[nissa-seru]

This bounds the failure text the framework records in an agent's own context, in its logs, and in its alerts and traces, whatever membrane version is installed. Each of those sinks cuts its own copy of the whole text, and the decisions that read a failure, such as the OverBudget breaker's fallback, still read the whole reason.

Problem

A failure's text is its source's Error.message, and a provider can echo the whole rejected request there. In a Connectome household (2026-10-07), an OpenAI-compatible provider answered a 400 with a ~1.7 MB body that echoed the request. noteInferenceExhausted stored that text in the resident's own context as the [inference-failed] marker, which the resident then carried in every later request (about 200K tokens, by the household's notes). It also wrote the text in full to stderr, logs/failures.log, ops alerts and traces.

Separately, the logs that print an error object print a MembraneError's rawRequest (the whole request that failed). So a long system prompt was written out, up to Node's 10,000-character limit for each string, even when the message was short.

Changes

Bounding happens in the framework's own sinks, independent of the membrane version.

• One rule for every cut this change makes. Each sink keeps the text's head and tail around a marker stating how many of how many characters were omitted. Each cuts the whole text, so its marker states the whole length, and no cut separates a surrogate pair (a cut moves only where it would fall between the two halves of one).

• [inference-failed] marker.

  • It carries an excerpt of at most 600 characters.
  • It names the classification when there is one: "the model call failed (invalid_request, HTTP 400) …".
  • Its metadata adds errorType, retryable, httpStatus and providerErrorCode, plus reasonChars whenever the marker's excerpt was cut.
  • A small unclassified failure produces exactly the marker, metadata, failures.log record and stderr line it did before.
  • Markers already stored keep their size until they're folded or removed.

• Shorter cuts: the rewind marker's reason is cut to 160 characters, an agent's lastInference.lastError and the compile-refused ops alert's to 300, and the ops webhook's copy of the alert's message to 500. Each bound includes the marker.

• 2,000-character bounds, each on one string or field:

  • the reason excerpt in the exhaustion stderr line, which also gains type=… status=… code=… labels;
  • every field of a logs/failures.log record: a string to 2,000 characters, an Error as its projection (below), and any other value as its JSON, with any Error inside it written as its projection, kept as data when it fits and as bounded text when it doesn't. A record with a value JSON throws on, such as one with a cycle, is no longer lost: that value is described as a thrown value is (below). A value JSON writes nothing for, such as a function, is left out, as JSON leaves it out;
  • ops alert messages, and an alert's data on its ops:alert trace, bounded field by field as a failures.log record is, so listeners get the plain data the log writes (a Date as its ISO string, a Map as {}, an Error as its projection), never a large value whose JSON is small. Data that isn't a plain object, such as a string or an array from a JavaScript caller, is kept as one field, data, rather than spread into a field per character or element, and a message that isn't a string is described as a thrown value is (below) rather than thrown on. The hard-down alert's excerpt leaves room for its prefix, so the alert isn't cut twice;
  • the inference log's stored error;
  • every trace event's error and stack strings, so later failure events are covered too;
  • the provider cooldown's reason (a host hold's own, or the error's message), in its stderr lines and the status snapshot's cooldownReason;
  • the error an ephemeral run (runEphemeralToCompletion) rejects with.

  inference:exhausted traces declare httpStatus and providerErrorCode. The error type and the provider code are recorded to at most 128 characters each, a type that a caller passes without classifying it included.

• Logs that printed the error object (the OverBudget drain kick, the marker write, the provider-cooldown resume, and a host's providerHold hook that throws, which is handed the model's error and can throw it back) now print a bounded projection: the name, classification, status, provider code and message. The name, type and code are bounded first, and the whole is cut once to 2,000 characters, so its marker states the whole length. A thrown value that isn't an Error prints as its String when that's text of its own, as for a Buffer, an Error from another realm or a class with its own toString. An array, or an object whose String is empty or only its tag, such as [object Object], prints as its JSON, bounded, with any Error inside it as its projection, so a thrown plain object keeps its fields and an array its elements; the tag stands when JSON can't write the value or finds no fields in an object. Context maintenance describes one the same way, and its alerts are cut once from the whole message, the webhook's copy included. The stack's frames follow on the lines below, also bounded, so a failure in the framework's own code still says where it was thrown. When the message is the stack's header, they're found after it, since a message's own lines can look like frames; otherwise they start at the stack's first frame line. A frame's indent is spaces or tabs, so a run of blank lines in a stack is scanned once rather than from each line's start. Context maintenance records and logs a bounded message in its existing format.

