fix(requests): request-only turns stay where the reply's request had them

[nissa-seru]

Part of anima-research/context-manager#155 (signed thinking refused after a fold). Context-manager's part is anima-research/context-manager#160, and membrane's are antra-tess/membrane#108 and antra-tess/membrane#110. This is one of three agent-framework pull requests that need no release from either; each stands alone. The others are #285 and #286.

Problem

A provider that binds signed thinking to the prefix it was minted under refuses that thinking once anything before it changes. Context-manager#160 strips the thinking its own rewrites invalidate, but it chains only the messages it compiles. A request-only turn that agent-framework adds after compiling is invisible to it, so agent-framework has to render each such turn the same way in every request after the one that minted a reply. Two didn't.

1. The silent heartbeat's instruction changed the system prompt for one turn. It rode InferenceRequest.ephemeralSystemPrompt into a system-position injection (framework:silent-heartbeat), so every heartbeat request's system differed from every other request's. That costs three things:
   • the heartbeat request misses the prompt cache from the system on;
   • every retained thinking block fails its binding in it;
   • the tick reply's own thinking fails at the next ordinary turn, where the system is back.
2. A [Continue] turn wasn't rendered again. When a compile ends on the agent's own message, the request gets a trailing request-only [Continue] turn, but later compiles didn't render it. So the reply it prompted sat straight after the previous assistant message, which caused two failures:
   • The merge: the formatter merged the two, putting signed thinking from two responses in one message. That's the "thinking … blocks in the latest assistant message cannot be modified" 400 when it's the latest.
   • The binding: the reply's binding failed from the next request. Context-manager's stamp matches, since it never saw the turn, so the reply's thinking would go out to be refused.

Changes

The heartbeat's instruction is the separator's text. A silent tick stores no prompt row. Every compile renders a request-only separator before the tick's first surviving row, and the tick's own request ends on it.

• The text: SILENT_HEARTBEAT_SEPARATOR is now the instruction the ephemeral prompt carried. The tick's request reads it as its prompt, and later requests show it at the tick, which tells the agent the turn was a private self-check.
• The system prompt: a tick's request now carries the agent's own, as every other turn does.
• The removed field: ephemeralSystemPrompt is gone from InferenceRequest and from every path that carried it: the push-event wake, the batched wake, the budget restart and the injection itself.

[Continue] is rendered before the replies that follow it.

• Which replies follow it: a reply follows a [Continue] when what it is sent ends on that [Continue], or on the tool results of a reply that followed it. That holds at a stream start and at each round inside a stream. A reply sent anything else after those results follows that instead, and carries no prompt. Two cases make this the rule:

  • A message injected at a tool boundary. When a message arrives while a tool runs, hear-while-acting stores it right after the tool results and hands it to the live stream with them, so the stream's next round follows the message.
  • A stream resumed after a provider cooldown, whose compile ends on a message that arrived during the cooldown.

  In both, once the round that followed [Continue] folds, rendering [Continue] before the later reply would put it between that message and a reply that followed the message.

• The prompt is read from the request, never carried. At each stream start, the Agent returns it as StartStreamResult.continuePrompt, a { turn, text } pair:

  • a new prompt when the request ends on [Continue];
  • else, when the request ends on tool results, the prompt stamped on the reply that called those tools (toolLoopPrompt);
  • else none.

  The stored rows are the only source, so a budget restart, an error retry, or a new process after a restart reads the prompt where the earlier rounds stored it.

• Each round: the framework holds the prompt for the turn's current round, privately, keyed by the turn's trigger. A tool boundary that hands the live stream injected messages clears it.

• The stamp: each reply that follows the prompt carries it as metadata.promptedBy on its assistant responses and tool results.

• Rendering: request builds put the prompt's text immediately before the first of its assistant rows that survives compilation. They find rows the way they find a tick's rows: by tool-use ids and thinking signatures, never by text.

Each turn renders the text its request was sent with.

• Ticks: each tick row records the separator its request rendered (SilentHeartbeatStamp.separator), and rendering uses that recorded text. A row stamped before the field existed renders the bare [heartbeat tick] that its requests carried.
• [Continue]: its stamp records its text the same way.
• So: an upgrade changes no stored reply's prefix, and a later change to either constant changes only rows stored after it.

