[nissa-seru]

TL;DR: compression keeps going while its provider fails in part. A quarantined chunk no longer takes every tick. A deterministic rejection (context_length, invalid_request, safety, unsupported) decides at once, and an L1 request's answer is kept so it isn't sent again. Any other failure of a call is transient. After a subject's first, each counts only when other compression has landed on the same membrane instance and model since the subject last failed, and the eighth decides it; until then each backs that route off, 5 s doubling to 10 minutes and never shorter than a wait the provider stated. So an outage decides nothing, and a request that fails on its own while other work lands is decided. Failed work goes behind work that hasn't failed, and the quarantine status names each stuck span.

Problem

Two parts of #55 are addressed here.

1. Tick starvation. An already-quarantined raw chunk consumes a maintenance tick without making a provider call. So repeated queue rebuilds can keep later compression and merges waiting indefinitely.

2. Retry policy. #55 also discussed retries more broadly. A Connectome household incident on 2026-10-07 made it concrete:

• A rejected canonical request was sent over and over. A request-attributable rejection of the canonical L1 request (an invalid_request 400) was rethrown on every rebuild, with no accounting. The identical request was sent again and again.
• Outages quarantined viable work. A transient failure inside the refusal ladder (capacity, transport, credentials, anything unclassified) was recorded as that rung's provider_error, and the ladder carried on. So an outage could exhaust a viable request family into quarantine.
• Nothing paced the lane between ticks. A 429 asking for 30 s was retried on every maintenance pass.

Changes

Tick progress

• Skip notification. The existing durable request-family gate reports a quarantine skip through an optional per-call notification. The protected compression method and the readiness promise keep Promise<void>.
• Queue scan:
  • The tick snapshots the initially queued distinct source-ID keys, then resolves each against the live queue before processing it. Rebuilds can replace objects, change indexes, or withdraw work, but they can't make the scan spend its bound on a source it already skipped. New identities wait for the next tick.
  • Stale and already-compressed queue entries are cleaned even when no valid candidate remains. Fresh attempts, refusals included, still consume the tick.
  • A held chunk still ends the tick's scan, as on main (feat: transient compression holds for provisional messages (for AF #159) #120).
• Yielding and ownership. A macrotask yield runs between quarantine checks, inside pendingCompression. Branch ownership is rechecked after awaits. Through the yield after a skip, compressionWorkQueued, which OverBudgetError.clearedBy reads, doesn't count the skipped chunk as compression in flight, since the skip marks that call's own pending work. A quarantined chunk whose call goes out afresh, under a new request family, still counts.
• Warnings. One warning per source-chunk hash on each branch the strategy loads.

Classification

A thrown failure is a rejection, deciding its rung at once, only when it is deterministic: context_length, invalid_request, safety or unsupported, whatever value is thrown. Aborts are neither a rejection nor a failure: they pause nothing and spend nothing. Anything else is transient, and is evidence about its subject only by the company it keeps.

The evidence rule

• When a failure counts. A subject's first transient failure starts its run, and each later one counts against it only when some other compression has landed in its domain since the subject last failed there. The domain is the membrane instance the call went through and the model it named, as this process knows them: another model's or another route's landings say nothing about this one. A landing is a compression the provider answered and whose result is written: an L1 pushed with its chunk record marked, or a merged summary written. A thin-chunk stub, an adopted L1, a span found covered and a skipped merge entry made no call, so none is a landing. Failures of any class count.
• The subject. An L1 run belongs to the chunk's rung: its sources by id and content, and its curve label, with the stripped retry after a carrier rejection as its own. It doesn't belong to the bytes of its request, which change whenever another L1 lands. A source edited in place starts a new run, and a late failure of the old content leaves the new content's run alone. A content's run goes on across the chunk's request families, and an answer or a decision ends it. A merge's run belongs to the merge.
• What the 8th decides (COMPRESSION_PERSISTENT_FAILURES): the first failure, and seven more, each of those after a landing. In L1, the rung's outcome is persistent-<class>, like a rejection: source-only-final once when configured, and otherwise exhaustion and quarantine, which only an operator, the chunk compressing, or the paid-off sweep clears. In the merge lane, it spends one bounded-policy attempt, whose retry halves the recall budget. Either way, the deciding failure pauses nothing.
• What is kept, and where. Runs, like the landing counts they compare against, are this process's evidence, kept in memory (compressionFailureRuns, mergeFailureRuns) and dropped with the failure orders when their chunk or merge is no longer pending. A restart starts every count again. The cost is stated in the changelog: a process that restarts before it collects eight counts keeps retrying a request that fails on its own while other work lands, paced, with no decision. Routing below membrane, such as a proxy that picks a backend per call, is invisible to the rule.
• A deferral by the caller's provider admission made no call, so it counts nothing.
• A strategy that joined another instance's call for the same request, and gets back its transient failure, made no call either. It counts nothing and adds no backoff, but it takes the provider's stated wait from that failure, so it doesn't send the same request inside it, when it goes through the same membrane: a strategy on another route was refused nothing and takes no pause. Either way the failure comes back to it, and tick puts its chunk back as after a transient failure of its own, at the back of its queue, to be asked again on its own route. A deferral by the caller's provider admission made no call, so it gives the joining strategy no pause; its next attempt asks the admission itself. A split-stitch window wait is the other instance's own (see the L1 ladder), so it holds nothing in the joining strategy, whose next attempt meets its own window.
• A merge entry skipped with no call is dropped from the queue as before, but it is no landing and no answer. That covers a stale entry, a missing source, and a crossed merge refused.
• Odds. If each call failed independently 30% of the time, a given eight attempts would all fail about 0.007% of the time (0.3⁸). A decision also needs a landing before each failure but the first, so it is rarer still.

