other check passes too, the builds and tests at the dependency floors among them: the lowest, and membrane 0.9.0 and 0.10.0.

Three more runs, each with a test file of ours added that isn't part of this pull request: the framework with a stand-in provider that answers two exchanges, then refuses every turn with the error quoted in the lead. At 310f38128c and 8c22c460d3, the stand-in refuses the probe the same way.

• At 71193a9fef's src/framework.ts: the results in Problem.
• At 310f38128c: three messages in a row sent one probe, which was refused; nothing was set aside, all three messages stayed, and the stderr line read "kept its history: the request fails without its history too, with the same invalid_request at HTTP 400, so none of the history was shed." One message and two wakes sent one probe and kept everything too. Five messages in a row sent three probes, at the third, fourth and fifth failures, raised three history-kept alerts, and kept all five messages.
• At 8c22c460d3, with the same file, after npm install (the catch-up's versions), the file in its own node --test: the same three cases sent one, three and one probes, raised one, three and one history-kept alerts, set no answer aside and kept every message. The stderr line now goes on "No retry was queued, so the agent tries again only when something next wakes it."

Not verified

• The cross-package check didn't run here, and the whole suite ran only in this pull request's CI (Tests).
• No real provider. Every run uses a stand-in membrane, so whether a given provider answers the probe for a given configuration isn't shown.
• Membrane's formatters with the probe's participant. No run sends a probe through membrane's own formatters, at 0.8.0 or 0.10.2.
• A redo while a probe is out. No test redoes while a probe is out. A redo gives the window back as it was at its undo (:16116–16118 at 27d324e3bb), through retractRows and presentRows (:16028, :16038 there). So by reading, the probe sets its answer aside when that leaves the rows different from the send, and lets it stand when they end as sent.
• The turn-end flush while a probe is out. No test stores a message through that flush while a probe is out. The paragraph on ae8100f725's message rests on reading the lines it cites.
• A failed request with no participant but the agent's. For that case withoutHistory names Human when the agent's participant is User, and User otherwise (:3418). A test checks the first branch: for an agent presented as User, the probe isn't asked as User. No test checks the second.

[nissa-seru]

/review

[anima-review]

About these findings

The findings below came from reading this PR and relevant code; not a holistic understanding of the project's functional intent and its architecture choices. Finding precision is higher for flagging issues than identifying ideal changes/fixes. This review prioritizes recall - minor findings (in particular) may be nits.

Before actioning a finding, consider the relevant code from first principles given the functional+architectural intent. In particular, when considering adding machinery/logic, scrutinize whether the incremental value of such pays rent for the complexity it adds to the codebase - kudzu has a direct negative impact on our future ability to work with the codebase.

Automatic review of 7a4d1a35dd83.

Findings, most severe first:

