Land the compaction-loop fix, last_turn counters, and UI cleanup on whip-rlm

[samheutmaker]

Summary

Four commits from the local whip-rlm branch, routed through a PR because whip-rlm requires the go, govulncheck, and codeql checks and rejects direct pushes.

• Compaction loop fix (internal/agent/agent.go): a fold may now cut inside an oversized turn on an assistant/tool-pair boundary, pinning the turn's opening user message verbatim after the summary. A fold with nothing left to fold makes no model call; a fold that cannot get back under the threshold stalls further proactive folds for the turn; a provider context-limit rejection with nothing left to fold fails the turn with ErrCompactionExhausted. The reactive one-retry is decoupled from proactive folds. Background and evidence: .ai-docs/plans/compaction-loop/.
• Reload parity (internal/session/session.go): applyCompaction re-derives the pinned message when the fold point is not a user message.
• Visible child health (internal/session/turn_outcome.go, guide fragment, web agent list): last_turn carries model_calls, compactions, and last_activity_at for the running turn; protocol types regenerated.
• Compaction-model fallback log (cmd/whip/daemon.go): one compaction.fallback line in whip.log when summaries fall back to the conversation model.
• Docs: compaction note in docs/agent-loop.md; Loupe SDK-ergonomics records; distribution test fix.
• UI cleanup across packages/app, apps/web, apps/desktop, and packages/ui.

Merging into whip-rlm triggers release-whipcode.yml.

Test plan

• go test ./internal/... ./cmd/... green (one daemon acceptance test flaked once under full-suite load with database is locked, passed on every isolated rerun).
• npm run check in packages/protocol (tsc, interop, drift), tsc -p packages/app/tsconfig.json --noEmit, npm run test:web (602 tests) green.
• Replay of the incident's real 64-message turn through the new tail selection: 136,638 estimated tokens fold to 18,805 with the opening message pinned and no orphaned tool result.

🤖 Generated with Claude Code

---

Note

High Risk
Changes core context compaction and turn-failure behavior in internal/agent, plus live last_turn projection on every model call; mistakes can truncate agent context or mis-report child health during long tool-heavy turns.

Overview
This PR lands the compaction-loop work in the agent and session layers, plus live child health on agents.list and a round of web/desktop UI polish documented in the accompanying plans.

Compaction can now fold inside a single oversized turn (assistant/tool-pair boundary) while pinning the opening user message verbatim after the summary; applyCompaction on reload re-derives that pin when the cutoff is not a user message. Proactive compaction skips no-op re-folds, stalls when a fold still leaves the prompt at/above the threshold, and surfaces ErrCompactionExhausted on context-limit retry when nothing remains to fold; the reactive overflow retry stays independent. cmd/whip/daemon logs compaction.fallback once per session when the compact model cannot be resolved.

last_turn gains model_calls, compactions, and last_activity_at from model.call.* events (guide + web agent rows); protocol types are regenerated.

The diff also adds extensive .ai-docs/plans/ write-ups and evidence (compaction incident, empty-workspace front door, loading-state rules, eval-harness simplification record, MCP contracts implementation log, Loupe SDK notes).

UI cleanup (per PR scope, not in the markdown-only diff snippet): honest session-opening placeholders and picker skeletons, New Chat / empty-workspace routing, provider-readiness priming, and related test/doc updates across packages/app and siblings.

^{Reviewed by Cursor Bugbot for commit dd8944f. Bugbot is set up for automated code reviews on this repo. Configure here.}

[github-actions]

🟡 warning This re-pin fires for ANY fold whose first kept row isn't a user message, but the live agent only pins when compactTailStart returned split=true. Two fold shapes reach a non-user fold point WITHOUT a live pin: (a) the clamp in compact() (tailStart = sysIdx+2, splitting turn 1 at its first assistant row) when the walk ended with start == 1 and split=false — live view is [sys, summary, a1, ...] with no pinned q1; (b) rollback/reload of compaction rows recorded by the previous release, where pinning didn't exist. In both cases a restarted session now reloads [sys, summary, q1, ..., a1, ...] — a user message the pre-shutdown agent never had in its view, with the summary already covering that content. That's a view-across-restart divergence, and it grows context on every reload of an old compacted session. Fix: persist a pinned flag (or the pinned raw seq) on the compaction row and only re-derive the pin when the fold actually split, defaulting legacy rows to no pin.