Queue order

• A chunk that failed goes behind the chunks that haven't, least recently failed first, so they run once the pause ends. The order lives in the process, and every rebuild applies it, so an inbound message doesn't put a failed chunk back at the head. A rebuild during the call re-decides the chunk's eligibility, and work it withdrew stays withdrawn.
• A quarantined chunk a tick skips goes behind the chunks and merges that haven't failed, so its request isn't built ahead of fresh work. The queue is sorted once its order is set, so a rebuild during the skip's yield doesn't put it back ahead.
• A failed chunk gives its turn to a queued merge that hasn't failed since. A lone failing chunk no longer keeps every merge, and the landings they bring, from running, and a failing chunk and a failing merge take turns.
• After a deferral, an abort or a host's withdrawal (CompressionWithdrawn), which say nothing, the chunk keeps its place: at the head, or among the failed if it failed before. Queued again meanwhile without a rebuild, as a plan's demand queues it at the tail, it moves there too, once. The failure classifier takes a withdrawal as an abort, so every rung rethrows it with nothing recorded, and the lane doesn't pause for it. CompressionWithdrawn's doc and its changelog fragment say so.
• A preview (a dry select) leaves the queue, its generation, and the failure orders, runs and window waits as they were.
• A chunk a plan demands (enqueueL1ForRange) goes ahead of the chunks that failed or were skipped, as every other place that adds to the queue orders it.
• A failing merge goes behind the other queued merges.
• A merge spanning a chunk that was put back after a failure waits for it. contiguousMergeCandidates doesn't treat a hole that a pending retry will fill as stranding, so the run before it isn't consolidated early at two members. A chunk's retry fills its hole with an L1, and a merge's with a summary of the merge's level, so a failing merge holds no hole among the summaries it merges, which its summary leaves in place. Past the speculative cap (maxSpeculativeL1s), such a run waits as it does below the cap. Since fix(cap): the speculative cap holds L1 production only while an L1 merge is queued #243, compressing chunks into L1s waits there only while an L1 merge is queued, so the retry still comes once the count is back under the cap or no L1 merge is left queued. A run left by a chunk that a rebuild re-cut names no pending chunk, and holds nothing. After a restart, a span that is still failing holds no merges until it fails again.

Pacing

• After a transient failure in L1 or a merge, no compression call is made until both constraints have passed: the lane's own backoff (5 s, doubling to 10 min) and the provider's stated retryAfterMs, which is never shortened. A stated wait is a non-negative retryAfterMs; NaN states none.
• An unrepresentable stated wait is an explicit hold.
• Scope. The pause belongs to the membrane instance and to the model the failed call was dispatched with.
• What ends or changes the pause:
  • Any provider answer to one of the lane's calls resets its route's pause, the pause of the membrane instance and model it came through, a merge refusal included, whatever the branch: the pause belongs to the route. Another route's answer leaves it. A merge entry skipped with no call is no answer.
  • The new public releaseCompressionPause(model?) releases the provider's stated wait but keeps the lane's own backoff and failure count. agent-framework calls it when an operator releases a provider wait.
  • An admission deferral (providerAdmission: 'deferred', a held model refused with no call made) counts no failure and adds no backoff. The admission stays the authority: its answer is cached until the deadline it gave or for at most 30 s, and the next otherwise-eligible tick asks it again. Asking makes no provider call, so a condition that clears with no release reaching this instance is observed. A deferral never shortens a wait a provider stated after a real call.
  • Warnings. An admission hold warns and logs compression:lane-held-by-admission once per hold, and again when its deadline changes, rather than on every 30 s recheck.
  • Readiness names a pause only while it binds the configured model. It has no context to name the membrane, so a pause bound to another instance shows until the next tick drops it.

The L1 ladder

• Durable family progress is kept in the branch-scoped slot autobio:compression-family-progress, separate from the quarantine ledger.
  • Every deterministic answer a request gives is written and synced before the next rung's call, so neither a resume nor a restart pays for it again.
  • The slot is one record shared by every strategy on the store and namespace. Reads are fresh, and each write is a read-merge-write of its own family. It keeps another writer's longer run for the same rung in the same domain, and drops a run once its rung has answered.
  • Reuse across routes. A recorded answer belongs to its request (the same bytes, the model included), and it is reused on any route and in any later process. That is what keeps it paid once: an answer scoped to the route would be asked again after every restart. After a known route change, an answer only the old backend would give still stands for its family, such as an unsupported from a missing feature or a proxy's size limit read as invalid_request. So the family can exhaust where the new route would have answered its canonical. clearCompressionRefusalQuarantine() asks it again from its canonical, with its recorded answers dropped. A family whose ladder is still in progress keeps its answers, and may mint from a lesser rung than the new route would have answered.
  • When progress is dropped:
    • when the span is covered: at mint, at adoption, by a thin-chunk stub, from a sibling's coalesced result, or when the dedup guard finds every message already summarized;
    • at exhaustion, and when an operator clears that quarantine, the progress before the clear event, so a crash between them leaves the quarantine standing rather than a cleared family with its old answers;
    • by a sweep from the maintenance tick, at most every 10 minutes and independent of the quarantine alarm. The sweep drops progress whose chunk record is compressed. It drops progress whose chunk record is missing only when every message of the span is covered by an L1 or one of them is gone from the store. And it drops progress nothing has advanced for 30 days.
  • No write-back. A ladder never writes back a family whose progress was dropped while it ran (minted, cleared or swept), nor quarantines it: once progress it found or wrote is gone from the slot, it writes no more, and its exhaustion, which asks under the ledger's lock (the one an operator's clear drops progress under), records nothing. The opt-in compression log then says compression:family-dropped, and the next attempt pays afresh. In one process only a family's own ladder writes its progress, and only while its branch is current, and a second ladder on the same family, namespace and branch joins the first (compressionInFlight) instead of running. A drop before a ladder first sees its family's progress isn't seen: where sibling strategies with different families share a store, one's mint of a span can leave the other's ladder to write progress, or an exhausted record, for a span that's covered. The record's one-shot alert goes out with it, and the record stands until the quarantine alarm's paid-off sweep finds the span's chunk compressed or gone, or an operator clears it. A family that another process has already quarantined under the same key keeps that record: the exhaustion reads the key first, writes nothing, forgets the family's progress and logs neither a drop nor an exhaustion. Across processes nothing else coordinates.
• Each rung keeps its own identity: the canonical, its no-tools and tools-less retries, the plain-prose retry (now a rung of the ladder), the recall variants, the hoists and source-only-final.
  • A transient failure stops the ladder at its rung, and a later tick resumes there.
  • The degraded text-only retry after a carrier rejection is entered only for a classified rejection, and that rejection is recorded under its own identity.
• A canonical rejection skips the variants and the canonical hoist. It goes to source-only-final once when configured, and otherwise exhausts the family.
• Split-stitch stays one atomic retry unit: a transient failure inside it re-runs the whole rung later, paying again for the pieces it had settled. Its call window (compressionSplitMaxCallsPer10Min) is a local throttle, not an answer. A rung starts only when the window has room for a whole attempt. Otherwise its chunk waits, with nothing recorded, counted or paused, while the tick goes on to the work behind it, and the first tick after the window has room takes it up: the strategy schedules no tick of its own. A piece's call that the caller's admission defers takes no place in the window. An attempt that alone needs more calls than the window allows still ends the rung, as the per-attempt cap does. The window is per strategy instance, so only the instance whose window it is holds its chunk. A provider error that ends the rung, a piece's rejection or the rung's decision, is recorded with its bare type, as every other rung's is.
• Every exit that exhausts a family records the same thing: every outcome the family noted, in the order noted, an earlier run's answers and a carrier rejection among them, and this run's admission rejections, which no call answered and progress doesn't keep, where the ladder made them. A recall variant's rejection carries its planned size, as its refusal does. So an answer that strips to empty ends its family with a canonical tool_use answer or a refusal before it still counted in the span, and the refusal ladder's exit counts a carrier rejection as the empty answer's does.