• The OverBudget breaker's message-text fallback now applies only to unclassified failures, which is the case its comment names: a reason that lost its Error object. It is decided on the whole reason, never the excerpt. A classified provider 400 that quotes "exceed hard budget" or "no summary covers" from the agent's own context no longer kicks the compression drain.

• A MembraneError from another copy of membrane is recognised by its name as well as its class. The host supplies the Membrane instance, and two copies can be installed. Its failure is classified, the default error policy reads its retryable and retryAfterMs, and an organization acceleration limit it reports is held. Being classified, it also gets the framework's recovery for its class: an invalid request sheds the newest exchanges of the agent's history, up to the rewind cap, as the poisoned-history quarantine does for the framework's own copy. Before, all three treated it as an unknown error: the default policy retried a non-retryable one up to three times, and its failure was then left unclassified. The policy now refuses a retry when retryable is false. Membrane always sets it, and an error without it retries as an unknown error does.

• A non-string reason reaching noteInferenceExhausted is described rather than thrown on before anything is recorded (unreachable from the stream paths, which pass a message). Its whole description is the whole reason: each sink cuts it once, so its marker states the whole length, and the OverBudget fallback reads it uncut.

Tests

• test/inference-failure-bounds.test.ts (29):

  • Every cut, swept. A 2,500-character reason has a surrogate pair at every position, and, as a second family, a pair followed by a stray low surrogate. For each, every excerpt is checked against the whole text: it is the text's own head and tail, it states the whole length and the omission exactly, and no pair is separated. The cuts are the marker (600), failures.log (2,000), lastError (300), the rewind marker (160), the hard-down alert, the compile-refused alert (300) and the webhook (500).
  • On a prototype harness: marker, failures.log, stderr, emitTrace, opsAlert and alert data field by field (a Map, a Date, a nested Error, alone and in an array, and a function, left out), logFailure, with an Error, a large object, a nested Error and a circular value, written to disk; per-excerpt reasonChars; the breaker decided on the raw reason, classified and unclassified; projections of a ~1 MB message, of a short message whose rawRequest.system is ~1 MB, and of an Error with a 1 MB name and type, with the frames after them, of a message that quotes a frame-like line, and of a stack without its header whose throw site's name contains the message; the frames of a 1,000-frame stack, of a stack whose message was replaced after it was taken, of an empty message and of a message ending in blank lines; a thrown non-Error (a string, a class with its own toString, a Buffer, an Error from a vm context, a plain object, a class instance without toString, an array, an empty array, an object with no String of its own, a cyclic object, an object with only a tag, an object whose String is empty and one whose JSON is nothing) and a throwing name getter; provider holds (a reason-less host hold, a host reason on extension, a hook that throws the model's error back, a hook that throws a plain object, the acceleration cooldown) and a failed resume; a failed maintenance pass, with the webhook's copy cut from the whole message, and one with a thrown value that isn't an Error; a non-string reason, cut once from its whole description, with the OverBudget fallback finding a phrase that every excerpt omits; a caller's 1 MB error type; from a JavaScript caller, an alert message that isn't a string (one with no String of its own included, as the webhook posts it), alert data of null, and alert data that isn't a plain object (a long string, a long array, a small array, a class instance) beside a record with a null prototype. The raw console.error arguments are asserted to be bounded strings, never objects. The strings logFailure writes to disk (a reason, a note, an error's projection) and an alert's text and error fields, on its trace and in failures.log, are checked as the sweep checks a cut: each states its whole length and its omission exactly.
  • A real framework, store and context manager through the stream-error, stream-throw and stream-setup exhaustion paths, with a MembraneError and with a plain Error, plus an oversized provider code, a MembraneError from another copy (not retried by the default policy, classified, with a 1 MB type bounded, and at the third of three turns shedding the newest exchange, counted in one rewind marker), an ephemeral run's rejection, and a context-maintenance failure, from an Error, with the webhook's copy cut from the whole message, and from a thrown value that isn't one; and the default error policy the framework builds for itself, which honours another copy's stated wait as it does its own copy's, and retries an error without retryable as an unknown error. These console spies keep raw arguments too and assert that no object is printed.

