fix(compression): couple pruned-skill reload instruction to the preserved todo snapshot

[teknium1]

Summary

Part of #84718 — the retention asymmetry at the compaction boundary: compaction re-injects the todo list verbatim (TODO_INJECTION_HEADER + TodoStore.format_for_injection) while skill instructions are pruned down to [SKILL_PRUNED: ...] markers. The imperative crosses the boundary; the policy that governed it does not. In the issue's forensic trace (T6), the agent kept executing a stale remove task whose justification, refuting evidence, and governing skill were all deleted.

This PR closes the asymmetry at the injection site with a scoped, zero-recurring-cost coupling: when the compressed transcript carries [SKILL_PRUNED: ...] markers AND a todo snapshot is being re-injected, the snapshot block also carries a bounded reload notice naming each pruned skill with its exact skill_view(name='...') call, plus a one-line instruction to re-check that preserved tasks are still justified after reloading. Skill guidance recovery now travels in the same boundary artifact as the imperative.

Mechanism

• _pruned_skill_reload_notice(compressed) (new, agent/conversation_compression.py) scans the post-compression transcript for canonical markers via the existing _extract_pruned_skill_names — covering both the summary's ## Pruned Skills section and pruned tool rows surviving in the protected tail. First-seen order, deduplicated, capped by the shared _MAX_PRUNED_SKILL_MARKERS.
• The injection site appends the notice after TODO_INJECTION_HEADER inside the same block, so:
  • _strip_stale_todo_snapshot removes snapshot + notice together at the next boundary (no accumulation, Prevent todo snapshot injection after compression #26981 parity);
  • the synthetic-row classifier (_is_synthetic_compression_user_turn keys on the header prefix) is unaffected — the row still never counts as real human intent (fix(compression): preserve zero-user provenance in compaction summaries #69292 provenance preserved).

Invariants held

• Cache/byte-stability: the notice is derived only from the compressed transcript — same input, same bytes; no per-turn nondeterminism in the rebuilt prompt. Compression remains the only sanctioned mutation.
• Zero recurring cost: sessions with no pruned skills are byte-identical to before. No per-item rationale storage, no execution gate (cron/subagent sessions keep executing), no verbatim 18KB skill carry that would defeat compression.
• No marker self-feed: the notice references skills without the canonical [SKILL_PRUNED: prefix, so it can never re-trigger the marker extractor at a later boundary (test-pinned).
• Role alternation: text-only change inside the existing snapshot block; merge/standalone-append logic untouched.

Tests

tests/agent/test_skill_todo_retention_parity.py (12 tests):

• unit contract of the notice builder — naming every pruned skill with its reload call, tail tool-row collection, dedup + first-seen order, _MAX_PRUNED_SKILL_MARKERS cap, byte-determinism, no marker self-feed;
• behavioral compaction runs through the real _compress_context path against a real SessionDB — notice travels with the snapshot into the trailing user message, absent when nothing was pruned, synthetic-row classification unbroken, strip lifecycle keeps exactly one snapshot+notice across repeated boundaries.

Sabotage-verified: disabling only the append flips the 3 behavioral tests red.

Also ran green locally: tests/agent/ -k "compress or compaction or todo or ghost or skill" (691 passed), tests/tools/test_todo_tool.py, ghost-skill pruning, zero-user provenance, rotation-state suites; ruff + Windows-footgun checks clean.

Relationship to other work

Complementary to draft #86267 (todo reframe + digest work): this PR is deliberately minimal and touches only the injection-site coupling — it does not add skill digests, provenance fields, or execution gates, which remain the design fork tracked in #84718.

Infographic

[github-actions]

૮ >ﻌ< ა ci review

_{ran on a6f911f — fix(compression): couple pruned-skill reload instruction to}

⚠️ Warnings

CI timings · View report · View job

Wall time 6m23s vs 3m43s (+71.7%). 15 job(s) slower, 9 faster,

• Python tests / Run tests slice 5/12: -59.0s
• Python tests / Run tests slice 7/12: -42.0s
• Python tests / Run tests slice 9/12: +39.0s
• Python tests / Run tests slice 12/12: -37.0s
• Python tests / Run tests slice 4/12: -30.0s

---

OSV vulnerability scan · View job

5 known vulnerabilities found in pinned dependencies.

• CVE-2026-67213 in package-lock.json
• CVE-2026-67213 in website/package-lock.json
• CVE-2026-70608 in package-lock.json
• CVE-2026-56876 in package-lock.json
• CVE-2026-70606 in package-lock.json

How to fix:

Review the findings in the Security tab. Update the affected dependencies if a patched version is available.