fix(compression): preserve instruction blocks from lossy engines (#13523)

Lossy compression engines leave `<system-reminder>`, `<instructions>` and `<project-instructions>` envelopes byte-identical. Agentic CLIs inject these into user messages, and compressing them inverted negations, dropped emphasis and broke the tags (#13453).

Maintainer fixes: (1) the new test imported `../../open-sse/…` from `tests/unit/compression/`, which does not resolve, so it had never run. With the path fixed, the main case failed: the envelopes were appended to the built-in list, so fenced code and inline code inside the reminder had already become sentinels, and `replacePattern` skips any match containing one. The envelopes now form a region pass right after frontmatter, before fenced-code extraction; all 4 cases and the full compression suite (1,518) pass, and the compression budget gate reports no regression. (2) Dropped an unused `tombstoned` binding. (3) The branch also carried an unrelated `feat(sveltekit)` commit (`apps/web/**`), so it was reset to the release tip plus only this commit, authorship preserved.

Validated in one consolidated batch of this series (37 PRs boarded together on `release/v3.8.51`): `typecheck:core`, `check:open-sse-typecheck` and `check:dashboard-typecheck` clean; ESLint clean on every changed file; file-size, complexity, cognitive-complexity, changelog-integrity, docs-counts, docs-sync and migration-numbering gates green (only the pre-existing `open-sse/utils/stream.ts` file-size red remains, inherited from the base); 3,743 focused `node:test` cases plus 34 vitest cases green.

Thanks @KooshaPari!

open-sse/services/compression/preservation.ts

@@ -87,6 +87,23 @@ export function extractPreservedBlocks(
   let result = text;
 
   result = extractFrontmatter(result, addBlock);
+
+  // Whole-region patterns run before fenced code and the inline built-ins: those leave
+  // sentinels inside a region, and replacePattern skips any match that already holds one.
+  // #13453: the instruction envelopes agentic CLIs inject into user messages —
+  // compressing them inverts negations, drops emphasis and breaks the XML tags.
+  const regionPatterns: CompiledPattern[] = [
+    { pattern: /<system-reminder>[\s\S]*?<\/system-reminder>/g, kind: "system_instruction" },
+    { pattern: /<instructions?>[\s\S]*?<\/instructions?>/g, kind: "system_instruction" },
+    {
+      pattern: /<project[- ]instructions?>[\s\S]*?<\/project[- ]instructions?>/g,
+      kind: "system_instruction",
+    },
+  ];
+  for (const { pattern, kind } of regionPatterns) {
+    result = replacePattern(result, ensureGlobal(pattern), kind, addBlock);
+  }
+
   result = extractFencedCodeBlocks(result, (content) => addBlock(content, "fenced_code"));
 
