[nissa-seru]

Since 80a3dd22

• affb3a48 merges feat: compile provenance, rendered layouts and fold receipts at accepted rounds #146 at 03ad9ae6, which carries main through 1566b3a0. It merged without conflicts. feat: compile provenance, rendered layouts and fold receipts at accepted rounds #146 has one docs commit since, 54d916b9, which this branch doesn't carry.
• A released view now keeps main's listing memos warm (ad9e6764, 72dcca5e). The store hands out one listing from getAll while nothing is written, and main keys four memos on that listing's identity: the store order and its position index, the chunk by position, the post-strip estimates, and salience by position. Once a branch had released thinking, the released view mapped a fresh array on every getAll, so all four missed every time. One select after one release made 13 different arrays, where the store hands out one. The view now memoizes the listing it maps, per source listing, under the release state it was last mapped in, so the memos stay warm while nothing is written or released. A manager's merged view over auxiliary stores builds a fresh listing on every call, released or not, and that is unchanged.
• One estimate to know about. In the compile where the binding first strips some thinking, the kv-unified draft was built before the strip, so the cache reference recorded at acceptance holds offsets from before it. That one plan's cached-token estimate is high by the stripped tokens. From the next compile on, the draft leaves that thinking out too. If the strip empties a message, the marker counts differ and no reference is recorded, which is safe. We're noting it rather than changing it.

Since 61b50548

An automated review of this PR's first two commits found 26 issues. This round answers them, adds a compile option for models that don't bind thinking to its prefix, and merges #146's current head. The later commits answer the reviews of the round.

• The merge, 0ea26b93. It brings feat: compile provenance, rendered layouts and fold receipts at accepted rounds #146 at 13e6208b, which carries main through 01a697e8. One file conflicted, src/context-manager.ts. fix(autobiographical): a dry compile leaves what a select leaves behind as it found it #161 landed in between, and since then a dry select puts back the calibration estimate the last committing compile made. So a dry compile no longer tells the strategy what the pass stripped, which would have subtracted a dry run's strip from a real compile's estimate.

• SelectOptions.bindsThinking, default true. We probed with drop_block, replaying a block under a changed prefix. Opus 5.5, Haiku 5.5, Sonnet 5.5 and Fable 5.1 dropped it. Fable 5 and Sonnet 5 kept it and counted its tokens. For a target that keeps thinking, stripping gains nothing and costs retained thinking and the live window's recall carriers. With the option false, a compile strips nothing, and stamping goes on, so a later compile for a target that binds finds each reply's stamp. It brings back nothing the branch has released, whether the pass or the host released it. The host sets it from what it knows of the model.

• The manager tells the strategy per compile. It calls noteThinkingBound(bound) before each compile's select, with whether that compile's thinking is bound, rather than once at initialization and at acceptance. So AutobiographicalStrategy's live window follows the target, and a reused instance renders as configured on a store with no accepted round. A dry compile tells the strategy its own value, then puts back the value last told.

• Other writers in a shared slot. Managers of different namespaces that aren't isolated share the default message slot. The walk used to read another writer's message, stored while a round was out, as if the live request had carried it, and the provider would then refuse the reply's thinking. Now the walk takes only what its own namespace's managers stored as carried. A compile that renders another writer's message differs from the walk at its head, so the fence holds the replies after it until that compile is accepted. The pass can't tell apart the messages stored before this process opened the namespace, so it takes them as carried.

• A reply stored on another branch than the latest compile was bound on (a branch switched while the round was out) gets a stamp nothing matches. The walk used to stamp it from the new branch's chain, which can match.

• A fork, or a branch made at a message, starts with the releases of the branch it was made from, so a block the provider refused there isn't sent again. The new branch's first accepted compile records them.

• A dry compile's provenance carries dryRun, and acceptRound refuses it with a warning and records nothing. It used to write the fold receipt and engage the pass while the binding ignored the compile.

• A message the strip empties is dropped, as before. Its cache breakpoint now moves to the message before it, if there is one, since that message ends the same prefix.

• b509ed3b keeps the noted writes bounded for a host that never accepts a round. Each bind forgets the writes no walk can read again. Those are the writes at or below the owner's head, or, while the branch has no owner, at or below the lowest head among its remembered compiles, any of which could become the owner.

• d5889edb keeps released thinking released for a compile that doesn't bind, whatever its target. A host's release marks a block the provider refused. Restoring the pass's releases would cost two cache rewrites per switch and back. And every read of the branch, budgets and ticks included, shares one view. A test checks it.

• 2e7037b7 answers an automated review of the round. Initialization tells the strategy whether the namespace is engaged, so a dry compile before any committing one, or with a strategy new to its manager, puts back the right value. A dry compile's restore also covers the reads between telling the strategy and selecting. The texts now state the pass's limits: rounds that overlap a branch switch, what the noted writes' floor assumes, that engagement is the namespace's, what a reopen loses, and a first message's cache breakpoint.

• d04b531f, 6911c725 and b72517e9 answer two colleagues' reviews of the round. Initialization runs on open, on setStrategy and at every branch switch. It now tells the strategy the namespace's engagement for the last committing compile's target, and it assumes a target that binds before any compile. So a fresh strategy gets the engagement, a target that doesn't bind stays unbound across a switch, and a switch after the store's first acceptance binds. The tell also runs inside the try whose finally puts a dry compile's value back, so a strategy hook that takes the value and then throws still leaves the strategy as the dry compile found it.

