Keep failed compact commits from replacing live history

A failed compact commit must not later replaceTurns stale output,
and an unpublished rewrite stays off the live generation until git
commit succeeds.

Author: TheGreatAxios

src/session/assemble-runtime.ts

@@ -58,6 +58,7 @@ import {
   applyRecordingPolicyToText,
   createCompactionArchive,
   createPrimaryDeliveryAdmission,
+  hashAuthorizedBytes,
   wrapAuthorizeWithEvidenceArchive,
   wrapCompactorWithCompletenessGate,
   type CompactionArchive,
@@ -491,6 +492,16 @@ export function assembleChatAgent(wiring: ChatAgentWiring): AssembledChatAgent {
         ? storage
         : {
             ...storage,
+            async writeBlob(key, bytes, contentType, signal) {
+              await storage.writeBlob(key, bytes, contentType, signal);
+              if (!key.startsWith("img-")) return;
+              await primaryArchive.recordExistingBlobReference({
+                kind: "attachment",
+                blobKey: key,
+                contentHash: hashAuthorizedBytes(bytes),
+                provenance: "persistBlobs:aged-image",
+              });
+            },
             async writeResponse(turn, signal) {
               const content = turn.content.map((block) => {
                 if (block.type !== "text") return block;

src/session/attachment-store.test.ts

@@ -119,4 +119,31 @@ describe("ageImageBlocks / rehydrateAttachmentImages", () => {
     expect(defined(result.output[0]).content).toEqual([{ type: "text", text }]);
     expect(result.record.decisions.restoredImageCount).toBe(0);
   });
+
+  test("aging base64 images does not record before persistBlobs", async () => {
+    const recorded: string[] = [];
+    const archive = {
+      recordAuthorizedPayload: async () => {
+        recorded.push("payload");
+        return {} as never;
+      },
+      recordExistingBlobReference: async () => {
+        recorded.push("existing");
+        return {} as never;
+      },
+    };
+    const turn: ConversationTurn = {
+      role: "user",
+      content: [
+        {
+          type: "image",
+          source: { kind: "base64", mimeType: "image/png", data: PNG_B64 },
+        },
+      ],
+      timestamp: 1,
+    };
+    const aged = await ageImageBlocks(turn, { archive: archive as never });
+    expect(aged.blobs).toHaveLength(1);
+    expect(recorded).toEqual([]);
+  });
 });

src/session/compaction-archive.test.ts

@@ -680,4 +680,44 @@ describe("wrapCompactorWithCompletenessGate", () => {
     expect(result.output).toHaveLength(1);
     expect(result.record.reason).toBe("compact");
   });
+
+  test("image-only dropped turns require covering attachment evidence", async () => {
+    const { wrapCompactorWithCompletenessGate } = await import("./compaction-archive.js");
+    const { archive } = memoryArchive();
+    const wrapped = wrapCompactorWithCompletenessGate(truncating("pruning-compactor"), archive);
+    const png = "iVBORw0KGgo=";
+    const turns: import("@intx/types/runtime").ConversationTurn[] = [
+      {
+        role: "user",
+        content: [
+          {
+            type: "image",
+            source: { kind: "base64", mimeType: "image/png", data: png },
+          },
+        ],
+        timestamp: 1,
+      },
+      {
+        role: "user",
+        content: [{ type: "text", text: "keep" }],
+        timestamp: 2,
+      },
+    ];
+
+    const blocked = await wrapped.apply(turns, ctx);
+    expect(blocked.output).toBe(turns);
+    expect(blocked.record.reason).toBe("incomplete-evidence-archive");
+
+    await archive.recordAuthorizedPayload({
+      kind: "attachment",
+      payload: png,
+    });
+    await archive.recordAuthorizedPayload({
+      kind: "user_message",
+      payload: "keep",
+    });
+    const allowed = await wrapped.apply(turns, ctx);
+    expect(allowed.output).toHaveLength(1);
+    expect(allowed.record.reason).toBe("compact");
+  });
 });

src/session/compaction-archive.ts

@@ -25,6 +25,7 @@ import {
   type ArchiveKind,
   type ToolRecordingLifecycle,
 } from "./compaction-archive-schema.js";
+import { parseAgedImageMarker } from "./attachment-uri.js";
 
 const INDEX_DIR = "evidence-archive";
 const INDEX_FILE = "index.jsonl";
@@ -626,10 +627,12 @@ function textKindForRole(role: ConversationTurn["role"]): ArchiveKind {
 
 function coveringOccurrence(
   units: readonly {
-    kind: "text" | "tool_call" | "tool_result";
+    kind: "text" | "tool_call" | "tool_result" | "image";
     text?: string;
     role?: ConversationTurn["role"];
     callId?: string;
+    data?: string;
+    blobKey?: string;
   }[],
   occurrences: readonly ArchiveOccurrence[],
 ): { ids: string[]; unmatched: boolean } {
@@ -638,6 +641,12 @@ function coveringOccurrence(
   for (const unit of units) {
     const match = occurrences.find((occ) => {
       if (used.has(occ.occurrenceId) || occ.gap === true) return false;
+      if (unit.kind === "image") {
+        if (occ.kind !== "attachment") return false;
+        if (unit.blobKey !== undefined) return occ.blobKey === unit.blobKey;
+        if (unit.data === undefined) return false;
+        return occ.contentHash === hashAuthorizedBytes(new TextEncoder().encode(unit.data));
+      }
       if (unit.kind === "text") {
         if (unit.role === undefined || unit.text === undefined) return false;
         if (occ.kind !== textKindForRole(unit.role)) return false;
@@ -655,25 +664,40 @@ function coveringOccurrence(
 }
 
