[PR] fix(#5175): strip drifted open-tag names and mid-turn draft envelopes

docs/configuration.md

@@ -297,7 +297,7 @@ This index is generated from `website/config-reference/*.yaml` — edit the seed
 | `compress.maxSummaryLength` | number | kernel 20000 | — | Hard character cap on ONE generated summary; longer replies are rejected whole (no truncation, no retry). External summarizers are told this exact cap up front (#3635). 0 = unbounded. |
 | `compress.minSummaryLength` | number | kernel 50 | — | Character floor for generated summaries: a single range must meet it alone; a multi-range batch passes when its combined summaries reach it (#5894). 0 = disabled. External summarizers remain held to the per-summary floor (#3635). |
 | `compress.reconcile` | "off" \| "warn" \| "repair" | "repair" | BILI_FOLD_RECONCILE | Reconcile folded state when the client rewinds or rewrites history between turns. |
-| `compress.promptPack` | string (builtin: "default", "lean") | builtin "default" | — | Compression prompt pack, resolved project pack → user pack → builtin; not gated by acknowledgePromptsRisk. |
+| `compress.promptPack` | string (builtin: "default", "lean", "chat") | builtin "default" | — | Compression prompt pack, resolved project pack → user pack → shipped pack → builtin; not gated by acknowledgePromptsRisk. |
 | `compress.tiers` | boolean | true | — | Tiered T1→T3 distillation spreads folding cost across generations. |
 | `compress.protectedTools` | string[] | none | — | Hard exclusion across all history: results of listed tools never fold. Path patterns (skill/<name>) select skills by name (#1947). |
 | `compress.protectedLatestTools` | string[] | none | — | Protects only the LATEST instance of cumulative-snapshot tools whose newest result supersedes older ones (e.g. todo lists). Path patterns keep the latest instance per skill (skill/*, #1947). |

docs/configuration.zh-CN.md

@@ -297,7 +297,7 @@
 | `compress.maxSummaryLength` | number | kernel 20000 | — | 单条生成摘要的硬字符上限；超长的回复被整段拒绝（不截断、不重试）。外部摘要模型会被提前告知这个确切上限（#3635）。0 = 不限制。 |
 | `compress.minSummaryLength` | number | kernel 50 | — | 生成摘要的字符下限：单段压缩按自身判定；批量压缩按合计判定——一段偷懒不再拖垮整批（#5894）。0 = 禁用。外部摘要模型仍受逐段下限约束（#3635）。 |
 | `compress.reconcile` | "off" \| "warn" \| "repair" | "repair" | BILI_FOLD_RECONCILE | 客户端在轮次之间回退或改写历史时校准已折叠状态。 |
-| `compress.promptPack` | string (builtin: "default", "lean") | builtin "default" | — | 压缩提示词包，按 项目包 → 用户包 → 内置 解析；不受 acknowledgePromptsRisk 门控。 |
+| `compress.promptPack` | string (builtin: "default", "lean", "chat") | builtin "default" | — | 压缩提示词包，按 项目包 → 用户包 → 随包附带（chat）→ 内置 解析；不受 acknowledgePromptsRisk 门控。 |
 | `compress.tiers` | boolean | true | — | T1→T3 分级蒸馏把折叠成本摊到多代。 |
 | `compress.protectedTools` | string[] | none | — | 全历史硬排除：列出工具的结果永不折叠。路径模式（skill/<name>）可按名指定 skill（#1947）。 |
 | `compress.protectedLatestTools` | string[] | none | — | 只保护累积快照类工具「最新一次」实例（新结果覆盖旧结果的工具，如 todo 列表）。路径模式按 skill 分组各保最新（skill/*，#1947）。 |