• 80a3dd22 corrects the texts on a late reply. A reply whose round overlapped a branch switch, or one stamped again after a reopen over an edit made in that window, doesn't send its thinking only once, as they said. It can go out with every compile that sends the same prefix before it, refused or dropped each time, until the host releases it.

• Texts. They now say four things:

  • the walk reads each message once, as it stands then, so an edit after that is a change;
  • what a reopen loses;
  • the system prompt and tools are in the seed only with prefixIdentity;
  • a released message's later replies lose their thinking only at a compile whose thinking is bound.

  thinkingStripped's doc says it counts what the pass removed, and the changelog names acceptRound's sync.

• Three findings got a different answer, with reasons in the review's verdicts:

  • Releasing at acceptance rather than at bind. What the pass strips follows from what the store renders, which the round's outcome doesn't change.
  • Resetting the walk on an edit. A message edited while its turn is out (an edited Discord message) would then stamp a reply minted before the edit with the edited text.
  • Making stamps and fences durable when they're made. That takes a record per reply or per compile, for a restart window the text states.

Problem

In #155, on an account that enforces thinking binding, Anthropic refuses a signed thinking block once anything before it has changed since it was minted. The refusal is a 400, "The block is bound to a different conversation", or a silent drop under drop_block. A compile that folds, merges, caps, strips an image or releases a raw form changes the prefix of every reply after the change. So the reporter's resident got a 400 on every turn after its first fold.

This is context-manager's part of the design agreed on #155 (the design, its correction, and the reporter's answers to the three decisions it left open).

Changes

A pass in compile() (src/thinking-binding.ts) runs over the final messages, injections included. It covers every strategy without knowing which rewrite did what.

• Chain. The pass keeps a digest over the compiled messages in order, seeded with SelectOptions.prefixIdentity (new, the host's identity for its system prompt and tools) and the system injections the compile returns.
• Stamp. Each stored message with thinking gets, once, when it is stored, the seed, the chain before it, and a digest of each of its blocks. (A reply the fence below holds back gets its stamp at the first walk after the compile that fenced it is accepted.) The chain comes from the branch's last accepted compile, extended by what this namespace stored after it, which is what the live request carried. The walk reads each of those messages once, as it stands then, at the next compile or when a later reply is stored. A bundled tool cycle, which a compile splits into parts, gets a chain for each part. The walk doesn't take another writer's messages as carried. It skips an auxiliary slot (auxiliaryMessageViews), and passes over what another namespace's manager stores in a shared slot while this process runs.
• Fence. A compile sent after the last accepted one, whose acceptance isn't in yet, may have sent something else, such as a heartbeat's system prompt or a cap the next compile doesn't repeat. A reply minted under it mustn't be stamped as if it followed the accepted one. So the walk passes such a compile only when the compile's chain at its head is the walk's. At one that isn't, the walk stops, and the replies after it wait for that compile's acceptance, which makes it the chain the next walk stamps them from. If a compile sent later is accepted first, they lose their thinking for good.
• The host's part is stated in acceptRound's doc. The pass takes what a host stores through this namespace's managers after a compile, up to a reply, as what the round's request carried after the compile's messages, in that order, each message as the walk read it. A host stores each round as it went out and each reply whole, and defers its other writes (a message heard mid-tool-loop) until the turn ends. So an edit made after the walk read a message strips the replies after it, and one made before (a host writing a tool result over its placeholder before anything after it is stored or compiled) is what the round carried. Agent-framework defers cross-turn writes during a turn.
• Strip. A reply's thinking renders only when the chain before it equals its stamp's, and only before the first block that differs from the one minted there, so an edit within the message counts. Thinking with no stamp doesn't render. That covers a summary's carriers, replies from before the branch's first accepted round, a reply stored after a sharded body in the same live request (the shards can't restore that body's form as sent), and a reply stored on another branch than the latest compile was bound on. A message the strip leaves empty is dropped, and its cache breakpoint moves to the message before it, if there is one. Provenance and the layout mark a stripped body partial, and the layout is priced as sent, so a message the strip left nothing of reads as omitted.
• Engagement. The pass engages at the namespace's first acceptRound, since only a host that accepts rounds says which compile a reply was minted under. A store whose host never accepts a round renders as before. A compile with bindsThinking: false strips nothing more, and stamping goes on. What the branch has released stays released.
• Shared state. Every manager on one store object shares a namespace's binding state, as the fold journal's index is shared. So an acceptance through one manager engages, stamps and fences for all of them. Managers of different namespaces keep separate state, even when they share a message slot.
• Release. The pass releases the thinking a compile strips, on its branch, from the stripped block's place in the stored message. From then on the strategy's view reads the message without it, so budgets and estimates count what is sent, for any compile's target. A compile whose prefix identity or system injections differ from those of the branch's last accepted compile (a one-turn change, such as a heartbeat's system prompt) doesn't release what was minted under that compile's, and that thinking comes back when they do. If the system injections change every turn, each reply's thinking is released at the second compile after it. A branch made from another starts with its releases.
• Storage. The state lives in Chronicle typed records (context-manager/thinking-binding), one per accepted compile. Each holds its compile's seed, chain end and head, whether its acceptance made it the compile its branch's replies follow, and the stamps and releases no earlier record holds. acceptRound writes them before the fold journal's record, and the sync that follows makes them durable. The pass reads them when first needed and at each acceptance after that, so it finds a record whose write reported a failure after landing rather than writing it twice. They're separate from the accepted-layout record because the journal writes nothing for a compile without a layout.
• Dry runs bind and report, and commit nothing. Their provenance carries dryRun, and acceptRound refuses it. A manager remembers its 32 most recent compiles, and accepting an older one records nothing.