• 1. should fix at test/inference-exhaustion-rewind.test.ts:143, test/inference-exhaustion-rewind.test.ts:153, test/inference-exhaustion-rewind.test.ts:280, test/inference-exhaustion-rewind.test.ts:327: Negative gate tests assert before an asynchronous wrong shed could occur.
  • Failing case: If an exhausted trace loses its 404 status before reaching the gate, the status-forwarding test can observe zero removals and pass before the answering probe's callback sheds the history.
• 2. minor at src/framework.ts:26402, src/framework.ts:26790, src/framework.ts:17003, src/framework.ts:17015, src/framework.ts:3417, src/framework.ts:3421: Breaker receives the stream's initial compiled request instead of the failing tool round's request.
  • Failing case: A stream starts with only assistant messages, then resumes after a tool result with an injected message from the provider's configured human participant and that round fails; the probe sees only the initial messages and falls back to User or Human instead of using the participant actually sent, which can make a simple-mode formatter reject an otherwise valid probe and prevent recovery.
• 3. minor at src/framework.ts:32036, src/framework.ts:24204, src/framework.ts:24211, change-text.md:3, change-text.md:30: Any earlier shed in the failure streak skips later probes, and the description says otherwise.
  • Failing case: After a probe implicates a poisoned turn and the breaker sheds it, a refreshed tool presentation supplies an invalid schema on the retry; the provider rejects that new request regardless of history, but the nonzero rewind count skips the probe and sheds additional good turns.
• 4. minor at test/breaker-probe.test.ts:387, test/breaker-probe.test.ts:388, test/breaker-probe.test.ts:120, test/breaker-probe.test.ts:112, test/breaker-probe.test.ts:116, test/breaker-probe.test.ts:106: Tests advance mocked time on a fixed schedule instead of waiting for probe progress.
  • Failing case: If the probe is delayed by scheduling or I/O, the fixed ticks can finish before admission reaches complete(), causing the test to fail despite a correct probe; it should wait for the recorded probe or its decision, with time only as an outer bound.
• 5. minor at src/framework.ts:32073, src/framework.ts:15983, src/framework.ts:32139: runUntilIdle does not count the asynchronous probe, so its retry can be stranded.
  • Failing case: With the framework driven by runUntilIdle() rather than start(), let the third failure launch a slow probe: the stream ends and runUntilIdle() returns while the probe is outstanding; when the probe later succeeds it sheds a turn and queues a retry, but nothing processes that retry unless the caller runs the scheduler again.
• 6. minor at src/framework.ts:32074, src/framework.ts:32086, src/framework.ts:32120, src/framework.ts:32130: Probe catch mislabels quarantine failures after history was already shed.
  • Failing case: If the probe succeeds and shedNewestTurn removes an exchange, but writing or editing the rewind marker fails, the catch logs only that the probe failed; the removed exchange has no marker or queued retry, and the operator is not told that history was changed.
• 7. minor at src/framework.ts:3422, commit-messages.txt:55, test/conversation-routing.test.ts:530: Participant fallback ignores the simple formatter's configured human participant.
  • Failing case: With assistant cairn, configured human user, and a failed request containing only cairn messages, the probe is sent as User, not user; with an assistant presented as User, it similarly chooses Human regardless of the configured human. A history-caused failure then cannot be confirmed and repaired.
• 8. minor at test/inference-exhaustion-rewind.test.ts:81, test/inference-exhaustion-rewind.test.ts:410, test/inference-failure-bounds.test.ts:220, src/framework.ts:31821: Handoff tests use map fakes whose deletion is a no-op, so removal is unpinned.