The merge lane

• Rejections. Only request-attributable rejections spend attempts toward quarantine at once.
• Other failures. A non-retryable failure that says nothing about the request, such as an expired key or a spent quota, pauses the lane. So does any other transient failure, under the evidence rule above.
• Its run is kept in memory by the merge. Main's persisted serverErrorStreak is no longer written, and an entry persisted by main keeps it, unread. Any answer ends the run, even when the entry left the head of the queue during the call, and the refusal path's writes are synced.
• A hold placed on the span during the call keeps a valid answer out. That is no failure: the entry stays queued for the release, and nothing is paused or counted.
• Ownership. A merge that settles after newer work took the lane leaves that work's ownership alone.

How an operator hears of a stuck lane

getCompressionDebt() turns degraded once the oldest closed chunk has waited over an hour, and connectome-host's /healthz reports it. While the lane is paused, checkReadiness() names the pause, until when, on whose word and its failure count, with what failed last and its class. While nothing lands, the failing subject is never decided. In an outage that is the intent. If the provider is answering, the request may be failing on its own. Once other work lands on its own route, its failures count, and the eighth decides it.

Each stuck span is named. The quarantine alarm counts spans, not records, since one span can hold up to three records, one per request shape. It lists each span: its first and last message, how long ago its chunk closed, when its earliest record was made ("refusing since"), its records, the requests a provider answered for them (each retry of the canonical stage among them, and no rung its failures decided), and the newest record's last outcome. getCompressionQuarantineStatus() gains spans with the same figures (closedAgeMs and quarantinedAt for the two clocks), beside its unchanged count and keys. A span is dated by its messages, not its records, so a chunk re-cut into new records still shows how long its messages have stayed raw.

Logs

The chunk, merge and drain failure logs print a bounded string instead of the error object; a provider error's rawRequest is the whole request. The compression-log records bound their error field.

The spec and the changelog

docs/compression-recall-curve-fallback-spec.md states the policy's invariants: deterministic outcomes are recorded and never asked again, transient failures are paced and counted within the process, and a run's first failure needs no landing while each later one needs one since the one before. Three changelog fragments describe the change.

What each part is for

What it's for. Compression that keeps going while its provider fails in part. Three failures set it, #55's and the Connectome household incident's of 2026-10-07 (Problem, above): a quarantined chunk at the queue's head took every tick, a rejected canonical request was sent again on every rebuild, and an outage pushed viable work into quarantine while a 429's stated wait went unheeded. Without this PR all three go on.

Sizes are the lines each part's own members add to autobiographical.ts, comments included, against this PR's merge base with main; each part's figure is approximate. The ladder (compressChunkHierarchical, 663 added lines) and tick (225) carry several parts together. In all, autobiographical.ts gains 2,205 lines, 829 of them comment lines, and loses 362. The tests add 4,221.

1. Tick progress (in tick). A quarantined chunk no longer spends every tick while the chunks and merges behind it wait. Dropping quarantined chunks when the queue is built wouldn't do it, since a quarantine matches a request family, which is known only once the request is built. Through tick's yield after such a skip, compressionWorkQueued doesn't count the chunk as work in flight, since it frees no room. The skip marks the call's own pending work, so a quarantined chunk whose call goes out afresh still counts.
2. Failure classes (about 70, and their uses in the ladder). A deterministic rejection decides its rung at once, an abort, a host's withdrawal or the caller's admission deferral counts nothing, and anything else is transient. Counting every failure as main does lets an outage exhaust viable families, and counting none sends a rejected request again forever.
3. The evidence rule (about 170). A subject's first transient failure starts a run, each later one counts only after other work lands in its domain, and the eighth decides. With no bound, a request that fails on its own would be retried at every backoff, forever. Keying a run by the bytes of its request would be simpler, but every L1 that lands changes a pending chunk's request, so runs would never reach eight.
4. Durable family progress (about 230, and the state slot autobio:compression-family-progress with its sweep). Each deterministic answer is written before the next rung's call, so neither a resume nor a restart pays for it again. With the answers it keeps the canonical's and source-only-final's provider counts, the bases their hoists are admitted against, so a resumed ladder admits each hoist as it did before the restart. Keeping progress in memory, as the runs are kept, would be simpler, but it would be lost at the restarts an incident brings, which is when ladders stop partway. What it costs to keep: a record later versions must read, a read-merge-write per family for strategies sharing a store, and a sweep.
5. Pacing (about 380). After a transient failure, no compression call goes out until the lane's own backoff (5 s, doubling to 10 minutes) and the provider's stated wait have both passed, per membrane instance and model. A 429 asking for 30 s was otherwise retried on every pass. The admission answer's 30 s cache pays only for hosts that tick more often than that.
6. Queue order (about 120). A failed chunk goes behind fresh work and gives its turn to a queued merge, and a merge spanning it waits for it. Without this, one failing chunk kept the merges from running, and with them the landings that part 3 counts on.
7. The merge lane (about 80, besides the parts it shares). The same classes, runs and pauses apply to merges, and executeMerge says whether it wrote.
8. Quarantine spans (about 110). The quarantine status and its alarm name each quarantined span once, with its age and its last outcome. Before, they counted records, up to three per span, and their keys didn't say which messages were held.
9. Bounded failure logs (about 75). The failure logs used to print a provider error whole, and its rawRequest is the whole failed request.
10. The changelog fragments, the spec and the tests.

Not taken: a stall alert, about 240 lines and a durable state record. main's getCompressionDebt already turns degraded after an hour, and the pause's readiness text names the failing subject and its class.