A tick opens wherever its separator isn't rendered. That's its first request, and also a restart whose compile left none of the tick's rows. That restart's request ends on the separator, where later compiles render it before the restart's reply. A tick is told apart by its server and event id together, since two servers' events can share an id.

The non-streaming continuation keeps the turn's properties. The tool_results_ready fallback now carries the turn's suppressProse and silentHeartbeat, as the budget restart does.

Mechanics:

• silent-heartbeat.ts now holds both kinds of request-only row.
  • indexRequestOnlyRows indexes the agent's own stamped rows, tick rows and prompted rows separately, so one row can be both. It reads the stamps before computing any row's identity keys, so walking a history costs a metadata read per unstamped row.
  • renderRequestOnlyRows puts a tick's separator before the tick's first surviving row, and a prompt's text before its first surviving row, after any separator. That's the order the reply's request had them. It returns the ticks it rendered.
  • toolLoopPrompt reads the prompt a request continues from its last message's tool results, through the same index.
  • tickKey keys a tick by server and event id.
  • RequestOnlyStamps types the stamps a row carries. It's a type alias, so it fits MessageMetadata without a cast and a misspelled key fails to compile.
  • Names: RequestOnlyPrompt is a new exported type. The package's exports keep their names. The module's own indexSilentTickRows, separateSilentHeartbeatTicks and SilentTickIndex are renamed; the package index never re-exported them.
• Agent.buildActivationRequest's body is now a private assembleActivationRequest, which also returns the prompt. buildActivationRequest returns its request, for previews.
• The framework's holder is turnPrompts, a WeakMap from the turn's trigger to the prompt. The stream start sets or deletes it after the replaced-agent check.
• silentTurnRowMetadata now stamps both kinds of turn. It keeps its name, since renaming it would touch seven call sites that other open pull requests change.

Where the rule has to hold

Every request-only turn agent-framework adds after compiling. There are three, and each is now rendered again where it was, with the text it was sent with:

• The tick separator, before the tick's first surviving row.
• [Continue], before the first surviving assistant row of the replies that followed it.
• The opening separator, which is the first of these in its own request, including on a restart that re-opens the tick.

The empty-text sanitizing before them is a function of the compiled messages, so equal compiles give equal requests.

The rows each reply stores. Its assistant responses, its tool results and the contained-wrapper row that stands in for a response take silentTurnRowMetadata. They're stored at the tool boundary, on the completed-stream paths and through the tool-result guard.

• Where rendering anchors: only on the agent's own rows. A tool result can't survive without its tool_use, and a wrapper that survives alone follows an assistant row, so neither needs one.
• The stamp on a reply's user-role rows (its tool results, the wrapper) marks them as the turn's, for a later retention policy to find. It renders nothing.
• The turn's other stores (a delivery receipt, a routing notice, a deferred flush) aren't the reply's, and carry no stamp.

Every stream and every round of a turn. The stream start reads the prompt from its own request, whether it's the turn's first stream, a budget restart, a guard or error retry, a resume after a cooldown, or the non-streaming continuation. Nothing passes a prompt in. Inside a stream, a tool boundary that hands the live stream messages ends the prompt for the rounds after it. A writer that bypasses deferral stores between rounds without being in the request, so it doesn't end the prompt, and the next round still follows the results.

After a process restart, the stored rows carry the prompt, so a turn whose request ends on a stored round's tool results continues it. A locus agent's first turn after boot announces its locus first, so its request ends on that notice, and its reply correctly follows no prompt. So this reaches agents whose plain speech has no locus, and agents with explicit or disabled prose routing.

A reply the render can't find. A reply with neither a tool call nor signed or redacted thinking has no identity a compiled window keeps. So it gets no request-only turn, in a tick or after [Continue], and merges into the message before it as before. Without signed thinking, that merge carries no refusal: it's a misreading.

Every turn that could still change the system: the system is buildSystemPrompt over the compile's system injections. With the heartbeat's injection gone, those are modules' gatherContext, MCPL beforeInference hooks and the subconscious's dispositions, each changing only when its content does.

Not the direct runInference path. It compiles through compileWithInjections and renders none of these turns, as it never rendered the tick separator. So an agent driven through both it and the framework's streams would send different prefixes. The direct API serves agents run without the framework's streams.