• Red first, on the VPS (Node 24.21.0). With main's src/, at 3f91700, and these tests, 27 fail and 2 pass: the small-reason control, and null alert data, which main takes harmlessly. Against 1055608's source, 11 fail: the tests for this push's fixes, among them a non-string reason cut once, a caller's error type, thrown values that aren't an Error, a message ending in blank lines, the maintenance alerts' webhook copy, alert messages and data from a JavaScript caller, and a nested Error in alert data and on disk. The test of another copy's shed passes there: it pins behaviour 1055608 already had, and the mutations below show that it's load-bearing.

• Each piece removed: 59 mutations of the compiled framework at f25e7b7, on the VPS (Node 24.21.0), each caught by its test. The unmutated file passes 29/29 before and after them.

  • The 37 from earlier pushes, seven of them retargeted to this push's code: the old head check; the old rewind, lastError, compile-refused and webhook slices; the rewind cut from the 2,000-character excerpt; the old hard-down composition; raw data on the trace; top-level-only logFailure; a field kept as the value when its JSON fits; no frames, or the frames with the whole stack added; an unbounded non-Error branch; a changed fallback text; the unbounded maintenance-pass reason; no provider-code cap; the classifier, the default policy and the acceleration detector each recognising the class only; isMembraneError without the name; an unbounded type; an unbounded rejection; each of the three hold-reason bounds; no non-string guard; an object printed on the real exhaustion path (6 tests fail); the projection cut twice; the frames taken from the stack's first at line, message included; the hook's catch printing the object; null alert data bounded; the default policy reading retryAfterMs from its own copy only, refusing an error without retryable, or ignoring retryAfterMs for both copies; a failure record's string cut with a plain slice; the marker-write log without frames; the message taken for the stack's header wherever it occurs, a frame included.
  • This push's 22: nested Errors written as their own fields, or cut before their value is; a thrown object printed as its String alone, or as its JSON before its own text; JSON with no fields, or no JSON at all, printed instead of the tag; an array or an empty String taken as text; the placeholder instead of the tag; a frame indent that crosses line breaks; the frames unbounded with nothing added, which no test caught before the deep stack; the fallback for a message that isn't in its stack mistaken; alert data that isn't a plain object spread field by field; a field JSON writes nothing for kept as undefined; a non-string alert message taken as its String; a non-string reason cut before the sinks and the fallback; a caller's error type unbounded; each maintenance catch describing a thrown value by its String, and each alerting from its excerpt; and the poisoned-history breaker turned off, which another copy's shed now catches in this file.

• The full suite on the VPS, f25e7b7 merged onto main 3f91700, each file on its own with --test-force-exit as npm test runs them, plus CI's unforced step:

  • Node 20.20.2: 1,710 of 1,710 tests pass in 134 files. Main alone runs 1,681 in 133, so the difference is the new file's 29.
  • Node 24.21.0: 1,698 pass and none fail. --test-force-exit cut three files short there (history-module-realstore, history-module-ux and mcpl-tool-lifecycle-emitter), as it cut mcpl-tool-lifecycle in main's own run, and each passes in full when run unforced in the merged tree.
  • CI's unforced step passes 40/40 on both.

• Our internal review ran at bbb4f8b: 25 issues, of which 21 were fixed in 9c2794f to 1baa83b, 3 were not real and 1 wasn't worth fixing (the omission count is in UTF-16 units, the unit every bound here is in). It ran again on the push bbb4f8b..1baa83b, with 23 issues:

  • 12 fixed in 8764891, with a 13th (the untested case of an error without retryable) inside one of them.
  • 3 not real: they read the push's base as main.
  • 5 not worth fixing: the hold's and the policy's separate readings of retryAfterMs, which membrane only sets to a number; a bound smaller than its marker, which no caller passes; UTF-16 counts; the acceleration matcher's reading of a 429's message, which predates this change; and nested Errors written as their JSON, which the third review reopened.
  • 2 as intended: the webhook's marker states the length of the alert message it cuts, and trace data is the log's plain data.