   const builtIns: CompiledPattern[] = [

tests/unit/compression/preserve-system-reminder.test.ts

@@ -0,0 +1,114 @@
+/**
+ * Tests for #13453: preserve <system-reminder> blocks from lossy compression.
+ *
+ * Agentic coding CLIs (Claude Code, Codex, etc.) inject project instructions
+ * into user-role messages wrapped in <system-reminder>…</system-reminder> envelopes.
+ * Lossy compression engines (ultra, aggressive, caveman, etc.) were rewriting
+ * these instruction blocks as prose, dropping negations and breaking XML tags.
+ *
+ * The fix adds <system-reminder> to the preservation patterns so they survive
+ * compression byte-identical.
+ */
+import { test } from "node:test";
+import assert from "node:assert/strict";
+import { extractPreservedBlocks } from "../../../open-sse/services/compression/preservation.ts";
+
+const INSTRUCTION_BLOCK = `<system-reminder>
+Project instructions (auto-injected by the coding agent CLI, role=user):
+
+# Deploy rules
+
+- NEVER run \`rm -rf\` on the target host. Always ask first.
+- Do not push to \`main\` directly; open a PR.
+- The backup files \`.app-prev-*\` must never be deleted.
+- Never store the SSH password on disk.
+- Always run \`npm test\` before \`npm run build\`.
+- Do NOT edit files under \`/etc\` by hand.
+
+## Restart procedure
+
+\`\`\`bash
+systemctl --user restart app.service
+curl -sf http://127.0.0.1:20128/health
+\`\`\`
+
+Docs: https://example.com/runbook
+</system-reminder>`;
+
+test("extractPreservedBlocks captures <system-reminder> blocks verbatim", () => {
+  const userMessage = `Here is my request:\n${INSTRUCTION_BLOCK}\n\nPlease deploy the fix.`;
+
+  const { text: tombstoned, blocks } = extractPreservedBlocks(userMessage);
+
+  // The instruction block should be tombstoned (replaced with placeholder)
+  assert.ok(
+    !tombstoned.includes("NEVER run"),
+    "Original instruction text should be replaced with a placeholder"
+  );
+  assert.ok(tombstoned.includes("Here is my request"), "Non-instruction text should remain");
+  assert.ok(tombstoned.includes("Please deploy the fix"), "Trailing text should remain");
+
+  // The preserved block should contain the full instruction text
+  const instructionBlock = blocks.find((b) => b.kind === "system_instruction");
+  assert.ok(instructionBlock, "Should find a preserved system_instruction block");
+  assert.ok(
+    instructionBlock!.content.includes("NEVER run"),
+    "Preserved block should contain the full instruction text"
+  );
+  assert.ok(
+    instructionBlock!.content.includes("<system-reminder>"),
+    "Preserved block should include the opening tag"
+  );
+  assert.ok(
+    instructionBlock!.content.includes("</system-reminder>"),
+    "Preserved block should include the closing tag"
+  );
+});
+
+test("extractPreservedBlocks captures <instructions> blocks", () => {
+  const text = `Before\n<instructions>\nDo NOT touch production.\n</instructions>\nAfter`;
+
+  const { text: tombstoned, blocks } = extractPreservedBlocks(text);
+
+  const instructionBlock = blocks.find((b) => b.kind === "system_instruction");
+  assert.ok(instructionBlock, "Should find a preserved system_instruction block");
+  assert.ok(
+    instructionBlock!.content.includes("Do NOT touch production"),
+    "Preserved block should contain instruction text"
+  );
+  assert.ok(
+    !tombstoned.includes("Do NOT touch production"),
+    "Instruction text should be tombstoned"
+  );
+});
+
+test("extractPreservedBlocks captures <project-instructions> blocks", () => {
+  const text = `Before\n<project-instructions>\nNEVER delete the database.\n</project-instructions>\nAfter`;
+
+  const { blocks } = extractPreservedBlocks(text);
+
+  const instructionBlock = blocks.find((b) => b.kind === "system_instruction");
+  assert.ok(instructionBlock, "Should find a preserved system_instruction block");
+  assert.ok(
+    instructionBlock!.content.includes("NEVER delete the database"),
+    "Preserved block should contain instruction text"
+  );
+});
+
+test("non-instruction text outside <system-reminder> is still compressible", () => {
+  const text = `Normal prose that can be compressed.\n<system-reminder>Do NOT do X</system-reminder>\nMore normal prose.`;
+
+  const { text: tombstoned } = extractPreservedBlocks(text);
+
+  // The prose around the instruction block should still be tombstoned
+  // (i.e. the prose can be compressed, but the instruction block is protected)
+  assert.ok(
+    tombstoned.includes("Normal prose that can be compressed"),
+    "Non-instruction prose should remain in the tombstoned text"
+  );
+  assert.ok(tombstoned.includes("More normal prose"), "Trailing prose should remain");
+  assert.ok(
+    !tombstoned.includes("Do NOT do X"),
+    "Instruction text should be replaced with placeholder"
+  );
+});