A row carrying both stamps, a tick row that's also a reply to [Continue], gets both turns, separator first. By reading the budget restart, the guard retry and the error retry, a later stream inside a tick whose rows are rendered compiles past a stored tool result, and one whose rows are all folded opens on its separator. So no stream inside a tick opens on [Continue] today. Rendering both keeps it right if one ever does. A tick's stamp is turn-level, unlike the prompt's: its instruction is true of every round of the tick.

Tests

silent-heartbeat-rows:

• a tick's request carries the agent's own system prompt;
• every tick row is stamped with the separator its request rendered, and no row stores the separator;
• recorded texts render as recorded, and a tick stamped without one renders [heartbeat tick];
• two servers' ticks that share an event id each get their separator;
• a restart whose compile left none of the tick's rows ends on the separator, and the next request keeps it as a byte-exact prefix;
• the reply to [Continue] is rendered after it again, and the request that minted it is a byte-exact prefix of the next;
• every row of a [Continue] reply's tool loop is marked, with one [Continue] before the first;
• with the reply's tool exchange dropped by a strategy, [Continue] precedes the surviving final reply, and no wire message carries two signatures;
• a reply to [Continue] that restarts at its tool boundary reads the prompt from the restart's own request, which ends on the round's tool results, so a window that later folds the round renders [Continue] before the restart's reply;
• a reply the error policy retries past its first round follows the prompt;
• a later round handed a message at its tool boundary follows the message: its rows carry no prompt, and once the round folds, the message precedes it, not [Continue];
• a reply resumed after a provider cooldown (a 429 holds the restart, and a message arrives during it) carries no prompt, and no [Continue] renders before it once the round folds;
• a reply after the process restarts (a new framework over the same store) reads the prompt from the stored rows;
• a request that ends on the agent's own message mints a new [Continue], even with an older one rendered earlier in it;
• a reply whose only identity is a redacted_thinking block gets its [Continue];
• a row with both stamps gets both turns, separator first, also as the tick's first surviving row.

silent-heartbeat, 1 changed: the instruction is the request's last turn, and its system is the agent's own.

Red-first:

• This pull request's first commit, at 02adf27's source: 4 of its tests fail.
• The second commit, at ee43daf's source: 7 of its tests fail. That's the restart and dropped-round tests on behaviour, and the rest on the new stamp shapes.
• The third and fourth, at 6f08783's source: 5 of their tests fail. Four fail on behaviour: the injected round, the cooldown, the process restart and the shared event id. The recorded-text test fails on the tick key's new form. The three that fill coverage gaps (the error retry, a second [Continue], redacted thinking) pass there.

Removals, each alone, on silent-heartbeat-rows, silent-heartbeat and activation-request-sanitize (Node 24.19.0, at 68f529f, this head). Each fails the tests aimed at it:

• the separator back to the bare marker: the heartbeat test, the system-prompt test, and the two restart tests that look for the instruction;
• the instruction riding a system injection again: the system-prompt test and the heartbeat test;
• the assembly never ending on a new prompt, the framework ignoring the prompt a stream start reads, or rows carrying no promptedBy: the ten [Continue] integration tests each time;
• the tick stamp recording no separator: ten tick tests, whose later requests render the bare marker where the tick's request had the instruction;
• rendering a constant instead of the recorded text: the recorded-text test, and for ticks the shared-event-id test too;
• a tick opening only before it has stored a row, the old rule: the restart-reopen test;
• the index ignoring promptedBy: eleven tests;
• a prompt before every one of its rows, or a separator before every tick row: the test aimed at each, "every row … one [Continue] before the first" and the both-stamps test;
• [Continue] before the separator: the both-stamps test;
• a [Continue] opening that reuses an older prompt: the second-[Continue] test;
• no clear where a tool boundary hands the stream messages: the injected-round test;
• a request that ends on tool results following no prompt: the budget-restart, retry and process-restart tests;
• a request that ends on anything else falling back to the newest prompt: the cooldown test and two [Continue] tests;
• a tick keyed by its event id alone: the shared-event-id test.
• Four kept with their reasons, as no test can tell them apart:
  • The index takes only the agent's own rows. In a shared slot it would otherwise index every resident's history, and rendering already passes over other participants' messages.
  • A stream start whose request follows no prompt deletes the holder. By reading, no path today starts a second stream for the same trigger onto such a request: an error retry reuses the trigger, but its request ends where the failed attempt's did, and every other restart makes a new trigger. Deleting keeps the holder exactly what the current request says.
  • The non-streaming continuation's properties: the framework's own streams never reach that fallback (see Not verified).
  • Reading the stamps before the identity keys changes what the walk costs, not what it finds.