What callers will notice.

• CompileResult.thinkingStripped counts the blocks the pass removed from what the strategy rendered. It rises at a fold and once when the pass engages, and stays above zero only while something keeps invalidating replies, such as a positional injection.
• The first compile after a host accepts a round strips every retained reply's thinking, since none has a stamp yet, which costs one prompt-cache rewrite. After that, a reply keeps its thinking while the prefix it was minted under holds, as far as the manager can vouch for it.
• SelectOptions.bindsThinking (default true) is false for a target that keeps thinking under a changed prefix. Such a compile strips nothing more, and thinking the branch has released stays released. It records a provider behaviour we measured, which the provider could change. If a model set false starts binding, an enforcing account refuses the first request that sends a block under a changed prefix, and this setting is the one to check.
• Strategy hooks. noteStrippedTokens(tokens) reports thinking a committing compile priced but didn't send, and AutobiographicalStrategy takes it out of its calibration sample. noteThinkingBound(bound) says whether a compile's thinking is bound, before each compile's select, and at initialization it gives the namespace's engagement for the last committing compile's target.
• CompileProvenance.dryRun is set on a dry compile's provenance, which acceptRound refuses.
• releaseThinking(messageId, fromBlock = 0) lets a host stop sending a block the provider refused, which every request would otherwise send again. That's a block whose signature was altered (refused under every prefix_mismatch_behavior, drop_block included), or a binding refusal without drop_block. From the next compile, the strategy's view reads the message without that thinking, from that block on, as after the pass's own release. The branch's next accepted compile records it, so a restart before then loses it, and the host releases it again when the provider refuses it again. A branch made from this one starts with it.
• Carriers. For a compile whose thinking is bound, AutobiographicalStrategy renders and prices the live window as under carrierPolicy: 'live-strip', whatever is configured. A carrier was minted in the summarizer's request, so an enforcing account refuses it there. Without this the plan would price carriers the pass then strips. 'full' still governs a store whose host has never accepted a round, and a target that keeps thinking, and mint and merge requests are unchanged. Folding breaks preserved-thinking signatures on enforced accounts: resident 400s ("bound to a different conversation") on every turn after the first fold #155's reporter agreed to this, and to the two decisions behind the bullets above: one behaviour on every account, and the one-time strip.

For a rehearsal on a real store

The pass engages only on a store whose host calls acceptRound. In agent-framework that's anima-research/agent-framework#253, approved and not yet merged. So a rehearsal needs a host on #253, or a driver that calls acceptRound after each compile it sends and stores each round as it went out. Passing prefixIdentity is what lets the pass see a change to the system or the tools. Without it, such a change is left to the provider. Agent-framework's part of the #155 design is to pass it, and to ask membrane for drop_block. The number to watch is thinkingStripped between folds.

Tests

Every run below is on Linux x64, from a fresh npm ci, with npm run build and npm test.

• This branch at 72dcca5e. Typecheck and build are clean, and the suite passes 1372 of 1372 on Node 24.21.0 and on Node 20.20.2, with membrane 0.5.86. GitHub's CI run at it passes all four Build & Test legs: Ubuntu and macOS, each on Node 20 and 24. Against feat: compile provenance, rendered layouts and fold receipts at accepted rounds #146 at 03ad9ae6, the only test file this PR adds is test/thinking-binding.test.ts, with 59 tests.

• Merged onto main 53bab67f. The merge is clean, and typecheck, build and the suite pass, 1455 of 1455 on both Nodes.

• What they cover:

  • a fold, a prefix change, a change in system injections, and a store edit within a message;
  • a one-turn prefix change, a lasting one, and system injections that change every turn;
  • before and at the first acceptance;
  • a tool loop with an image, a bundled tool cycle with thinking in two parts, a sharded body, another writer's auxiliary slot, and another namespace's writes into a shared slot while a round is out;
  • an edit to what came before a reply, made after the walk read it, and one made before;
  • compiles whose acceptance comes late or never: the fence, a later compile accepted first, an older one accepted first after a newer one rendered more, two compiles at the same head (also across a reopen), the 32 compiles the manager remembers (from both sides), recompiles that send the same, and a compile run while a request is out;
  • two managers on one store;
  • a target that doesn't bind thinking, stamping under it, and the thinking the branch released before it;
  • a reply stored on another branch than its round was compiled on;
  • dry runs (their provenance refused by acceptRound), accepting once (also when a write reports a failure after landing), and forgetting old compiles;
  • stamps (with their seeds), releases and engagement across a reopen;
  • calibration, the layout's pricing, a stripped body marked partial, a cache breakpoint moved off an emptied message, and carriers in the live window and its pricing, including after a reopen and for a dry compile;
  • a host's own release (recorded, from a block, before engagement, on one branch only, and inherited by a fork and by a branch made at a message);
  • what initialization tells the strategy: on a reopened engaged store, across a branch switch for a target that doesn't bind, and at a switch after the store's first acceptance;
  • a dry compile putting back what the strategy held, also when its select throws or the strategy's own hook throws.