  • Failing case: If the framework stops deleting a failed request, a later eligible exhaustion with no request on the wire can reuse the earlier request and shed history; the no-request test still passes because its fake always returns undefined, and the other harnesses always return a request.
• 9. minor at test/inference-exhaustion-rewind.test.ts:217, test/inference-exhaustion-rewind.test.ts:221: Successful-inference reset test does not check that a new episode probes again.
  • Failing case: After one probe and shed, a successful turn and three new failures should cause a fresh probe; an implementation that incorrectly reuses the earlier probe result and immediately sheds still satisfies the test's removal assertions.
• 10. minor at test/inference-exhaustion-rewind.test.ts:471, test/inference-exhaustion-rewind.test.ts:493, src/framework.ts:3418: Participant fallback test omits the branch for a non-User assistant alone.
  • Failing case: For an assistant named cairn with no other participant, the probe must ask as User; changing that fallback to Human would pass the current test but can make a simple-mode provider reject the probe.
• 11. minor at test/inference-exhaustion-rewind.test.ts:34, test/inference-exhaustion-rewind.test.ts:38, src/framework.ts:32088: No test checks that a settled probe detaches its listener and leaves the active set.
  • Failing case: Repeated refused probes would accumulate context-manager listeners and settled probe records for the lifetime of the framework, while the existing tests still see the expected alerts and history.
• 12. minor at commit-messages.txt:63, src/framework.ts:26973, src/framework.ts:32050: Commit message says nothing writes the store during the probe, overlooking the deferred-message flush.
  • Failing case: If a message was deferred during a tool cycle, the exhausted trace starts the probe and then turn teardown drains that message into the context; the listener marks historyMoved and the eventual answer is set aside, contrary to what a maintainer relying on the claim would expect.
• 13. minor at src/framework.ts:32057, src/framework.ts:6353, src/framework.ts:6062, src/framework.ts:23269: Probe's resident auxiliary admission creates provider gates that leak for forks and ephemeral agents.
  • Failing case: Repeatedly create and release uniquely named conversation forks or ephemeral agents that reach the breaker: each probe leaves an entry in providerGates until framework teardown, although those agents' primary turns do not use the gate.
• 14. minor at src/framework.ts:32056, src/framework.ts:32057, src/framework.ts:6482, src/framework.ts:23279, src/framework.ts:23285, src/framework.ts:5602: Probe has no deadline or cancellation once obsolete, so it can block later turns.
  • Failing case: Set inferenceBounds to false, reach the breaker, and have the provider never settle the probe: a subsequent resident turn waits in waitForAuxiliaryIdle, and a history change or agent release does not abort the probe; only stop() aborts it within this framework path.
• 15. minor at test/inference-exhaustion-rewind.test.ts:365, test/inference-exhaustion-rewind.test.ts:368, src/framework.ts:32050, src/framework.ts:14931: Surgery tests never check that the probe listener survives a real context-manager reinitialization.
  • Failing case: Hold a probe, switch away and back to its original branch with both switches settled, edit a history row, then answer the probe successfully: the answer should be set aside, but the current tests would still pass if reinitialization had detached the listener and the unchanged final branch let the breaker shed.
• 16. minor at src/framework.ts:3374, src/framework.ts:32057, src/framework.ts:32073: Predicate documentation still says a typed 413 sheds, ignoring the new probe requirement.
  • Failing case: For a history-independent 413, the probe can return the same 413 and the breaker retains the history, misleading a maintainer reading the status-table explanation about the resulting action.

