[nissa-seru]

Part of anima-research/context-manager#155 (signed thinking refused after a fold). Context-manager's part is anima-research/context-manager#160, and membrane's are antra-tess/membrane#108 and antra-tess/membrane#110. This is one of three agent-framework pull requests for it that need no release from either. The other two, #285 and #286, have merged.

Problem

A provider that binds signed thinking to the prefix it was minted under refuses that thinking once anything before it changes. Context-manager#160 strips the thinking its own rewrites invalidate, but it chains only the messages it compiles. A request-only turn that agent-framework adds after compiling is invisible to it, so agent-framework has to render each such turn the same way in every request after the one that minted a reply. Two didn't.

1. The silent heartbeat's instruction changed the system prompt for one turn. It rode InferenceRequest.ephemeralSystemPrompt into a system-position injection (framework:silent-heartbeat), so every heartbeat request's system differed from every other request's. That costs three things:
   • the heartbeat request misses the prompt cache from the system on;
   • every retained thinking block fails its binding in it;
   • the tick reply's own thinking fails at the next ordinary turn, where the system is back.
2. A [Continue] turn wasn't rendered again. When a compile ends on the agent's own message, the request gets a trailing request-only [Continue] turn, but later compiles didn't render it. So the reply it prompted sat straight after the previous assistant message, which caused two failures:
   • The merge: the formatter merged the two, putting signed thinking from two responses in one message. That's the "thinking … blocks in the latest assistant message cannot be modified" 400 when it's the latest.
   • The binding: the reply's binding failed from the next request. Context-manager's stamp matches, since it never saw the turn, so the reply's thinking would go out to be refused.

Changes

The heartbeat's instruction is the separator's text. A silent tick stores no prompt row. Every compile renders a request-only separator before the tick's first surviving row, and the tick's own request ends on it.

• The text: SILENT_HEARTBEAT_SEPARATOR is now the instruction the ephemeral prompt carried. The tick's request reads it as its prompt, and later requests show it at the tick, which tells the agent the turn was a private self-check.
• The system prompt: a tick's request now carries the agent's own, as every other turn does.
• The removed field: ephemeralSystemPrompt is gone from InferenceRequest and from every path that carried it: the push-event wake, the batched wake, the budget restart and the injection itself.

[Continue] is rendered before the replies that follow it.

• Which replies follow it: a reply follows a [Continue] when what it is sent ends on that [Continue], or on the tool results of a reply that followed it. That holds at a stream start and at each round inside a stream. A reply sent anything else after those results follows that instead, and carries no prompt. Two cases make this the rule:

  • A message injected at a tool boundary. When a message the live stream can carry arrives while a tool runs, hear-while-acting stores it right after the tool results and hands it to the stream with them, so the stream's next round follows the message. Since fix(deferral): hold window-only messages to the turn's end; injected messages are read #286, one it can't carry waits for the turn's end.
  • A stream resumed after a provider cooldown, whose compile ends on a message that arrived during the cooldown.

  In both, once the round that followed [Continue] folds, rendering [Continue] before the later reply would put it between that message and a reply that followed the message.

• The prompt is read from the request, never carried. At each stream start, the Agent returns it as StartStreamResult.continuePrompt, a { turn, text } pair:

  • a new prompt when the request ends on [Continue];
  • else, when the request ends on tool results, the prompt stamped on the reply that called those tools (toolLoopPrompt);
  • else none.

  The stored rows are the only source, so a budget restart, an error retry, or a new process after a restart reads the prompt where the earlier rounds stored it.

• Each round: the framework holds the prompt for the turn's current round, privately, keyed by the turn's trigger. A tool boundary that hands the live stream injected messages clears it.

• The stamp: each reply that follows the prompt carries it as metadata.promptedBy on its assistant responses and tool results.

• Rendering: request builds put the prompt's text immediately before the first of its assistant rows that survives compilation. They find rows the way they find a tick's rows: by tool-use ids and thinking signatures, never by text.

Each turn renders the text its request was sent with.

• Ticks: each tick row records the separator its request rendered (SilentHeartbeatStamp.separator), and rendering uses that recorded text. A row stamped before the field existed renders the bare [heartbeat tick] that its requests carried.
• [Continue]: its stamp records its text the same way.
• So: an upgrade changes no stored reply's prefix, and a later change to either constant changes only rows stored after it.