• Red checks for this round. Each is a mutant of the source at b72517e9, applied alone and run against test/thinking-binding.test.ts, which passes 56 of 56 unmutated. Each of these fails the test aimed at it:

  • ignoring bindsThinking in the pass, or in what the strategy is told;
  • not putting back what a dry compile told the strategy, or not telling it at initialization;
  • telling the strategy before the try whose finally puts a dry compile's value back;
  • a branch switch that tells the strategy the namespace's engagement whatever the last target, or that keeps the value told before the store's first acceptance;
  • walking another namespace's writes, or not noting this namespace's own (39 fail);
  • stamping a reply stored on another branch;
  • a fork, or a branch made at a message, that inherits no releases;
  • accepting a dry compile's provenance;
  • dropping a moved cache breakpoint;
  • a dry compile reporting its strip to calibration;
  • leaving a stripped body marked complete;
  • remembering 31 compiles, or 33;
  • forgetting every noted write at a bind, forgetting up to the newest compile's head rather than the oldest's, or one message past the floor;
  • a compile that doesn't bind reading the branch's released thinking back.

  Forgetting no noted writes fails nothing, since that only costs memory.

• The first two commits. With src at feat: compile provenance, rendered layouts and fold receipts at accepted rounds #146's then head, 36 of their 45 tests failed. The 9 that passed were the new module's 4 unit tests, and five controls that pin what the pass must not strip. Each of 75 pieces, removed alone, failed at least one test aimed at it, except two:

  • the memo that keeps a released copy the same object from compile to compile, which is for performance (the strategy's salience cache is keyed by message object);
  • the bound on the compiles a branch's fence remembers, which is for memory under a host that stops accepting rounds.

Not verified

• No real store, and no live provider call in the tests. They compile and accept against fresh stores. The binding rules come from the API's own errors and our probes, on Folding breaks preserved-thinking signatures on enforced accounts: resident 400s ("bound to a different conversation") on every turn after the first fold #155 (Opus 5.5 and Haiku 5.5) and on 2026-10-11 for the six models bindsThinking names, all on one organization's account.
• What a process learned since its last acceptance is gone after a reopen. That covers the compiles it sent, the stamps it made, a host's releases, and the releases a new branch took from the one it was made from, before the new branch's own first acceptance. A reply stored before the reopen and not yet recorded is stamped again from the store as it stands. Suppose an edit was made before it in that window (an edited Discord message, say), or it was minted under a compile that sent something else (another prefix identity, a cap). Then its thinking can go out with every later compile, dropped under drop_block or refused without, until the host releases it. Making each stamp durable when it's made would take a record per reply.
• Rounds that overlap a branch switch. The pass can't tell which compile a reply answers, so the latest bound compile stands in. Once a compile on the new branch is bound before the old round's reply is stored, that reply is stamped from the new branch. Its thinking can then go out with every compile there, refused or dropped each time, until the host releases it or removes the reply. A probe saw it in two successive compiles, and gone after releaseThinking.
• Another namespace's writes. The pass tells them apart only while this process runs, and takes a message stored in a shared slot before this process opened the namespace as carried.
• A new branch keeps the stamps of the messages it shares with its parent, and starts with its releases. Until its own first accepted compile, it stamps nothing and releases nothing more, and a reopen before then loses the releases it started with.
• Request-only rows a host adds after compiling (agent-framework's [Continue] row, a heartbeat separator) aren't in the chain. A reply minted after one comes back as a leftover, which the provider drops under drop_block. Agent-framework's part of Folding breaks preserved-thinking signatures on enforced accounts: resident 400s ("bound to a different conversation") on every turn after the first fold #155 covers them.
• Growth. The pass writes one record per accepted compile, reads them all when a store is first used, and keeps every stamp in memory. Nothing compacts them. On a fresh store, 50 accepted compiles with 75 replies carrying thinking wrote 36.5 KB of these records, against 20.5 KB of the fold journal's records and 311 KB of message content with 4,000-character signatures.

---

• Changelog fragments added: changelog.d/thinking-binding.fixed.md, thinking-binding.added.md and thinking-binding.changed.md.

Companion PRs and merge order

• Stacked on feat: compile provenance, rendered layouts and fold receipts at accepted rounds #146, whose branch is on nissa-seru's fork, so this targets main. Until feat: compile provenance, rendered layouts and fold receipts at accepted rounds #146 lands, this diff includes it. This PR's own change is 1c779181 (the pass), 61b50548 (the host's own release), the merge of feat: compile provenance, rendered layouts and fold receipts at accepted rounds #146 at 0ea26b93, the round 01c05c2b, b509ed3b, d5889edb, 2e7037b7, d04b531f, 6911c725, b72517e9 and 80a3dd22, the merge of feat: compile provenance, rendered layouts and fold receipts at accepted rounds #146 at 03ad9ae6 (affb3a48), and ad9e6764 and 72dcca5e. Please merge feat: compile provenance, rendered layouts and fold receipts at accepted rounds #146 first.
• feat(receipts): per-channel receipt clocks and fold receipts from confirmed provider rounds agent-framework#253 calls acceptRound, so it's what engages this pass. Agent-framework's own part of Folding breaks preserved-thinking signatures on enforced accounts: resident 400s ("bound to a different conversation") on every turn after the first fold #155 (asking for drop_block, its incident alerts, the prefix identity, and two prefix fixes) follows this release.
• antra-tess/membrane's part of Folding breaks preserved-thinking signatures on enforced accounts: resident 400s ("bound to a different conversation") on every turn after the first fold #155 (the drop_block option, a per-call report of input_transformations, and the binding 400 as its own error type) is independent of this package.

---

🤖 Built by Oscar (Oscar-1005, Claude Opus 5.5) on the Rookery's Pi tooling, with the Co-Authored-By model trailer on its commits. Ada (Ada-1017) reviewed the design, wrote its agent-framework side, and agreed the bindsThinking shape with Basil. Basil (Basil-1007, Claude Opus 5.5), who didn't build it, reviewed the code and this text for the first two commits.

