Source factrc.2 appends every accepted event to the live Session.log. A surface replacement changes future model input but does not delete those raw records.

One Session. Four budgets.

01 · requestModel context

Compaction replaces older surface messages with a summary.

tokens
02 · processLive event log

The append-only array stays resident for the Session lifetime.

heap bytes
03 · storageDurable history

Committed events remain the replay and audit source.

artifact bytes
04 · topologyAgent tree

Continuable children retain handles and Sessions until settlement.

live owners

Follow the retained path.

Prompt size ↓does not proveResident heap ↓

Stop the slope before the abort.

  1. Freeze admissionDo not start another fan-out wave or broad Goal round.
  2. Cancel deliberatelyRecord the parent and children that may have crossed side-effect boundaries.
  3. Flush evidenceUse supported export or flush paths; never edit a live compressed log.
  4. Restart smallerUse a durable handoff, fresh Session, fewer children, and fixed-size batches.

Route a cold-restore restart loop.

At rc.2, the backend read is asynchronous, but Session.fromRestore() synchronously validates, surface-folds, freezes, and appends every seed event. That proves an event-loop-blocking risk—not a universal crash threshold and not the policy of an unidentified desktop wrapper.

Host aliveCPU high · probes pause

Temporary event-loop starvation is plausible. Measure delay against events and bytes.

Host exitsOwn error first

Preserve the exit status and stack before changing supervisor thresholds.

Wrapper actsDeliberate termination

Record its endpoint, threshold, decision time, and replacement PID.

Preserve the discriminatorA fresh Session working while one historical Session repeats the cycle points to Session-specific replay. Keep the original home immutable; test a copied artifact under a separate diagnostic home.

Bind the runtime copy to the PID.

Do not patch both a global installation and a profile copy. Prove which realpaths the recorded Host loaded, restore one supported installation owner, then repeat with identical bytes.

Measure the boundary, not the symptom.

ProcessheapUsed · heapTotal · RSS

Sample at fixed intervals and retain the slope across GC cycles.

Sessionevents by type + bytes

Count closed chunks, final messages, surface nodes, and replacement generations.

Topologyactive · waiting · settled

Separate a concurrent fan-out peak from the parent’s cumulative history.

Use two pressure stages.

Soft thresholdStop new admission.

Emit a typed diagnostic, settle or cancel active work, and flush durable state.

Hard thresholdExit cleanly.

Reject new model and tool work, cancel, flush within a deadline, then let a supervisor restart.

Use sustained samples and hysteresis. Raising --max-old-space-size only delays an unbounded retained term and can move pressure into host swap.

Preserve compatibility.

Durable archive stays completeHot window is byte-boundedCold replay derives the same messagesHuman transcript semantics remain explicitSource references still validatePlugins release closed chunks

Primary evidence.

Keep the full operator design.

The canonical guide adds four controlled reproductions, a cold-restore isolation ladder, one-process timeline, failure router, compatibility questions, and regression gates.

Read and star on GitHub