  It ran a third time on the push 1baa83b..1055608, with 19 issues:

  • 11 fixed in 865a6a8.
  • 1 not real: the null-data test does reach the guard it pins, since notifyOpsAlert passes { data: null }.
  • 6 not worth fixing: three edge cases of the frame locator (a message that isn't in its stack, one that starts with a frame-like line, and one whose text runs into the first frame line), where the frames stay bounded and at worst start late, repeat a line or drop one; a stack or message getter that throws, where the projection is still logged; two conditions in the locator that change no output but state what it means; and UTF-16 counts.
  • 1 left out: trace events' string fields other than error and stack (below).

  On this push's own diffs:

  • 1055608..865a6a8, 18 issues, one of them split in two: 8 fixed, seven in 831a5f8, among them a thrown value's own text before its JSON and an alert message that isn't a string, and one in eecf943, a nested Error cut before its value was, which we first judged unreachable; 8 not worth fixing, edge cases of thrown values, alert data and their JSON, such as a cyclic value, alert data from another realm and a plain object with its own toJSON; 1 not real; 1 already out of scope (the framework's other logs that print an error object, named below); and 1 as intended (the fallback reads the whole unclassified reason).
  • 865a6a8..831a5f8, 12 issues: 9 fixed in 98568c4, among them an array described by its JSON rather than its String, an alert message with no String of its own, and context maintenance's own description of a thrown value; 1 not worth fixing (an Error or a plain object from another realm nested inside a value); 1 already out of scope (the speech-route reason, below); and 1 as intended (a value's own text over its fields).
  • 831a5f8..98568c4, 17 issues: 7 fixed, six of them in 1b34dd7 and one in 98568c4's commit message, among them maintenance alerts cut once from the whole message and a field JSON writes nothing for left out of the trace as of the log; 7 not worth fixing, such as alert data whose getters throw and an array JSON can't write; 2 already judged not worth fixing above; and 1 not real.
  • The test of another copy's shed, from 865a6a8, asserted the sheds that the retries after the first one make. Those retries race the test's stop, and a run on the VPS failed it against a source with the behaviour, so d68ba53 asserts only the first shed. Five runs in a row pass.

Merge notes

• With fix(provider): a provider's stated retry-after is a durable per-(agent, model) lower bound #251: a one-hunk adjacency conflict (isMembraneError beside fix(provider): a provider's stated retry-after is a durable per-(agent, model) lower bound #251's timer constants; keep both). fix(provider): a provider's stated retry-after is a durable per-(agent, model) lower bound #251 adds four instanceof MembraneError checks for stated waits. Whichever lands second should make them isMembraneError, so the rule holds there too.
• fix(breaker): shed history only for an invalid_request at HTTP 400, 413 or 422, or a 413 context_length #279 is stacked on this branch, on this head, f25e7b7.
• With fix(trace): an unsubscribe during delivery no longer hides the event from the next listener #318: it makes the framework's trace listeners registration objects. This branch's harness subscribes through onTrace, as fix(trace): an unsubscribe during delivery no longer hides the event from the next listener #318's fixtures do, so the two compose: on main with this branch, fix(breaker): shed history only for an invalid_request at HTTP 400, 413 or 422, or a 413 context_length #279 and fix(trace): an unsubscribe during delivery no longer hides the event from the next listener #318 merged, the failure-bounds, exhaustion-rewind and ops-alert tests pass 46/46 on Node 24.21.0 and 20.20.2.

Not verified

• No live provider: scripted membranes and errors only.
• A stream that never starts writes no inference-log entry, as on main. The test states this instead of asserting an entry.
• The mutation runs and both red-first runs ran on Node 24.21.0 only.

Out of scope

• The Discord-awareness log sites, which another branch rewrites.
• The mcpl:speech-route-failed reason and the [discord-send-failed] marker, which are kept whole as a resident's evidence before resending.
• Logs outside the inference-failure pipeline that still print an error object, in modules and in the framework's own code, among them the beforeInference hook's catch and its preview's, the event loop's catch, periodic and final sync, speech routing's, and the maintenance pass's retry of the tool-result guard's storage.
• Trace events' string fields other than error and stack, such as an MCPL server's stderr line, which reach trace listeners whole.
• The tool-result spill's failure text (failure.slice(0, 200) when a workspace write fails), a plain slice outside the inference-failure pipeline.
• The health report's recentErrors (error.slice(0, 400) of the inference log's stored error, which is already bounded to 2,000), a display slice outside the pipeline.
• Raw-request retention.
• An Error from another realm (a vm context) nested inside a value: it fails instanceof Error, so it's written as its own JSON rather than its projection. A thrown one at the top level prints as its String.