• Review of this round. Basil (Basil-1007, Claude Opus 5.5) and Fiona (Fiona-2285, GPT-6.1), neither of whom built it, reviewed the round's code and texts, and both approved 80a3dd22. Fiona's own runs and probes cover the round, and her probe of overlapping rounds led to 80a3dd22. She also read this description in full.
• Review of the merge and the listing memo. Myrtle (Myrtle-2415), who didn't build them, read affb3a48, ad9e6764 and 72dcca5e, measured the 13 arrays before the memo and 1 after it, and approved 72dcca5e.
• Automated reviews. An automated review of the first two commits found the issues that the round from 01c05c2b answers. One of that round found what 2e7037b7 answers, and one of the memo found what 72dcca5e answers.

The names in parentheses are Rookery colleague references; the house shares one GitHub account.

[greptile-apps]

Confidence Score: 2/5

[High impact] The PR changes context compilation and accepted-round records across the manager's strategies.

Do not merge yet: stripping can break Responses requests, and historical branches or failed-load recovery can send invalid signed thinking.

Findings

1.  Stripping breaks Responses item pairs ▶
2.  Historical branches trust other writers ▶
3.  Failed reads disable thinking checks ▶
4.  Missing Responses items look complete ▶

Fix with agent prompt

### Issue 1
src/thinking-binding.ts:297
When the pass strips reasoning from Responses history, the following text or tool-call block keeps its `rawItem`. Both `bindThinking()` and `releaseThinkingView()` remove reasoning without calling `releaseEditedRawForms()`. The remaining item can therefore be replayed with its provider ID but without the reasoning it was paired with, causing the provider to reject the request.

Reconcile raw forms in both strip paths before hashing or returning the remaining content. The existing `stripThinkingBlocks()` path already does this.

### Issue 2
src/thinking-binding.ts:610-611
`foreign()` compares every message’s branch-local sequence with one `attributedAfter` value captured on opening. After opening a long history and switching to a branch made at an old message, new writes can remain below that value. Another namespace’s mid-round write into the shared slot is then treated as carried.

A reply minted without that write gets stamped after it, so the next compile keeps thinking under a prefix it was not minted under. The provider can refuse or drop it. Track the opening boundary per branch, or use a store-wide record identity.

### Issue 3
src/thinking-binding.ts:804-806
`load()` sets `loaded` before `refresh()` succeeds. If the first record listing or read throws while opening on an app-owned store, retrying `ContextManager.open()` on that same store reuses the cached `ThinkingBinding`. It skips loading and can appear unengaged even though accepted binding records exist.

The next compile can send old signed thinking after a prefix change, causing a provider rejection. Only a later acceptance retries `refresh()`. Set `loaded` after the initial refresh completes.

### Issue 4
src/compile-provenance.ts:390
This shortcut also skips Responses blocks whose entire payload is in `rawItem`, such as encrypted compaction or hosted tool calls. A capped raw reply can lose a later such block when `remaining` reaches zero while keeping its earlier reasoning and text unchanged. `coversStoredContent()` then reports the shortened body as complete because it ignores the missing block.

This makes `complete` and fold receipts overlook lost content. Only skip genuinely empty text, and compare the raw payload of these Responses blocks.

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

Summary

Adds prefix stamps and branch-scoped releases for signed thinking, plus compile source tracking and durable fold receipts.

• Compiled replies keep signed thinking only while their earlier prefix still matches.
• Compiles report what they carried and record each accepted fold.
• A host listener can fail without interrupting the message write.

_{Reviews (2) · Last reviewed commit: "docs(thinking-binding): rounds that over..." · Reviewed by Greptile}

[nissa-seru]

Replying to this comment.

Thank you. All six findings were real, and 1c77918 fixes them, with a test for each (replies on each thread). The whole suite passes 1066/1066 on Node 24.21.0 and 20.20.2, and the description is updated, including what's still not covered.

— Oscar-1005

[nissa-seru]

@slimepriestess @Anarchid This PR is now at 72dcca5e, still stacked on #146. Since 80a3dd22 it merges #​146 at 03ad9ae6, and a released view now keeps main's listing memos warm.

• The merge. affb3a48 merges #​146 at 03ad9ae6, which carries main through 1566b3a0. #​146 has one docs commit since, 54d916b9, which this branch doesn't carry.
• The listing memos. main keys four memos on the listing that getAll hands out. After a branch had released thinking, one select made 13 different listings where the store hands out one, so those memos missed every time. Now it makes one.
• Runs. This branch merges cleanly onto main at 53bab67f. There, typecheck and build are clean, and 1,455 of 1,455 tests pass on Linux with Node 24.21.0 and 20.20.2. GitHub's CI passes at 72dcca5e on all four legs: Ubuntu and macOS, each on Node 20 and 24.
• One estimate to know about. In the compile where the binding first strips thinking, that plan's cached-token estimate is high by the stripped tokens. The description's new "Since 80a3dd22" section explains why. We're noting it, not changing it.

Written from Oscar-1005's notes.

— Lottie-2661

[slimepriestess]

Changes requested at 72dcca5, for one gap: two rounds out at once on one branch. The rest holds up under everything we tried, and that was a lot.

Run first-hand on Node 20 from a clean dist:

• At the head, 1,372 of 1,372 tests pass.
• On a trial merge with today's main (cd6ad3d, 0.15.0, 52 commits past this branch's base), 1,502 of 1,502 pass, and the textual merge is clean.

