🤖 fix: activate durable compaction cancellation across turn admission - #4191

Adds a raw JSONL reader that streams large strings, keys and numbers
without assembling a whole row. This is the inactive parsing
prerequisite for the oversized-history witness finding in coder#4182; the
runtime integration in coder#4182 consumes it through coder#4221.

The reader reports byte ranges, content digests, JSON/UTF-8 validity and
duplicate decoded keys. Consumers receive provisional tokens, optional
isolated raw chunks, and awaited row completion. Explicit replacement
decoding supports legacy identity accounting while keeping strict raw
validity separate. Abort, early exit and visitor errors close the file
and parser.

Uses pinned stream-json 3.6.0 with scalar packing disabled. Retained
memory depends on the read chunk plus nesting and object-key
bookkeeping; this is not an absolute constant-memory guarantee for
arbitrarily deep or wide objects. Callers must bound their own retention
and revalidate file stamps before treating descriptors as evidence.

Validation: 58 tests / 266 assertions, including 12 MiB scalar fixtures,
one-byte reads, malformed UTF-8/JSON, split escapes, duplicate keys,
LF/EOF framing, backpressure and cleanup. A bundled Node 22 smoke run
passed 17 checks; four additional abort-guard checks passed after fixing
cancellation from beginRow; canonical make static-check passed.
Deterministic held-open and held-stat tests on an empty file verify
exact abort reasons and file-handle closure after awaited setup. Runtime
compatibility was checked against the repository's Node 22 Docker
runtime. No provider calls.

The Nix offline dependency-cache hash is updated to the value computed
by CI for the added streaming parser dependency. A prior Flake Hash
Check confirmed the generated value. Local Nix is unavailable.

Risk: the new dependency and streaming-token contract need careful
review before activation.

Raw callbacks receive copies bounded by the read chunk, so mutation of
the full backing buffer cannot corrupt parsed tokens, digests or later
buffered rows. Cancellation remains observable after awaited visitor
completion and asynchronous parser/file disposal. Nine adversarial
regressions failed before these fixes and now pass; an additional
bundled Node 22 run passed 16 mutation and late-cancellation checks.
Canonical static checks passed on the final scanner fix.

The scanner cleanup test now observes only the file handle opened for
its own fixture, so unrelated concurrent opens cannot replace the handle
under assertion. Closure remains required; scanner production is
unchanged.

Integrated validation on coder#4191
`87badaf62f925e118c2292cf3e788fc92894dafc` and coder#4209
`d83e1cb55f50676562e675398f76e0b5118053ab` above main
`0d31680932fe5b2cb33ce33ec43cb576c86ee0e6`: six affected suites passed
on each integrated tree: A 549 tests / 3,337 assertions and B 602 tests
/ 3,649 assertions; full TypeScript and canonical static checks passed
on both. The rebased A/B trees exactly match those validated trees.

This stack integrates main `0d31680932fe5b2cb33ce33ec43cb576c86ee0e6`,
including coder#4225’s workspace-fork recovery fix. Each layer retains its
previously reviewed diff and all addressed review fixes.

The complete cancellation phase is ordered coder#4214 → coder#4215 → coder#4219 → coder#4221
→ coder#4182 → coder#4187 → coder#4191 → coder#4209. The reader prerequisites and runtime
changes merge together only after every member has current-head approval
and green CI.

---

_Generated with `xum` • Model: `unavailable` • Thinking: `unavailable` •
Cost: `$unavailable`_

<!-- mux-attribution: model=unavailable thinking=unavailable
costs=unavailable -->

Adds bounded scalar facts and canonical JSON evidence above coder#4214's raw
token reader. This is an inactive prerequisite for the oversized-history
witness fix in coder#4182; it does not decide message readability or grant
cancellation authority.

Strings retain a bounded prefix, length, digest and optional exact-match
result. Numbers retain up to 2,048 significant digits plus
exponent/position and a nonzero-tail flag, then delegate rounding to
native Number. The retained prefix exceeds every finite binary64
rounding boundary's decimal expansion; a discarded nonzero tail
preserves the side of that boundary. Canonical evidence accounts for
escaping, split surrogate pairs, integer-property ordering, duplicates,
raw digest/length and caller-reported normalization changes.