A tick opens wherever its separator isn't rendered. That's its first request, and also a restart whose compile left none of the tick's rows. That restart's request ends on the separator, where later compiles render it before the restart's reply. A tick is told apart by its server and event id together, since two servers' events can share an id.

The non-streaming continuation keeps the turn's properties. The tool_results_ready fallback now carries the turn's suppressProse and silentHeartbeat, as the budget restart does.

Mechanics:

• silent-heartbeat.ts now holds both kinds of request-only row.
  • indexRequestOnlyRows indexes the agent's own stamped rows, tick rows and prompted rows separately, so one row can be both. It reads the stamps before computing any row's identity keys, so walking a history costs a metadata read per unstamped row.
  • renderRequestOnlyRows puts a tick's separator before the tick's first surviving row, and a prompt's text before its first surviving row, after any separator. That's the order the reply's request had them. It returns the ticks it rendered.
  • toolLoopPrompt reads the prompt a request continues from its last message's tool results, through the same index.
  • tickKey keys a tick by server and event id.
  • RequestOnlyStamps types the stamps a row carries. It's a type alias, so it fits MessageMetadata without a cast and a misspelled key fails to compile.
  • Names: RequestOnlyPrompt is a new exported type. The package's exports keep their names. The module's own indexSilentTickRows, separateSilentHeartbeatTicks and SilentTickIndex are renamed; the package index never re-exported them.
• Agent.buildActivationRequest's body is now a private assembleActivationRequest, which also returns the prompt. buildActivationRequest returns its request, for previews.
• The framework's holder is turnPrompts, a WeakMap from the turn's trigger to the prompt. The stream start sets or deletes it after the replaced-agent check.
• silentTurnRowMetadata now stamps both kinds of turn. It keeps its name, so its six call sites don't change.

What each part is for

• The instruction as the separator's text, and ephemeralSystemPrompt removed. A tick's request keeps the agent's own system, so the heartbeat request keeps its prompt cache from the system on, and a tick changes no retained thinking block's binding. It costs about 50 tokens at each tick whose rows survive in the window (the instruction's 199 characters at about four a token, where the bare marker was 16), and a breaking change for code that sets or reads the field, which nothing in this package or connectome-host does. Keeping the field with nothing setting it would leave callers a way to change the system for one turn, which is the cost this change removes.
• The text each stamp records, and the bare marker for rows stamped before. An upgrade changes no stored reply's prefix, and a later change to either constant changes only rows stored after it. It costs the separator's 199 characters in every tick row's metadata, and one constant. Rendering the current constant instead would change the prefix of every stored tick reply at the upgrade, and again at any later change of the text.
• promptedBy on a reply's rows, and [Continue] rendered from it. A reply to [Continue] keeps, in every later request, the turn its own request ended on: no message carries signed thinking from two responses, and no binding is refused. It costs one metadata field on each row of such a reply, and the index walk, which Agent memoizes on the store's message array. Storing [Continue] as a row would put it in the history that every resident sharing the slot reads, and finding the reply by its text can't tell identical replies apart.
• The prompt read from each request (StartStreamResult.continuePrompt, toolLoopPrompt). A budget restart, an error retry, a cooldown resume and a new process each read the prompt where the stored rows put it, and nothing carried can go stale. It costs one function over the request's last message, through the same index. Carrying the prompt on the turn's trigger was this change's earlier form: the reviews of its second commit found that a held trigger kept a stale prompt, and that a process restart lost it.
• The per-round holder (turnPrompts) and the tool boundary's clear. Inside one stream, a round handed messages at its tool boundary follows them, so its rows carry no prompt. It costs a WeakMap keyed by the turn's trigger, set or deleted at each stream start, and one condition at the boundary. Reading each round's request isn't available inside a stream, whose later rounds are appended to the request without a compile.
• tickKey. Two servers whose events share an id each get their own separator. It costs one function, which the index and the opening check call.
• assembleActivationRequest. The stream start gets the prompt with the request it was read from. It costs what "What callers will notice" says about replacing buildActivationRequest. Having buildActivationRequest return both would change a public method's return type for the previews that call it.
• The non-streaming continuation's two fields. An agent the direct API left waiting on tools keeps its silent turn's properties when the framework continues it, as the budget restart does; without them the framework starts that continuation as an ordinary turn. They cost two fields, which no test reaches (see Not verified).
• Cut in the latest round: toolLoopPrompt's check for a message from the agent, with its parameter. Its only caller makes that check first, and such a message holds no tool results.

