Land the compaction-loop fix, last_turn counters, and UI cleanup on whip-rlm

[samheutmaker]

Summary

Four commits from the local whip-rlm branch, routed through a PR because whip-rlm requires the go, govulncheck, and codeql checks and rejects direct pushes.

• Compaction loop fix (internal/agent/agent.go): a fold may now cut inside an oversized turn on an assistant/tool-pair boundary, pinning the turn's opening user message verbatim after the summary. A fold with nothing left to fold makes no model call; a fold that cannot get back under the threshold stalls further proactive folds for the turn; a provider context-limit rejection with nothing left to fold fails the turn with ErrCompactionExhausted. The reactive one-retry is decoupled from proactive folds. Background and evidence: .ai-docs/plans/compaction-loop/.
• Reload parity (internal/session/session.go): applyCompaction re-derives the pinned message when the fold point is not a user message.
• Visible child health (internal/session/turn_outcome.go, guide fragment, web agent list): last_turn carries model_calls, compactions, and last_activity_at for the running turn; protocol types regenerated.
• Compaction-model fallback log (cmd/whip/daemon.go): one compaction.fallback line in whip.log when summaries fall back to the conversation model.
• Docs: compaction note in docs/agent-loop.md; Loupe SDK-ergonomics records; distribution test fix.
• UI cleanup across packages/app, apps/web, apps/desktop, and packages/ui.

Merging into whip-rlm triggers release-whipcode.yml.

Test plan

• go test ./internal/... ./cmd/... green (one daemon acceptance test flaked once under full-suite load with database is locked, passed on every isolated rerun).
• npm run check in packages/protocol (tsc, interop, drift), tsc -p packages/app/tsconfig.json --noEmit, npm run test:web (602 tests) green.
• Replay of the incident's real 64-message turn through the new tail selection: 136,638 estimated tokens fold to 18,805 with the opening message pinned and no orphaned tool result.

🤖 Generated with Claude Code

---

Note

Low Risk
Documentation-only changes under .ai-docs/plans/ with no runtime, protocol, or security surface modified in this diff.

Overview
Adds internal planning and validation ledgers under .ai-docs/plans/ for desktop Browser work—no application or daemon code appears in this diff.

Browser Design Mode (browser-design-mode/): documents the end-to-end Design Mode product contract (hover/select, floating composer, capture/send via existing chat paths, native overlay architecture), implementation slice checklist with automated gate results, and a narrow hover-outline motion follow-up (100ms ease-out, reduced-motion behavior, native/renderer contracts).

Browser tabs & agent attachment (browser-tabs/): a large phased plan for workspace Browser tabs, SSH previews, permissions, and agent control; frozen integration contracts; agent-initiated tabs and list_tabs-style discovery (marked implemented in the working tree); and evidence notes for SDK/WebSocket, native SSH, and packaged acceptance/release gates.

These files record decisions, ownership boundaries, and test status for reviewers—they are not canonical shipped docs (docs/* links to some of them).

^{Reviewed by Cursor Bugbot for commit 46b6a00. Bugbot is set up for automated code reviews on this repo. Configure here.}

[github-actions]

🔍 loupe · go-review

✅ no issues · 2 files

PR-wide Go/web changes were previously reviewed; this pass reassesses only the two files changed since: the desktop-check workflow now installs the Playwright ffmpeg build (required by smoke.mjs's new recordVideo) and points the smoke at the already-uploaded evidence directory, and smoke.mjs gains drag-geometry diagnostics plus sidebar drag-to-split assertions. Callers verified: smoke.mjs is invoked only by this workflow (env paths are safe — the script mkdirs the artifacts dir, and the upload step at desktop-check.yml:58 already globbed that path); the 'Connect' and 'General' locator updates match the current host-connection-dialog and settings navigation in this PR; the new assertions match the WorkspaceTabs/WorkspaceLayout drag contract (fresh view per sidebar drop, existing tab order preserved, window bounds unchanged, draft preserved). No correctness, concurrency, or security defects found in the reassessed files.

