🤖 fix: admit fresh automatic input after settled Stop - #4209

Adds a raw JSONL reader that streams large strings, keys and numbers
without assembling a whole row. This is the inactive parsing
prerequisite for the oversized-history witness finding in coder#4182; the
runtime integration in coder#4182 consumes it through coder#4221.

The reader reports byte ranges, content digests, JSON/UTF-8 validity and
duplicate decoded keys. Consumers receive provisional tokens, optional
isolated raw chunks, and awaited row completion. Explicit replacement
decoding supports legacy identity accounting while keeping strict raw
validity separate. Abort, early exit and visitor errors close the file
and parser.

Uses pinned stream-json 3.6.0 with scalar packing disabled. Retained
memory depends on the read chunk plus nesting and object-key
bookkeeping; this is not an absolute constant-memory guarantee for
arbitrarily deep or wide objects. Callers must bound their own retention
and revalidate file stamps before treating descriptors as evidence.

Validation: 58 tests / 266 assertions, including 12 MiB scalar fixtures,
one-byte reads, malformed UTF-8/JSON, split escapes, duplicate keys,
LF/EOF framing, backpressure and cleanup. A bundled Node 22 smoke run
passed 17 checks; four additional abort-guard checks passed after fixing
cancellation from beginRow; canonical make static-check passed.
Deterministic held-open and held-stat tests on an empty file verify
exact abort reasons and file-handle closure after awaited setup. Runtime
compatibility was checked against the repository's Node 22 Docker
runtime. No provider calls.

The Nix offline dependency-cache hash is updated to the value computed
by CI for the added streaming parser dependency. A prior Flake Hash
Check confirmed the generated value. Local Nix is unavailable.

Risk: the new dependency and streaming-token contract need careful
review before activation.

Raw callbacks receive copies bounded by the read chunk, so mutation of
the full backing buffer cannot corrupt parsed tokens, digests or later
buffered rows. Cancellation remains observable after awaited visitor
completion and asynchronous parser/file disposal. Nine adversarial
regressions failed before these fixes and now pass; an additional
bundled Node 22 run passed 16 mutation and late-cancellation checks.
Canonical static checks passed on the final scanner fix.

The scanner cleanup test now observes only the file handle opened for
its own fixture, so unrelated concurrent opens cannot replace the handle
under assertion. Closure remains required; scanner production is
unchanged.

Integrated validation on coder#4191
`87badaf62f925e118c2292cf3e788fc92894dafc` and coder#4209
`d83e1cb55f50676562e675398f76e0b5118053ab` above main
`0d31680932fe5b2cb33ce33ec43cb576c86ee0e6`: six affected suites passed
on each integrated tree: A 549 tests / 3,337 assertions and B 602 tests
/ 3,649 assertions; full TypeScript and canonical static checks passed
on both. The rebased A/B trees exactly match those validated trees.

This stack integrates main `0d31680932fe5b2cb33ce33ec43cb576c86ee0e6`,
including coder#4225’s workspace-fork recovery fix. Each layer retains its
previously reviewed diff and all addressed review fixes.

The complete cancellation phase is ordered coder#4214 → coder#4215 → coder#4219 → coder#4221
→ coder#4182 → coder#4187 → coder#4191 → coder#4209. The reader prerequisites and runtime
changes merge together only after every member has current-head approval
and green CI.

---

_Generated with `xum` • Model: `unavailable` • Thinking: `unavailable` •
Cost: `$unavailable`_

<!-- mux-attribution: model=unavailable thinking=unavailable
costs=unavailable -->

Adds bounded scalar facts and canonical JSON evidence above coder#4214's raw
token reader. This is an inactive prerequisite for the oversized-history
witness fix in coder#4182; it does not decide message readability or grant
cancellation authority.

Strings retain a bounded prefix, length, digest and optional exact-match
result. Numbers retain up to 2,048 significant digits plus
exponent/position and a nonzero-tail flag, then delegate rounding to
native Number. The retained prefix exceeds every finite binary64
rounding boundary's decimal expansion; a discarded nonzero tail
preserves the side of that boundary. Canonical evidence accounts for
escaping, split surrogate pairs, integer-property ordering, duplicates,
raw digest/length and caller-reported normalization changes.

Validation: reader/scalar tests previously passed 91 cases with 4,712
assertions; the final reader/scalar/projection combination passes 109
tests / 7,339 assertions. A Node 22 native oracle passes 4,704 checks,
including midpoint/subnormal/overflow edges, huge exponent cancellation,
2,000 generated numbers and an 8 MiB canonical row. Both owned layers
passed canonical static checks and independent review before
composition; production scalar code remained unchanged during final test
lint fixes.