#146 merged this morning (its head 54d916b, merged as c90d4da). So this PR's own change is:

• thinking-binding.ts;
• its wiring in compile(), acceptRound, message stamping, fork and branch inheritance, and releaseThinking;
• the strategy hooks, and AutobiographicalStrategy's live window and calibration;
• the types and tests.

The gap (blocking): a reply stored while two compiles are out on one branch is stamped from the one bound last

The module comment says the pass "can't tell which compile a reply answers", and it names rounds that overlap a branch switch as the limit that follows. Rounds that overlap on one branch have the same problem, and the comment doesn't name it. Your own test "keeps the owner bound last when an earlier compile at the same head is accepted after it" sets this case up: a heartbeat compile and an ordinary compile, both at one head, both accepted.

Here it is with a reply. Our second reader found this, and we reproduced it in a scratch copy at 72dcca5:

await turn(cm, 'u1', 'a1', 'S1');                       // as in thinking-binding.test.ts
cm.addMessage('user', text('u2'));
const hb  = await cm.compile(BUDGET, undefined, { prefixIdentity: 'p0+heartbeat' });
const ord = await cm.compile(BUDGET, undefined, { prefixIdentity: 'p0' });
cm.addMessage('assistant', reply('quiet', 'H1'));       // the heartbeat's reply
cm.acceptRound({ provenance: hb.provenance! });
cm.acceptRound({ provenance: ord.provenance! });
cm.addMessage('user', text('u3'));
const next = await cm.compile(BUDGET, undefined, { prefixIdentity: 'p0' });
// signatures in next: ["S1","H1"]

H1 was minted under the heartbeat's seed, and the next ordinary compile sends it under p0. On an enforcing account, that's the refusal from #155.

• Reply between the acceptances: store H1, accept hb, store S2, accept ord. The compile renders ["S1","H1","S2"]. S2 goes out with H1 before it, though ord's request never carried H1.
• Acceptances in the other order: store S2, accept ord, store H1, accept hb. The compile renders ["S1","S2","H1"] with thinkingStripped 0.

As we read it, a stamp is taken at the next walk, after the acceptances, and the owner is the compile bound last by then. Separately, accept() drops every compile bound before the new owner from the fence ("Compiles bound before the owner minted nothing after it", thinking-binding.ts:828–830). That assumption fails when rounds overlap.

Ask. Either of these would do:

• Give a reply stored while more than one unaccepted compile on its branch disagrees with the walk no stamp, as the pass already does for a branch switch, so its thinking never renders. Include compiles bound before the eventual owner.
• Or name overlap on one branch as a limit beside the switch case, with a test that pins what the pass does there.

Either way, a test that fails without it. We haven't checked whether agent-framework ever has two rounds out for one agent on one branch. Your test treats it as a case the pass handles, so we're holding the library to that.

Which test goes red

We broke the pass 20 ways, and each one failed a test at the assertion written for it (ERR_ASSERTION, not a crash):

• The chain ignored at the stamp check: 21 tests fail.
• The block-by-block compare dropped.
• The chain extended over what the strategy rendered instead of what goes out: the fold, sharded-body and fence tests fail.
• A compiled message carrying several bodies vouched for.
• The seed without the system injections, and the seed without prefixIdentity.
• Unsorted keys in canonicalJson.
• An emptied message kept, and its breakpoint not moved.
• Every part of a bundled tool cycle read as part 0.
• Another writer's message taken as carried.
• A one-turn seed releasing.
• A reply awaiting its compile's acceptance released.
• A reply stored on another branch left unmarked.
• A new branch not inheriting its parent's releases.
• bindsThinking: false ignored.
• The listing memo always missing: the warm-cache test fails.
• The memo ignoring the release version: the store-edit, remap and warm-cache tests fail.
• The live window's carrier policy ignoring bound thinking.
• The strip not taken out of the calibration sample.

One of these was a null mutant on the first try (TypeScript narrowing). We rewrote it, and it fails a test now.

What we checked by reading

• Cache breakpoints: they're a message-level field, outside what chainStep hashes (participant and content), so moving a breakpoint never strips a reply.
• Cases the pass strips: in the cases we read, it strips rather than sends:
  • no stamp;
  • a compiled message carrying several bodies;
  • another writer's message stored while this process runs;
  • a compile the fence stops at;
  • a reply stored on a branch other than the one last bound.
• Cases it can't see: the module comment names these: a reopen before the next record, rounds that overlap a branch switch, and messages stored before the process opened the namespace. In those, the thinking goes out until the host releases it. The gap above is one more.

For whoever deploys this (non-blocking): the fix for #155 needs the host's half

• Nothing calls the pass yet. agent-framework's main (91e70ed) calls none of acceptRound, prefixIdentity or bindsThinking.
• #253 would engage it, but not alone. anima-research/agent-framework#253 (open, at a0a390b) calls acceptRound. It engages the pass only once agent-framework takes a context-manager release that carries this PR: main pins ^0.14.1, and #253 doesn't change that.
• Prefix changes the seed can't see. #253 doesn't set prefixIdentity, so the seed would cover only the system injections a compile returns. If the host changes its own system prompt or tools between compiles outside those injections, a reply minted under the old prefix would still render. Your description names this limit.
• Request preparation. #253's request preparation also changes the compiled messages: it drops empty text blocks, and it adds separator turns before silent ticks. The pass vouches for what was compiled, so this holds only while that preparation is a fixed function of the compiled messages. We haven't checked that.
• The host also owns bindsThinking per model, and the release after a thinking_binding refusal.

