@cortexkit/opencode-magic-context 0.41.4 → 0.42.0

package/src/shared/sqlite.ts

@@ -39,12 +39,28 @@
  * `run()` → {changes,lastInsertRowid}) is identical and was verified directly.
  */
 
+import { statSync } from "node:fs";
 // Type import only — runtime is loaded dynamically below. @types/better-sqlite3
 // has the richest definitions and is a structural superset of the API surface
 // we use, so calls typed against BetterSqlite3 work under bun:sqlite and
 // node:sqlite at runtime (both expose prepare/run/get/all/exec/close).
 import type BetterSqlite3 from "better-sqlite3";
 
+/**
+ * Slow-write reporting is injected rather than imported: this module is also
+ * executed directly by Node (the `node:sqlite` smoke in CI, Pi, Desktop), and
+ * Node's type-stripping loader does not resolve extensionless imports, so any
+ * static import of the plugin's logging chain here breaks that path. The
+ * storage bootstrap registers the real reporter; until then slow privileged
+ * writes are simply not logged.
+ */
+type SlowWriteReporter = (site: string, transactionStartedAt: number) => void;
+let reportSlowPrivilegedWrite: SlowWriteReporter | undefined;
+
+export function registerSlowWriteReporter(reporter: SlowWriteReporter): void {
+    reportSlowPrivilegedWrite = reporter;
+}
+
 export type SqliteRuntime = "Bun" | "Node.js";
 
 type SqliteModule = {
@@ -158,6 +174,88 @@ const DatabaseImpl: typeof BetterSqlite3 = isBun
     ? (sqliteModule.Database as typeof BetterSqlite3)
     : buildNodeSqliteDatabaseClass(sqliteModule.DatabaseSync);
 
+interface TrackedSqliteConnection {
+    sequence: number;
+    filename: string;
+    readonly: boolean;
+    reference: WeakRef<BetterSqlite3.Database>;
+}
+
+export interface SqliteConnectionMemoryStats {
+    sequence: number;
+    filename: string;
+    readonly: boolean;
+    pageSize: number | null;
+    pageCount: number | null;
+    freelistCount: number | null;
+    cacheSize: number | null;
+    cacheSizeUnit: "pages" | "kib" | null;
+    cacheUpperBoundBytes: number | null;
+    mmapSizeBytes: number | null;
+    walFileBytes: number | null;
+    shmFileBytes: number | null;
+    fts5TableCount: number | null;
+    journalMode: string | null;
+}
+
+export interface SqliteMemoryStats {
+    connectionCount: number;
+    cacheUpperBoundBytes: number;
+    mmapUpperBoundBytes: number;
+    walFileBytes: number;
+    shmFileBytes: number;
+    sqliteStatusApi: "unavailable";
+    connections: SqliteConnectionMemoryStats[];
+}
+
+const trackedSqliteConnections = new Map<number, TrackedSqliteConnection>();
+let nextSqliteConnectionSequence = 1;
+
+function trackSqliteConnection(
+    db: BetterSqlite3.Database,
+    filename: unknown,
+    options: unknown,
+): BetterSqlite3.Database {
+    const originalClose = db.close.bind(db) as (...args: unknown[]) => unknown;
+    const sequence = nextSqliteConnectionSequence++;
+    const metadata = {
+        sequence,
+        filename:
+            typeof filename === "string"
+                ? filename
+                : Buffer.isBuffer(filename)
+                  ? "<buffer>"
+                  : ":memory:",
+        readonly:
+            Boolean(options) &&
+            typeof options === "object" &&
+            ((options as { readonly?: unknown }).readonly === true ||
+                (options as { readOnly?: unknown }).readOnly === true),
+    };
+    Object.defineProperty(db, "close", {
+        configurable: true,
+        value: (...args: unknown[]) => {
+            try {
+                return originalClose(...args);
+            } finally {
+                trackedSqliteConnections.delete(sequence);
+            }
+        },
+    });
+    trackedSqliteConnections.set(sequence, {
+        ...metadata,
+        reference: new WeakRef(db),
+    });
+    return db;
+}
+
+const TrackedDatabase = new Proxy(DatabaseImpl, {
+    construct(target, args) {
+        const db = Reflect.construct(target, args, target) as BetterSqlite3.Database;
+        return trackSqliteConnection(db, args[0], args[1]);
+    },
+}) as typeof BetterSqlite3;
+
 /**
  * Wrap node:sqlite's `DatabaseSync` so it presents the better-sqlite3/bun
  * surface the rest of the codebase calls:
@@ -259,7 +357,108 @@ function buildNodeSqliteDatabaseClass(DatabaseSync: any): typeof BetterSqlite3 {
     return NodeSqliteDatabase as unknown as typeof BetterSqlite3;
 }
 
