Bound Workbench producer / completed-envelope render history end to end #681

Priority and scope

P2 — memory and response-size reliability. Follow-up to #666 and #600. Coordinate with production streaming #686, but keep streaming latency and retained-history bounds as separate acceptance criteria.

Audited commit: b435f7b9179271cbff81d3e40d14ee342cbd65dd.

Origin: owner-requested deep-dive, 2026-09-06. Expanded with the complete producer/final/history findings.

Evidence level: source inspection establishes that the replay limit does not bound all retained invocation data. The reviewer has not reproduced an out-of-memory failure or claimed that every renderer has no other internal limit.

Verified gap

The 256-render-event bound applies to one live replay buffer, not the whole invocation lifecycle:

• route-invocation-production.ts: renderCompiled() pushes render events into an array and returns that collection.
• route-invocation-child.ts: the completed child result carries its event collection through IPC.
• route-invocation-service.ts: successful invocations retain events: child.events; completed history and the final stream envelope retain that result. #publishStream() only evicts live render messages.

The final envelope can therefore restore the history that replay eviction discarded. Limiting the number of completed invocations does not establish a bound on retained events or bytes inside each invocation.

Required behavior

Use one documented retention policy across producer collection, child IPC, live replay, completed invocations, history reads, final stream envelopes, and browser replay. Keep the latest/final document separately from disposable intermediate history. Preserve outcome, correlation, and an explicit truncation indication.

Address retained bytes as well as event counts. Handle oversized final documents separately and explicitly; do not silently truncate valid results or introduce an unjustified universal plugin-result limit merely to cap intermediate history.

Acceptance

• Produce substantially more than 256 events through an actual compiled child, not only a mocked renderChild callback.
• Assert producer-retained events and completed invocation.events remain bounded.
• Assert GET/read/history and final-stream responses do not rehydrate the full discarded history.
• Preserve a single truthful truncation indication and the correct final document/outcome/correlation.
• Exercise retained-byte behavior with large intermediate snapshots, not only many tiny events.
• Reconnect after eviction and verify a coherent latest document or an explicit replay limitation.
• Cancel after the shell event has been evicted and after a long progress sequence; retain intelligible partial evidence and correct cancellation status.
• Error, cancellation, and completion paths release disposable producer/IPC buffers and preserve process-tree cleanup.
• Preserve existing live replay behavior; a replay-only test is not sufficient proof of end-to-end bounds.

Test owners

• packages/agent-bundle/tests/route-invocation-service.test.ts
• packages/agent-bundle/tests/route-invocation-dev-server.test.ts
• packages/workbench/tests/invocation-model.test.ts
• packages/workbench/tests/audiobook-curator.acceptance.e2e.test.ts

Non-goals

No durable trace database, remote telemetry, new orchestration layer, or changes to plugin business behavior. Executable selection is #680; production Flight delivery is #686.