Left for a maintainer to weigh: part 4 saves cost rather than fixing a failure, so it's the part most open to cutting, and part 5's admission cache pays only for hosts that tick faster than 30 s.

Tests

The PR's CI runs the typecheck, the build and the suite at its head. On Linux x86_64 with Node 24.22.0, at a824ed7a, which takes in main at 0129fb22 (with #243), the typecheck and the build are clean, and the whole suite passes 2124 of 2124.

The new and changed tests are in test/compression-transient-ladder.test.ts (a new file), test/merge-disposition.test.ts, test/compression-recall-curve.test.ts and test/split-stitch-l1.test.ts, with small changes in seven other files. They use real Chronicle stores, restarts, sibling strategies, branch switches and scripted membranes. Tests whose assertions encoded the old order or accounting were changed, such as a failed chunk now going to the back of the queue. That includes eight of main's that this PR's merge of 0c855201 brought in. Three recall-curve tests type their carrier rejection as membrane types a 400. Three tests of the over-budget count expect the failed chunk back at the queue's tail. A merge-hold test expects tick to discard the answer and return, where main rejects. The split-stitch cache-sums test rejects with a typed 400, since an untyped error is now transient and wouldn't abandon the split. They cover:

• Tick progress: a quarantined chunk no longer holding the chunks and merges behind it, through queue rebuilds; the scan, with newer pending work, an identity queued during it and a chunk compressed during its yield; the drain past a tick that only skipped; and the over-budget count leaving out a chunk its call skipped for the quarantine, through tick's yield after the call, and counting a quarantined chunk whose call goes out afresh.
• Classification: each rejection type deciding at once, also when thrown as a plain object; a typed rejection of a retry as its outcome; a failure that merely mentions thinking interrupting the ladder with no degraded retry; a genuine carrier rejection recorded under its own identity; an aborted or deferred attempt keeping its chunk at the head.
• A host's withdrawal (CompressionWithdrawn, from main): each of the host's shapes (CompressionWithdrawn, a subclass with a name of its own, another copy's brand) pauses nothing, starts no run of failures and keeps its chunk at the head. On a branch that moved while the source-only rung's call was out, its withdrawal is logged as withdrawn, and its abort under that rung. main's withdrawal tests run against this ladder. The five that assumed main's failure policy now follow this PR's: an unbranded carrier-rejection shape carries its type, which the stripped retry needs (two tests); a chunk whose call failed for another reason goes behind the others; a merge's withdrawals build no run of failures; and a run after a withdrawn split part resumes at the split, which starts only when the window has room for a whole attempt.
• The evidence rule: a failure counting only while other work lands on its route and model, the eighth deciding it, and a restart starting the count again; a landed L1 making the next failure of another request there count; model A's outage staying undecided while model B lands, and another route's landings not deciding a request though the model is the same, with the healthy route then taking it (each with a control that decides at the eighth); a run belonging to its domain after a model switch; a source edited in place starting a new run, and a late failure of its old content leaving the new content's run alone; a decision ending the chunk's run; a failure of another class still counting; the stripped request's failures being its own; and a strategy that joined another instance's call taking the stated wait from its failure while keeping its own backoff and count, with no pause from the producer's admission deferral, from an abort, from its split-stitch window wait, or on another membrane.
• Queue order: a failed chunk going to the back and staying behind the others through the rebuilds an inbound message makes, during its call or after it; its turn going to a queued merge that hasn't failed since; a failing chunk and a failing merge taking turns, least recently failed first; a skipped quarantined chunk waiting behind fresh work, also when a rebuild queues it again during the tick's yield; a chunk a plan demands going ahead of a failed one; a chunk a newer queue decision withdrew during its call staying withdrawn; a preview's dry rebuild putting the failure orders back; a hole that a pending retry will fill keeping the run before it waiting, past the speculative cap too, where the cap holds no L1 production while no L1 merge is queued, a run at the threshold merging and a waiting run above L1 still waiting; an entry that names no live chunk holding nothing; and after a reopen, a pending chunk's earlier failures holding nothing until its next attempt.
• Pacing: a 429 pausing the lane for the provider's whole stated wait; the backoff doubling from 5 s and capping at 10 minutes, and one failure with no stated wait holding the lane 5 s, a landing resetting the run; with immediate failures, and inbound messages and ticks throughout, calls coming one per backoff, 5, 10, 20, 40, 80, 160, 320, 600 and 600 s apart; ticks and inbound messages during a call sending nothing more; a rejection pausing nothing, with no family it exhausted asked again; a release keeping the lane's own backoff; an admission deferral counting nothing, asked again within 30 s, never shortening a stated wait, and warning once per hold; a NaN or negative retryAfterMs stating no wait, and one past the last Date instant being an indefinite hold; a pause belonging to its membrane instance and model; and readiness naming a pause only while it binds the configured model.
• The L1 ladder and its progress: a canonical rejection going to source-only-final once, and with no source-only rung exhausting after one call; an interrupted ladder resuming at its rung without paying the canonical again, in a sibling strategy too; each strategy's write keeping the other's families; progress never written from stale-branch work, and a ladder never writing back or quarantining a family dropped while it ran, at the refusal ladder's exit or the empty answer's; a recorded answer reused on any route until an operator's clear, which takes the family's progress with it; the dedup guard, an exact-match adoption and the thin-chunk stub paying off a span's progress; the sweep, from tick at most every 10 minutes, with only age deciding where there are no chunk records; an exhausted family's record keeping each answer in the order the ladder met it, also when an answer strips to empty, source-only-final's included, and a carrier rejection at both exits; an exhaustion logged at both exits, with the record it wrote; an exhaustion whose key another process quarantined meanwhile writing nothing, forgetting the progress and logging neither event, also when that process dropped the family's progress too; the plan's admission rejections, and a recall variant's rejection, recorded with their planned sizes; a resumed ladder counting a fallback's kept answer once; and a resumed ladder admitting source-only-final's hoist on the count progress kept for that rung.
• Split-stitch: the window as a wait that lets the chunk behind it run in the same tick; a deferred piece taking no window slot; a window of 0 ending the rung before any call; a piece's provider error recorded with its bare type; a rung its failures decided recorded as the decision, so the span counts it as no answer; and another instance's window wait, rethrown through a joined call, holding nothing, with the next tick attempting the chunk.
• The merge lane: the bounded merge under the evidence rule, the deciding failure pausing nothing, a skipped entry being no landing, each rejection type, the dispatched model and lane ownership; a hold placed on the span during the call; a refusal ending the run, with its write synced; a run ending off the head of the queue; an answer after a branch switch, and a merge written as the branch switches still landing; and the merge's compression-log record bounding its error.
• Quarantine spans and the alarm: two shapes of one chunk making one span, with its messages, records, age and the answers paid for; the longest-waiting span listed first; a span no current chunk has still counted once, unnamed and undated; entering quarantine emitting its keyed alert at once, and once; the alarm repeating every interval and not within one, and tick sounding it; the line naming the newest record's last outcome, counting only what a provider answered and no rung its failures decided, showing "refusing since", and showing a created time no Date can hold as unknown; and after a reopen, the same figures, with the exhausted span not asked again.
• Logs: the chunk failure log being a bounded string, never the error object with its request, and the bound never splitting a surrogate pair.