-export const Database: typeof BetterSqlite3 = DatabaseImpl;
+export const Database: typeof BetterSqlite3 = TrackedDatabase;
+
+function pragmaValue(db: BetterSqlite3.Database, name: string): unknown {
+    const row = db.prepare(`PRAGMA ${name}`).get() as Record<string, unknown> | undefined;
+    if (!row) return undefined;
+    return row[name] ?? Object.values(row)[0];
+}
+
+function pragmaNumber(db: BetterSqlite3.Database, name: string): number | null {
+    try {
+        const value = pragmaValue(db, name);
+        return typeof value === "number" && Number.isFinite(value) ? value : null;
+    } catch {
+        return null;
+    }
+}
+
+function pragmaString(db: BetterSqlite3.Database, name: string): string | null {
+    try {
+        const value = pragmaValue(db, name);
+        return typeof value === "string" ? value : null;
+    } catch {
+        return null;
+    }
+}
+
+function sqliteSidecarBytes(filename: string, suffix: "-wal" | "-shm"): number | null {
+    if (filename === ":memory:" || filename === "<buffer>") return 0;
+    try {
+        return statSync(`${filename}${suffix}`).size;
+    } catch (error) {
+        return (error as NodeJS.ErrnoException).code === "ENOENT" ? 0 : null;
+    }
+}
+
+function fts5TableCount(db: BetterSqlite3.Database): number | null {
+    try {
+        const row = db
+            .prepare(
+                "SELECT COUNT(*) AS count FROM sqlite_master WHERE type = 'table' AND sql LIKE '%USING fts5%'",
+            )
+            .get() as { count?: unknown } | undefined;
+        return typeof row?.count === "number" ? row.count : null;
+    } catch {
+        return null;
+    }
+}
+
+/**
+ * Read the SQLite memory bounds that Bun/node:sqlite expose without native FFI.
+ * SQLite's sqlite3_status()/sqlite3_db_status() counters are not surfaced by
+ * either runtime, so cache and mmap values are configured upper bounds rather
+ * than resident-byte measurements.
+ */
+export function getSqliteMemoryStats(): SqliteMemoryStats {
+    const connections: SqliteConnectionMemoryStats[] = [];
+    for (const [sequence, tracked] of trackedSqliteConnections) {
+        const db = tracked.reference.deref();
+        if (!db) {
+            trackedSqliteConnections.delete(sequence);
+            continue;
+        }
+        const pageSize = pragmaNumber(db, "page_size");
+        const cacheSize = pragmaNumber(db, "cache_size");
+        const cacheSizeUnit = cacheSize === null ? null : cacheSize < 0 ? "kib" : "pages";
+        const cacheUpperBoundBytes =
+            cacheSize === null
+                ? null
+                : cacheSize < 0
+                  ? Math.abs(cacheSize) * 1024
+                  : pageSize === null
+                    ? null
+                    : cacheSize * pageSize;
+        connections.push({
+            sequence: tracked.sequence,
+            filename: tracked.filename,
+            readonly: tracked.readonly,
+            pageSize,
+            pageCount: pragmaNumber(db, "page_count"),
+            freelistCount: pragmaNumber(db, "freelist_count"),
+            cacheSize,
+            cacheSizeUnit,
+            cacheUpperBoundBytes,
+            mmapSizeBytes: pragmaNumber(db, "mmap_size"),
+            walFileBytes: sqliteSidecarBytes(tracked.filename, "-wal"),
+            shmFileBytes: sqliteSidecarBytes(tracked.filename, "-shm"),
+            fts5TableCount: fts5TableCount(db),
+            journalMode: pragmaString(db, "journal_mode"),
+        });
+    }
+    const sumKnown = (select: (connection: SqliteConnectionMemoryStats) => number | null): number =>
+        connections.reduce((sum, connection) => sum + (select(connection) ?? 0), 0);
+    return {
+        connectionCount: connections.length,
+        cacheUpperBoundBytes: sumKnown((connection) => connection.cacheUpperBoundBytes),
+        mmapUpperBoundBytes: sumKnown((connection) => connection.mmapSizeBytes),
+        walFileBytes: sumKnown((connection) => connection.walFileBytes),
+        shmFileBytes: sumKnown((connection) => connection.shmFileBytes),
+        sqliteStatusApi: "unavailable",
+        connections,
+    };
+}
 