[github-actions]

🔍 loupe · go-review

✅ no issues · 53 files · ⚠️ degraded run

The shown diff is the MCP-import feature set (OpenCode discovery source, project/.mcp.json gate, daemon mcp.import.candidates/apply RPCs, CLI rewrite onto mcp.Candidates/mcp.Apply, web import screen + Welcome/Settings integration, protocol 6.6→6.7) plus login-flow touch-ups; the headline compaction/session changes from the PR description are not in the presented diff, so they could not be reviewed here. I checked the behavior-changed exports and their callers: Merge (now variadic, precedence now opencode < ~/.claude.json < codex < .mcp.json < whip) in config.go/config_test/config_trust_test — consistent; ImportPolicyFrom (project off by default, zero-value ImportPolicy now imports nothing) against its callers in cmd/whip/mcp.go and LoadMerged, which both go through ImportPolicyFrom; mcpImportCLI rewritten onto Candidates/Apply, with the CLI honoring source gates and the web screen deliberately bypassing them after explicit ticks; clientMCPImport/importState mirrors ImportPolicyFrom defaults (project off, others on) including the nil-Enabled case; SelectLoginTeam now also accepting choose_project resets projects/ProjectID correctly; the {env:VAR}→${VAR} rewrite in opencodeReferences resolves correctly under Go's regexp replacement rules (verified ${$1} emits $+{+group+}); Apply drops provenance, clears Enabled, and never exposes headers/env over the Candidate/protocol surface. The design points that looked risky — project-authored .mcp.json importable into trusted native config via the web screen, secrets copied from source configs into ~/.whip/config.json, and the one-shot 'Offered' flag set even on an empty skip — are all deliberate, tested, and documented in the diff.

Run details

• review: headless fallback (agentic run failed)
• verification: skipped
• scope: delta
• dropped: 0 malformed finding(s), 0 malformed concern(s), 0 out of scope, 0 below profile, 0 rejected by verification
• off-diff notes published: 0

Last reviewed commit: 13bce10

[cursor]

Stale Bugbot comment from a previous run.

[cursor]

Stale Bugbot comment from a previous run.

[cursor]

LLM spans close before final settlement

High Severity

Settle always ends the LLM span, including when accounting is only parked in pendingAccounting or when a later model.call.corrected write has the real tokens and cost. endSpanTx refuses to update a span that already has end_ns != 0, so those retries never land. Cancelled calls that interruptOpenSpansTx closes first show up as interrupted with no usage, even though durable model-call accounting was corrected.

Additional Locations (2)

• internal/daemon/spans.go#L262-L296
• internal/session/span.go#L247-L253

 

^{Reviewed by Cursor Bugbot for commit d24b088. Configure here.}

[github-actions]

🟡 warning Switching the stored stamp layout from time.RFC3339 (2026-09-14T19:04:05Z) to a fixed nine-digit fraction (2026-09-14T19:04:05.000000000Z) changes string width and mixes formats with rows already stored in users' databases. The comment says these stamps are 'stored or compared in SQL' — and lexicographically an old stamp sorts after a new stamp at the same second ('Z' > '.'), so any WHERE expires <= ? / ORDER BY created_at-style comparison across pre- and post-upgrade rows can invert or exclude rows at a same-second boundary (e.g. an old …T19:04:05Z fails <= …T19:04:05.000000000Z even though it's equal-or-earlier). Go's time.Parse handles both formats per-row, so this is only a problem where SQL compares the text. If internal/session/migrations.go does not already rewrite existing rows to the new layout (I could not verify), either add a one-time normalization of stored stamps or compare via datetime()/parsed values rather than raw text.

[github-actions]

🟡 warning Regenerating a stream that failed after its first delta re-runs streamOnce with the same onText/onThink/onToolCall callbacks, so every consumer of the stream receives the discarded partial output a second time (e.g. par + ok for a stream that stalled mid-answer). The returned Message is clean because msg is rebuilt per attempt, but persisted text/thinking events and live UI streams are fed by the callbacks, not by the final message. The new RetryEvent.Regenerating/Discarded fields imply the intended contract is 'consumers rewind Discarded characters on a regeneration' — but nothing in the agent/session turn loop appears to do that, so a mid-stream provider stall (exactly the inference.net 30 s no-token case this targets) appends phantom deltas to the event log. Either rewind the discarded bytes in the stream consumer before retrying, or add a rewind signal the TUI/web transcript handles; at minimum cover the duplicate-delta behavior in a test so the contract is explicit.