Risk: incorrect number or canonical equivalence could misclassify later
history evidence, so this module stays inactive until the
history-specific adapter is reviewed. Retention is bounded for scalars;
nesting/key bookkeeping follows the raw reader's documented limits. No
new persistence format or schema interpreter.

The numeric proof comment names SIGNIFICANT_DIGITS so its retention
bound cannot drift from the implementation. This review correction
changes no behavior.

Two fork/send integration assertions retain their success requirement
while exposing the returned error when a request fails. Scalar-reader
production is unchanged.

Integrated validation on coder#4191
`87badaf62f925e118c2292cf3e788fc92894dafc` and coder#4209
`d83e1cb55f50676562e675398f76e0b5118053ab` above main
`0d31680932fe5b2cb33ce33ec43cb576c86ee0e6`: six affected suites passed
on each integrated tree: A 549 tests / 3,337 assertions and B 602 tests
/ 3,649 assertions; full TypeScript and canonical static checks passed
on both. The rebased A/B trees exactly match those validated trees.

This stack integrates main `0d31680932fe5b2cb33ce33ec43cb576c86ee0e6`,
including coder#4225’s workspace-fork recovery fix. Each layer retains its
previously reviewed diff and all addressed review fixes.

The complete cancellation phase is ordered coder#4214 → coder#4215 → coder#4219 → coder#4221
→ coder#4182 → coder#4187 → coder#4191 → coder#4209. The reader prerequisites and runtime
changes merge together only after every member has current-head approval
and green CI.

---

_Generated with `xum` • Model: `unavailable` • Thinking: `unavailable` •
Cost: `$unavailable`_

<!-- mux-attribution: model=unavailable thinking=unavailable
costs=unavailable -->

…r#4219)

Adds streamed message-readability evidence above the scalar reader in
coder#4215. Oversized history rows need the same identity and readability
decisions as ordinary JSON.parse rows without retaining entire message
payloads. This prerequisite provides those facts; the separate row
adapter and coder#4182 integration will consume them.

The projection checks every part and workflow element against the
existing schema fragments, including constrained strings, finite
numbers, strict objects, array limits and ordered workflow events. It
preserves legacy role coercion, duplicate-key behavior and normalization
detection. Scalar retention is bounded; nesting and distinct object-key
bookkeeping retain the raw reader's documented limits. There is no
persistence change or replacement authority decision in this layer.

Legacy array-coerced system roles remain readable collision evidence but
are classified as system rows, matching the native reader. The
system-role classification is gated by successful readability so
malformed role objects are not coerced.

Integrated validation on coder#4191
`87badaf62f925e118c2292cf3e788fc92894dafc` and coder#4209
`d83e1cb55f50676562e675398f76e0b5118053ab` above main
`0d31680932fe5b2cb33ce33ec43cb576c86ee0e6`: six affected suites passed
on each integrated tree: A 549 tests / 3,337 assertions and B 602 tests
/ 3,649 assertions; full TypeScript and canonical static checks passed
on both. The rebased A/B trees exactly match those validated trees.

Risk: projection drift from the ordinary reader could change which
historical messages count as readable. The implementation deliberately
uses the current schema fragments and native-comparison tests;
activation stays in the separately reviewed adapter/integration change.

This stack integrates main `0d31680932fe5b2cb33ce33ec43cb576c86ee0e6`,
including coder#4225’s workspace-fork recovery fix. Each layer retains its
previously reviewed diff and all addressed review fixes.

This is one layer of the cancellation phase: coder#4214 → coder#4215 → coder#4219 →
coder#4221 → coder#4182 → coder#4187 → coder#4191 → coder#4209. All eight PRs merge together
after every member has current-head approval and passing CI.

---

_Generated with `xum` • Model: `unavailable` • Thinking: `unavailable` •
Cost: `$unavailable`_

<!-- mux-attribution: model=unavailable thinking=unavailable
costs=unavailable -->

…r#4221)

Adds the history-specific row adapter above coder#4219. It preserves
ordinary-row parsing and legacy normalization, derives oversized-row
identity without assembling whole payloads, and compares replay
candidates using exact bounded byte ranges. The owning coder#4182 integration
will use this adapter to finish the oversized-row review finding.