Validation: reader/scalar tests previously passed 91 cases with 4,712
assertions; the final reader/scalar/projection combination passes 109
tests / 7,339 assertions. A Node 22 native oracle passes 4,704 checks,
including midpoint/subnormal/overflow edges, huge exponent cancellation,
2,000 generated numbers and an 8 MiB canonical row. Both owned layers
passed canonical static checks and independent review before
composition; production scalar code remained unchanged during final test
lint fixes.

Risk: incorrect number or canonical equivalence could misclassify later
history evidence, so this module stays inactive until the
history-specific adapter is reviewed. Retention is bounded for scalars;
nesting/key bookkeeping follows the raw reader's documented limits. No
new persistence format or schema interpreter.

The numeric proof comment names SIGNIFICANT_DIGITS so its retention
bound cannot drift from the implementation. This review correction
changes no behavior.

Two fork/send integration assertions retain their success requirement
while exposing the returned error when a request fails. Scalar-reader
production is unchanged.

Integrated validation on coder#4191
`87badaf62f925e118c2292cf3e788fc92894dafc` and coder#4209
`d83e1cb55f50676562e675398f76e0b5118053ab` above main
`0d31680932fe5b2cb33ce33ec43cb576c86ee0e6`: six affected suites passed
on each integrated tree: A 549 tests / 3,337 assertions and B 602 tests
/ 3,649 assertions; full TypeScript and canonical static checks passed
on both. The rebased A/B trees exactly match those validated trees.

This stack integrates main `0d31680932fe5b2cb33ce33ec43cb576c86ee0e6`,
including coder#4225’s workspace-fork recovery fix. Each layer retains its
previously reviewed diff and all addressed review fixes.

The complete cancellation phase is ordered coder#4214 → coder#4215 → coder#4219 → coder#4221
→ coder#4182 → coder#4187 → coder#4191 → coder#4209. The reader prerequisites and runtime
changes merge together only after every member has current-head approval
and green CI.

---

_Generated with `xum` • Model: `unavailable` • Thinking: `unavailable` •
Cost: `$unavailable`_

<!-- mux-attribution: model=unavailable thinking=unavailable
costs=unavailable -->

…r#4219)

Adds streamed message-readability evidence above the scalar reader in
coder#4215. Oversized history rows need the same identity and readability
decisions as ordinary JSON.parse rows without retaining entire message
payloads. This prerequisite provides those facts; the separate row
adapter and coder#4182 integration will consume them.

The projection checks every part and workflow element against the
existing schema fragments, including constrained strings, finite
numbers, strict objects, array limits and ordered workflow events. It
preserves legacy role coercion, duplicate-key behavior and normalization
detection. Scalar retention is bounded; nesting and distinct object-key
bookkeeping retain the raw reader's documented limits. There is no
persistence change or replacement authority decision in this layer.

Legacy array-coerced system roles remain readable collision evidence but
are classified as system rows, matching the native reader. The
system-role classification is gated by successful readability so
malformed role objects are not coerced.

Integrated validation on coder#4191
`87badaf62f925e118c2292cf3e788fc92894dafc` and coder#4209
`d83e1cb55f50676562e675398f76e0b5118053ab` above main
`0d31680932fe5b2cb33ce33ec43cb576c86ee0e6`: six affected suites passed
on each integrated tree: A 549 tests / 3,337 assertions and B 602 tests
/ 3,649 assertions; full TypeScript and canonical static checks passed
on both. The rebased A/B trees exactly match those validated trees.

Risk: projection drift from the ordinary reader could change which
historical messages count as readable. The implementation deliberately
uses the current schema fragments and native-comparison tests;
activation stays in the separately reviewed adapter/integration change.

This stack integrates main `0d31680932fe5b2cb33ce33ec43cb576c86ee0e6`,
including coder#4225’s workspace-fork recovery fix. Each layer retains its
previously reviewed diff and all addressed review fixes.

This is one layer of the cancellation phase: coder#4214 → coder#4215 → coder#4219 →
coder#4221 → coder#4182 → coder#4187 → coder#4191 → coder#4209. All eight PRs merge together
after every member has current-head approval and passing CI.

---

_Generated with `xum` • Model: `unavailable` • Thinking: `unavailable` •
Cost: `$unavailable`_

<!-- mux-attribution: model=unavailable thinking=unavailable
costs=unavailable -->

…r#4221)

Adds the history-specific row adapter above coder#4219. It preserves
ordinary-row parsing and legacy normalization, derives oversized-row
identity without assembling whole payloads, and compares replay
candidates using exact bounded byte ranges. The owning coder#4182 integration
will use this adapter to finish the oversized-row review finding.