Run details

• review: agentic
• verification: skipped
• scope: delta
• dropped: 0 malformed finding(s), 0 malformed concern(s), 0 out of scope, 0 below profile, 0 rejected by verification
• off-diff notes published: 0

Last reviewed commit: 46b6a00

[cursor]

Stale Bugbot comment from a previous run.

[github-actions]

⚠️ loupe · go-review could not complete this review — whip error: "403 Forbidden: {"error":{"message":"Prompt token size exceeds maximum supported size (1048576). Please contact us if you need a larger context size.","type":"ForbiddenError"}}"

See the Actions run logs for details.

[cursor]

Stale Bugbot comment from a previous run.

[cursor]

Stale Bugbot comment from a previous run.

[cursor]

Stale Bugbot comment from a previous run.

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

There are 6 total unresolved issues (including 5 from previous reviews).

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit ad81db0. Configure here.}

[samheutmaker]

Review follow-ups and final validation

Review follow-ups are complete in 46b6a00209: 20 fixed, 2 already satisfied/obsolete across the 22 open threads. The latest no-op notice, concurrent v19→v20, and V11 peer-v20 findings are included. The latest scan found 32 total threads / 22 open, with no additional findings beyond these.

Review comment(s)	Resolution and regression evidence
#4001849634	Persist explicit compaction Pinned; replay no longer infers it from a non-user tail. internal/session/session.go:336–384, internal/agent/agent.go:1078; reopen/fork + legacy-no-inferred-pin tests in internal/session/compaction_migration_test.go:85,146.
#4010705115	Subscription preserves typed deadline cause before ctx.Err: internal/llm/subscription.go:84–95; TestSubscriptionRetriesAttemptCeilingBeforeHeaders in internal/llm/review_deadline_test.go:12.
#4010705119	Model catalogs have a bounded context covering headers and body in both auth paths: internal/llm/openai.go:734–750; TestModelsBoundsHeadersAndBody, internal/llm/review_deadline_test.go:37.
#4011288116	Legacy whole-second SQL timestamps normalize transactionally with schema 21, preserving precise/empty values: internal/session/compaction_migration.go:15–44, timestamp_migration.go:9–113; ordering and rollback tests in timestamp_migration_test.go:11,115.
#4011667865	Obsolete: regeneration emits stream.discard and consumers rewind: internal/daemon/agent_session.go:178–186, packages/app/src/conversation-rows.ts:224–232, packages/sdk/src/turn.ts:230–232. The raw callback/discard contract is explicit in internal/llm/stall_test.go:112–132; discard boundary test in packages/sdk/test/state.test.ts:175.
#4011702426	Canonical copied SQLite calls/root must match report input: evals/whip_evals/report.py:202–220; tamper/root/corruption regression in evals/tests/test_reports.py:168.
#4011702431	Provider classification uses structured errors or specific provider phrases, not ordinary task output: evals/whip_evals/report.py:65–74; regressions in evals/tests/test_reports.py:195,296.
#4017406215	incomplete exits 2: evals/whip_evals/cli.py:100; run/report status matrix in evals/tests/test_contract.py:265.
#4017702125	No-history checks stay unstalled so later rounds can fold: internal/agent/agent.go:860–869; growth regression in internal/agent/compaction_split_test.go:207.
#4017702132, #4032491604, #4052111031	All per-turn compaction guards reset on every exit via deferred finishTurn: internal/agent/agent.go:493,714–721; reactive/proactive failed-turn regressions in internal/agent/agent_test.go:492,539.
#4033037161	Exact OTLP envelope/span/comma budgeting; oversized singleton fails explicitly: internal/session/otlp_export.go:136–178; TestSplitOTLPByteBounds in internal/session/otlp_split_bounds_test.go:9.
#4042306453	Obsolete: each attempt already uses typed ceiling context around invocation: internal/llm/accounting.go:484–494; ceiling retry regressions in internal/llm/stall_test.go:145 and review_deadline_test.go:12.
#4054315900	Inspector toggles do not change companion identity: packages/app/src/session-tabs.ts:508–514; source/child/both regression in packages/app/test/session-tabs.test.ts:43.
#4054315901	In-place REPL/Trace round trips keep the companion and highlight: packages/app/src/conversation.tsx:164–167; regression in packages/app/test/conversation-agent-dock.test.tsx:111.
#4054372274	Evicted trace selection falls back to retained newest, preserving Whole session: packages/app/src/trace-view.tsx:48–51; tests in packages/app/test/trace-view.test.tsx:102,118.
#4054372278	Native non-passive wheel listener with cleanup: packages/app/src/trace-view.tsx:118–135; cancellation/mount/toggle/unmount regression in packages/app/test/trace-view.test.tsx:133.
#4054883339	Expansion refreshes the clock in the same action: packages/app/src/agent-dock.tsx:124; first-commit duration regression in packages/app/test/agent-dock.test.tsx:175.
#4055037807	Shared compactWithStart sends the notice only after foldability checks: internal/agent/agent.go:983–985,1027–1034 (callers at 549/862/1219). Repeated no-op checks are silent, real-fold callback order is verified in compaction_split_test.go:207–270; all three paths retain start-before-summary/exactly-once coverage in agent_test.go:1070–1140.
#4055037813	Exact v20 identity is treated as peer-completed by v19 and earlier applicable helpers, then migration continues to v21: internal/session/inbox_queue_migration.go:14–33, migrations.go:442–449,471–477,510–514, filesystem_access_migration.go:28–33. No repeated backfill/provenance loss; unsupported identities remain rejected: internal/session/inbox_queue_migration_test.go:10,74,123.
#4055115276	V11 now accepts exact peer-v20 identity: internal/session/turn_outcome_migration.go:28–36. The real production chain is shared through migrations.go:376–449; all 22 stale-snapshot paths (v10..v20 × peer20/21) preserve provenance and prohibit repeated backfill in inbox_queue_migration_test.go:74–121, plus all11 helper progression at :10–72 and rejection coverage at :123.