Full suite, one node --test process per file, on a clean worktree:

• This head (68f529f): 1392/1392 across 126 files on Node 20.20.2.
  • On Node 24.21.0 the per-file run reported 1381, because --test-force-exit cut mcpl-tool-lifecycle to 24 of its 31 and mcpl-tool-lifecycle-emitter to 22 of its 26.
  • Run alone and unforced, they pass 31/31 and 26/26, which makes 1392. So does history-module-realstore, 28/28, which the same cut had shortened at 6f08783.
• 6f08783: 1386/1386 on Node 20.20.2.
• 02adf27: 1377/1377 on both runtimes.
• Per file: the only test file this round changes is silent-heartbeat-rows, which had 21 tests and now has 27.

Trial merges with every open pull request, at their heads at 20:28Z on October 11, against this head:

• Conflicts this change has: three, all in agent.ts and all present since the second commit:
  • feat(receipts): per-channel receipt clocks and fold receipts from confirmed provider rounds #253 (06b7900). feat(receipts): per-channel receipt clocks and fold receipts from confirmed provider rounds #253 also splits buildActivationRequest, into a public prepareActivationRequest returning the request with its receipt evidence. It also remaps receipt coordinates when the request-only turns shift later messages.
    • The resolution: one assembler returns feat(receipts): per-channel receipt clocks and fold receipts from confirmed provider rounds #253's evidence and this change's continuePrompt, with renderRequestOnlyRows in place of the separator call.
    • The [Continue] turns: by reading, feat(receipts): per-channel receipt clocks and fold receipts from confirmed provider rounds #253's remap goes by message identity, so it covers them too. That resolution hasn't been run.
  • fix(guard): a withheld tool result says where its original is (#277) #281 (353d66f) and fix(guard): a withheld materialize, sync or delete keeps its file lists in its stub (#277) #283 (7c0e7ec). Each wraps the stream start's buildActivationRequest call in toolResultGuard.afterAnnotations(…), where this change calls assembleActivationRequest. The resolution wraps the new call the same way.
• Clean as text: every other open pull request that doesn't already conflict with main, including fix(compile): compiles that are never sent are dry runs; a fork's seed carries no thinking #285, fix(deferral): hold window-only messages to the turn's end; injected messages are read #286, feat(routing): speech follows its conversation, and publishes only where MCPL RFC-011 declares the place #256 and feat(mcpl): every channel item names its conversation in a stored source header #257. The tool boundary's clear sits outside the drain block fix(deferral): hold window-only messages to the turn's end; injected messages are read #286 restructures and the hand-off feat(receipts): per-channel receipt clocks and fold receipts from confirmed provider rounds #253 extends, and the test harness's channel registry stays as on main, which feat(routing): speech follows its conversation, and publishes only where MCPL RFC-011 declares the place #256 and feat(mcpl): every channel item names its conversation in a stored source header #257 edit.
• Already conflicting with main: feat(framework): gated operator body changes with journaled recovery (stacked on #250; merge after it) #255, fix(tune-out): enforce diversion across live delivery and recovery #201, feat(focus): single-channel focus mode with held backlog, autoreply, and expiry #195, fix(code-execution): the python runner gets the child allowlist too (follow-up to #175) #193, fix(mcpl): a server that fails a tools re-list keeps its known tools #183, feat(gate): messageQuietPeriod — one wake per message burst #179, fix(prose): failed sends release held prose; opt-in round-scoped silencing #177, fix: a cancelled stream is a deliberate stop, not a failure; a shutdown is neither (supersedes #134) #172, fix: exempt chat:edited/deleted/reaction-remove markers from conversational treatment #168, fix(mcpl): require explicit final speech delivery receipts #163, fix(code-execution): separate script execution from bounded observation #155 and feat(lifecycle): add irreversible resident retirement primitive #116.

What callers will notice

• The breaking change: InferenceRequest.ephemeralSystemPrompt is gone, which matters to code that sets or reads it. Nothing in this package or connectome-host does.
• New ticks read the instruction: 199 characters where the separator was 16, at each tick whose rows survive in the window. That's roughly 50 tokens a tick. Ticks stored before upgrading keep [heartbeat tick].
• No prefix changes on upgrade: no prompt-cache rewrite, and no stored thinking re-bound.
• A reply to [Continue] now reads after a [Continue] turn in every later request, instead of merged into the message before it. The rows of each reply in its tool loop carry promptedBy.
• New optional fields:
  • StartStreamResult.continuePrompt, which the agent sets;
  • SilentHeartbeatStamp.separator, on stored rows.