Both existing reset protections remain in force through shared scanner
helpers: raw reset markers, including control-separated keys, and the
reverse token recognizer. Protected or invalid-UTF-8 readable rows still
count for identity collisions, but cannot grant replacement authority.
Digests reject mismatches cheaply; matching digests still require exact
byte comparison and rechecking the captured content digest. LF
termination is excluded from replay equality. Callers retain
responsibility for file provenance and publication-lock validation.

Small and oversized legacy array-coerced system rows retain collision
identities but cannot qualify as replacement candidates. User and
assistant role coercion remains supported; the small-row classification
agrees with the streamed projection.

Token scanning, captured size, and follow-up range reads now share the
same open file handle. A path replacement cannot mix the new inode’s
token evidence with the old inode’s bytes or size. The borrowed-handle
helper retains the caller’s ownership and captured range; existing stamp
and publication-lock checks remain required for in-place writes.

Integrated validation on coder#4191
`87badaf62f925e118c2292cf3e788fc92894dafc` and coder#4209
`d83e1cb55f50676562e675398f76e0b5118053ab` above main
`0d31680932fe5b2cb33ce33ec43cb576c86ee0e6`: six affected suites passed
on each integrated tree: A 549 tests / 3,337 assertions and B 602 tests
/ 3,649 assertions; full TypeScript and canonical static checks passed
on both. The rebased A/B trees exactly match those validated trees.

Risk: classification or reset-probe drift could admit ambiguous history.
Native-reader comparisons and existing provider privacy suites exercise
those contracts. This layer remains inactive until coder#4182 is integrated
and reviewed; it introduces no new persisted state or scan budget for
lifetime history proofs.

This stack integrates main `0d31680932fe5b2cb33ce33ec43cb576c86ee0e6`,
including coder#4225’s workspace-fork recovery fix. Each layer retains its
previously reviewed diff and all addressed review fixes.

This is one layer of the cancellation phase: coder#4214 → coder#4215 → coder#4219 →
coder#4221 → coder#4182 → coder#4187 → coder#4191 → coder#4209. All eight PRs merge together
after every member has current-head approval and passing CI.

---

_Generated with `xum` • Model: `unavailable` • Thinking: `unavailable` •
Cost: `$unavailable`_

<!-- mux-attribution: model=unavailable thinking=unavailable
costs=unavailable -->

…oder#4182)

Retained Stop needs durable proof that a replacement was accepted before
canceled recovery can be released. This layer adds guarded append,
batch, and Resume publication, with receipts captured at the history
commit point and witnesses verified across active history and archives.
Runtime activation follows in coder#4191/coder#4209.

Acceptance rechecks the captured cancellation nonce, journal generation,
physical lock, and logical ownership. Visible bytes are distinguished
from durable receipts, including file and directory flush failures.
Preserve-mode publication grants no replacement authority. Request-entry
capture and explicit malformed/unsupported-record repair share the
existing history lock so repair cannot adopt an intervening Stop. A
committed context reset can report its exact predecessor and successor
generation through an in-memory receipt; advancing the generation or
exposing bytes alone grants no queue-refresh authority. Stop retirement
similarly reports the exact predecessor and cleared successor only after
verified deletion under that same lock, retaining the receipt obligation
through failed-unlink retries.

Resume preserves the original row, signatures, and metadata. It accepts
the exact typed target or its exact wire projection. Retrying an already
stamped Resume can reuse byte-identical archive replay copies for its
captured nonce; duplicate active rows or changes to identity, sequence,
nonce, formatting, provenance, or generation still refuse authority.
Ordinary unstamped Resume retains its existing checks. A consumed nonce
cannot accept another replacement before retirement; the exact stamped
Resume replay is the only reuse exception. Publication metadata is
written back only to the original snapshotted message references, so
caller array changes cannot interrupt the durable receipt.

Witness traversal uses coder#4221's bounded row adapter. Protected and
invalid-UTF-8 rows still occupy identities; fingerprints can only
conservatively reject collisions, while replay authority requires exact
byte ranges. Ordinary append sequence allocation still has its existing
large archive-tail read; this PR does not claim the entire append path
has bounded memory.