Both existing reset protections remain in force through shared scanner
helpers: raw reset markers, including control-separated keys, and the
reverse token recognizer. Protected or invalid-UTF-8 readable rows still
count for identity collisions, but cannot grant replacement authority.
Digests reject mismatches cheaply; matching digests still require exact
byte comparison and rechecking the captured content digest. LF
termination is excluded from replay equality. Callers retain
responsibility for file provenance and publication-lock validation.

Small and oversized legacy array-coerced system rows retain collision
identities but cannot qualify as replacement candidates. User and
assistant role coercion remains supported; the small-row classification
agrees with the streamed projection.

Token scanning, captured size, and follow-up range reads now share the
same open file handle. A path replacement cannot mix the new inode’s
token evidence with the old inode’s bytes or size. The borrowed-handle
helper retains the caller’s ownership and captured range; existing stamp
and publication-lock checks remain required for in-place writes.

Integrated validation on coder#4191
`87badaf62f925e118c2292cf3e788fc92894dafc` and coder#4209
`d83e1cb55f50676562e675398f76e0b5118053ab` above main
`0d31680932fe5b2cb33ce33ec43cb576c86ee0e6`: six affected suites passed
on each integrated tree: A 549 tests / 3,337 assertions and B 602 tests
/ 3,649 assertions; full TypeScript and canonical static checks passed
on both. The rebased A/B trees exactly match those validated trees.

Risk: classification or reset-probe drift could admit ambiguous history.
Native-reader comparisons and existing provider privacy suites exercise
those contracts. This layer remains inactive until coder#4182 is integrated
and reviewed; it introduces no new persisted state or scan budget for
lifetime history proofs.

This stack integrates main `0d31680932fe5b2cb33ce33ec43cb576c86ee0e6`,
including coder#4225’s workspace-fork recovery fix. Each layer retains its
previously reviewed diff and all addressed review fixes.

This is one layer of the cancellation phase: coder#4214 → coder#4215 → coder#4219 →
coder#4221 → coder#4182 → coder#4187 → coder#4191 → coder#4209. All eight PRs merge together
after every member has current-head approval and passing CI.

---

_Generated with `xum` • Model: `unavailable` • Thinking: `unavailable` •
Cost: `$unavailable`_

<!-- mux-attribution: model=unavailable thinking=unavailable
costs=unavailable -->

…oder#4182)

Retained Stop needs durable proof that a replacement was accepted before
canceled recovery can be released. This layer adds guarded append,
batch, and Resume publication, with receipts captured at the history
commit point and witnesses verified across active history and archives.
Runtime activation follows in coder#4191/coder#4209.

Acceptance rechecks the captured cancellation nonce, journal generation,
physical lock, and logical ownership. Visible bytes are distinguished
from durable receipts, including file and directory flush failures.
Preserve-mode publication grants no replacement authority. Request-entry
capture and explicit malformed/unsupported-record repair share the
existing history lock so repair cannot adopt an intervening Stop. A
committed context reset can report its exact predecessor and successor
generation through an in-memory receipt; advancing the generation or
exposing bytes alone grants no queue-refresh authority. Stop retirement
similarly reports the exact predecessor and cleared successor only after
verified deletion under that same lock, retaining the receipt obligation
through failed-unlink retries.

Resume preserves the original row, signatures, and metadata. It accepts
the exact typed target or its exact wire projection. Retrying an already
stamped Resume can reuse byte-identical archive replay copies for its
captured nonce; duplicate active rows or changes to identity, sequence,
nonce, formatting, provenance, or generation still refuse authority.
Ordinary unstamped Resume retains its existing checks. A consumed nonce
cannot accept another replacement before retirement; the exact stamped
Resume replay is the only reuse exception. Publication metadata is
written back only to the original snapshotted message references, so
caller array changes cannot interrupt the durable receipt.

Witness traversal uses coder#4221's bounded row adapter. Protected and
invalid-UTF-8 rows still occupy identities; fingerprints can only
conservatively reject collisions, while replay authority requires exact
byte ranges. Ordinary append sequence allocation still has its existing
large archive-tail read; this PR does not claim the entire append path
has bounded memory.

A throwing retirement observer is logged after the state receipt and
cannot skip directory durability or recreate deletion debt. Superseding
a local retirement aborts that attempt’s provisional history scan and
exact replay comparison through their existing cancellation signal;
scanner handles are disposed before the queued Stop publishes. Current
verification errors still propagate. Legacy array-coerced system rows
cannot be stamped or used as replacement witnesses, while readable user
and assistant compatibility remains unchanged.