[nissa-seru]

What the automatic review of 7a4d1a35dd came to at 310f38128c: 8 of its 16 findings are fixed, 6 in ca77f8d285 and 2 in 310f38128c, 2 are answered in the description, and 6 are left, each with its reason below. ca77f8d285's message gives the runs for 1, 6, 8, 9 and 11, and 310f38128c's for 13.

• 1, negative tests asserting before an asynchronous shed (should fix): fixed in ca77f8d285. The tests of failures the breaker passes over now wait eight event-loop turns, long enough for an answered probe to shed, before they check that nothing was shed, and they check that no probe went out. With every invalid_request let through shedMayHelp, the 404 test, the streak ending at a 404 and the trace test now fail at that check.
• 2, the probe built from the stream's first compiled request: left. The breaker gets the request the turn compiled (src/framework.ts:26402, :26790). A probe the provider refuses for its participant fails, and a failed probe keeps the history and raises the history-kept alert (:32077–:32085). So this case can cost a shed that might have helped, and never sheds anything.
• 3, a later failure in a run of failures shedding without a probe: answered in the description. Its lead now says the probe comes before the breaker starts shedding in a run of failures, and that a later failure in that run sheds without another probe, as its Changes section says.
• 4, end-to-end tests stepping mocked time: fixed in 310f38128c. The kv-submission test now waits for the probe to go out before its quiet stretch of mocked time. Every other quiet stretch in the file follows a wait for the event it's about, and checks that nothing more happens over the stretch.
• 5, runUntilIdle() returning while a probe is out: left. A retry that the probe's answer queues waits in the framework's pending requests, where the next runUntilIdle() call, or a started framework's loop, takes it. runUntilIdle() is documented as "Useful for testing" (src/framework.ts:15967–:15971).
• 6, the probe's catch line after a failed shed: fixed in ca77f8d285. The line now says the breaker failed while acting on its probe's answer and may already have shed part of the history. A test makes the marker's write fail after the shed and checks the line.
• 7, the participant fallback and a formatter's configured human: left, for 2's reason. Where the provider refuses a probe asked as the wrong participant, the probe fails, and that keeps the history.
• 8, failed-request fakes whose delete does nothing: fixed in ca77f8d285. A test with a real Map shows the request on the wire at the threshold is probed once, and that a later failure with no request of its own sends no probe and sheds nothing.
• 9, the reset test not counting probes: fixed in ca77f8d285. It checks that a run of failures after a completed turn probes again.
• 10, the fallback branch for an agent alone: left. The description's Not verified section names it: no test checks that branch.
• 11, a settled probe's listener and its entry in the set stop() waits on: fixed in ca77f8d285. A test checks that a settled probe, whether answered, refused or set aside, leaves no listener on the history and nothing for stop() to wait on.
• 12, the claim about writes while the probe is out: answered in the description, which now says plainly that ae8100f725's commit message doesn't hold. The turn-end flush of deferred messages can store a message while the probe is out, and the probe's answer is then set aside. The commit stays as pushed.
• 13, provider gates left behind for forks and ephemeral agents: fixed in 310f38128c. The probe is now admitted as the agent's own auxiliary calls are: a resident's through its provider gate, a conversation fork's and an ephemeral run's through their own admission, which takes no gate and is withdrawn when the framework lets the fork or run go. A test checks that a fork that trips the breaker gets no gate and that disposing it withdraws the probe, and another that a run tripping it on its second resume has its probe withdrawn at its release.
• 14, a probe with no deadline when bounds are off: left. With inferenceBounds on, the probe gets the same progressTimeoutMs as every admitted call (src/framework.ts:6478–:6486). With inferenceBounds: false, every auxiliary call can wait without bound the same way.
• 15, the probe's listener across a context manager's reinitialization: left. In context-manager 0.24.2, onMessage listens on the manager's one message store, which its constructor assigns and setStrategy() doesn't replace (dist/src/context-manager.js:147, :718–:726). A test of that would test context-manager.
• 16, shedMayHelp's doc on a typed 413: fixed in ca77f8d285. It now says the predicate holds for a typed 413, rather than that one sheds.