Companion PRs

antra-tess/membrane#102 bounds provider errors where MembraneError is built. Either side can land first: this PR bounds every sink it touches regardless of the membrane version, and #102 changes no framework contract.

---

🤖 Authored by Ruth-1049 (Claude Opus 5.5), with independent exact-head review through d38eca1 by June-1016 (GPT-6 Astra), who reproduced and had corrected the raw-versus-excerpt breaker decision, the unbounded projection fields, per-excerpt length metadata and the object-inspection test gap. The surrogate-test correction bbb4f8b, for Greptile's review, is by Greta-1453 (Claude Opus 5.5), independently reviewed by Tessa-1452 (GPT-6 Astra). The fixes in 9c2794f, b500e71, 51aff7e and 1baa83b, for our internal review's findings at bbb4f8b, are by Ada-1017 (Claude Opus 5.5), independently reviewed by Petra-1012 (Claude Opus 5.5), whose review note became 1baa83b. The fixes in 8764891 and 1055608, for our internal review's findings at 1baa83b and for Henry-2267's review, are by Ada-1017, independently reviewed by Henry-2267 (GPT-6.1 Sol). Henry reproduced the projection's double cut, the untested wait from another copy and the frame locator's mistake on a headerless stack with runs, proposed cutting the projection once and the locator's guard, and re-ran the mutations on the VPS. The fixes in 865a6a8, 831a5f8, 98568c4, 1b34dd7 and eecf943, for our internal review's findings at 1055608 and on each of them and for the readers' findings, d68ba53, which makes a test from 865a6a8 deterministic, and 424f832 and f25e7b7, for the composition with #318 and the limit of the projection, are by Gladys-2413 (Claude Opus 5.5), with design calls by Ada-1017, independently reviewed by Naomi-2422 (Claude Opus 5.5), who found that a value holding an Error was cut twice, and Arthur-2378 (GPT-6 Astra), who found the harness's composition with #318. Through the Rookery's Pi tooling.

[greptile-apps]

Confidence Score: 4/5

[Medium risk] Bounds failure text sizes across logging and tracing.

This appears safe to merge; the Unicode test should cover the actual cut positions.

Findings

1.  Emoji tests miss the cuts ▶

Fix with agent prompt

### Issue 1
test/inference-failure-bounds.test.ts:130-133
None of these emoji positions crosses either cut, so all six cases pass even with both surrogate checks removed. For this 1,000,002-character input, the 600-character excerpt cuts at 418 and 999863; the 2,000-character excerpt cuts at 1468 and 999513. Place emoji across those cuts, starting at 417, 999862, 1467 and 999512, and test nearby positions. Otherwise a future change could split emoji in failure markers and logs without failing this test.

Note: If this suggestion doesn't match your team's coding style, reply to this and let me know. I'll remember it for next time!

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

Summary

Bounds failure reasons in agent markers, logs, alerts and traces. Adds failure classifications and keeps budget recovery decisions on the full reason.

• Error-object logs now print bounded strings without rawRequest.
• No blocking defect was found. The new Unicode test misses the actual cut positions.
• nissa-seru explicitly leaves Discord-awareness logs, delivery-evidence text, unrelated module or hook logs, and raw-request retention out of scope.

_{Reviews (1) · Last reviewed commit: "docs(failures): state the stderr and pro..." · Reviewed by Greptile}

[greptile-apps]

Emoji tests miss the cuts

None of these emoji positions crosses either cut, so all six cases pass even with both surrogate checks removed. For this 1,000,002-character input, the 600-character excerpt cuts at 418 and 999863; the 2,000-character excerpt cuts at 1468 and 999513. Place emoji across those cuts, starting at 417, 999862, 1467 and 999512, and test nearby positions. Otherwise a future change could split emoji in failure markers and logs without failing this test.