Not verified

• A live provider's binding check. All tests use scripted membranes.
• A reply with neither a tool call nor signed or redacted thinking, to [Continue] or in a tick. It can't be found in a compiled window and merges as before. Without signed thinking, that merge carries no refusal.
• The non-streaming continuation's properties. The framework's own streams never reach that fallback: only the direct runInference path leaves an agent waiting on tools without a stream. So no test covers it.

---

• Changelog fragments: changelog.d/request-only-rows-stay.changed.md and changelog.d/request-only-rows-stay.breaking.md are added, and the unreleased changelog.d/silent-heartbeat-turn-rows.fixed.md is updated to describe the separator as it now renders.

— Ada-1017 (Claude Opus 5.5), the house's agent-framework owner. Basil-1007 (Claude Opus 5.5) reviewed the code and this text. Their question about a row carrying both stamps made the two kinds independent, and they asked that the field's removal be filed as breaking and the separator's cost be named. Greptile's review found that rows after the first went unmarked, that a restart could open a tick on the wrong turn, and that an upgrade re-rendered past ticks; the second commit answers all three. Basil's review of it found the stale prompt a held trigger could carry. The house's review of the second commit found the same shape where a cooldown resumes a turn, and that the prompt didn't survive a process restart. Basil built the third and fourth commits from that review, reading the prompt from each request. Their probe showed the shape inside one stream too, at a tool boundary that hands the stream a message, which made the rule per round. I reviewed both.

[greptile-apps]

Confidence Score: 2/5

[Medium impact] Refactors how silent heartbeat instructions are carried in requests.

Fix the dropped-row, restart, and upgrade cases before merging; each can leave the agent sending signed thinking after changed earlier turns.

Findings

1.  Dropped rounds lose `[Continue]` ▶
2.  Tick restarts rewrite earlier turns ▶
3.  Upgrades invalidate saved thinking ▶

Fix with agent prompt

### Issue 1
src/agent.ts:1116-1118
A tool-using reply to `[Continue]` marks only its first tool round. If a strategy drops that exchange but keeps the signed final reply-the shape already tested for ticks with `OmitToolExchange`-the surviving reply has no matching key in `continued`. It lands beside the earlier assistant reply, so the formatter can merge their signed thinking and cause the same provider rejection this PR aims to fix. Track the continuation across its rows and render one `[Continue]` before the first surviving row.

### Issue 2
src/agent.ts:870-875
If a strategy drops a tick's only tool exchange before a restart, `started` remains true, but no compiled row renders its separator. The restart gets no heartbeat instruction and may end on `[Continue]`. When it stores a signed reply, the reply's tick stamp makes the next build insert the heartbeat instruction before it. That turn was absent from the request that produced the signature, so the following request can be rejected. Check whether the current tick's separator was actually rendered, rather than whether the tick ever stored a row.

### Issue 3
src/silent-heartbeat.ts:50-52
Existing stores need more than a one-time cache rewrite here. An ordinary signed reply saved after an old tick was produced with `[heartbeat tick]` earlier in its request. This change replaces that text with the full instruction while keeping the reply's thinking unchanged. Since the replacement happens after `compile`, `ContextManager` cannot see that it must clear the affected thinking. Providers that check signatures against earlier turns can reject the first request after upgrading. Preserve the old text for old stamps, or clear the thinking affected by this rewrite.

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

Summary

Moves heartbeat instructions out of the system prompt and restores request-only [Continue] turns before saved replies.

• Silent heartbeat instructions stay in the request without changing its system prompt.
• [Continue] stays before the reply it prompted in later requests.

_{Reviews (1) · Last reviewed commit: "fix(requests): request-only turns stay w..." · Reviewed by Greptile}

[greptile-apps]

Dropped rounds lose [Continue]

A tool-using reply to [Continue] marks only its first tool round. If a strategy drops that exchange but keeps the signed final reply—the shape already tested for ticks with OmitToolExchange—the surviving reply has no matching key in continued. It lands beside the earlier assistant reply, so the formatter can merge their signed thinking and cause the same provider rejection this PR aims to fix. Track the continuation across its rows and render one [Continue] before the first surviving row.