Under-lock witness verification now returns superseded only when its
original attempt lost ownership; current verification errors still
propagate. Every eligible occurrence of a nonce must prove the same
exact receipt, so conflicting eligible identities anywhere in active or
archived history refuse retirement. Ineligible legacy system stamps
cannot consume replacement authority, while still occupying their ID and
sequence for collision checks.

Separately deserialized legacy user/assistant roles retain an accepted
Resume receipt through a later history update. Comparison uses the
existing role coercion; changed roles cannot inherit the receipt, and
system/invalid rows remain ineligible witnesses.

Validation includes real-file crash replay, foreign-writer/CAS races,
malformed-record recovery, and deterministic file/directory durability
failures. Integrated validation on coder#4191
`87badaf62f925e118c2292cf3e788fc92894dafc` and coder#4209
`d83e1cb55f50676562e675398f76e0b5118053ab` above main
`0d31680932fe5b2cb33ce33ec43cb576c86ee0e6`: six affected suites passed
on each integrated tree: A 549 tests / 3,337 assertions and B 602 tests
/ 3,649 assertions; full TypeScript and canonical static checks passed
on both. The rebased A/B trees exactly match those validated trees.

Risk: conservative refusal can delay recovery when ownership or history
evidence is ambiguous; flush latency affects publication. Tests retain
exact history-byte and foreign-writer assertions.

This stack integrates main `0d31680932fe5b2cb33ce33ec43cb576c86ee0e6`,
including coder#4225’s workspace-fork recovery fix. Each layer retains its
previously reviewed diff and all addressed review fixes.

This is one layer of the cancellation phase: coder#4214 → coder#4215 → coder#4219 →
coder#4221 → coder#4182 → coder#4187 → coder#4191 → coder#4209. All eight PRs merge together
after every member has current-head approval and passing CI.

---

_Generated with `xum` • Model: `unavailable` • Thinking: `unavailable` •
Cost: `$unavailable`_

<!-- mux-attribution: model=unavailable thinking=unavailable
costs=unavailable -->

…#4187)

Centralizes prepared history publication so manual triggers and their
prefixes use one publication boundary. Origin remains independent of
visibility and billing, and later runtime layers consume durable
receipts and rollback facts instead of interpreting a successful send as
acceptance.

This preparation layer exposes coder#4182's guarded publication without
activating cancellation policy; that activation belongs to coder#4191/coder#4209
in the same phase. Both Result errors and unexpectedly rejected
publication promises reach the existing rollback checkpoints. Only the
publication service promise is normalized: acceptance receipts and
subsequent callback failures retain their distinct semantics.

Real HistoryService tests inject both failure forms after each prepared
prefix and assert rollback preserves concurrent foreign history. A
CI-only goal fixture now waits for publication entry and settles its
held promise before teardown; observing an atomic rename no longer
substitutes for write completion. Production goal behavior is unchanged.
Integrated validation on coder#4191
`87badaf62f925e118c2292cf3e788fc92894dafc` and coder#4209
`d83e1cb55f50676562e675398f76e0b5118053ab` above main
`0d31680932fe5b2cb33ce33ec43cb576c86ee0e6`: six affected suites passed
on each integrated tree: A 549 tests / 3,337 assertions and B 602 tests
/ 3,649 assertions; full TypeScript and canonical static checks passed
on both. The rebased A/B trees exactly match those validated trees.

Risk: publication callbacks govern queue and budget accounting. The
real-disk assertions protect against lost or duplicated input and
incorrect refunds.

This stack integrates main `0d31680932fe5b2cb33ce33ec43cb576c86ee0e6`,
including coder#4225’s workspace-fork recovery fix. Each layer retains its
previously reviewed diff and all addressed review fixes.

This is one layer of the cancellation phase: coder#4214 → coder#4215 → coder#4219 →
coder#4221 → coder#4182 → coder#4187 → coder#4191 → coder#4209. All eight PRs merge together
after every member has current-head approval and passing CI.

---

_Generated with `xum` • Model: `unavailable` • Thinking: `unavailable` •
Cost: `$unavailable`_

<!-- mux-attribution: model=unavailable thinking=unavailable
costs=unavailable -->

…coder#4191)

Activates durable compaction cancellation across Stop, manual
send/edit/Resume, queued input, and automatic recovery. Failed
preparation preserves cancellation; a durably accepted replacement may
release it. This V1 layer defers unresolved automatic recovery; coder#4209
adds settlement proof for eligible fresh input.