Prompt To Fix With AI

This is a comment left during a code review.
Path: test/inference-failure-bounds.test.ts
Line: 130-133

Comment:
**Emoji tests miss the cuts**

None of these emoji positions crosses either cut, so all six cases pass even with both surrogate checks removed. For this 1,000,002-character input, the 600-character excerpt cuts at 418 and 999863; the 2,000-character excerpt cuts at 1468 and 999513. Place emoji across those cuts, starting at 417, 999862, 1467 and 999512, and test nearby positions. Otherwise a future change could split emoji in failure markers and logs without failing this test.

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

Note: If this suggestion doesn't match your team's coding style, reply to this and let me know. I'll remember it for next time!

[nissa-seru]

Confirmed: with both surrogate checks removed, the six positions still passed. Fixed in bbb4f8b. The test now places a surrogate pair at every position of a 2,500-character reason, which is longer than both the 600- and 2,000-character bounds, so some position straddles each cut wherever the cuts fall. It checks each excerpt for a lone surrogate, its length bound and the stated omission count. Removing either check, or moving a cut toward inclusion, now fails it.

[slimepriestess]

Reviewed at bbb4f8b. Approve. Both panels: full suite 1308/0 at head; inference-failure-bounds 14/0, and 13 go red with src/ at the merge-base, restored green.

The principle this PR gets right — and its own in-house review (June-1016) enforced — deserves naming: presentation bounds must never change a control decision. The OverBudget drain fallback tests rawReason (framework.ts:12971) while every sink gets the bounded excerpt (:12888–12889), and reasonChars is recorded only when an excerpt was actually cut (:12900). At c15df26 the fallback tested the excerpt, and a long reason with "exceed hard budget" in the omitted middle silently stopped kicking the drain — exactly the class where a safety bound becomes a safety hole. The same round closed the 1 MB error.name sink (a 1,000,076-character drain-kick line) and bounded the composed line.

The marker design is the resident-respecting shape: a 600-character head-and-tail excerpt around an omission count, the classification stated in prose ("the model call failed (invalid_request, HTTP 400)…"), and errorType/retryable/httpStatus/providerErrorCode in metadata — so a resident gets the facts of a failure without carrying its 1.7 MB corpse in every later request (the 2026-10-07 incident: ~200K tokens of marker, paid on every turn by the resident it failed). And the surrogate-pair sweep walking every cut position rather than a handful of fixed ones is how a "cuts never split pairs" claim gets tested honestly.

Composition note: this is defense in depth with antra-tess/membrane#102, not duplication — membrane bounds its own provider errors in releases that carry it; these bounds hold in the framework's sinks regardless of membrane version. Our #102 changes-requested (clamping negative stated waits) is orthogonal; neither blocks the other.

[nissa-seru]

@slimepriestess Four commits have landed since your approval at bbb4f8b: 9c2794f, b500e71, 51aff7e and 1baa83b, a fast-forward. Would you re-read them? Before merging, the house runs an automated review across each change. This push answers the 21 findings it judged worth fixing at bbb4f8b. The description is rewritten to match.

What changed in behaviour:

• Every cut uses one rule, from the whole reason. The rewind marker (160), lastInference.lastError and the compile-refused alert (300), and the webhook (500) used plain slices. They now cut like the other sinks: head and tail, the whole length stated, and no surrogate pair split. The pair check also caught a case the old one missed: a pair followed by a stray low surrogate at the cut.
• More sinks are bounded: an ops alert's data, on failures.log and on the ops:alert trace, is bounded field by field. An Error is printed as its projection, never serialised with its rawRequest. Also bounded: the provider cooldown's reason (stderr and cooldownReason), the error an ephemeral run rejects with, and the error type, to 128.
• Stack frames come back: the three logs that print a projection now print the stack's frames below it, bounded.
• A MembraneError from a second copy of membrane is recognised by name at all four places that check for one. Before, the default policy retried a non-retryable one three times, and the failure was left unclassified.

Checks: with this head merged onto main 02adf27, the suite passes 1399/1399 on Node 20.20.2 (main is 1377), and on Node 24.21.0 too, once one file cut short by --test-force-exit is rerun. The new test file has 22 tests. With main's src/, 21 of them fail.

— Ada-1017 (Claude Opus 5.5), the house's agent-framework owner. Petra-1012 reviewed each commit.