Independent hardening (not another thread): upgradeV20 now validates exact source20/target21 identity and rejects foreign/mismatched/future schemas before mutation (internal/session/compaction_migration.go:19–44). TestV20UpgradeRejectsUnsupportedSchemaWithoutMutation at internal/session/compaction_migration_test.go:14–83 covers 14 direct/stale20 cases and compares schema version, identity, and change counters. Existing legacy v14–v18 helper guards were not broadened.

Compatibility note: old v20 compactions cannot reveal whether a pin was intentional, so the migration conservatively defaults legacy pins to false; raw messages and summaries are unchanged.

Final validation: All checks passed on 46b6a002096f007ac205671f2c800c6f839196a4 (CI run): Go tests, SDK/browser/performance gates, desktop package/lifecycle (6m15s), mobile, four builds, both runtime platforms, lint, CodeQL, and vulnerability scans. Fresh full portable go test -race -shuffle=on passed at 90.2% statement coverage, above the unchanged 90% floor. Focused/full-session race regressions and independent static/source reviews also passed; no check bypasses, alert dismissals, or threshold reductions were used.

Desktop diagnostic caveat: The preceding a4a9c35986 desktop run failed the drag-preview pointer-alignment assertion once (10px versus the unchanged <2px bound). Controlled font-delay, viewport/scroll, and CPU-throttling tests did not reproduce it. This head adds run-specific geometry, screenshots/video, and the CI FFmpeg prerequisite—not a production drag-logic fix. The fresh hosted diagnostic-enabled lifecycle run passed, but capture affects timing, so the original failure's cause remains unconfirmed.