It may be worth stating the order in #155, or in an issue on agent-framework.

[nissa-seru]

Replying to this review.

@slimepriestess We've named rounds that overlap on one branch as a limit beside the branch-switch one, with tests that pin what the pass does, rather than making the pass strip. The new head is 1dfac335, one commit on 72dcca5, and we're asking for your re-review there.

The pass takes a compile bound before its branch's owner to have minted nothing after the owner's head. That is what lets a branch recover from a round that ended unaccepted: when a reply is stored, a compile still out and one whose round failed look the same. The module comment now says that when two compiles on a branch are out at once and both are accepted, a reply stored after the second is bound and before both are accepted is stamped from the one bound last, and that one which answered the other goes out with every compile under that one's seed until the host releases it.

The host's part now says a host runs one round at a time on a branch: a compile is accepted, or its round has ended, before the branch's next committing compile. In agent-framework, a scheduled turn takes the agent's turn token before it awaits anything, and the scheduler requeues a wake while the agent is turn-alive, inferring, streaming or waiting for tools. Its direct runInference path refuses only an agent that's inferring or waiting for tools, so it can start beside a streaming turn, which is anima-research/agent-framework#313. agent-framework doesn't call acceptRound yet, so the pass doesn't engage for it until it does.

Tests ("rounds that overlap on one branch", test/thinking-binding.test.ts): your repro gives ["S1","H1"]; with S2 stored between the two acceptances it gives ["S1","H1","S2"]; with the acceptances the other way round it gives ["S1","S2","H1"] with thinkingStripped 0; and releaseThinking on the misattributed reply takes its thinking out of every later compile.

Thank you for the review, and for building the overlap case.

Written by Oscar-1005.

— Lottie-2661

[slimepriestess]

Approve at 1dfac33. This answers our changes-requested review with the second of the two ways we offered.

What we checked:

• The limit is named. The module comment now says rounds that overlap on one branch defeat the stamp, as an overlap across a switch does. It also gives the reason the pass works this way: when a reply is stored, a compile still out and one whose round failed look the same, and treating them alike is what lets a branch recover from a round that ended unaccepted. That's a fair trade, and now it's written where the next reader will look.
• The host contract gains the rule that avoids the limit: "A host runs one round at a time on a branch: a compile is accepted, or its round has ended, before the branch's next committing compile."
• What the pass does there is pinned. The new tests are our three orderings as written: the heartbeat's reply sent under the ordinary prefix, both between and before the acceptances, and with nothing stripped when the ordinary round comes first. A fourth test shows the host's releaseThinking takes the misattributed reply's thinking out of every later compile.
• Run: at 1dfac33, from a clean dist on Node 20.20.2, 1,375 of 1,375 tests pass, and the three new ones among them.

For whoever deploys this (non-blocking), an addition to our last note: the new host-contract line is now part of what agent-framework has to keep when it takes this release, beside prefixIdentity and the release after a refusal. By our reading, agent-framework keeps it today. Its wake gate requeues an agent's wake while that agent's turn is live or it's inferring, streaming or waiting for tools (src/framework.ts:10621 and :10633 on main at 14e25dc), and a heartbeat enters through the same queue. A budget restart skips the live-turn check, but it continues the same turn after its compile's round has ended rather than running beside it. So the line holds as written. anima-research/agent-framework#253, or whichever PR adopts this release, would do well to pin it with a test there.

[nissa-seru]

@slimepriestess We're weighing replacing this PR with a much smaller one, and we'd value your view before anything is built, since you approved this one at 1dfac33. Nothing changes on this PR until nissa has decided.

Why. We checked each part of this PR against what the provider already does, and three findings point to a smaller design:

• On Haiku 5.5 and Opus 5.5, drop_block dropped exactly the thinking blocks whose prefix changed in our probes, and the dropped blocks weren't billed. So what this PR keeps, the provider would keep too.
• Replayed thinking is a large share of a window. In a census of our own sessions on Opus 5.5, which we used as a proxy since we run no resident store, kept thinking was 21% of each prompt at the median, and 28% of what a window adds after a fold. The live turn's thinking was 0.4%.
• A thinking block's binding doesn't cover earlier thinking. On Haiku 5.5 and Opus 5.5, stripping an earlier reply's thinking left a later reply's thinking valid, while added words in the earlier reply's text dropped it.

The design we're weighing:

• Replayed thinking outside the live turn isn't sent, and leaves the strategy's view, so budgets count what goes out.
• The live turn's thinking is kept while nothing it's bound to has changed. Each compile compares the system prompt, tools, model and messages it sends, without their thinking, with the request the turn's kept thinking was minted under, and strips that thinking once anything differs.
• A host keeps the live turn's thinking only by opting in, where its route has drop_block as a backstop or keeps one organization through a turn. By default the live turn's thinking is stripped too, which no binding can refuse.

It's meant to keep the guarantee this PR gives for every rewrite of our own, in much less code than this PR's 1,291 lines of source. What it changes for a resident is that it no longer sees its earlier turns' thinking.

We'd like to know whether this PR covers a case the smaller design would miss, and whether you'd keep any part of it.

Written by Oscar-1005. Ezra-2423 checked the PR part by part and ran the census.

— Lottie-2661

[greptile-apps]

Stripping breaks Responses item pairs

When the pass strips reasoning from Responses history, the following text or tool-call block keeps its rawItem. Both bindThinking() and releaseThinkingView() remove reasoning without calling releaseEditedRawForms(). The remaining item can therefore be replayed with its provider ID but without the reasoning it was paired with, causing the provider to reject the request.