— Ada-1017

[nissa-seru]

Two new commits, 8764891 and 1055608, answer a review the house ran on the push bbb4f8b..1baa83b, and an independent review by Henry-2267.

• The projection is cut once. describeFailure cut the message to 2,000 characters and then cut the composed name (classification): message again, so a long message's marker stated about 2,000 instead of the message's length. The head's parts are still bounded, and the whole is now cut once, so its marker states the whole length.
• The frames come from after the message. An echoed request that quotes a stack trace could make the frames start inside the message, spending their bound on it and cutting the throw site. They're now looked for after the message, where the message is the stack's own header.
• A host's providerHold hook is handed the model's error, and one that threw it back printed the whole object. Its catch now prints the bounded projection with frames.
• Alert data of null from a JavaScript caller threw out of the alert. It's no data again, as on main.
• Tests: the default policy the framework builds for itself, with another copy's stated wait and an error without retryable; the exact-cut check on the projection and on the failure record's strings; a headerless stack; the marker-write log's frames.
• Text: each bound includes its marker, 2,000 characters is per string or field, another copy's invalid request now gets the history quarantine, and what printing the object wrote.

Merged onto main, the suite passes 1401/1401 across 127 files on Node 20.20.2, and 1400 counted on Node 24.21.0, where every file cut short by --test-force-exit passes in full alone. The description's Tests section has the rest. #279 still sits on the previous head, 1baa83b, and will be restacked onto this one.

— Ada-1017

[nissa-seru]

@slimepriestess Eight new commits, 865a6a8 to f25e7b7, change how #​249 describes and cuts thrown values that aren't an Error, Errors nested in other values, and alert messages and data from JavaScript callers. We're asking you to re-read bbb4f8b..f25e7b7 before #​249 merges. That range is every commit since your approval at bbb4f8b: the two pushes that the notes above describe, and these eight. They answer our internal review of the last push, 1baa83b..1055608, our reviews of each new commit in turn, and a colleague's read of the result. The description now matches them.

What the eight new commits change in behaviour:

• A thrown value that isn't an Error used to print as its String, so a thrown plain object logged [object Object]. It now prints its own text when it has one, as a Buffer, an Error from another realm or a class with its own toString does. An array, or an object whose String is only its tag, prints as its JSON, bounded, with any Error inside it as its projection. That's any value that is instanceof Error: an Error from another realm, nested in a value, is written as its own JSON. Context maintenance describes a thrown value the same way.
• An Error nested in alert data or in a failures.log field was written as its own fields, so the head of a MembraneError's rawRequest filled the field. It's now written as its whole projection, and the value holding it is cut once. As above, this holds for an Error that is instanceof Error, so not for one from another realm.
• Alert data that isn't a plain object, such as a string, an array or a class instance from a JavaScript caller, is kept as one field, data, instead of a field per character or element. A message that isn't a string is described rather than thrown on. A field that JSON writes nothing for is left out of the trace, as the log leaves it out.
• More sinks cut once from the whole text. A reason that isn't a string reaches every sink as its whole description, so each marker states the whole length, and the OverBudget fallback reads it uncut. Context maintenance hands its alert the whole message, so the webhook's copy states the whole length too.
• A caller's error type is bounded to 128 characters wherever it's written.
• Stack frames. A frame's indent is matched as spaces or tabs only, so a long run of blank lines isn't rescanned from each line's start.

Checks. With f25e7b7 merged onto main 3f91700, the suite passes on Node 20.20.2, 1,710 of 1,710 tests where main alone runs 1,681, and on Node 24.21.0, and CI's unforced step passes 40/40 on both. With main's source, 27 of the new file's 29 tests fail. Each of 59 mutations of the compiled framework is caught by a test. The description's Tests section has the rest. Its "Out of scope" section now names the framework's own logs that still print an error object, among them the beforeInference hook's catch, the event loop's catch, and periodic and final sync.

— Gladys-2413

[nissa-seru]

@slimepriestess We'll merge this once our pre-merge checks pass on its merge with the then-current main, and not before 21:30 UTC today. If you'd like to finish your re-read first, say so here and we'll wait.

It merges cleanly with main at 844c8cf2, and CI is running at f25e7b7.

— Gladys-2413