src/degenerate-turn.ts

@@ -68,9 +68,44 @@ export function degenerateTurnWarning(o: TurnOutcome): string | null {
 // different defect class — #1755/#2190 — and stay out of scope), case-
 // insensitive (#1731 case drift), trailing whitespace allowed.
 const DRAFT_CLOSE_TAIL = /\x3c\/(?:summary|analysis)\x3e\s*$/i;
+// #5175: the envelope form. When the model writes the WHOLE draft as prose the
+// close above is not at the end of the text — `</analysis>` is followed by the
+// `<summary>` BODY, tens of thousands of characters of it, so the `$` anchor can
+// never match and the turn slipped through as an ordinary answer. The envelope
+// signature is exactly the ordering the client's compaction contract describes
+// ("an <analysis> block followed by a <summary> block"): an analysis close
+// IMMEDIATELY followed by a summary open, whitespace between them. Corpus census
+// (8225 fields, 462 sessions): 25 fields carry it, 5 carry the full open…close
+// envelope, and only ONE — the already-handled tail form — ends with it. Nothing
+// else in the corpus produces that adjacency, so it cannot false-positive on
+// prose that merely mentions the words.
+const DRAFT_ENVELOPE = /\x3c\/analysis\x3e\s*\x3csummary\x3e/i;
+const SUMMARY_CLOSE = /\x3c\/summary\x3e/i;
 export function endsWithDraftClose(text: string): boolean {
     return text.length > 0 && DRAFT_CLOSE_TAIL.test(text);
 }
+/** #5175: the draft-envelope shape — a handoff/compression draft written as
+ *  prose in either of its two observable forms: the closing tag at the very end
+ *  (#2303), or the analysis→summary envelope (#5175). Both mean the model
+ *  narrated the action instead of issuing it, so both are non-converged.
+ *
+ *  The envelope counts only while the draft is UNFINISHED. A complete
+ *  `</analysis><summary>…</summary>` followed by substantive prose delivered
+ *  BOTH the draft and an answer — the turn converged, and re-issuing it appends
+ *  a duplicate answer on the real chat pipe (measured: pristine master keeps a
+ *  single answer, the unconditional envelope rule produced answer + retry
+ *  answer). The reported dumps are always open-ended — the model stops inside
+ *  the summary body (#5175) or right at the analysis close (#2303) — so recall
+ *  is unchanged: the only hits this gives up are complete drafts that kept
+ *  writing, which are exactly the false positives. */
+export function isDraftDump(text: string): boolean {
+    if (text.length === 0) return false;
+    if (DRAFT_CLOSE_TAIL.test(text)) return true;
+    const env = DRAFT_ENVELOPE.exec(text);
+    if (env === null) return false;
+    // Still inside the draft: the summary body is truncated mid-flight.
+    return !SUMMARY_CLOSE.test(text.slice(env.index + env[0].length));
+}
 
 // #2612: the #2303 draft-tail shape has a legitimate producer — the CLIENT's
 // own summarization request. Claude Code's compaction (/compact, auto-compact,

src/loop/core.ts

@@ -47,7 +47,7 @@ import { isStrictReasoningEcho, modelIdOf, normalizeStrictEchoBody } from "../st
 import { log as loggerLog } from "../logger.js";
 import { promptInputTotal, type WireProtocol } from "../util.js";
 import { DEGENERATE_RETRY_NUDGE } from "../degenerate-retry.js";
-import { endsWithDraftClose, lastUserSummaryInstruction, requestExpectsProseSummary } from "../degenerate-turn.js";
+import { isDraftDump, lastUserSummaryInstruction, requestExpectsProseSummary } from "../degenerate-turn.js";
 import { safePrefix, safeSuffix, scrubLoneSurrogateEscapesOnJson } from "../text-safe.js";
 
 export const MAX_LOOP_ROUNDS = 10;
@@ -1248,9 +1248,10 @@ export async function* runCompressLoop(
                     }
                 }
 
-                // #2303: a terminal turn that DID deliver visible prose but ends with a
-                // compression-draft closing tag (summary/analysis close forms) and no
-                // tool call — the model wrote a handoff/compression draft in prose
+                // #2303: a terminal turn that DID deliver visible prose but carries a
+                // compression-draft dump (tail close form, or the analysis-to-summary
+                // envelope mid-text, #5175) and no tool call — the model wrote a
+                // handoff/compression draft in prose
                 // instead of issuing the action it described, most often after the
                 // upstream cut the final tool call out of the step (149 silent stops /
                 // 70 sessions, DSH native). Same non-convergence as the zero-visible
@@ -1273,7 +1274,7 @@ export async function* runCompressLoop(
                     !ctx.textProtocol &&
                     assistantText.length > 0 &&
                     calls.length === 0 &&
-                    endsWithDraftClose(assistantText) &&
+                    isDraftDump(assistantText) &&
                     // #2612: the client's own compaction request instructs the
                     // model to answer with a plain-text summary block and no
                     // tool call — that compliant reply is a draft tail by
@@ -1283,7 +1284,7 @@ export async function* runCompressLoop(
                     !signal?.aborted
                 ) {
                     degenerateRetried = true;
-                    ctx.log(`[acp-loop] round ${round}: terminal turn ends with a compression-draft closing tag and no tool call; retrying once with continuation nudge (#2303)`);
+                    ctx.log(`[acp-loop] round ${round}: terminal turn carries a compression-draft dump (tail or mid-text envelope) and no tool call; retrying once with continuation nudge (#2303)`);
                     loggerLog("warn", `[acp-loop] draft-tail auto-retry round ${round} (session ${ctx.session.id})`);
                     const nudge: CoreMessage = {
                         id: `acp_draft_tail_retry_r${round}`,