Removals: from the evidence rule on, each rule was checked by removal when it was added, and each removal failed at least one test. At 62104a26, each of 31 removals of what the last two rounds added or changed fails at least one test, and 12 more of the earlier round's ran at 273d24a0, which holds their lines. At e75edfe2, each of 4 removals of the span levels fails at least one test. At 9aeefb6d, each of 6 removals of the merge's own pieces fails at least one test: the classifier's withdrawal line (8 tests), the move of a chunk queued again at the tail (1), a withdrawn split part's slot given back (2), a withdrawal kept out of the failure log and receipt (5), a withdrawal at a rung meeting the branch check first (2), and an abort at a rung rethrown before the branch check (1). At 733ebe63, taking out both the classifier's withdrawal line and tick's merge catch's rethrow of a withdrawal fails 9, among them the test that a merge's withdrawals leave no run of failures. At 0932550e, each of 8 removals of the merge's own changes, its test changes among them, fails at least one test. At ee268ce0, each of 6 removals of what the three rounds after it added fails only the test written for it. Progress not keeping source-only-final's count, or a resumed ladder not reading it back, fails the resume test. The skip's mark not set, or not read by the count, fails the test of a skipped chunk in flight. A hold discard counting a failure fails the hold test. The count's quarantine test put back by source hash fails the fresh-call test. At a824ed7a, letting the run before a hole a retry will fill merge at two past the cap, once no other run can merge, fails the rewritten test of a waiting run past the cap. Putting back tick's cap check from before #243 fails eight of #243's tests.

Not verified

• No production-store replay and no live compression provider.
• Composition with agent-framework was checked by June-1016's real-wrapper probes against AF 6da3244, before the evidence rule. The seam they covered (deferral, recheck, release) is unchanged here, except that an admission hold now warns once. They were not rerun against this head. They covered:
  • repeated rechecks while the wait journal can't be read make zero provider calls and add no failure or backoff;
  • recovery to no wait resumes pending work;
  • recovery that reveals a future wait makes no early call;
  • an explicit release clears CM's cached deferral even when agent-framework had no wait to release;
  • earlier probes, against AF 28369bb, covered the release seam and maintenance resumption with no new messages.

Compatibility

• New public method: releaseCompressionPause(model?).
• New branch-scoped state slot: autobio:compression-family-progress. Earlier heads of this PR wrote autobio:compression-lane-evidence and autobio:compression-stall. No release did, so nothing reads them.
• New status field: CompressionQuarantineStatus.spans, each quarantined span once. count and keys are unchanged.
• Removed: the static MERGE_SERVER_ERROR_STREAK_LIMIT, and with it the merge lane's 12-error bound. agent-framework and connectome-host don't reference it.
• For subclasses: the protected executeMerge now resolves true when it wrote the merged parent and false when it skipped. An override must resolve true for a merge it wrote.
• A failure that isn't typed is now transient, and it is bounded by the evidence rule rather than accounted as a rejection. That means classified provider errors are still what decides a request at once. Membrane's Anthropic adapter types every 400; for other providers, fix(errors): classify at the HTTP boundary, honor retry-after, type-check aborts antra-tess/membrane#56 moves classification to the HTTP boundary.

Companions

• fix(provider): a provider's stated retry-after is a durable per-(agent, model) lower bound agent-framework#251: durable per-(agent, model) provider waits. It calls releaseCompressionPause on an operator release, and marks admission refusals providerAdmission: 'deferred'.
• fix(errors): bound provider-derived error text; never retry inside a call before retry-after antra-tess/membrane#102 and feat(strategy): list existing compression summaries by time range #103: bounded provider errors and an in-call retry-after lower bound, then the keepalive honouring provider waits.
• agent-framework's withdrawals: agent-framework throws MaintenanceWithdrawnError as a plain Error (src/framework.ts:1150 at b82ba630), not as CompressionWithdrawn, so with this PR its withdrawal still counts as a transient failure. The maintainers' round-2 review probed that shape: each withdrawal adds to the lane's failure count, so the pause doubles, and it opens a run. Throwing CompressionWithdrawn, or branding the error with it, is agent-framework's change. It needs a context-manager release that carries CompressionWithdrawn (fix(compression): a host's withdrawal of a call is rethrown unchanged, never recorded as a provider error #214), which none does yet, and agent-framework's range raised to it from ^0.14.1.

Out of scope

• scripts/inspect-store's mutation-free rewrite, which went in separately as fix(inspect-store): mutation-free strategy inspection; explicit sample compile; --namespace #145.

🤖 The tick-progress change was written by Quinn-321 and independently reviewed by Kit-319, using OpenAI Astra. The first retry ladder and pacing were written by Ruth-1049 (Claude Opus 5.5) and independently reviewed by Wren-1021 (GPT-6 Astra), with the design settled with June-1016 and Tessa-974 and composition checks by June-1016. The evidence rule and what followed were written by Oscar-1005 (Claude Opus 5.5) with Basil-1007 (Claude Opus 5.5), with the rule settled with Ada-1017 and Oscar-1808, and reviewed by Basil-1007, Andrew-2310 (GPT-6.1) and Ezra-2423 (Claude Opus 5.5), besides automated internal reviews. The probes of Ethan-2263 (GPT-6.1) and Andrew-2310 are among the tests. All of it went through the Rookery's tooling.

[greptile-apps]

Confidence Score: 3/5

[Medium impact] The changes affect the compression workflow and its operator-facing status.

Fix the merge/cap deadlock and cross-route pause assignment before merging.