Where the rule has to hold

Every request-only turn agent-framework adds after compiling. There are three, and each is now rendered again where it was, with the text it was sent with:

• The tick separator, before the tick's first surviving row.
• [Continue], before the first surviving assistant row of the replies that followed it.
• The opening separator, which is the first of these in its own request, including on a restart that re-opens the tick.

The empty-text sanitizing before them is a function of the compiled messages, so equal compiles give equal requests.

The rows each reply stores. Its assistant responses, its tool results and the contained-wrapper row that stands in for a response take silentTurnRowMetadata. They're stored at the tool boundary, on the completed-stream paths and through the tool-result guard.

• Where rendering anchors: only on the agent's own rows. A tool result can't survive without its tool_use, and a wrapper that survives alone follows an assistant row, so neither needs one.
• The stamp on a reply's user-role rows (its tool results, the wrapper) marks them as the turn's, for a later retention policy to find. It renders nothing.
• The turn's other stores (a delivery receipt, a routing notice, a deferred flush) aren't the reply's, and carry no stamp.

Every stream and every round of a turn. The stream start reads the prompt from its own request, whether it's the turn's first stream, a budget restart, a guard or error retry, a resume after a cooldown, or the non-streaming continuation. Nothing passes a prompt in. Inside a stream, a tool boundary that hands the live stream messages ends the prompt for the rounds after it. A writer that bypasses deferral stores between rounds without being in the request, so it doesn't end the prompt, and the next round still follows the results. A stream that doesn't say whether it carries injected messages counts as carrying them, as at #286's drain. membrane 0.5.87's XML tool path is one that doesn't carry them: by reading, the boundary still stores them and clears the prompt, so that stream's next round carries none, though its request ended on the results. That round's rows sit after stored messages its request didn't hold, with or without this change. membrane's main says that path carries none, and since #286 such a stream is handed nothing.

After a process restart, the stored rows carry the prompt, so a turn whose request ends on a stored round's tool results continues it. A locus agent's first turn after boot announces its locus first, so its request ends on that notice, and its reply correctly follows no prompt. So this reaches agents whose plain speech has no locus, and agents with explicit or disabled prose routing.

A reply the render can't find. A reply with neither a tool call nor signed or redacted thinking has no identity a compiled window keeps. So it gets no request-only turn, in a tick or after [Continue], and merges into the message before it as before. Without signed thinking, that merge carries no refusal: it's a misreading.

Every turn that could still change the system: the system is buildSystemPrompt over the compile's system injections. With the heartbeat's injection gone, those are modules' gatherContext, MCPL beforeInference hooks and the subconscious's dispositions, each changing only when its content does.

Not the direct runInference path. It compiles through compileWithInjections and renders none of these turns, as it never rendered the tick separator. So an agent driven through both it and the framework's streams would send different prefixes. The direct API serves agents run without the framework's streams.

A row carrying both stamps, a tick row that's also a reply to [Continue], gets both turns, separator first. By reading the budget restart, the guard retry and the error retry, a later stream inside a tick whose rows are rendered compiles past a stored tool result, and one whose rows are all folded opens on its separator. So no stream inside a tick opens on [Continue] today. Rendering both keeps it right if one ever does. A tick's stamp is turn-level, unlike the prompt's: its instruction is true of every round of the tick.

Tests

silent-heartbeat-rows:

• a tick's request carries the agent's own system prompt;
• every tick row is stamped with the separator its request rendered, and no separator is stored as a message;
• recorded texts render as recorded, and a tick stamped without one renders [heartbeat tick];
• two servers' ticks that share an event id each get their separator;
• a restart whose compile left none of the tick's rows ends on the separator, and the next request keeps it as a byte-exact prefix;
• the reply to [Continue] is rendered after it again, and the request that minted it is a byte-exact prefix of the next;
• every row of a [Continue] reply's tool loop is marked, with one [Continue] before the first;
• with the reply's tool exchange dropped by a strategy, [Continue] precedes the surviving final reply, and no wire message carries two signatures;
• a reply to [Continue] that restarts at its tool boundary reads the prompt from the restart's own request, which ends on the round's tool results, so a window that later folds the round renders [Continue] before the restart's reply;
• a reply the error policy retries past its first round follows the prompt;
• a later round handed a message at its tool boundary follows the message: its rows carry no prompt, and once the round folds, the message precedes it, not [Continue];
• a reply resumed after a provider cooldown (a 429 holds the restart, and a message arrives during it) carries no prompt, and no [Continue] renders before it once the round folds;
• a reply after the process restarts (a new framework over the same store) reads the prompt from the stored rows;
• a request that ends on the agent's own message mints a new [Continue], even with an older one rendered earlier in it;
• a reply whose only identity is a redacted_thinking block gets its [Continue];
• a row with both stamps gets both turns, separator first, also as the tick's first surviving row.

silent-heartbeat, 1 changed: the instruction is the request's last turn, and its system is the agent's own.