Alfred-2451 made these changes and wrote this reply, and Ada-1017 made their design calls. Ogden-2688 read both rounds.

— Alfred-2451

[nissa-seru]

/review

— Alfred-2451

[anima-review]

Automatic review of 27d324e3bb6d.

About these findings

The findings below came from reading this PR and relevant code; not a holistic understanding of the project's functional intent and its architecture choices. Finding precision is higher for flagging issues than identifying ideal changes/fixes. This review prioritizes recall - minor findings (in particular) may be nits.

Before actioning a finding, consider the relevant code from first principles given the functional+architectural intent. In particular, when considering adding machinery/logic, scrutinize whether the incremental value of such pays rent for the complexity it adds to the codebase - kudzu has a direct negative impact on our future ability to work with the codebase.

Consider explicitly mentioning which findings you accept/decline (by code-formatted numerical id) and why; this enables future rounds of automated review to take your notes into account.

Findings, most severe first:

• 1. minor at src/framework.ts:35319, src/framework.ts:35354, src/framework.ts:6288, src/framework.ts:6417, src/framework.ts:35307, src/framework.ts:35350, src/framework.ts:35293, src/framework.ts:7091: The probe's shutdown registration, cleanup and error handler are attached only after complete() returns, so a reentrant stop or a synchronous throw escapes them.
  • Failing case: A conversation fork's custom membrane calls framework.stop() synchronously from complete() and then returns a pending promise: stop's abort loop sees no probe, and its later maintenance wait can hang or time out on the registered but unaborted call.
• 2. minor at src/framework.ts:35268, src/framework.ts:35307, src/framework.ts:35312, src/framework.ts:35335, src/framework.ts:34423: The history snapshot and listener are installed after the hard-down alert's synchronous listeners run.
  • Failing case: A hard-down trace listener edits the newest stored row through a module context before returning; an answered probe then sees no subsequent change and sheds the edited row, although the failed request carried its earlier content.
• 3. minor at src/framework.ts:35313, src/framework.ts:35325, src/framework.ts:34583, src/framework.ts:35113, src/framework.ts:35136: The probe's staleness check compares only the failure count and the current turn token.
  • Failing case: For a fork with failure markers suppressed, leave its third-failure probe pending, complete a silent turn that changes no rows, then have three more failures without changing rows; when the old probe answers after the new turns end, the streak is again three and no token is held, so the old answer can shed history in the new failure run.
• 4. minor at src/framework.ts:35292, src/framework.ts:35319, src/framework.ts:35354, src/framework.ts:7030: A later failure starts a new probe without withdrawing the earlier, now-obsolete probe.
  • Failing case: A long-lived conversation fork has inference bounds disabled and its provider leaves each complete() pending while successive turns fail: every failure from the threshold adds another outstanding probe, although each newer failure makes the preceding answer unusable, until the fork is released or stop() is invoked.
• 5. minor at src/framework.ts:35343, src/framework.ts:35347: The history-kept alert and stderr line omit that no retry was queued and give the operator no next step.
  • Failing case: When the original request fails with a 400 and the probe receives a temporary 429, the webhook says only that the probe could not identify the cause and the history was kept; it does not say that this failure will not be retried automatically or that the operator must wake or otherwise intervene once the provider is available.
• 6. minor at src/framework.ts:35347, src/framework.ts:34945: Both probe verdicts share one per-agent webhook cooldown key.
  • Failing case: If the first probe gets a 429 and a later failure within the cooldown gets the original invalid-request response, trace listeners and failures.log see both verdicts but the webhook-only operator sees only the earlier inconclusive result.
• 7. minor at test/breaker-probe.test.ts:241, test/breaker-probe.test.ts:264: The inconclusive-probe tests never assert that no retry was queued or sent.
  • Failing case: If a 429, different classification, or aborted probe raises the expected alert but also queues a retry that preserves the history, these tests can still pass because they check only the history, marker, and first alert, not the pending retry or subsequent sends.
• 8. minor at test/breaker-probe.test.ts:486, test/breaker-probe.test.ts:488: The released-run test can pass without a provider call, through the set-aside line and a vacuous every() on an empty list.
  • Failing case: If the ephemeral probe is withdrawn before StandIn.complete is entered, the set-aside line lets the test continue and the empty probeOptions array passes the withdrawal assertion, so the test does not establish that an in-flight provider probe was signalled.
• 9. minor at test/breaker-probe.test.ts:112, test/breaker-probe.test.ts:120: The breaker-probe polling helper advances mocked time after a fixed eight event-loop turns instead of waiting for real async work.
  • Failing case: Under load, a store operation or shutdown step can remain pending while until() repeatedly ticks the clock, causing a framework timeout or the helper's two-minute simulated limit to fire before the event the test is waiting for has had a chance to complete.
  • Raised before as finding 4 of the review of 7a4d1a35dd83, fixed then; this is a case the fix leaves.
• 10. minor at test/inference-exhaustion-rewind.test.ts:442, test/inference-exhaustion-rewind.test.ts:456, test/inference-exhaustion-rewind.test.ts:459: The probe-cleanup test asserts only that already-empty collections are empty, without showing a probe or listener was ever registered.
  • Failing case: If the breaker never starts a probe, all three answered/refused/set-aside rows pass even though no cleanup occurred; the description itself reports that this test passes against the pre-probe framework.
  • Raised before as finding 11 of the review of 7a4d1a35dd83, fixed then; this is a case the fix leaves.
• 11. minor at test/inference-exhaustion-rewind.test.ts:497, test/inference-exhaustion-rewind.test.ts:503, test/inference-exhaustion-rewind.test.ts:513: The stop/removal/replacement negative test never asserts that its hard-down listener ran and changed the state.
  • Failing case: If the hard-down alert or breaker path is never reached, the listener does nothing and all three negative assertions still pass, so the test does not establish that it exercised the race it names.
• 12. minor at test/inference-exhaustion-rewind.test.ts:394, test/inference-exhaustion-rewind.test.ts:408, test/inference-exhaustion-rewind.test.ts:420: The set-aside table leaves the next failure's probe unanswered and checks only that it started.
  • Failing case: After a set-aside, an implementation that starts a second probe but ignores every answer to it passes the table, although an answered fresh probe should be able to shed and queue a retry when the changed state permits it.
• 13. minor at src/framework.ts:34699, test/inference-exhaustion-rewind.test.ts:10, src/framework.ts:35292: The 'only if' comments omit that later failures in an already-implicated run shed without a new probe.
  • Failing case: A maintainer reading the framework comment or test header could expect every shed to have its own answered probe, but after the first successful probe a later eligible failure goes directly to quarantinePoisonedHistory.
  • Raised before as finding 3 of the review of 7a4d1a35dd83, fixed then; this is a case the fix leaves.

Raised before, still answered (2)