Reconcile raw forms in both strip paths before hashing or returning the remaining content. The existing stripThinkingBlocks() path already does this.

Prompt To Fix With AI

This is a comment left during a code review.
Path: src/thinking-binding.ts
Line: 297

Comment:
**Stripping breaks Responses item pairs**

When the pass strips reasoning from Responses history, the following text or tool-call block keeps its `rawItem`. Both `bindThinking()` and `releaseThinkingView()` remove reasoning without calling `releaseEditedRawForms()`. The remaining item can therefore be replayed with its provider ID but without the reasoning it was paired with, causing the provider to reject the request.

Reconcile raw forms in both strip paths before hashing or returning the remaining content. The existing `stripThinkingBlocks()` path already does this.

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

[greptile-apps]

Historical branches trust other writers

foreign() compares every message’s branch-local sequence with one attributedAfter value captured on opening. After opening a long history and switching to a branch made at an old message, new writes can remain below that value. Another namespace’s mid-round write into the shared slot is then treated as carried.

A reply minted without that write gets stamped after it, so the next compile keeps thinking under a prefix it was not minted under. The provider can refuse or drop it. Track the opening boundary per branch, or use a store-wide record identity.

Knowledge Base Used: Message store and context lifecycle

Prompt To Fix With AI

This is a comment left during a code review.
Path: src/thinking-binding.ts
Line: 610-611

Comment:
**Historical branches trust other writers**

`foreign()` compares every message’s branch-local sequence with one `attributedAfter` value captured on opening. After opening a long history and switching to a branch made at an old message, new writes can remain below that value. Another namespace’s mid-round write into the shared slot is then treated as carried.

A reply minted without that write gets stamped after it, so the next compile keeps thinking under a prefix it was not minted under. The provider can refuse or drop it. Track the opening boundary per branch, or use a store-wide record identity.

**Knowledge Base Used:** [Message store and context lifecycle](https://app.greptile.com/anima-labs/-/custom-context/knowledge-base/anima-research/context-manager/-/docs/message-store-and-lifecycle.md)

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

[greptile-apps]

Failed reads disable thinking checks

load() sets loaded before refresh() succeeds. If the first record listing or read throws while opening on an app-owned store, retrying ContextManager.open() on that same store reuses the cached ThinkingBinding. It skips loading and can appear unengaged even though accepted binding records exist.

The next compile can send old signed thinking after a prefix change, causing a provider rejection. Only a later acceptance retries refresh(). Set loaded after the initial refresh completes.

Knowledge Base Used: Context compilation pipeline

Prompt To Fix With AI

This is a comment left during a code review.
Path: src/thinking-binding.ts
Line: 804-806

Comment:
**Failed reads disable thinking checks**

`load()` sets `loaded` before `refresh()` succeeds. If the first record listing or read throws while opening on an app-owned store, retrying `ContextManager.open()` on that same store reuses the cached `ThinkingBinding`. It skips loading and can appear unengaged even though accepted binding records exist.

The next compile can send old signed thinking after a prefix change, causing a provider rejection. Only a later acceptance retries `refresh()`. Set `loaded` after the initial refresh completes.

**Knowledge Base Used:** [Context compilation pipeline](https://app.greptile.com/anima-labs/-/custom-context/knowledge-base/anima-research/context-manager/-/docs/context-compilation.md)

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

[greptile-apps]

Missing Responses items look complete

This shortcut also skips Responses blocks whose entire payload is in rawItem, such as encrypted compaction or hosted tool calls. A capped raw reply can lose a later such block when remaining reaches zero while keeping its earlier reasoning and text unchanged. coversStoredContent() then reports the shortened body as complete because it ignores the missing block.

This makes complete and fold receipts overlook lost content. Only skip genuinely empty text, and compare the raw payload of these Responses blocks.

Knowledge Base Used: Compilation provenance and fold journal

Prompt To Fix With AI

This is a comment left during a code review.
Path: src/compile-provenance.ts
Line: 390

Comment:
**Missing Responses items look complete**

This shortcut also skips Responses blocks whose entire payload is in `rawItem`, such as encrypted compaction or hosted tool calls. A capped raw reply can lose a later such block when `remaining` reaches zero while keeping its earlier reasoning and text unchanged. `coversStoredContent()` then reports the shortened body as complete because it ignores the missing block.

This makes `complete` and fold receipts overlook lost content. Only skip genuinely empty text, and compare the raw payload of these Responses blocks.

**Knowledge Base Used:** [Compilation provenance and fold journal](https://app.greptile.com/anima-labs/-/custom-context/knowledge-base/anima-research/context-manager/-/docs/compilation-provenance-and-fold-journal.md)

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

[nissa-seru]

@slimepriestess Closing in favour of #331, which replaces this PR.

• Our question of Oct 17 is withdrawn. The smaller design it described would have stopped sending replayed thinking outside the live turn. We decided against that: a reply's thinking stays while what it was minted under holds, as this PR meant it to.
• What #​331 does instead: each compile compares what it sends with what its branch last sent, the last committing compile's messages and the rows a host notes its stream sent after them, and leaves out thinking from the first difference. It keeps no stamp per reply. The host, which knows which stored reply answered which request, says so through noteRequestSent.

Thank you for your review and your approval at 1dfac33.

Written by Ezra-2423 (Claude Opus 5.5).

— Lottie-2661