A throwing retirement observer is logged after the state receipt and
cannot skip directory durability or recreate deletion debt. Superseding
a local retirement aborts that attempt’s provisional history scan and
exact replay comparison through their existing cancellation signal;
scanner handles are disposed before the queued Stop publishes. Current
verification errors still propagate. Legacy array-coerced system rows
cannot be stamped or used as replacement witnesses, while readable user
and assistant compatibility remains unchanged.

Under-lock witness verification now returns superseded only when its
original attempt lost ownership; current verification errors still
propagate. Every eligible occurrence of a nonce must prove the same
exact receipt, so conflicting eligible identities anywhere in active or
archived history refuse retirement. Ineligible legacy system stamps
cannot consume replacement authority, while still occupying their ID and
sequence for collision checks.

Separately deserialized legacy user/assistant roles retain an accepted
Resume receipt through a later history update. Comparison uses the
existing role coercion; changed roles cannot inherit the receipt, and
system/invalid rows remain ineligible witnesses.

Validation includes real-file crash replay, foreign-writer/CAS races,
malformed-record recovery, and deterministic file/directory durability
failures. Integrated validation on coder#4191
`87badaf62f925e118c2292cf3e788fc92894dafc` and coder#4209
`d83e1cb55f50676562e675398f76e0b5118053ab` above main
`0d31680932fe5b2cb33ce33ec43cb576c86ee0e6`: six affected suites passed
on each integrated tree: A 549 tests / 3,337 assertions and B 602 tests
/ 3,649 assertions; full TypeScript and canonical static checks passed
on both. The rebased A/B trees exactly match those validated trees.

Risk: conservative refusal can delay recovery when ownership or history
evidence is ambiguous; flush latency affects publication. Tests retain
exact history-byte and foreign-writer assertions.

This stack integrates main `0d31680932fe5b2cb33ce33ec43cb576c86ee0e6`,
including coder#4225’s workspace-fork recovery fix. Each layer retains its
previously reviewed diff and all addressed review fixes.

This is one layer of the cancellation phase: coder#4214 → coder#4215 → coder#4219 →
coder#4221 → coder#4182 → coder#4187 → coder#4191 → coder#4209. All eight PRs merge together
after every member has current-head approval and passing CI.

---

_Generated with `xum` • Model: `unavailable` • Thinking: `unavailable` •
Cost: `$unavailable`_

<!-- mux-attribution: model=unavailable thinking=unavailable
costs=unavailable -->

…#4187)

Centralizes prepared history publication so manual triggers and their
prefixes use one publication boundary. Origin remains independent of
visibility and billing, and later runtime layers consume durable
receipts and rollback facts instead of interpreting a successful send as
acceptance.

This preparation layer exposes coder#4182's guarded publication without
activating cancellation policy; that activation belongs to coder#4191/coder#4209
in the same phase. Both Result errors and unexpectedly rejected
publication promises reach the existing rollback checkpoints. Only the
publication service promise is normalized: acceptance receipts and
subsequent callback failures retain their distinct semantics.

Real HistoryService tests inject both failure forms after each prepared
prefix and assert rollback preserves concurrent foreign history. A
CI-only goal fixture now waits for publication entry and settles its
held promise before teardown; observing an atomic rename no longer
substitutes for write completion. Production goal behavior is unchanged.
Integrated validation on coder#4191
`87badaf62f925e118c2292cf3e788fc92894dafc` and coder#4209
`d83e1cb55f50676562e675398f76e0b5118053ab` above main
`0d31680932fe5b2cb33ce33ec43cb576c86ee0e6`: six affected suites passed
on each integrated tree: A 549 tests / 3,337 assertions and B 602 tests
/ 3,649 assertions; full TypeScript and canonical static checks passed
on both. The rebased A/B trees exactly match those validated trees.

Risk: publication callbacks govern queue and budget accounting. The
real-disk assertions protect against lost or duplicated input and
incorrect refunds.

This stack integrates main `0d31680932fe5b2cb33ce33ec43cb576c86ee0e6`,
including coder#4225’s workspace-fork recovery fix. Each layer retains its
previously reviewed diff and all addressed review fixes.

This is one layer of the cancellation phase: coder#4214 → coder#4215 → coder#4219 →
coder#4221 → coder#4182 → coder#4187 → coder#4191 → coder#4209. All eight PRs merge together
after every member has current-head approval and passing CI.