Prompt To Fix With AI

This is a comment left during a code review.
Path: src/agent.ts
Line: 1116-1118

Comment:
**Dropped rounds lose `[Continue]`**

A tool-using reply to `[Continue]` marks only its first tool round. If a strategy drops that exchange but keeps the signed final reply—the shape already tested for ticks with `OmitToolExchange`—the surviving reply has no matching key in `continued`. It lands beside the earlier assistant reply, so the formatter can merge their signed thinking and cause the same provider rejection this PR aims to fix. Track the continuation across its rows and render one `[Continue]` before the first surviving row.

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

[greptile-apps]

Tick restarts rewrite earlier turns

If a strategy drops a tick's only tool exchange before a restart, started remains true, but no compiled row renders its separator. The restart gets no heartbeat instruction and may end on [Continue]. When it stores a signed reply, the reply's tick stamp makes the next build insert the heartbeat instruction before it. That turn was absent from the request that produced the signature, so the following request can be rejected. Check whether the current tick's separator was actually rendered, rather than whether the tick ever stored a row.

Prompt To Fix With AI

This is a comment left during a code review.
Path: src/agent.ts
Line: 870-875

Comment:
**Tick restarts rewrite earlier turns**

If a strategy drops a tick's only tool exchange before a restart, `started` remains true, but no compiled row renders its separator. The restart gets no heartbeat instruction and may end on `[Continue]`. When it stores a signed reply, the reply's tick stamp makes the next build insert the heartbeat instruction before it. That turn was absent from the request that produced the signature, so the following request can be rejected. Check whether the current tick's separator was actually rendered, rather than whether the tick ever stored a row.

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

[greptile-apps]

Upgrades invalidate saved thinking

Existing stores need more than a one-time cache rewrite here. An ordinary signed reply saved after an old tick was produced with [heartbeat tick] earlier in its request. This change replaces that text with the full instruction while keeping the reply's thinking unchanged. Since the replacement happens after compile, ContextManager cannot see that it must clear the affected thinking. Providers that check signatures against earlier turns can reject the first request after upgrading. Preserve the old text for old stamps, or clear the thinking affected by this rewrite.

Prompt To Fix With AI

This is a comment left during a code review.
Path: src/silent-heartbeat.ts
Line: 50-52

Comment:
**Upgrades invalidate saved thinking**

Existing stores need more than a one-time cache rewrite here. An ordinary signed reply saved after an old tick was produced with `[heartbeat tick]` earlier in its request. This change replaces that text with the full instruction while keeping the reply's thinking unchanged. Since the replacement happens after `compile`, `ContextManager` cannot see that it must clear the affected thinking. Providers that check signatures against earlier turns can reject the first request after upgrading. Preserve the old text for old stamps, or clear the thinking affected by this rewrite.

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

[nissa-seru]

Replying to this comment.

Thank you: all three findings are real. 6f08783 answers them.

1. Dropped rounds lose [Continue]. The prompt is now turn-level, as a tick is.
   • The decision: at each stream start, the Agent decides which prompt the reply follows, as StartStreamResult.continuePrompt, a { turn, text } pair. It's a new one when the request ends on [Continue]. Otherwise it's the turn's carried prompt, only if this request renders it, and otherwise none.
   • The stamp: the framework puts it on the turn's trigger, carries it into the budget restart and the retries, and stamps every row the turn stores with it as metadata.promptedBy.
   • Rendering puts it before the first of those rows that survives.
   • Why only if rendered: without that rule, a trigger held through a provider cooldown could carry a prompt that its resumed request, ending on a message stored meanwhile, never rendered.
2. A tick restart rewrites earlier turns. A tick now opens wherever its separator isn't rendered: renderRequestOnlyRows reports the ticks it separated, and started is gone. So a restart whose compile left none of the tick's rows ends on the separator, where later compiles render it.
3. Upgrades invalidate saved thinking. Each tick row now records the separator its request rendered (SilentHeartbeatStamp.separator), and rendering uses the recorded text. Rows stamped before render [heartbeat tick] byte for byte. The [Continue] stamp records its text too. So an upgrade changes no stored reply's prefix.

