fix(agent): bound managed staging by reclaiming superseded deltas

[chlee1001]

What

Managed fallback stages a whole attempt in ManagedAttemptTransaction so a discarded one stays unobservable. Every staged streaming frame carries the WHOLE accumulated partial twice — once as message, once as assistantMessageEvent.partial — so staged bytes grow with the square of the response length.

Reaching the cap now reclaims the staged *_delta increments first; only a batch that still cannot fit fails. Each increment's complete value is re-published by its block's *_end frame and by the terminal message_end / done frames, and those are retained, so the replayed sequence still delivers the full turn.

Unchanged by design:

• nothing is published early — the batch stays all-or-nothing, so a discarded attempt remains unobservable
• the local overflow still carries no transport facts, so it never consumes or rotates the fallback chain
• a single oversized event keeps its pre-clone rejection (witnessReads === 1 contract)
• per-frame event-time distinctness is untouched (replays mutating provider partials as event-time snapshots and the degraded-snapshot sibling still pass unmodified)

Why

A reasoning-heavy turn of a few thousand tokens crossed the 16 MiB cap and killed the run with Managed fallback attempt exceeded the provisional event buffer limit, even though no single event came close to the cap and the attempt itself was healthy.

Measured on 0.13.3 before the fix, driving the real agentLoop with a mock provider:

stream	before	after
4-char deltas, 7,200 chars	ok	ok
4-char deltas, 8,000 chars (~2k tokens)	dies	ok
8-char deltas, 11,200 chars	dies	ok
4-char deltas, 80,000 chars (20,000 deltas, also over the 10,000-event cap)	dies	ok
same stream with fallbackManaged: false	ok	ok

Field case: session with profile chain zai/glm-5.2:medium -> commandcode-goat/meta/muse-spark-1.2-contributor. Three consecutive turns died on this error; the turns that succeeded were 1,636 and 1,731 output tokens, and the dead ones streamed 45-70s before reporting usage=0.

Related, but neither covers this:

• bug(transport): Codex websocket stays 'request already in progress' after turn abort; fallback then re-overflows provisional event buffer #4534 mentions the same error string, but PR fix(ai): release Codex websocket on consumer abort #4556 fixed the follow-on Codex websocket leak and states its scope explicitly: "without reinterpreting local buffer overflow as provider transport evidence or advancing the managed fallback chain". Reproduced here on zai / anthropic-messages, which never touches the Codex websocket path.
• fix(agent): make managed-fallback provisional buffer limits configurable via env #4602 exposes the caps as env knobs. That moves the threshold; the growth is quadratic, so the same turn dies a bit later.

Testing

Added completes a long managed stream by reclaiming superseded increments instead of failing: 200 x 1 KiB increments stage ~40 MiB uncompacted. It fails on the parent commit with the exact user-facing string, and passes with the fix:

Received: "Managed fallback attempt exceeded the provisional event buffer limit"
(fail) managed attempt transaction > completes a long managed stream by reclaiming superseded increments instead of failing

It also pins that the fallback chain is never consumed (outcomeCalls === 0), that increments were actually reclaimed (fewer replayed text_delta than pushed), and that the retained path still delivers the block's complete content (text_start / text_end present, text_end.content is the full text).

• bun test packages/agent/test/managed-attempt-transaction.test.ts -> 55 pass / 0 fail (all 54 pre-existing assertions unchanged)
• bun test packages/agent/test/ -> 783 pass / 0 fail
• bun --cwd=packages/agent run check -> biome + tsc clean

Scope note on the root bun run check:ts: it does not pass on a pristine dev worktree either, before this change — packages/coding-agent/src/internal-urls/gjc-protocol.ts(21,51): error TS2307: Cannot find module './docs-index.generated' (generated module absent until generate-docs-index runs). A second failure, telegram-daemon-generation-guard.test.ts reporting ENOENT for a file that exists, appears only under the parallel run and passes standalone in the same tree. Neither touches packages/agent.