 function droppedContentUnits(dropped: readonly ConversationTurn[]): {
-  kind: "text" | "tool_call" | "tool_result";
+  kind: "text" | "tool_call" | "tool_result" | "image";
   text?: string;
   role?: ConversationTurn["role"];
   callId?: string;
+  data?: string;
+  blobKey?: string;
 }[] {
   const units: {
-    kind: "text" | "tool_call" | "tool_result";
+    kind: "text" | "tool_call" | "tool_result" | "image";
     text?: string;
     role?: ConversationTurn["role"];
     callId?: string;
+    data?: string;
+    blobKey?: string;
   }[] = [];
   for (const turn of dropped) {
     for (const block of turn.content) {
       if (block.type === "text" && block.text.length > 0) {
-        units.push({ kind: "text", role: turn.role, text: block.text });
+        const marker = parseAgedImageMarker(block.text);
+        if (marker !== undefined) {
+          units.push({ kind: "image", blobKey: marker.id });
+        } else {
+          units.push({ kind: "text", role: turn.role, text: block.text });
+        }
       } else if (block.type === "tool_call") {
         units.push({ kind: "tool_call", callId: block.id });
       } else if (block.type === "tool_result") {
         units.push({ kind: "tool_result", callId: block.callId });
+      } else if (block.type === "image") {
+        if (block.source.kind === "base64") {
+          units.push({ kind: "image", data: block.source.data });
+        } else {
+          units.push({ kind: "image" });
+        }
       }
     }
   }

src/session/optimized-context-store.test.ts

@@ -782,6 +782,29 @@ describe("createOptimizedContextStore unpublished rewrite", () => {
     expect(turnTexts(loaded.turns)).toEqual(["old-a", "old-b"]);
   });
 
+  test("git commit failure after rewrite lands keeps load on HEAD", async () => {
+    const dir = tempDir();
+    const store = await createOptimizedContextStore(dir);
+    const original = [turn("keep-a"), turn("keep-b"), turn("drop-me")];
+    await store.writeTurns(original);
+    await store.writeMetadata(EMPTY_CHECKPOINT_METADATA);
+    const published = await store.commit({ message: "published original" });
+
+    await store.writeTurns([turn("[Compacted prior context]"), turn("keep-b")]);
+
+    const hookDir = path.join(dir, ".git", "hooks");
+    fs.mkdirSync(hookDir, { recursive: true });
+    const hook = path.join(hookDir, "commit-msg");
+    fs.writeFileSync(hook, "#!/bin/sh\nexit 1\n");
+    fs.chmodSync(hook, 0o755);
+
+    await expect(store.commit({ message: "publish compact" })).rejects.toThrow();
+
+    const loaded = await store.load();
+    expect(turnTexts(loaded.turns)).toEqual(["keep-a", "keep-b", "drop-me"]);
+    expect(turnTexts(await store.readAt(published.hash))).toEqual(["keep-a", "keep-b", "drop-me"]);
+  });
+
   test("append writeTurns is still visible before commit", async () => {
     const dir = tempDir();
     const store = await createOptimizedContextStore(dir);

src/session/optimized-context-store.ts

@@ -438,7 +438,7 @@ export async function createSessionStores(
   const base = await createIsogitStore(dir, signer);
   const pendingBlobFilepaths = new Set<string>();
   const pendingSegmentPaths = new Set<string>();
-  const writeTurnsSegmented = createSegmentedJSONLWriter(dir, TURNS_FILE);
+  let writeTurnsSegmented = createSegmentedJSONLWriter(dir, TURNS_FILE);
   const writePromptSegmented = createSegmentedJSONLWriter(dir, PROMPT_FILE);
   let liveTurnRefs: readonly ConversationTurn[] | null = null;
   let unpublishedRewrite: ConversationTurn[] | null = null;
@@ -641,10 +641,9 @@ export async function createSessionStores(
     },
     async commit(options, signal) {
       return withResolvedDirLock(dir, async () => {
-        if (unpublishedRewrite !== null) {
-          await writeSegmented(writeTurnsSegmented, unpublishedRewrite);
-          liveTurnRefs = unpublishedRewrite;
-          unpublishedRewrite = null;
+        const stagedRewrite = unpublishedRewrite;
+        if (stagedRewrite !== null) {
+          await writeSegmented(writeTurnsSegmented, stagedRewrite);
         }
         const toAdd: string[] = [];
         const toRemove: string[] = [];
@@ -686,9 +685,16 @@ export async function createSessionStores(
           const committed = await base.commit(options, signal);
           pendingBlobFilepaths.clear();
           pendingSegmentPaths.clear();
+          if (stagedRewrite !== null) {
+            liveTurnRefs = stagedRewrite;
+            unpublishedRewrite = null;
+          }
           return committed;
         } catch (cause) {
           await resetIndexPaths(dir, extraPaths);
+          if (stagedRewrite !== null) {
+            liveTurnRefs = null;
+          }
           throw cause;
         }
       });