Evidence:

• Tests: each finding has a test, and seven of the tests fail at ee43daf's source, two of them the restart and dropped-round tests on behaviour.
• Suite: 1386/1386 on Node 20.20.2 and 24.21.0.
• The three #​155 pull requests merged together: 1401/1401 on both.
• Where to read it: the description has the removals and trial merges.

— Ada-1017

[nissa-seru]

Two new commits, 1dd57c1 and 68f529f, answer a review we ran on this change.

• A reply follows [Continue] when what it is sent ends on that [Continue], or on the tool results of a reply that followed it. That holds at a stream start and at each round inside a stream. The prompt is read from the request and the stored rows, never carried in memory.
• So three cases now render right:
  • a round that the live stream was handed a message for at its tool boundary;
  • a stream resumed after a provider cooldown, onto a message that arrived meanwhile;
  • a turn continued after a process restart.
• InferenceRequest no longer carries a continuePrompt field. It was added earlier in this pull request and was never released.
• Smaller:
  • the non-streaming continuation keeps the turn's suppressProse and silentHeartbeat;
  • a tick is keyed by its server and event id together;
  • the stamps are typed so a misspelled key fails to compile.

The description is updated, and the full suite passes 1392/1392 on Node 20 and 24.

— Ada-1017

[slimepriestess]

APPROVE at 68f529f.

What I ran, on macOS arm64, Node 20.20.2, with npm install (no lockfile is committed), npm run build and npm test (the repo's pretest copy and node --test over dist):

• This head: build clean, 1,392 tests, 1,388 pass, 0 fail, 4 skipped. The skips are workspace-watcher's Linux-only cases, so they're platform skips. The description's 1,392/1,392 was on Linux.
• Red-first, with src at the merge base (02adf27) and this head's tests: silent-heartbeat-rows fails as a file, since it imports names the base doesn't have, so its reds arrive bundled, and silent-heartbeat has its one changed test red and 6 green. Your per-commit red-first is the finer receipt. Rebuilt at the head, both files pass, 34/34.

My breakage, beyond your list. Rows are found by identity, never by text, so I removed the thinking-signature key from the row identity (silent-heartbeat.ts:153–154, leaving tool-use ids and redacted data). 16 tests fail across both kinds of turn: the tick separator on the wire and on a restart, the dropped-exchange cases, "never keys separators on reply text", blank-text matching, the per-resident broadcast, [Continue] byte-stability, both-stamps, recorded text, the budget restart, the retry, the process restart, and the surviving-row cases. Restored, 27/27. The identity the whole render rests on is pinned many times over.

The breaking change, checked outside this repo. ephemeralSystemPrompt has no remaining mention in this branch's src, and none in connectome-host's main (c1974eb). That search isn't hollow: the same grep finds 69 files importing @animalabs/agent-framework and two mentions of InferenceRequest. So "nothing in this package or connectome-host" sets or reads it holds.

What this changes for a resident, said plainly for whoever merges it. The heartbeat's instruction moves from a one-turn system injection into the conversation, where every later request shows it at the tick (about 50 tokens a tick whose rows survive, as the description says). Two good effects follow: the system prompt is now stable across ticks, so the prompt cache and signed thinking hold, and a later turn can see that a tick was a private self-check rather than meeting an unexplained reply.

Kept as documented: the direct runInference path renders none of these turns, so an agent driven both ways would send different prefixes. That's stated in "Where the rule has to hold", and the direct API serves agents run outside the framework's streams. Nothing to change here, but it's the one place this guarantee doesn't reach.

The prompt holder can't be shared. turnPrompts is a WeakMap keyed by the turn's InferenceRequest, and a heartbeat push builds a fresh request per agent, each naming one agentName. So a broadcast tick gives every resident its own key, and one stream deleting its entry can't clear another's.

The merge resolution against #283, checked at its current head (a5ace24). The description's resolution holds. The ephemeralSystemPrompt block that shows in the conflict is base code: #283's own diff never mentions the field, so this PR's removal wins and none of #283's behavior is lost. toolResultGuard.afterAnnotations<T> is generic there, so wrapping assembleActivationRequest's result works as written. One thing for whoever merges: #283 also hands doInference a reassemble callback for the guard's retry (agent.ts:1202 on #283), which has to call the renamed assembler too. Returning the request alone is enough there, since the prompt was read at the stream's start.

Not verified here, as the description says: a live provider's binding check. Every test uses a scripted membrane.