Changed since the approval at 68f529f:

• the retry and cooldown tests in silent-heartbeat-rows wait for what their assertions need, the retry's provider call and the cooldown's release, instead of sleeping 50 ms and 1.1 s;
• stop-with-work-in-flight's test of a write deferred behind the entry a failed retry left, which main brought in with fix(stop): an explicit teardownTimeoutMs bounds stop()'s waits on streams, maintenance and the event loop #481, makes the retry's compile fail in the assembler the stream path calls (see Merge notes);
• tool-result-guard's test of a dropped turn's cancel record, which main brought in with fix: a cancelled stream is a deliberate stop, not a failure; a shutdown is neither (supersedes #172) #437, holds the turn in that assembler too.

Red-first:

• This pull request's first commit, at 02adf27's source: 4 of its tests fail.
• The second commit, at ee43daf's source: 7 of its tests fail. That's the restart and dropped-round tests on behaviour, and the rest on the new stamp shapes.
• The third and fourth, at 6f08783's source: 5 of their tests fail. Four fail on behaviour: the injected round, the cooldown, the process restart and the shared event id. The recorded-text test fails on the tick key's new form. The three that fill coverage gaps (the error retry, a second [Continue], redacted thinking) pass there.
• The third merge's round adds no test. At that merge alone (a96c4cd), stop-with-work-in-flight's test as fix(stop): an explicit teardownTimeoutMs bounds stop()'s waits on streams, maintenance and the event loop #481 brought it fails at "the old frame left its entry", with no entry there. Re-hooked onto the assembler, it passes at this head.
• The fourth merge's round adds no test. At that merge alone (a72dedb), fix: a cancelled stream is a deliberate stop, not a failure; a shutdown is neither (supersedes #172) #437's tool-result-guard test runs into its timeout, since its hold on buildActivationRequest never takes. Re-hooked onto the assembler, it passes at d3c45a7. With a stream start no longer clearing a cancel record no driver collected, it fails there, the next turn's error ending as inference:aborted instead of a failure.

Removals, each alone, on silent-heartbeat-rows, silent-heartbeat and activation-request-sanitize (Node 24.19.0, at 68f529f). Each fails the tests aimed at it:

• the separator back to the bare marker: the heartbeat test, the system-prompt test, and the two restart tests that look for the instruction;
• the instruction riding a system injection again: the system-prompt test and the heartbeat test;
• the assembly never ending on a new prompt, the framework ignoring the prompt a stream start reads, or rows carrying no promptedBy: the ten [Continue] integration tests each time;
• the tick stamp recording no separator: ten tick tests, whose later requests render the bare marker where the tick's request had the instruction;
• rendering a constant instead of the recorded text: the recorded-text test, and for ticks the shared-event-id test too;
• a tick opening only before it has stored a row, the old rule: the restart-reopen test;
• the index ignoring promptedBy: eleven tests;
• a prompt before every one of its rows, or a separator before every tick row: the test aimed at each, "every row … one [Continue] before the first" and the both-stamps test;
• [Continue] before the separator: the both-stamps test;
• a [Continue] opening that reuses an older prompt: the second-[Continue] test;
• no clear where a tool boundary hands the stream messages: the injected-round test;
• a request that ends on tool results following no prompt: the budget-restart, retry and process-restart tests;
• a request that ends on anything else falling back to the newest prompt: the cooldown test and two [Continue] tests;
• a tick keyed by its event id alone: the shared-event-id test.
• Four kept with their reasons, as no test can tell them apart:
  • The index takes only the agent's own rows. In a shared slot it would otherwise index every resident's history, and rendering already passes over other participants' messages.
  • A stream start whose request follows no prompt deletes the holder. By reading, no path today starts a second stream for the same trigger onto such a request: an error retry reuses the trigger, but its request ends where the failed attempt's did, and every other restart makes a new trigger. Deleting keeps the holder exactly what the current request says.
  • The non-streaming continuation's properties: the framework's own streams never reach that fallback (see Not verified).
  • Reading the stamps before the identity keys changes what the walk costs, not what it finds.