GJC verdict

gajae.pr-review-verdict.v1 merge-approved sha256:d8d9671d17c84116ae9c22c90f36f348cf8d4df4131cdfd7a3c257bd2b931962 reviewer:architect reviewer-id:Yeachan-Heo evidence:independent adversarial review; repro on parent c83ffe3d fails with exact user-facing string, head passes; bun test packages/agent/test/ 783/0 on cc48e54b and on fix-forward f83d08b596; bun --cwd=packages/agent run check clean; changelog-history-guard pass; exact-head APPROVED review 2026-08-18T00:23:34Z

---

• Target branch is dev
• bun check passes — scoped bun --cwd=packages/agent run check is clean; the root check is red on pristine dev for the unrelated reasons above
• Tested locally
• CHANGELOG updated (if user-facing)
• Verdict above matches the exact PR head (f83d08b), not an earlier commit

---

Maintainer fix-forward (2026-08-18): dev rolled 0.14.0 after this PR's base, so merging the original head verbatim would have placed the new changelog bullet inside the released ## [0.14.0] section. Head is advanced by one merge commit (f83d08b596dcccff5a6e070ee1ecf3da065f0cea) merging dev 6696988b6d in and resolving packages/agent/CHANGELOG.md so the bullet sits under ## [Unreleased] (diff vs dev: exactly one insertion; changelog-history-guard passes). The original contributor commit cc48e54b0d is preserved verbatim as the merge's first parent — code and tests are untouched. Digest above is recomputed for the new exact head with the gate's own command (git diff --binary --full-index --no-ext-diff <merge-base>...<head>).

[Yeachan-Heo]

Independent adversarial review of PR #4610 (fix(agent): bound managed staging by reclaiming superseded deltas).

Defect independently reproduced: applied only the PR's regression test to parent commit c83ffe3 and it fails with the exact user-facing string Managed fallback attempt exceeded the provisional event buffer limit; on the fix head it passes. Quadratic staged-byte growth (each staged frame carries the whole accumulated partial twice) is real, and managed fallback is the default session path whenever a fallback chain has >= 2 entries, so this kills ordinary long reasoning turns.

Correctness audit of the compaction design: all four reclaimed delta types (text_delta, thinking_delta, reasoning_summary_delta, toolcall_delta) have their complete value re-published by retained frames — text_end/thinking_end/reasoning_summary_end carry full content, toolcall_end carries the full parsed tool call, and terminal done/message_end carry the full message (verified in packages/agent/src/proxy.ts). The committed message is built from the live provider partial, never from staged frames, so no content can be lost. Lossless staging path untouched. Attempt atomicity preserved: compaction never publishes, only frees accounting.

Verification on exact submitted head cc48e54: bun test packages/agent/test/ 783 pass / 0 fail (clean env; the single remote-compaction failure seen in a polluted shell is ambient OPENAI_BASE_URL leakage, unrelated and passing standalone), bun --cwd=packages/agent run check (biome + tsc) clean.

Verification on fix-forward head f83d08b (merge of cc48e54 into dev 6696988): agent suite 783/783, package check clean, bun scripts/changelog-history-guard.ts pass, targeted managed-attempt-transaction/agent-loop/verify-pr-verdict tests 112/112.

Maintainer fix-forward applied under maintainerCanModify (one merge commit, no code changes): dev rolled 0.14.0 after the PR base, so the original head's changelog entry would land inside the released section on merge. The merge resolves packages/agent/CHANGELOG.md so the new bullet sits under ## [Unreleased]; git diff origin/dev f83d08b5 -- packages/agent/CHANGELOG.md is exactly one insertion. Contributor commit cc48e54 is preserved verbatim as the first parent.

Advisory (non-blocking, strictly better than today's hard failure): on threshold-crossing turns the replayed delta stream becomes a subsequence, so chunk-folding consumers (e.g. ACP agent_message_chunk) see a suffix-only live stream for those turns; full content is still delivered by the retained *_end/message_end frames, and those turns previously failed the entire run.

—
[repo owner's gaebal-gajae (clawdbot) 🦞]