From 313cd338ab4962b66c7b5d338b8faf583d0187f5 Mon Sep 17 00:00:00 2001 From: bitkyc08-arch Date: Sun, 30 Aug 2026 12:29:32 +0900 Subject: [PATCH] docs(devlog): record the final gate for the cursor tool-continuation unit The unit's eleven audit rounds all reviewed the change while it was being built, against a plan the same session wrote. This adds 080, the record of a narrower gate those rounds structurally could not perform: whether the landed code on dev holds up to a reviewer who did not build it, and whether every claim in the written record is true against git rather than against memory. Verdict: pass, no findings. The gate produced one correction worth having. The fix does not emit a separate assistant [Tool Call] root before a replayed result - it names the invocation inside the result envelope as an "invoked:" line, because a standalone marker gets few-shot-mimicked by the model and breaks multi-tool continuations, which is what the remote suite's 363-B guard caught when this unit first tried that shape. So the invariant is "no replayed result root lacks its invocation line", and the earlier call-precedes-result framing is misleading. Coverage is measured rather than asserted: six mutations each reddening on-point tests, and the round 11 note threshold reproducing in both directions - relaxing it reddens 4, tightening it reddens 1. A suite that can tell a correct bound from an unnecessarily strict one is what rounds 5 through 10 lacked. Three hostile shapes also attacked the checkpoint skip premise directly and none produced an orphan, because the invocation is keyed by call id over full history. It records one behaviour without filing it: when two calls share a decoded call id the ambiguous id is dropped and both results replay with no invocation line. The code argues that tradeoff explicitly and upstream call ids are unique. Docs only. Nothing in the build, typecheck or test path reads devlog/. --- .../080_final_gate.md | 78 +++++++++++++++++++ 1 file changed, 78 insertions(+) create mode 100644 devlog/_fin/260829_cursor_tool_continuation_pairing/080_final_gate.md diff --git a/devlog/_fin/260829_cursor_tool_continuation_pairing/080_final_gate.md b/devlog/_fin/260829_cursor_tool_continuation_pairing/080_final_gate.md new file mode 100644 index 0000000000..732fcb4a21 --- /dev/null +++ b/devlog/_fin/260829_cursor_tool_continuation_pairing/080_final_gate.md @@ -0,0 +1,78 @@ +# 080 — Final gate: independent audit of the landed fix + +Reviewed tree: `7747bf74f`, checked out detached and clean, which at the time was `origin/dev`. +The fix path and this unit are byte-identical at later heads, so the audit still describes them. + +## Why a separate gate, after eleven rounds + +Rounds 1 through 11 in `070` audited the change while it was being built, against a plan the same +session wrote. This gate asks a narrower question that those rounds structurally could not: does the +landed code on `dev` hold up to someone who did not build it, and is every claim in the written record +true against git rather than against memory. + +The reviewer was given the three deliberately scoped-out items up front — the inert +`envelope_exhausted` propagation, the extreme-byte-axis note ordering, and `composer-2.5`'s hybrid +root count — precisely so it could not bill known accepted tradeoffs as new findings, and was told a +PASS was an acceptable outcome so it had no incentive to manufacture one. + +## Verdict: pass, no findings + +### The invariant is not the one the plan named + +The most useful thing the gate produced is a correction to how this fix should be described. It does +not emit a separate assistant `[Tool Call]` root before the result. It names the invocation *inside* +the result envelope, as an `invoked: with ` line +(`src/adapters/cursor/protobuf-request.ts`). That is deliberate: a standalone `[Tool Call]` marker +gets few-shot-mimicked by the model and breaks multi-tool continuations, which is what the remote +suite's 363-B guard caught when this unit first tried that shape. + +So the invariant worth testing is "no replayed result root lacks its invocation line", not "a call +root precedes the result". The goalplan's own criterion wording carries the older framing. + +### Coverage, measured rather than asserted + +Six mutations, each reddening on-point tests against a 166 pass / 0 fail baseline on four cursor +suites: + +| Mutation | Red | +|---|---| +| Orphan-strip skip reverted | 3 — suffix-growth and byte-pressure rows | +| Guard skipped unconditionally | 1 — the full-replay orphan row | +| `callBefore` positional bound dropped | 2 — both history-position rows | +| `knownCallsOffset` dropped from the root bound | 3 — including the pre-cut call naming row | +| `carriedRoots.count` removed from `historyLimit` | 10 | +| Turn-granular admission restored for suffixes | 1 — incremental pruning | + +The round 11 note threshold reproduces in both directions: relaxing `>= 1` to `>= 0` reddens 4, +tightening to `>= 2` reddens 1. A suite that can tell a correct bound from an unnecessarily strict one +is the strongest single piece of evidence in this unit, and it is what rounds 5 through 10 lacked. + +### Sweeps + +96 shapes across pair counts, full replay and two checkpoint cuts, bare-call and narrated histories, +result sizes to 64 KiB: 503 result roots, none missing an invocation line. A wider 576-configuration +sweep over parallel batches, system-prompt counts, carried roots, tail kinds and note arming reported +no throws, no count overrun, no orphan cases and no lost newest result. 55 invocation pairings across +checkpoint cuts produced no mislabel, so no result was ever named with a later command. + +### The checkpoint skip does not rest on trusting the checkpoint + +Three hostile shapes attacked the `knownCallsOffset > 0` premise: a covered prefix with no user turn, +`suffixStart = 1` where message 0 is an assistant, and a cut falling between a call and its result. +All three kept the invocation line and produced no orphan, because the line is keyed by call id over +full history. The positional bound and the orphan-strip skip are independent mechanisms, which is why +the skip cannot resurrect the original looping symptom. + +### Claims checked against git + +`62df78d8d` is #2940's squash commit and an ancestor of the reviewed head; `0340d1759` is that PR's +recorded head with all-success CI; `git diff` between them on the fix path is empty, which is what +makes "the landed tree is verified, not only the pre-merge head" a fair statement rather than a +flourish. The 213 / 127 test counts reproduce exactly. `bun run typecheck` is clean. + +## One behaviour named, not counted as a defect + +When two calls share a decoded call id, `toolCallsByCallId` drops the id as ambiguous and both results +replay with no invocation line — the pre-fix orphan shape, for that narrow case. The code argues the +tradeoff explicitly: a wrong invocation is undetectable by the model, a missing one is honest. Upstream +Codex call ids are unique. The gate agreed with the choice and recorded it rather than filing it.