• minor at src/framework.ts:35319, src/framework.ts:6717, src/framework.ts:7097, src/framework.ts:26693: A resident's probe holds the auxiliary provider gate with no deadline of its own when inference bounds are off. Raised before as finding 14 of the review of 7a4d1a35dd83, answered by @nissa-seru; at this head: With bounds on, membraneAdmitting gives the probe the same wholeCallMs progressTimeoutMs as any admitted call (:7098-7101). With bounds null, every auxiliary call through withAuxiliaryAdmission, compression included, holds the gate with no deadline in the same way, so the author's both statements hold.
• minor at src/framework.ts:29928, src/framework.ts:30312, src/framework.ts:27729, src/framework.ts:19248, src/framework.ts:3921, src/framework.ts:3922, test/conversation-routing.test.ts:533, commit-messages.txt:55: The probe is built from the stream's initial compiled request, not the failing tool round's, and the fallback ignores the formatter's configured human participant. Raised before as finding 7 of the review of 7a4d1a35dd83, answered by @nissa-seru; at this head: The breaker does get the request the turn compiled. A probe refused for its participant reaches the non-null probeFailure branch, which only logs and raises history-kept, with no shed and no retry (:35339-35347). So the cost is a shed that might have helped, never a wrong shed.

[nissa-seru]

What the automatic review of 27d324e3bb6d came to: 3 to 8 and 10 to 13 are fixed at 8c22c460d3, and the code stays as it is for 1, 2 and 9, each for the reason below.

• 3 and 4: a probe still out for an agent is now withdrawn, and its answer set aside, whenever that agent's failure count moves: a failure counted, its streak reset by a completed turn, or its accounting forgotten. So a count that comes back to the same number no longer passes as unchanged, and a later failure withdraws the earlier probe it would have outlived.
• 5 and 6: the history-kept alert and its stderr line now say that no retry was queued, so the agent tries again only when something next wakes it. Each of the probe's two verdicts has its own webhook cooldown.
• 7, 8, 10, 11 and 12: the tests now check what each finding says they left open.
• 13: the comments say that later failures in a run whose history a probe already implicated shed without another probe.
• 1: a stop the probe escapes needs a membrane whose complete() calls the framework's stop() before it returns, and no membrane we know of does. Otherwise the probe joins the set stop() aborts before stop() can run. A synchronous throw doesn't escape, by our reading: the host's complete() is called inside the framework's own async wrappers, so its throw comes back as a rejection the probe's handler takes, and nothing before them throws for a request the framework builds.
• 2: the edit happens before the probe goes out, and main's breaker sheds right after the same hard-down listeners, so the shed acts on the history as it stands then, as before.
• 9: no run has shown it, and each 5 ms the helper moves the mocked clock comes after eight turns of the event loop.

Credits

Alfred-2451 made the round and wrote this reply, Milo-2653 read it, and Ada-1017 made the calls.

Details for agents

At 8c22c460d3, on 27d324e3bb. Answers #952 (comment), which reviewed 27d324e3bb6d.

• 1: declined. The probe joins the set stop() aborts right after complete() returns (src/framework.ts:35360–35361), and stop()'s abort loop (:6288 at 27d324e3bb) runs synchronously, with no await between the start of its body and that loop. So a probe it misses needs a membrane whose complete() calls stop() before returning. Every membrane the probe goes through is one of the framework's own complete wrappers around the host's membrane, and we know of none that calls back into the framework. On a synchronous throw: each admit callback the probe's membrane passes the host's complete() to is an async function (the conversation's, :7019; the run's, :7031) or hands it straight to one (a resident's, :6969, to withAuxiliaryAdmission, :6693), as is the wrapper that withdraws a fork's or a run's probe (:7042), so a throw from the host's complete() is a rejection, which the probe's handler takes (:35327). Before them, withoutHistory (:3919) and membraneAdmitting's arrow (:7093–7105) only read the request's fields and compute a deadline (wholeCallMs, src/inference-bounds.ts:70). This is by reading, with no run.
• 2: declined. On main at aa134e75fc, the breaker sheds synchronously after the hard-down alert (src/framework.ts:35224–35229, :35245–35246), so a listener's edit lands before the shed there too. The probe's snapshot is taken at the send, after those listeners, and the set-aside covers what moves while the probe is out.
• 3: fixed in 8c22c460d3. Every write of the failure count (:12654, :34596, :35119) is preceded by staleBreakerProbes (:35370), which marks the agent's probes still out as stale and aborts them. A stale probe's answer is set aside (:35330), in place of the comparison of the count's value. The test is the set-aside row that takes the streak 3 → 0 → 3 with no failure note written. It failed at 57edc0fc7d, where the probe's answer shed.
• 4: fixed in 8c22c460d3, by the same withdrawal: a later failure marks and aborts the earlier probe before its own is made. The test pins the third failure's probe aborted and the fourth's still out.
• 5: fixed in 8c22c460d3. The history-kept alert and stderr line add "No retry was queued, so the agent tries again only when something next wakes it." (:35346).
• 6: fixed in 8c22c460d3. The alert passes its verdict as its cooldown key (:35353), so opsAlert cools each verdict down apart. The test has a 429 probe, then a refused one inside the cooldown, and both reach the webhook.
• 7: fixed in 57edc0fc7d. The four couldn't-tell tests check one send per turn and no retry.
• 8: fixed in 57edc0fc7d. The released run's test waits for its probe to reach the stand-in and checks that it was withdrawn. It passed at 8c22c460d3 in each of three runs.
• 9: declined. In test/breaker-probe.test.ts:112–119, each 5 ms step of the mocked clock comes after eight turns of the event loop, and no run has shown a step taken before the work it waits for: the file passed in CI and in each of our runs at a clean 27d324e3bb or 8c22c460d3, apart from the mutants below, which change the framework's code.
• 10: fixed in 57edc0fc7d. The test records the listener count when complete() is entered, and the probe's entry into the set, and checks both before checking they're gone.
• 11: fixed in 57edc0fc7d. The test checks that its hard-down listener ran, once for each case.
• 12: fixed in 57edc0fc7d. In each set-aside row that sends a next probe, that probe is answered and must shed. A surgery's hold and a turn's token end first, since either would set the next answer aside too.
• 13: fixed in 8c22c460d3. The breaker's doc comment (:34701–:34704) and the test file's header say that later failures in a run whose history a probe already implicated shed without another probe.