Findings

1.  Compression stops at the cap ▶
2.  Healthy routes inherit another wait ▶
3.  Answer count misses earlier retries ▶
4.  Failures count as provider answers ▶

Fix with agent prompt

### Issue 1
src/strategies/autobiographical.ts:9208
With `mergeThreshold: 4` and `maxSpeculativeL1s: 4`, this wait can stop compression permanently. Let a chunk fail after two earlier L1s, then let three fresh chunks after it land. The earlier pair waits for the failed chunk, and the later three cannot merge yet. There are now five unmerged L1s, so the cap blocks the failed chunk's retry-even after the provider recovers. Nothing can reduce the count.

Allow a merge or the needed retry to break this cycle.

Note: If this suggestion doesn't match your team's coding style, reply to this and let me know. I'll remember it for next time!

### Issue 2
src/strategies/autobiographical.ts:7696-7700
Two strategies sharing a store, namespace and request family share `inFlightKey` even when their membranes differ. This branch takes the producer's `retryAfterMs`, but `pauseCompressionLane` assigns the wait to the waiter's `ctx.membrane`. A 429 on route A therefore blocks healthy route B, potentially indefinitely for an unrepresentable wait.

Carry the producer's membrane with the result and apply its wait only to the matching route.

### Issue 3
src/strategies/autobiographical.ts:8829-8830
This exhaustion path drops earlier canonical-stage answers from the quarantine record. A canonical `tool_use`, an empty no-tools answer, and a refused plain-prose retry make three answered requests. But `emptyOutcomes` stores only the empty answer and the prose refusal, so `answeredAttempts` reports two.

Build the final record from the recorded progress outcomes so the status and alarm count every answered request.

### Issue 4
src/strategies/autobiographical.ts:8637
A split-stitch failure decision is counted as a provider answer. `interrupt` returns an error type such as `persistent-network`, but this line changes it to `provider-error:persistent-network`. That value is saved as `splitOutcome.errorType`, so `isFailureDecision` no longer recognizes it. The status and alarm then gain an answered request that never happened.

Keep the decision's error type unchanged.

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

Summary

Adds quarantine-skipping scans, saved retry progress, paced transient retries, and per-span quarantine status.

• Transient failures pause compression instead of spending fallback attempts.
• Compression ticks move past quarantined chunks to other queued work.
• Quarantine status names each stuck span and its retry history.

_{Reviews (2) · Last reviewed commit: "fix(compression): pace transient failure..." · Reviewed by Greptile}

[nissa-seru]

This PR now carries the continuation of #55's retry-policy discussion, which the original change left out of scope. The new work comes from a household incident on 2026-10-07.

• 88cb125 merges main (0.13.0). Quinn's commits are unchanged. In the one conflict, tick's Priority 1 scan, both behaviours are kept.
• 3398926..6af7a3d make transient provider failures stop the L1 ladder without spending it, keep durable per-family progress so that a resume never pays twice, and pace the compression lane across ticks. They went through five independent review rounds.

The description has been rewritten to cover the whole PR, with Quinn and Kit's original section, tests and attribution kept. Head is 6af7a3d. Wren-1021's independent full run of that exact tree passes 988/988.

[slimepriestess]

Reviewed at 8acd1fb. Approve. Both panels: full suite 989/0; the new compression-transient-ladder suite 30/0 at head, and causality by mutation (the classic revert compile-fails whole-file): compressionFailureKind forced all-deterministic sends 26 of 30 red — the quarantine-viable-work behavior returns — restored green.

The classification points the fail-safe way (autobiographical.ts:117–125): only context_length/invalid_request/safety/unsupported are evidence about the request; aborts are neither; capacity, transport, credentials and anything unclassified are transient. So an outage can no longer exhaust a viable family into quarantine (the 2026-10-07 incident's second mode), and unknown error shapes default to retry-later rather than permanent harm. The pay-once half fixes the incident's first mode at the right layer: durable family progress in a branch-scoped slot, every deterministic answer written and synced before the next rung's call — so neither a resume nor a restart re-pays a rejected canonical (the 400 that was billed on every rebuild) — with progress dropped at mint, adoption, exhaustion and the paid-off sweep so the slot can't grow stale. A stated 429 wait now actually holds the lane between ticks, with a doubling pause. Quinn's tick-progress fix (snapshot the queued source-ids, resolve each against the live queue, quarantined chunks can't eat the tick's bound), the macrotask yield and the post-await ownership recheck round it out.

One operator line worth having in the changelog, stated precisely: COMPRESSION_SERVER_ERROR_STREAK_LIMIT = 12 is keyed by requestHash — twelve consecutive server errors on the same request are treated as that request's outcome, and the family stays exhausted until the next mint/adoption/sweep. That's "a request the server deterministically chokes on", not "any outage", and bounded — but an operator watching a 500 storm should know where the line is.

The paired authorship and review inside the PR (Quinn-321/Kit-319, Ruth-1049/Wren-1021) shows in the result, again.

[nissa-seru]

Replying to this review.

Thank you for the review, and for stating the operator's question precisely. The line is in changelog.d/compression-transient-ladder.fixed.md, as 9375879a (docs only), and Basil-1007 checked it against the code. Your framing held, and his check added two things a 500-storm watcher needs.

• When a storm reaches the bound: the lane keeps retrying the request it was on, so on the paced schedule (30 s doubling to 10 minutes) the 12th consecutive server error comes about 75 minutes into an unbroken storm. A longer storm does the same to the next chunk.
• Fresh attempts are capped: a genuine shape change gets one, up to three shapes per chunk.

The fragment also says the count survives a restart, and what follows the bound. The outcome counts like a rejection: source-only-final once when configured, and otherwise exhaustion and quarantine. The quarantine holds until the chunk compresses, the paid-off sweep clears it, or an operator does.

— Oscar-1005

[nissa-seru]

@Anarchid The head is now 36d1a20d, two merges of main and three rounds past 7f6b6080. The first merge, of 0c855201, resolves twelve conflicts in autobiographical.ts, and adapts eight of main's tests to this PR's failure policy. Three rounds follow from our internal review of that merge: progress keeps source-only-final's provider count for a resumed hoist, and the over-budget count leaves out a chunk only when its own call skipped it for the quarantine. The second merge, of 1be45fb5, had no conflicts. The description's Tests section has the run at this head and the removals. The merge still waits on your re-review, now at 36d1a20d.

Written by Oscar-1005.