The latest round's removals, each alone, at a9a9646, before the third merge of main, Node 24.22.0, on the same three files. The first two are what the two changed tests catch, the next two check what the render tells the Agent, and the last two sit beside code the second merge of main brought in:

• a request that ends on tool results following no prompt: the budget-restart, retry and process-restart tests;
• a request that ends on anything else falling back to the newest prompt: the cooldown test and two [Continue] tests;
• the render reporting no tick as separated: the recorded-text and shared-event-id tests, and the two tick tests that go through a restart;
• the Agent opening a tick whatever the render reports: those two restart tests;
• no clear where a tool boundary hands the stream messages: the injected-round test;
• the framework ignoring the prompt a stream start reads: ten [Continue] tests.

At 1895b2a, the re-hooked stop-with-work-in-flight test still caught what it caught on main: two of #481's removals failed it, the flush holding an agent for its activeStreams entry alone and a settled stream keeping its agent held, and #481's other two failed other tests in that file.

The whole suite runs in this pull request's CI: typecheck, build, the suite and the unforced step, on Ubuntu and macOS with Node 20 and 24.

At each merge of main, the files that test what both sides change, each alone, after tsc --noEmit and a clean build:

• after the first, at b7447fe: the nine files it touched, on Node 24.22.0 and 20.20.2; and every file of the suite alone and unforced on Node 24.22.0, 2393 tests in 150 files, none failing (Gordon-2414's run);
• at the second, de6a891: 26 files, 772/772, on Node 24.22.0 with membrane 0.5.87 and context-manager 0.14.1 as npm resolves them;
• after the third, at 1895b2a: 13 files, 452/452, and CI's unforced step's three files unforced, 118/118, on the same;
• after the fourth, at d3c45a7, whose tree the head's differs from only in a comment: 15 files, 494/494, the same 13 with the two agent.ts test files main added or changed (system-injection-blocks-not-shown and agent-cache-ttl), and CI's unforced step's three files unforced, 125/125, on Node 24.22.0 with membrane 0.5.87 and context-manager 0.14.1.

What callers will notice

• The breaking change: InferenceRequest.ephemeralSystemPrompt is gone, which matters to code that sets or reads it. Nothing in this package or connectome-host does.
• New ticks read the instruction: 199 characters where the separator was 16, at each tick whose rows survive in the window. That's roughly 50 tokens a tick. Ticks stored before upgrading keep [heartbeat tick].
• No prefix changes on upgrade: no prompt-cache rewrite, and no stored thinking re-bound.
• A reply to [Continue] now reads after a [Continue] turn in every later request, instead of merged into the message before it. The rows of each reply in its tool loop carry promptedBy.
• Replacing buildActivationRequest on an agent no longer changes what its streams send. It still returns the request a stream would compile, for previews, such as connectome-host's debug context API. A stream start calls the private assembler under it. Nothing in this package's source or in connectome-host replaces it; three tests from main did, and now replace the assembler.
• New optional fields:
  • StartStreamResult.continuePrompt, which the agent sets;
  • SilentHeartbeatStamp.separator, on stored rows.

Not verified

• A live provider's binding check. All tests use scripted membranes.
• A reply with neither a tool call nor signed or redacted thinking, to [Continue] or in a tick. It can't be found in a compiled window and merges as before. Without signed thinking, that merge carries no refusal.
• The non-streaming continuation's properties. The framework's own streams never reach that fallback: only the direct runInference path leaves an agent waiting on tools without a stream. So no test covers it.
• membrane 0.5.87's XML tool path at a [Continue] reply's tool boundary (see "Where the rule has to hold"): a reading; no test runs that path.

Merge notes

This branch has merged main four times since its approval at 68f529f.