[github-actions]

🟡 warning row[key] for calls/cost/tokens is now taken straight from state.json with no integrity check left anywhere. This diff deleted verify_snapshot (sessions.db ↔ state.json model_calls and content-bodies agreement), the per-body digest/size checks, and the accounting_snapshot_mismatch cross-check — and integrity.py/result_evidence.py were removed in the same PR. I verified upstream too: adapter.py's whip_accounting_complete now gates only on observer exit code, cleanup, evidence_errors, and final_accounting_complete, so nothing re-establishes the lost coverage. Concrete failure mode: a fetched trial tarball whose state.json call rows were edited (or a partial/desynced artifact upload produced by an interrupted cloud sync) passes missing_required_evidence, identity, and finality checks, so evidence_complete=True and the fabricated known_cost_usd/token totals flow into summarize, arms, and the baseline unchanged — previously the same artifact failed with snapshot_inconsistent/accounting_snapshot_mismatch/content_digest_mismatch. At minimum restore the cheap half (compare model_calls in the copied sessions.db against state["calls"] — it was ~5 of the removed lines) or stop labeling that path evidence-complete so promotion gates don't consume unverified numbers.

[github-actions]

🟡 warning termination() scans diagnostic — the agent's whole cli.stderr plus ndjson error lines — for these substrings before classifying any agent_error. "429" and "rate limit" match ordinary task output: a terminal-bench agent that curls an endpoint and logs "429 Too Many Requests" or writes about "rate limit" in its own work, then fails for an unrelated agent reason, gets termination_source = "provider_error", inflating status_detail.provider_errors and the report's provider-error counts. The old tuple's "429"/"502"/"503"/"520" had the same weakness; the expansion ("rate limit", "stream timed out" etc.) widens it. Restrict the numeric/status tokens to lines matching whip's own error shape (api error: prefix, the ndjson-structured errors) and keep free-form stderr matches to unambiguous whip/provider phrases.

[github-actions]

🟡 warning Behavior change: exit-code parity with the old status vocabulary is lost. Previously a partial run (some trials ungraded / evidence incomplete) exited 2; now build_result emits incomplete for that exact case, and only cancelled/failed exit 2 — so a campaign that finished with missing results, unproven cleanup, or provider errors returns 0, indistinguishable from a complete run to any scripted caller. If that is deliberate, fine; otherwise add "incomplete" to the tuple (the status_detail fields you added make the distinction visible in the JSON payload regardless).

[cursor]

Stale Bugbot comment from a previous run.

[github-actions]

🟡 warning This stalls on any errNoHistory, but errNoHistory also means "nothing foldable yet this round", not "at the floor forever". Concrete trigger: early in a turn the newest assistant/tool pair alone exceeds the tail budget while sys+pinned+that pair push the estimate over the threshold (e.g. pair ≈30% of the window, threshold 50%, tail budget 25%). history=[user] and pinned=[user], so len(history)-len(pinned) <= 0 → errNoHistory → compactStalled = true for the rest of the turn. As the turn then accumulates older pairs that are foldable, proactive compaction never runs again; the turn grows until a provider context-limit rejection and must burn its single reactive retry to survive. Note this branch by definition made no summary call (errNoHistory returns before buildSummaryPrompt/cli.Complete), so stalling here doesn't save the per-round model call the comment cites — that cost is what compactOutcome handles after a real fold. Fix: return nil without setting compactStalled here (re-checking next round is now cheap), and keep the stall only in compactOutcome for the post-fold-still-over-threshold case — matching the PR's own stated split of the two mechanisms.

[github-actions]

🟡 warning compactStalled (and retriedOverflow) are documented as per-turn ("stalls further proactive folds for the turn", "has been spent this turn") but are only reset on the success paths (here and finalAnswer). A turn that fails after stalling — any model error once compactStalled is true — leaks the flag into the next turn, which then runs with no proactive compaction even though the failed turn's messages are new foldable material; the PR description promises the stall is per-turn. Likewise a failed turn that spent retriedOverflow leaves the next turn without its one reactive retry, so a context-limit rejection surfaces raw instead of folding. Fix: reset the three guards at turn entry (top of turn()) rather than only where the turn succeeds.

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

There are 4 total unresolved issues (including 3 from previous reviews).

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 13bce10. Configure here.}

[github-actions]

⚠️ loupe · go-review could not complete this review — whip error: "context deadline exceeded (Client.Timeout or context cancellation while reading body)"

See the Actions run logs for details.