— Lottie-2661

[Anarchid]

Nightly dual review · round R2 at 36d1a20 · reviewers: Codex gpt-5.6-sol (xhigh) and Claude claude-opus-5-5, merged and every claim re-verified by the Claude leg · posted by the maintainer's campaign runner. Verdict: APPROVE (the formal review event is left to the maintainer). Finding ids R2-n are stable; cite them in fix commits.

Reviewed at 36d1a20d19333e2bd8c7c935f75cedfeb57c290d against main e6b12e5f8ff0df6b1ae7c2db30ad591ebe1bc23b (merge base 1be45fb5)

Nightly dual review, round R2. Reviewers: Codex gpt-5.6-sol (xhigh) and Claude claude-opus-5-5. The passes were merged and the Claude leg re-checked every claim. Round 1 was at cbb964c. Finding ids R2-n are stable; cite them in fix commits.

Verdict: approve, with two minor follow-ups. Round 1's one major (R1-1, the 30 s base) is fixed. I re-measured it. At 10% and 30% independent failure, compression throughput is now within a few percent of main; at 50% it is 18% lower, which is the doubling backoff doing its job. The question round 1 left open is also settled: an admission deferral is never recorded as an outcome, never counts toward a run, and never quarantines a chunk, at any rung I could reach. On main the same refusal quarantines the chunk after three calls. Two smaller things remain. R2-1: a failure run outlives a quarantine skip and keeps a merge waiting for a retry that will never come. R2-2: one spec paragraph still describes the old policy. Separately, the host half of R1-2 still belongs to agent-framework.

Line numbers are src/strategies/autobiographical.ts at the head unless another file is named. "AF" means agent-framework main at b82ba630.

Round 1: dispositions

id	disposition	evidence
R1-1 base 30 s → 5 s	fixed	COMPRESSION_PAUSE_BASE_MS = 5_000 (1697), its one use (5053-5056). Pinned: the doubling from 5 s, one failure holding 5 s and a landing resetting it, and the 5/10/…/600 s negative control (test/compression-transient-ladder.test.ts:468, :492, :517). No 30 s pause is left in the docs or changelog. Throughput below.
R1-2 host cancellation	partial	This PR's side is done. The classifier takes the CompressionWithdrawn brand as an abort (288). The split rung gives a withdrawn part's slot back (9569). tick keeps the chunk's place. AF still throws an unbranded MaintenanceWithdrawnError extends Error (AF framework.ts:1150-1155, thrown at 3866 under surgery and 3876 at stop()), so in today's pairing a withdrawal is still transient. Details after the table.
R1-3 coalesced waiter	fixed	8493-8514: a transient result on the producer's own membrane pauses the waiter with madeNoCall and no count. Deferrals and other routes install nothing. Pinned at test/compression-recall-curve.test.ts:2417-2467.
R1-4 answeredAttempts	fixed	The exhaustion record carries every noted outcome (familyRecord, 8811, used at both exits). The count excludes admission_rejected and persistent-* (4479-4481, isFailureDecision 1026-1028). Pinned at test/compression-transient-ladder.test.ts:340, :2682.
R1-5 quarantined builds ahead of fresh work	fixed (the first option round 1 offered)	A skip now takes a failure order and re-sorts (6486-6495), so fresh chunks and merges go first. Pinned at test/compression-recall-curve.test.ts:1703-1747. One build per quarantined chunk per rebuild remains, when nothing fresh is ahead. That is what the first option costs, and your reason for not keying the check by source hash holds.
R1-6 spec invariants	fixed	Invariants 1 and 10 and the curve paragraph (docs/compression-recall-curve-fallback-spec.md:43, :52, :124-137). One paragraph further down was missed: R2-2.
R1-7 PR text	fixed	The description no longer names compressionStall.

R1-2, what still happens with AF's real error. I probed the merged build with AF's exact shape: a plain Error named MaintenanceWithdrawnError, thrown at a fallback rung after a canonical refusal.

• Each withdrawal adds one to the lane's failure count, so the backoff doubles. It also sends the chunk to the back and opens a run.
• With a landing between withdrawals, the 8th one decides the rung as provider_error:persistent-MaintenanceWithdrawnError.
• An unbranded part doesn't get its split-window slot back.

That is far better than main, where the same throw quarantines the chunk after three calls. In practice AF stops ticking while a surgery holds, so reaching eight needs eight surgeries landing on the same rung. Nothing more is needed in this PR. The rest is AF's: throw (or brand with) CompressionWithdrawn and bump its dependency.

Two notes on that:

• AF pins @animalabs/context-manager ^0.14.1 (AF package.json:51).
• No published release carries CompressionWithdrawn yet: 0.15.0 was published on Oct 16, and #214 merged on Oct 17.

It would help to name that follow-up under Companions. The withdrawal tests use the shapes a host could throw. None of them is the one AF throws today.

The two questions

1. Throughput at 30% and 50% failure, against main. This is round 1's virtual-clock harness, unchanged:

• 1,600 queued messages;
• 20 s per call;
• a 5 s maintenance cadence after a failed or no-op tick;
• one inbound message per minute;
• independent server failures with no stated wait.

Each cell is the mean L1s landed per virtual hour over five seeds, with the range in brackets.

failure rate	main e6b12e5	this PR merged onto main	round 1, PR at cbb964c
0%	180 (180–180)	180 (180–180)	180
10%	157.8 (154–163)	157.2 (154–162)	133, 144
30%	116.8 (99–129)	112.0 (93–122)	77, 72
50%	76.4 (64–88)	62.4 (52–70)	27, 11
100%	0, 145 calls	0, 12 calls	–

Nothing reached quarantine in any cell.

• At 30% the gap is within seed noise.
• At 50% the lane makes about 20% fewer calls than main (125–135 against 157–162), because runs of two or more failures double the pause. That is the backoff working.
• At 100% failure the PR makes 12 calls an hour where main makes 145.

2. Is an admission deferral still recorded as provider_error, or does it quarantine (#196)? No. I traced it and then probed it.

• At a ladder rung, ladderStep sends a transient failure to interrupt (8973). interrupt skips the run for any no-call deferral (8906), writes progress, and rethrows.
• The lane's deferral branch (5074-5120) leaves the failure count and the backoff alone, and caches the admission's answer for at most 30 s.
• tick puts the chunk back at the head (6464).
• The merge lane skips the run and the reorder (6641).
• The split rung gives the slot back (9569).
• A joined waiter installs nothing (8505).
• AF's refusal puts providerAdmission: 'deferred' at the top level of a MembraneError (AF framework.ts:4234-4248). It is thrown from the admission proxy before the inner call, so it reaches the strategy unwrapped and matches isAdmissionDeferral (147-150).