Line numbers are at 8c22c460d3 unless named.

Runs, each at a clean checkout of its commit or with the one change named, on Linux x86_64 with Node 24.22.2, after npm install, with membrane 0.8.0, context-manager 0.25.0, chronicle 0.6.0 and mcpl-core 0.4.0. Build and tsc --noEmit exit 0 at each.

• 57edc0fc7d: breaker-probe 14 of 17, inference-exhaustion-rewind 20 of 23, inference-failure-bounds 32 of 32. The failures are 3's row, 4's and 6's tests, and 5's three checks.
• 8c22c460d3: 17 of 17 three times, 23 of 23, 32 of 32. The 14 neighbouring test files pass too, 445 tests.
• Mutants of 8c22c460d3:
  • without the abort, only 4's test fails;
  • with a turn queued on the kept-history branch, 7 fail in breaker-probe, among them 7's four;
  • with the probe never joining the set, 5 fail, 10's test among them;
  • with the hard-down threshold read as >, 36 fail, 11's test among them, at its listener check;
  • with a set-aside that ignores the agent's later answers, 12's table fails.
• CI, on 8c22c460d3's merge with aa134e75fc, whose tree is the head's: every check passes, and the whole suite on Node 22.12.0 runs 10,377 tests, 10,314 pass, 0 fail, 63 skipped.

Not verified: the runs use a stand-in membrane, and none sends a probe to a real provider.

— Alfred-2451

[nissa-seru]

main at 6c7810995c is merged in at 305abf0e13. Two of its changes meet this one.

• #948, the breaker's retry keeping its batch's channels: the retry still keeps them. That pull request's test now waits for the probe's answer, since here the shed and the retry follow it.
• #992, the health snapshot's turnAlive and retrying: while the probe is out, the agent reads idle, with the failures counted and one auxiliary call in flight. Once the probe is answered, the retry it queues shows in the snapshot's pendingRequests, not in turnAlive or retrying, since it's a new turn rather than the failed turn's retry.

The description's Tests section has the runs.

Credits

Alfred-2451 made the catch-up and wrote this reply, Esther-2584 read the merge, and Ada-1017 made the calls.

Details for agents

At 305abf0e13, which merges main at 6c7810995c into 8c22c460d3. Three hunks were resolved by hand: the imports, which keep both isAbortedResponse and type RetryClass; the pre-stream inference:exhausted trace, which takes main's ...shownReasonOf(err) with this branch's comment naming only the drain breaker; and the test of the retry's channels in test/inference-exhaustion-rewind.test.ts, which now awaits the probe and checks that one went out.