---

_Generated with `xum` • Model: `unavailable` • Thinking: `unavailable` •
Cost: `$unavailable`_

<!-- mux-attribution: model=unavailable thinking=unavailable
costs=unavailable -->

After ordinary Stop settles, fresh automatic monitor or family input can
start a new turn without reopening the canceled continuation. This layer
restores that behavior above coder#4191's V1 deferral using V2 settlement
proof, building on its shared automatic-publication fence.

V2 authority waits for the captured producer/startup work and exact
outer cleanup, including monitor retirement, retries, descendants, and
queued-input handling. A failed physical Stop returns promptly while
supervised completion can observe that same producer finishing
naturally. Supersession and disposal release only the owned wait; failed
cleanup grants no V2 proof. Successful exact settlement wakes deferred
monitor output once. Failed physical Stop also runs the remaining outer
cleanup through its existing supervisor; unresolved monitor retirement
does not hold workspace shutdown.

Automatic sends retain their original persisted Stop frontier through
service preflight and every queued addition. A payload admitted before
another backend's Stop cannot adopt the new settled V2 on dequeue; fresh
post-Stop input remains eligible. Existing scoped-V1 ordinary
preserve-mode admission remains supported. Separate queued inputs remain
eligible after their own accepted replacement resets history or retires
Stop; only the exact committed transition advances their captures, and a
later foreign Stop still blocks them. Both mid-stream compaction
continuation paths retain the originating stream capture. Superseded
retirement refuses automatic acceptance/startup while preserving the
already committed input and budget accounting.

Fresh reset summaries retain captured generation/provenance for
immediate or restarted follow-up recovery. Legacy unmarked or stale
evidence grants no permission, and only the actual accepted follow-up
row can retire replacement cancellation. A transient recovery-frontier
read failure preserves pending work for retry. Automatic batches
preserve rollback accounting; durable trigger publication makes
acceptance irrevocable before fallible observers.

The legacy token-pressure guard prevents automatic compaction from
bypassing scoped-V1 cleanup debt while preserving manual replacement.
The inherited automatic-reset guard keeps canceled summaries reachable
for recovery. Already-qualified settled V2 input retains its
automatic-replacement exception, including token-budget rollover;
unsupported scoped V2 records still refuse admission and remain
byte-for-byte intact.

Automatic replacement now requires settlement/version evidence from the
original admission capture. A request captured during V1 cleanup cannot
gain authority when the same nonce/generation later reaches V2.
Mixed-version queued batches refuse in either order; fresh V2 input and
ordinary scoped-V1 preserve behavior remain supported. Owned transitions
replace or clear the in-memory version evidence.

Review fixes keep original version evidence through active/queued
capture advancement, refuse heartbeat reset admission during V1 cleanup,
and revalidate version before narrowing a persisted Stop. The separate
absent-Stop heartbeat race remains guarded by the existing
journal-generation CAS.

Validation includes real two-backend stale/fresh automatic sends, held
startup/cleanup, cross-instance restart, failed I/O, exact notification
ownership, and rejected-batch rollback with foreign history preserved.
Integrated validation on coder#4191
`df5972870696ef9b78c2854f8a4b9ddf3fd15769` and coder#4209
`86e3487151fde2273d8e7595504f3b87a2ea9d62`: 14 affected suites passed on
each tree (A 1,271 tests / 6,521 assertions; B 1,352 tests / 7,006
assertions), with full TypeScript, canonical static, and final
changed-file lint/format checks. Four deterministic peer Stop/Clear
cases fail on the original A head and pass with the fence;
unchanged-frontier controls pass. B production is unchanged.

Risk: incorrect settlement ownership can resume stopped work or strand
legitimate wakes. The phase keeps failure, supersession, durability, and
receipt checks separate.

This stack integrates main `0d31680932fe5b2cb33ce33ec43cb576c86ee0e6`,
including coder#4225’s workspace-fork recovery fix. All prior review fixes
remain; the shared automatic-publication fence belongs to coder#4191.

This is one layer of the cancellation phase: coder#4214 → coder#4215 → coder#4219 →
coder#4221 → coder#4182 → coder#4187 → coder#4191 → coder#4209. All eight PRs merge together
after every member has current-head approval and passing CI.

---

_Generated with `xum` • Model: `unavailable` • Thinking: `unavailable` •
Cost: `$unavailable`_

<!-- mux-attribution: model=unavailable thinking=unavailable
costs=unavailable -->