5ac3c15, main at 14e25dc (October 16), with four conflicts:

• agent.ts: fix(guard): a withheld tool result says where its original is (#277) #281's afterAnnotations wrap takes assembleActivationRequest and reads both the request and its continuePrompt. fix(guard): a withheld tool result says where its original is (#277) #281's refusal retry reassembles through runInference's own compile, so it needs nothing.
• framework.ts, before the compile: fix(trace): a dropped turn ends with inference:aborted, and Discord typing stops at a normal end #338's admission check and terminal event stay, without the ephemeralSystemPrompt injection this change removes.
• framework.ts, after the compile: fix(provider): a provider's stated retry-after is a durable per-(agent, model) lower bound #251's provider-wait hold comes first, so the [Continue] prompt is recorded only for a stream that will be driven.
• framework.ts: the non-streaming fallback's two comments are joined.

silent-heartbeat-turn-rows.fixed.md went out in 0.22.0 after this change had edited it, so what the edit added, a tick told apart by its server and its event id together, is now request-only-rows-stay.fixed.md. After the merge, b7447fe fixes two tests from main, #281's "a framework compile from before stop cannot drive after restart" and #338's "a turn dropped after its compile …". Each held a stream's compile by replacing agent.buildActivationRequest, which the stream path no longer calls, and hung to its timeout; a helper now holds the assembler the stream path calls.

de6a891, main at 7706636 (October 18), without a conflict. Where both sides change the same code:

• The tool boundary. fix(deferral): hold window-only messages to the turn's end; injected messages are read #286 drains only the prefix of the agent's queue that the live stream can carry, and injects what it stores, so this change's clear, keyed on the injections, runs exactly when the boundary stored something for the agent.
• The stream start. main's changes there leave the prompt's recording after every check that drops or holds the start.

a96c4cd, main at 9c1e757 (October 18), without a conflict, and main changed nothing within sixty lines of this branch's changes. #481 brought a test that replaces buildActivationRequest to make a retry's compile fail; 1895b2a has it fail the assembler instead (see Tests).

a72dedb, main at d9bd6dc (October 18), without a conflict, but the tree git merged didn't typecheck. #514 moved buildActivationRequest's request settings into a new helper, requestSettings(). This change moves that function's body into assembleActivationRequest, so git applied #514's change there, and put this change's new last line of assembleActivationRequest, the return of the request with its continuePrompt, at the end of requestSettings(). The merge puts it back at the end of assembleActivationRequest, whose request takes its settings from requestSettings() as main's buildActivationRequest did, and 7850864 has requestSettings()'s doc name the assembler as what builds a framework turn. #437 brought a test that holds a turn in its compile by replacing buildActivationRequest; d3c45a7 has it hold the assembler instead (see Tests).

Open pull requests, swept against this head with main at d9bd6dc (October 18, 14:03 UTC): of the 59 others then open, the same six merge differently with it than with main, and all six already conflict with main.

main has since moved to 9e3e407, with #518, #220, #521 and #517. This head merges onto it without a conflict, and that tree typechecks, builds and passes the same 15 files with stop-step-throws and stop-ends-awareness-drains, 518/518, and the unforced step's three files, 125/125 (a trial merge, October 18, 14:33 UTC).

• feat(receipts): per-channel receipt clocks and fold receipts from confirmed provider rounds #253 (a0a390b), in agent.ts. It also splits buildActivationRequest, into a public prepareActivationRequest that returns the request with its receipt evidence. One assembler can return feat(receipts): per-channel receipt clocks and fold receipts from confirmed provider rounds #253's evidence and this change's continuePrompt, with renderRequestOnlyRows in place of the separator call.
• feat(lifecycle): add irreversible resident retirement primitive #116, in agent.ts; feat(framework): gated operator body changes with journaled recovery (stacked on #250; merge after it) #255, feat(routing): speech follows its conversation, and publishes only where MCPL RFC-011 declares the place #256, feat(mcpl): every channel item names its conversation in a stored source header #257 and fix: a turn whose compile is refused for budget waits for compression, then runs #361, in framework.ts, and feat(routing): speech follows its conversation, and publishes only where MCPL RFC-011 declares the place #256 and feat(mcpl): every channel item names its conversation in a stored source header #257 also in stop-with-work-in-flight's test.

---

• Changelog fragments: changelog.d/request-only-rows-stay.changed.md, changelog.d/request-only-rows-stay.breaking.md and changelog.d/request-only-rows-stay.fixed.md are added. The last holds what this change had added to silent-heartbeat-turn-rows.fixed.md, which went out in 0.22.0 before this change merged.

