Checkpoint follow-ups from the #923 review: two windows for one line, a transcript walked twice a boundary, an unpinned double-composed page, a sleep-poll, and a dead rung #979

The owner of internal/session/checkpoint.go reviewed PR #923 (feat/turn-promotes-itself) twice. The three blockers and the peer's six were closed in that PR; these are the follow-ups both passes left open, in the reviewer's own words. They are separate defects and want separate commits.

1. The net's line and the compaction line are drawn from two different windows, and the net's is the higher one

internal/session/inherit.go:233-243 — contextRoomFor uses a.childWindow(model), which for the agent's own model returns a.window() — the model's raw claim. Compaction uses a.compactThreshold() = compactThresholdOf(a.trustedWindow()) (loop.go:3972), the claim with every learned memo applied over it, and trusted ≤ claimed by construction. So on any model this process has learned to distrust, the net's line sits above the line compaction already folds at, and the net can never fire for that model at all. The doc comment claims the opposite — "THE LINE IS THE ONE THIS BUILD ALREADY DRAWS and not a second opinion about it". Route both readers through TrustedWindowFor(model, window).

2. ContextTokens() now runs at every boundary

internal/session/checkpoint.go:2748 — the if mark == 0 { return false } early-out was deleted, so turnHasRunAway takes a.mu and walks every message through estimateTokensLocked (loop.go:4698) on every step — duplicating the identical walk maybeCompact performs eight lines later. One reading of that quantity per boundary, shared, is the one-mechanism answer (bar #1). Note the ≤50 ms law does not cover it: loop_speed_test.go's filling fakes PromptTokens in the response rather than growing the transcript, so the walk under test is over a handful of messages.

3. promotedSystem can compose the page twice, and nothing pins that it does not

internal/session/inherit.go:344-361, 377-382 — quick.system is messageContentText(seed[0]), i.e. the caller's fully rendered messages[0] — page plus placesText plus standingText plus the decisions record. adoptSeed sets child.system to that plus the tail; refreshSystemLocked (memory.go:1398-1403) then composes a.system + a.placesText + a.standingText and appends the child's own recordText. Any non-empty child places/standing/decisions is therefore appended a second time, and the shared prefix — "the whole economic argument for inheriting anything" — breaks on the first differing byte. The comment asserts refreshSystemLocked "rewrites the same bytes"; nothing pins it. Add the assertion: messages[0] byte-identical across the child's first refresh.

4. awaitReading is a sleep-poll that gives up silently

internal/session/route_judge_test.go:309-319 — 5,000 iterations of time.Sleep(time.Millisecond) waiting on c.marks > 0, and on timeout it simply returns. It is the real sleep the owner's standing preference asks lanes not to write (deterministic clocks over real sleeps on a shared box), and a helper that returns quietly on timeout converts a genuine ordering bug into a differently-shaped failure five seconds later. Signal off the sidecar's own completion rather than polling.

5. checkpointMarkAt(checkpointMarks) is dead in production

checkpointMeter.round caps at checkpointNotes, so rung 3's geometric round is only ever reached by fixtures.

Every fixture in internal/session/checkpoint_test.go still opens with rounds := checkpointMarkAt(checkpointMarks), which is now a test-only spelling of "long enough". Either the helper says so, or the fixtures stop asking for a rung that no turn reaches.

Replication

All five are read off the tree at dev once #923 lands; 1, 2, 3 and 5 are structural and want a reading of the named lines, 4 is internal/session/route_judge_test.go.

Acceptance

1. one function answers "how much room is left" for both the net and compaction, over TrustedWindowFor, with a test on a model carrying a shrinking memo;
2. one reading of the context per boundary, shared by the net and maybeCompact, with the ≤50 ms law exercising a transcript that really grew;
3. a test asserting a promoted child's messages[0] is byte-identical to its caller's after the child's first refreshSystemLocked, with non-empty places and standing on both;
4. awaitReading replaced by a signal off the sidecar, and a timeout that fails rather than returns;
5. no production caller of checkpointMarkAt(checkpointMarks), and the fixtures naming what they actually want.

Filed out of the review at ~/af-review-923.md (items 5, 6, 7, 8, 10 of the first pass, carried unchanged into the second).

🤖 Generated with Claude Code

Drafted with CodeAF · reviewed and owned by the author