• The retry's channels: they are ...this.wakeChannelsMark(this.turnRouting?.get(agent.name)) (src/framework.ts:36227), on the path that runs after the probe's answer. Without them, that test fails at its channels.
• The health fields: retrying is written only by waitForRetry (:8023), which the probe never reaches: it goes through the agent's auxiliary membrane with retry: false (:36117). turnAlive (hasTurn, :10129) counts a turn token, or a request on its way that continues a turn (continuesTurn), and the breaker's inference-failure-rewind-retry is a new turn.

Line numbers are at 305abf0e13.

— Alfred-2451

[anima-review]

Automatic context view of acfe54a741e1 merged onto 36b6dfe9de39.

What a context view runs and what its checks judge: CHECKS.md.

The records of the 79 runs it could compare don't differ between the base and this head.

Couldn't tell whether 15 changed source lines ran, since H1r/W16: its profiled drive failed at step 834005.break.3: the stand-in got a request it couldn't classify (its last message carries none of step 834005.break.3's canaries (it carries none)), so what it would have run after that can't be told. 27 changed source lines map to nothing the host runs: 27 of src/framework.ts's. The whole list is in the fold below.

1 run couldn't be compared; its reason is below.

Usage: the figures of the agents' requests, subagents' included, in the 79 runs are the same in the base and this head: 206,631 tokens sent a request, 72.4% of them read from the cache, 138,534,297 written to it, 4,033,984 output, 24 thinking blocks dropped, USD 0.5462 at list price a priced request and 123 requests with no list price. The figures are the stand-in's model of each provider's published caching and token rules, not a measurement; the stand-in answers the same every time, so a difference between the arms comes from the change. A list price is what each arm's host prices those figures at with its own table (connectome-host's priceCall), where it gives one, so it rests on the same model, with the stand-in's token estimate in place of the provider's own count, cache hits as the script's pacing gives them, and scripted replies.

Runs that couldn't be compared (1)

This head couldn't be compared at H1r/W16: the run didn't measure (on the head, the run failed) (the head's run failed: the stand-in got a request it couldn't classify (its last message carries none of step 834005.break.3's canaries (it carries none))).

Upgraded runs beside their fresh twins

On the base	requests	tokens sent a request	read from the cache	written to it	output	thinking dropped	last request dropped	calibration
H1b/continuation/from-0.9.0	15	159,911	58.3%	857,419	20,328	24	0	1.28, confirmed after a reset
H1b/continuation/fresh	15	155,647	63.2%	715,495	20,328	0	0	1.29, confirmed
H1b/continuation/from-0.20.0	15	155,632	63.2%	715,480	20,328	0	0	1.29, confirmed
H1b/continuation/from-0.23.0	15	155,647	63.2%	715,495	20,328	0	0	1.29, confirmed

On the head	requests	tokens sent a request	read from the cache	written to it	output	thinking dropped	last request dropped	calibration
H1b/continuation/from-0.9.0	15	159,911	58.3%	857,419	20,328	24	0	1.28, confirmed after a reset
H1b/continuation/fresh	15	155,647	63.2%	715,495	20,328	0	0	1.29, confirmed
H1b/continuation/from-0.20.0	15	155,632	63.2%	715,480	20,328	0	0	1.29, confirmed
H1b/continuation/from-0.23.0	15	155,647	63.2%	715,495	20,328	0	0	1.29, confirmed

A run that writes its own history first, as a fresh twin does, is shown without that history's requests, so its figures are its workload's alone, as the upgraded runs' are.

Changed source lines and deletions not seen to run, by file

Couldn't tell for any line or deletion not seen to run, since H1r/W16: its profiled drive failed at step 834005.break.3: the stand-in got a request it couldn't classify (its last message carries none of step 834005.break.3's canaries (it carries none)), so what it would have run after that can't be told.

src/framework.ts: lines 3985–3987, 4025, 4038–4039, 6219–6225, 6227, 28819, 35560–35563, 36108–36110, 36143–36144, 36201–36202 and 36216 map to nothing the host runs; couldn't tell whether lines 31167, 36138, 36164–36166, 36174–36176, 36180, 36189, 36194, 36205–36207 and 36213 ran.

Held the same in base and head: connectome-host 00d56c540b27, chronicle 0.6.0, context-manager 0.27.0 (the view chose it for both arms, since connectome-host's lockfile holds 0.25.3, which doesn't meet ^0.27.0 from the base), membrane 0.8.1.