fix(advisor): bound retained stream and replay state

[luvs01]

Summary

• Bound Advisor guard-owned stream, reconstruction, accumulated usage, and replay retention independently of provider parser leases. Enforce a 32 MiB aggregate limit, a 2 MiB limit per Advisor call's JSON-encoded argument fragments, and per-leg event/call limits even when no shared translator budget is supplied.
• Pass the optional request translator budget through translated delivery and empty-completion continuation paths. Reserve reconstruction space before materialization, keep overlapping owners charged until replacement, and release only Advisor-owned charges on completion, error, or iterator close. Budget refusals use the existing content-free translation_buffer_limit error contract.
• Preserve real-tool passthrough and continuation pairing, add focused retention and wiring regressions, register the tests, and document the ownership contract. Advisor remains opt-in; this change does not enable it.

Verification

Validation recorded for the identical candidate tree, with Bun 1.4.3:

• Advisor test directory (bun test tests/advisor/): 166 passed, 0 failed, 799 assertions across 12 files.
• Layout guards (bun test tests/test-layout.test.ts tests/test-layout-tooling.test.ts): 27 passed, 0 failed, 568 assertions.
• Root TypeScript check (bun node_modules/typescript/bin/tsc --noEmit): exit 0.
• bun run structure:check, bun run privacy:scan, the file-size ratchet, and git diff --check: passed.

The full suite was not run because of shared-worktree resource constraints; broader coverage remains for CI and review. test:changed did not complete after its wrapper initiated dependency installation and is not counted as passing. Live-provider, process-memory/OOM, deployment, and release validation were not run. Security review and maintainer acceptance criteria remain pending; opening this draft does not attest to disclosure-policy compliance or completed security review.

Advisor lane verification (2026-10-15)

Head: 3c854045998c997ef9fa25c50a56fe0b289f07b8.

• bun test tests/advisor/ tests/server/advisor-routes.test.ts: 186 passed / 0 failed.
• bun run typecheck, bun run structure:check, bun run privacy:scan, bun scripts/file-size-ratchet.ts, git diff --check: exit 0.
• Full cross-platform CI: https://github.com/lidge-jun/opencodex/actions/runs/38712599527 (exact head on ci/pr-7134).

All lane commands used fresh OPENCODEX_HOME=$(mktemp -d) CODEX_HOME=$(mktemp -d) sandboxes. Focused local coverage was used because independent worktrees are testing concurrently; the standalone full suite was not run on this PR head. Live-provider consultations were not run. Cross-platform CI below is queued, not passing evidence.

The draft status is preserved. Broad cross-platform results and maintainer review remain required before landing.

Local interaction test: start at origin/dev (7640a942b), merge #7114, then #7134, then #7124. The first two merge cleanly. Adding #7124 requires preserving both changes in gui/src/pages/Advisor.tsx, gui/tests/advisor-save-feedback.test.tsx, structure/advisor.md, structure/gui-and-management-api.md, and tests/advisor/advisor-responses-wiring.test.ts. The locally resolved union passes 248 backend/layout tests, 12 GUI tests, root typechecking and the GUI build. The earlier resolved union also completed bun run test:changed: 15,454 passed / 35 skipped / 0 failed across 628 files; the later refusal-reporting fixes were validated with focused tests. Recommended integration order: #7134 and #7114 first (either order), then resolve #7124 against the landed tree and rerun its exact-head CI. No PR was merged.

#5955 is already integrated as 13212e6ef; #6617 as e2b6eef5c. These are the foundation/admission fixes, not open duplicate PRs.

Review round 1 fix (2026-10-15)

Head: 863b279d540cf1e7cda4017cbf314d7e7bd7efeb.

• Defect found at 3c8540459: every non-empty text/thinking delta of a non-tool leg used one of the 4,096 retained-event slots. A plain Advisor-enabled answer streaming 3,000 thinking + 3,000 text deltas of 4 characters (well under the 16 KiB per-leg character caps) ended after 4,096 events in a translation_buffer_limit 502, even though the model never called the advisor. On dev the same stream passes through.
• Fix: non-empty text/thinking deltas still consume retained bytes but no event slots, since the character caps already bound them; empty deltas are not retained. Signatures, redacted blocks and Advisor argument fragments keep the count limit. structure/advisor.md updated.
• New regression ordinary token-sized text and thinking deltas never exhaust the event count fails on 3c8540459 and passes on this head.
• bun test tests/advisor/ tests/server/advisor-routes.test.ts: 185 passed / 0 failed. bun run typecheck, bun run structure:check, bun run privacy:scan, bun scripts/file-size-ratchet.ts, git diff --check: exit 0.
• Union dev + fix(advisor): bound retained stream and replay state #7134 (this head) + fix(gui): select Advisor model from the routed catalog #7114 + feat(advisor): add activity and evidence-based adaptive consultation #7124, using the same five conflict resolutions as before: 317 passed / 0 failed across the Advisor, route, layout, skill-surface, file-size and Lab-boundary tests; 12 GUI tests passed; typecheck and structure check exit 0.
• Full cross-platform CI: https://github.com/lidge-jun/opencodex/actions/runs/38714243261 (exact head on ci/pr-7134; queued, not passing evidence yet).

Checklist

• Scope stays focused and avoids unrelated cleanup.
• Docs or release notes were updated when needed.
• Security-sensitive changes were reviewed for secrets, auth, and unsafe defaults.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

✅ Deterministic PR hygiene checks passed.

[luvs01]

Author follow-up: at 863b279d540cf1e7cda4017cbf314d7e7bd7efeb, tests/helpers/responses-core-source.ts still needs advisor-retention.ts in RESPONSES_CORE_MODULES. The new module is imported by advisor-slot.ts and reached by the core graph.

Please include that inventory entry and validate bun test tests/responses/responses-core-modules.test.ts. The previous HEAD failed on this exact graph/inventory mismatch: https://github.com/lidge-jun/opencodex/actions/runs/38698641835/job/116305110648

Current-head CI is still queued; the observation above is from the current source, not a current-head CI failure.

[lidge-jun]

Being carried into #7219 with your authorship preserved; this PR will be closed when the bundle lands.

[lidge-jun]

Landed on dev in 329d91b via #7219 (your change is its own commit in that bundle, and the squash keeps your authorship as Co-authored-by). Thank you!