vendor/intx-inference/PATCHES.md

@@ -313,7 +313,9 @@ tracks the skip-unchanged-history patch.
 `reactor.ts` — `executeCompact` persists blobs, stages `writeTurns`, and
 leaves reactor memory on the old generation until `commitCycle` publishes.
 `replaceTurns` runs only after a successful commit. `commitCycle` must not
-`writeTurns` live (old) memory over that staging.
+`writeTurns` live (old) memory over that staging. A failed commit clears
+`pendingCompactOutput` so a later infer/tools cycle writes live history and
+does not `replaceTurns` with the unpublished compact.
 
 **Disposition:** Promotion candidate. Compaction durability — an interrupt
 between stage and commit must resume the complete old generation, not a

vendor/intx-inference/src/reactor.test.ts

@@ -5277,6 +5277,7 @@ function truncatingCompactor(name: string): Compactor {
 
 function makeRecordingContextStore(opts?: {
   failCommit?: boolean;
+  failCommitRemaining?: { n: number };
   initialTurns?: ConversationTurn[];
 }): {
   store: ContextStore;
@@ -5313,6 +5314,10 @@ function makeRecordingContextStore(opts?: {
       if (opts?.failCommit === true) {
         throw new Error("commit failed");
       }
+      if (opts?.failCommitRemaining !== undefined && opts.failCommitRemaining.n > 0) {
+        opts.failCommitRemaining.n -= 1;
+        throw new Error("commit failed");
+      }
       commits.push({
         message: options.message,
         turns: [...lastWrittenTurns],
@@ -5674,6 +5679,64 @@ describe("createReactor — transform chain ordering and compact action", () =>
     expect(seenLengths[1]).toBeGreaterThan(1);
   });
 
+  test("failed compact commit does not replaceTurns stale output on a later infer cycle", async () => {
+    const seed: ConversationTurn[] = [
+      { role: "user", content: [{ type: "text", text: "a" }], timestamp: 1 },
+      { role: "user", content: [{ type: "text", text: "b" }], timestamp: 2 },
+      { role: "user", content: [{ type: "text", text: "c" }], timestamp: 3 },
+    ];
+    const recording = makeRecordingContextStore({
+      failCommitRemaining: { n: 1 },
+      initialTurns: seed,
+    });
+    let inspectLength = 0;
+    let messages = 0;
+    const director: ReactorDirector = {
+      async decide(event, state, caps) {
+        if (event.type === "message.received") {
+          messages++;
+          if (messages === 1) {
+            return caps.compact("tail-only", "explicit-test");
+          }
+          if (messages === 2) {
+            return caps.infer();
+          }
+          inspectLength = state.turns.length;
+          return caps.done();
+        }
+        if (event.type === "inference.done") {
+          return caps.wait();
+        }
+        return caps.done();
+      },
+    };
+    const { reactor, waitFor } = createDirectReactor({
+      contextStore: recording.store,
+      director,
+      compactors: { "tail-only": truncatingCompactor("tail-only") },
+      inferenceRunner: mockInferenceRunner("live-after-failed-compact"),
+    });
+    reactor.start();
+    reactor.deliver(makeInboundMessage());
+    setTimeout(() => reactor.deliver(makeInboundMessage()), 30);
+    setTimeout(() => reactor.deliver(makeInboundMessage()), 80);
+    await waitFor("reactor.done");
+
+    const liveWrites = recording.writeTurnsCalls.filter((turns) =>
+      turns.some(
+        (turn) =>
+          turn.role === "assistant" &&
+          turn.content.some((b) => b.type === "text" && b.text === "live-after-failed-compact"),
+      ),
+    );
+    expect(liveWrites.length).toBeGreaterThan(0);
+    expect(liveWrites.some((turns) => turns.length === 1)).toBe(false);
+    expect(inspectLength).toBeGreaterThan(1);
+    const inferCommit = recording.commits.find((c) => c.message.startsWith("Cycle: inferred"));
+    expect(inferCommit).toBeDefined();
+    expect(inferCommit?.turns.length).toBeGreaterThan(1);
+  });
+
   test("compact for an unknown name emits a fatal error and shuts down", async () => {
     const recording = makeRecordingContextStore();
     const { reactor, events, waitFor } = createDirectReactor({

vendor/intx-inference/src/reactor.ts

@@ -1098,6 +1098,9 @@ export function createReactor(config: ReactorConfig): Reactor {
         `Cycle commit failed: ${cause instanceof Error ? cause.message : String(cause)}`,
         false,
       );
+      // A staged compact must not leak into a later infer/tools cycle: skip-write
+      // plus replaceTurns would publish stale compact output over live memory.
+      pendingCompactOutput = null;
       resetCycleAccumulators();
       return;
     }