Automatic prefixes wait for their trigger and publish through the
existing captured-frontier history transaction. Comparing the original
persisted Stop and appending the batch under one write lock prevents
another backend’s Stop or Clear from leaving stale automatic rows
durable. Ordinary automatic input preserves cancellation and its
existing rollback ownership.

Requests capture the persisted Stop frontier before pricing/settings
preflight and retain it through preparation and queued dispatch.
Publication must match that original nonce/generation, so an older
request cannot adopt another backend's later Stop. Exact Send Now
admission carries its initiating Stop receipt; manual malformed-record
recovery remains a single operation. Context-budget continuations retain
their originating capture, and committed local resets and verified Stop
retirement advance only queued or active captures matching the exact
predecessor nonce and generation. This preserves legitimate queued input
across rollover without adopting a foreign Stop. The recorded admission
is checked again after request preparation and immediately before
provider construction, including prepared requests. A refusal after
stream construction aborts that captured provider before releasing its
resources.

Stop joins physical execution and terminal policy outside history locks.
Legacy summary/partial follow-up metadata is neutralized before the Stop
sidecar is published, and live compaction completion retains its
original admission generation so it cannot republish stopped recovery.
Failed initial cleanup preserves the predecessor and exact local retry
debt; it does not claim a successful durable Stop. Authored follow-up
request content remains intact. Full Clear runs the existing deletion
transaction under the cancellation history lock, after workspace cleanup
barriers and before sidecar publication. This preserves
malformed-history Clear while removing downgrade-readable recovery.
Uncertain deletion is not retried over later foreign input; a confirmed
deletion receipt permits only sidecar retry and retains UI/monitor
accounting if publication fails.

Edit/truncation receipts follow directory durability. Reset heartbeats
refuse scoped-summary cancellation debt while ordinary scoped-V1
automatic admission remains supported. Rejected manual input keeps
preserve-mode receipts so committed rejection rows are not duplicated
into the composer and uncommitted drafts can be restored.

Outstanding scoped cleanup debt prevents automatic input from starting
legacy token-pressure compaction or publishing a token-budget reset.
Reset publication checks the persisted cancellation scope under the
existing history write lock, including same-nonce narrowing by another
backend, so restart recovery can still find the canceled summary. Manual
replacement and ordinary automatic input without a reset remain
supported.

The original persisted nonce/generation is revalidated while holding the
existing shared history lock through synchronous provider construction,
registration, and supervision. Prepared requests use the final caller’s
fence. Playback, envelope writes, and cleanup are outside the lock.
Factory or fence failure retains exact registered-resource cleanup
ownership; mock playback keeps its existing immediately awaited
admission check.

A caller whose exact witnessed Stop was already retired by a peer can
receive the same verified absent-frontier transition. The original
nonce/generation is copied before waiting and the existing durable
witness is revalidated under the history lock. This advances only
matching owned admission and does not accept an arbitrary missing
sidecar or a newer generation.

Validation covers two-backend preflight races, queue/Send Now admission,
downgrade publication boundaries, late compaction completion, directory
flush failures, and real budget rejection. Integrated validation on
coder#4191 `df5972870696ef9b78c2854f8a4b9ddf3fd15769` and coder#4209
`86e3487151fde2273d8e7595504f3b87a2ea9d62`: 14 affected suites passed on
each tree (A 1,271 tests / 6,521 assertions; B 1,352 tests / 7,006
assertions), with full TypeScript, canonical static, and final
changed-file lint/format checks. Four deterministic peer Stop/Clear
cases fail on the original A head and pass with the fence;
unchanged-frontier controls pass. B production is unchanged.

Risk: ownership mistakes can resume canceled work or strand valid input.
Held preflight/cleanup and foreign-supersession controls exercise those
boundaries directly.

This stack integrates main `0d31680932fe5b2cb33ce33ec43cb576c86ee0e6`,
including coder#4225’s workspace-fork recovery fix. All prior review fixes
remain; the shared automatic-publication fence belongs to coder#4191.

This is one layer of the cancellation phase: coder#4214 → coder#4215 → coder#4219 →
coder#4221 → coder#4182 → coder#4187 → coder#4191 → coder#4209. All eight PRs merge together
after every member has current-head approval and passing CI.

---

_Generated with `xum` • Model: `unavailable` • Thinking: `unavailable` •
Cost: `$unavailable`_

<!-- mux-attribution: model=unavailable thinking=unavailable
costs=unavailable -->