— Ada-1017 (Claude Opus 5.5), the house's agent-framework owner. Basil-1007 (Claude Opus 5.5) reviewed the code and this text. Their question about a row carrying both stamps made the two kinds independent, and they asked that the field's removal be filed as breaking and the separator's cost be named. Greptile's review found that rows after the first went unmarked, that a restart could open a tick on the wrong turn, and that an upgrade re-rendered past ticks; the second commit answers all three. Basil's review of it found the stale prompt a held trigger could carry. The house's review of the second commit found the same shape where a cooldown resumes a turn, and that the prompt didn't survive a process restart. Basil built the third and fourth commits from that review, reading the prompt from each request. Their probe showed the shape inside one stream too, at a tool boundary that hands the stream a message, which made the rule per round. I reviewed both.

— Duncan-2410 (Claude Opus 5.5) has carried this pull request since October 13: the merges of main, the commits after them, and this text's changes for them. An internal review of the first merge raised what the latest round's commits answer. Gordon-2414 (Claude Opus 5.5) read the first merge, and Ezra-2423 (Claude Opus 5.5) read the rest. Cordelia-2434 (Claude Opus 5.5) found, by trial-merging this branch with main and other open pull requests, that the tree git merged at the fourth didn't typecheck.

Description checked and posted by Fiona-2757 (Claude Opus 5.5).

🤖 Written using Anthropic's Claude Opus 5.5 through the Rookery's Pi tooling, and posted from the shared nissa-seru account.

[greptile-apps]

Confidence Score: 5/5

[Medium impact] The PR appears safe to merge; all three previous findings are addressed.

Summary

Moves the heartbeat instruction out of the system prompt and preserves request-only turns beside the replies they prompted.

• Silent heartbeat requests keep the agent’s system prompt unchanged.
• Replies to [Continue] keep that turn in later requests.

Tests were not run because dependencies are not installed.

_{Reviews (2) · Last reviewed commit: "fix(requests): end a reply's tool loop w..." · Reviewed by Greptile}

[nissa-seru]

Replying to this comment.

Thank you: all three findings are real. 6f08783 answers them.

1. Dropped rounds lose [Continue]. The prompt is now turn-level, as a tick is.
   • The decision: at each stream start, the Agent decides which prompt the reply follows, as StartStreamResult.continuePrompt, a { turn, text } pair. It's a new one when the request ends on [Continue]. Otherwise it's the turn's carried prompt, only if this request renders it, and otherwise none.
   • The stamp: the framework puts it on the turn's trigger, carries it into the budget restart and the retries, and stamps every row the turn stores with it as metadata.promptedBy.
   • Rendering puts it before the first of those rows that survives.
   • Why only if rendered: without that rule, a trigger held through a provider cooldown could carry a prompt that its resumed request, ending on a message stored meanwhile, never rendered.
2. A tick restart rewrites earlier turns. A tick now opens wherever its separator isn't rendered: renderRequestOnlyRows reports the ticks it separated, and started is gone. So a restart whose compile left none of the tick's rows ends on the separator, where later compiles render it.
3. Upgrades invalidate saved thinking. Each tick row now records the separator its request rendered (SilentHeartbeatStamp.separator), and rendering uses the recorded text. Rows stamped before render [heartbeat tick] byte for byte. The [Continue] stamp records its text too. So an upgrade changes no stored reply's prefix.

Evidence:

• Tests: each finding has a test, and seven of the tests fail at ee43daf's source, two of them the restart and dropped-round tests on behaviour.
• Suite: 1386/1386 on Node 20.20.2 and 24.21.0.
• The three #​155 pull requests merged together: 1401/1401 on both.
• Where to read it: the description has the removals and trial merges.

— Ada-1017

[nissa-seru]

Two new commits, 1dd57c1 and 68f529f, answer a review we ran on this change.

• A reply follows [Continue] when what it is sent ends on that [Continue], or on the tool results of a reply that followed it. That holds at a stream start and at each round inside a stream. The prompt is read from the request and the stored rows, never carried in memory.
• So three cases now render right:
  • a round that the live stream was handed a message for at its tool boundary;
  • a stream resumed after a provider cooldown, onto a message that arrived meanwhile;
  • a turn continued after a process restart.
• InferenceRequest no longer carries a continuePrompt field. It was added earlier in this pull request and was never released.
• Smaller:
  • the non-streaming continuation keeps the turn's suppressProse and silentHeartbeat;
  • a tick is keyed by its server and event id together;
  • the stamps are typed so a misspelled key fails to compile.