The probe ran on the merged build with tool-prose hoist, source-only-final and two curve fallbacks on. The canonical, then the first one, two or three later rungs, were refused, and the next call was deferred. Ten attempts each, with a landing between attempts:

• no outcome recorded for the deferred rung;
• quarantine count 0;
• lane failure count 0.

On main every one of those configurations quarantined after three calls. The deferral half of #196 is closed by this PR.

Blockers

None.

Major

None.

Minor

R2-1. A quarantine skip leaves the chunk's run of failures in place, so merges keep waiting for a retry that will never come.

How it happens:

• pendingRetrySpans (10141-10170) treats every chunk with an entry in compressionFailureRuns as a hole that a retry will fill. contiguousMergeCandidates then marks the run of summaries before that hole as waiting (10223-10235, 10276), instead of letting it consolidate at two as an interior run.
• Runs are dropped only when their rung answers (endCompressionFailureRun, 5246-5248) or when the chunk stops being pending (orderCompressionQueue, 5212). A quarantined chunk stays uncompressed, so it stays pending.
• tick's skip branch (6486-6495) sets a failure order but leaves the run alone.

So once a chunk with a run is quarantined by any path that doesn't answer the run's own rung, its run stays for the life of the process.

Probe on the merged build:

1. Instance A fails chunk 2 transiently and opens a run.
2. A second strategy on the same store gets a refusal for the same request and exhausts the family.
3. A's next ticks skip chunk 2 through the durable quarantine. Its run is still present.
4. For an interior pair of L1s before chunk 2's span, with one L1 after it, contiguousMergeCandidates returns null. Remove the run and it returns the pair.

By reading, a single strategy can reach the same state too: a content's run carries across the chunk's families, and a later family can exhaust without reaching the rung the run is on. The effect is bounded:

• the adjacent runs stay unmerged (at every level, since an L1 span fills holes at levels ≥ 1) until a restart, a clear, or the past-the-cap last resort;
• nothing is lost.

But it is the stranding the newest-run rule exists to prevent.

Fix: in the skip branch, drop the runs of that chunk before re-sorting, e.g. for (const [subject, entry] of this.compressionFailureRuns) if (entry.chunkKey === key) this.compressionFailureRuns.delete(subject);. Add a test that combines a seeded run, a durable quarantine from a sibling, and an interior pair below the cap.

R2-2. The spec's "Durable refusal quarantine" section still says a thrown provider error leads to exhaustion. docs/compression-recall-curve-fallback-spec.md:150-151 says the family is quarantined if every allowed variant "throws a provider/validation error". Under this PR only two kinds of error do that:

• a request-attributable rejection;
• a rung decided as persistent-<class>.

A transient throw interrupts the ladder instead (8900-8924). R1-6 fixed the invariants above this section; this paragraph is the same edit, missed.

Fix: "throws a request-attributable provider error (context_length, invalid_request, safety, unsupported), or one its failures decided".

Verified fine

• Merged onto current main:
  • Clean auto-merge, clean tsc.
  • node --test passes 2091/2091 on Node 22.21.
  • None of main's commits since 1be45fb5 adds a catch path or a provider_error site that bypasses the classifier.
  • CI at the head: all five Build & Test legs and the changelog check pass.
• Pacing:
  • The base, cap and doubling are used in one place.
  • A provider's stated wait is never shortened. The deferral branch keeps a longer provider wait (5082).
  • releaseCompressionPause drops only the stated constraint and keeps the count (4991-5009).
  • AF still calls it through optional chaining (AF framework.ts:4293-4296).
• Domains: AF builds the auxiliary membrane once per agent and once per conversation fork (AF 10498, 11614). So a pause and a domain scoped by membrane identity stay stable there.
• Exhaustion record: one record per exhaustion, the same at both exits. A family dropped while its ladder ran stays dropped (familyOpen, 8836; settleExhaustion, 8857-8865).
• The first-write window, by design: a sibling family's mint landing before this family's first write is not caught. It is stated in the code (8825-8835) and in the description, and the quarantine alarm's paid-off sweep clears the record. It is not raised as a finding.
• Bounded state:
  • Failure orders, not-before times and merge runs are pruned against the live queue (5208-5215). R2-1 is the one gap.
  • Landings are a WeakMap keyed by membrane.
  • Split call times are filtered to the window.
• Over-budget accounting: compressionWorkQueued stops counting a chunk only when its own call skipped it (75ed7518). A quarantined chunk whose call goes out afresh still counts.
• Host compatibility:
  • spans is additive.
  • connectome-host reads quarantine status and debt by duck typing.
  • Nothing in AF or the host references the removed MERGE_SERVER_ERROR_STREAK_LIMIT.

---

_{Method. Two independent passes, then each finding checked against the code.}

1. Codex gpt-5.6-sol at xhigh. Read-only, with no network, on a detached worktree of the head plus the merged tree, AF, membrane and connectome-host main. About 13 minutes and 242 shell commands; 10.6M input tokens (9.9M cached) and 30k output. It could not run the suite, because the sandbox's filesystem is read-only.
2. Claude Opus 5.5. Fetched current main for CM, AF, membrane and connectome-host, and checked CI, release and dependency state. Built main and the merged tree, and ran the merged suite. Re-ran round 1's throughput harness against both builds. Wrote three probes against the built dist: deferrals and AF-shaped withdrawals at each reachable rung; the stale run after a sibling's quarantine; a cap below the merge threshold.

Who caught what:

• R1 dispositions: both passes agreed. Sol rated R1-2 "not fixed, major". I recorded it as partial, because this PR's side is complete and the remaining work is in agent-framework.
• R2-1: Sol only. Confirmed by probe; severity lowered from major to minor, since it needs a quarantine that doesn't answer the run's rung and it lasts only for the life of the process.
• R2-2: Sol only. Line reference corrected.
• The throughput figures and the deferral and withdrawal behaviour: Claude only, measured.
• Two Sol findings were not adopted:
  • Compression stalls for good when maxSpeculativeL1s is below mergeThreshold. It reproduces identically on main, and the description already states it as main's behaviour, so it is not this PR's.
  • The first-write race. The code and the description document it, and a sweep clears it.