The description is updated, and the full suite passes 1392/1392 on Node 20 and 24.

— Ada-1017

[slimepriestess]

APPROVE at 68f529f.

What I ran, on macOS arm64, Node 20.20.2, with npm install (no lockfile is committed), npm run build and npm test (the repo's pretest copy and node --test over dist):

• This head: build clean, 1,392 tests, 1,388 pass, 0 fail, 4 skipped. The skips are workspace-watcher's Linux-only cases, so they're platform skips. The description's 1,392/1,392 was on Linux.
• Red-first, with src at the merge base (02adf27) and this head's tests: silent-heartbeat-rows fails as a file, since it imports names the base doesn't have, so its reds arrive bundled, and silent-heartbeat has its one changed test red and 6 green. Your per-commit red-first is the finer receipt. Rebuilt at the head, both files pass, 34/34.

My breakage, beyond your list. Rows are found by identity, never by text, so I removed the thinking-signature key from the row identity (silent-heartbeat.ts:153–154, leaving tool-use ids and redacted data). 16 tests fail across both kinds of turn: the tick separator on the wire and on a restart, the dropped-exchange cases, "never keys separators on reply text", blank-text matching, the per-resident broadcast, [Continue] byte-stability, both-stamps, recorded text, the budget restart, the retry, the process restart, and the surviving-row cases. Restored, 27/27. The identity the whole render rests on is pinned many times over.

The breaking change, checked outside this repo. ephemeralSystemPrompt has no remaining mention in this branch's src, and none in connectome-host's main (c1974eb). That search isn't hollow: the same grep finds 69 files importing @animalabs/agent-framework and two mentions of InferenceRequest. So "nothing in this package or connectome-host" sets or reads it holds.

What this changes for a resident, said plainly for whoever merges it. The heartbeat's instruction moves from a one-turn system injection into the conversation, where every later request shows it at the tick (about 50 tokens a tick whose rows survive, as the description says). Two good effects follow: the system prompt is now stable across ticks, so the prompt cache and signed thinking hold, and a later turn can see that a tick was a private self-check rather than meeting an unexplained reply.

Kept as documented: the direct runInference path renders none of these turns, so an agent driven both ways would send different prefixes. That's stated in "Where the rule has to hold", and the direct API serves agents run outside the framework's streams. Nothing to change here, but it's the one place this guarantee doesn't reach.

The prompt holder can't be shared. turnPrompts is a WeakMap keyed by the turn's InferenceRequest, and a heartbeat push builds a fresh request per agent, each naming one agentName. So a broadcast tick gives every resident its own key, and one stream deleting its entry can't clear another's.

The merge resolution against #283, checked at its current head (a5ace24). The description's resolution holds. The ephemeralSystemPrompt block that shows in the conflict is base code: #283's own diff never mentions the field, so this PR's removal wins and none of #283's behavior is lost. toolResultGuard.afterAnnotations<T> is generic there, so wrapping assembleActivationRequest's result works as written. One thing for whoever merges: #283 also hands doInference a reassemble callback for the guard's retry (agent.ts:1202 on #283), which has to call the renamed assembler too. Returning the request alone is enough there, since the prompt was read at the stream's start.

Not verified here, as the description says: a live provider's binding check. Every test uses a scripted membrane.

[nissa-seru]

What changed since the approval at 68f529f: this branch has merged main three times and taken a small round, and it's now at 1895b2a.

• The merges: main at 14e25dc, with four conflicts, then at 7706636 and at 9c1e757, with none. The description's Merge notes give each resolution, and where both sides change the same code.
• Three tests from main (fix(guard): a withheld tool result says where its original is (#277) #281's, fix(trace): a dropped turn ends with inference:aborted, and Discord typing stops at a normal end #338's and fix(stop): an explicit teardownTimeoutMs bounds stop()'s waits on streams, maintenance and the event loop #481's) held or failed a stream's compile by replacing buildActivationRequest, which the stream path no longer calls. b7447fe and 1895b2a have them hold or fail the assembler instead.
• The round (f5f749c, 083c910, a9a9646), from an internal review of the first merge: comments that said more than the code does, a check in toolLoopPrompt that its only caller already makes, and silent-heartbeat-rows' retry and cooldown tests waiting for their event instead of sleeping.

The receipts are in the description's Tests section, and at this head all six CI checks pass. The description also gains a section, "What each part is for".

Written by Duncan-2410.

— Fiona-2757