 /** Instance type alias used by helpers and storage modules. */
 export type Database = BetterSqlite3.Database;
@@ -298,6 +497,7 @@ export function withPrivilegedWriter<T>(db: Database, operation: () => T): T {
     const previousDepth = privilegeDepth.get(db) ?? 0;
     const nested = isInTransaction(db);
     const savepoint = "mc_privilege_scope";
+    const transactionStartedAt = nested ? undefined : performance.now();
     if (nested) {
         db.exec(`SAVEPOINT ${savepoint}`);
     } else {
@@ -316,6 +516,9 @@ export function withPrivilegedWriter<T>(db: Database, operation: () => T): T {
             db.exec(`RELEASE ${savepoint}`);
         } else {
             db.exec("COMMIT");
+            if (transactionStartedAt !== undefined) {
+                reportSlowPrivilegedWrite?.("privileged_writer", transactionStartedAt);
+            }
         }
         if (previousDepth > 0) privilegeDepth.set(db, previousDepth);
         else privilegeDepth.delete(db);

package/src/shared/status-detail-text.test.ts

@@ -1,4 +1,5 @@
 import { describe, expect, test } from "bun:test";
+import { formatOpenCodeDbMissingStatusLine, resolveOpenCodeDbPath } from "./opencode-db-path";
 import type { StatusDetail } from "./rpc-types";
 import { formatStatusDetailMarkdown } from "./status-detail-text";
 
@@ -68,8 +69,9 @@ const STATUS_FIXTURE: StatusDetail = {
 };
 
 describe("formatStatusDetailMarkdown", () => {
-    test("renders the fixed TUI status payload as compact markdown", () => {
-        expect(formatStatusDetailMarkdown(STATUS_FIXTURE)).toBe(`## Magic Context Status
+    test("renders a missing-store condition before the fixed TUI status payload", () => {
+        expect(formatStatusDetailMarkdown(STATUS_FIXTURE)).toBe(
+            `${formatOpenCodeDbMissingStatusLine(resolveOpenCodeDbPath())}\n\n## Magic Context Status
 
 - **Mode:** Magic Context compaction
 - **Active profile:** work
@@ -78,7 +80,8 @@ describe("formatStatusDetailMarkdown", () => {
 - **Historian:** running; boundary present; coverage 12
 - **Memory:** 8 active; 3 injected
 - **Tags:** 4 active, 1 dropped; 2 pending drops
-- **Execute threshold:** 65.0%`);
+- **Execute threshold:** 65.0%`,
+        );
     });
 
     test("shows module-routed host paths only in Rust-mode chat fallback", () => {

package/src/shared/status-detail-text.ts

@@ -1,5 +1,12 @@
 import { formatCacheTtlDisplay } from "./cache-ttl-display";
 import { formatConfigParseStatusLine } from "./config-diagnostics";
+import {
+    formatOpenCodeDbMissingStatusLine,
+    formatOpenCodeDbReadFailureStatusLine,
+    getOpenCodeDbReadFailure,
+    openCodeDbPathExists,
+    resolveOpenCodeDbPath,
+} from "./opencode-db-path";
 import type { StatusDetail } from "./rpc-types";
 import { RUST_MODE_HOST_PATHS_LINE } from "./rust-mode-status";
 
@@ -29,12 +36,20 @@ export function formatStatusDetailMarkdown(detail: StatusDetail): string {
             ? undefined
             : `coverage ${detail.coverageOrdinal === null ? "none" : detail.coverageOrdinal}`,
     ].filter((value): value is string => value !== undefined);
+    const openCodeDbResolution = resolveOpenCodeDbPath();
+    const openCodeDbReadFailure = getOpenCodeDbReadFailure();
+    const openCodeDbStatusLine = !openCodeDbPathExists(openCodeDbResolution)
+        ? formatOpenCodeDbMissingStatusLine(openCodeDbResolution)
+        : openCodeDbReadFailure?.path === openCodeDbResolution.path
+          ? formatOpenCodeDbReadFailureStatusLine(openCodeDbReadFailure)
+          : null;
     const mode =
         detail.compaction_enabled === false
             ? "native compaction (Magic Context history compaction disabled)"
             : "Magic Context compaction";
 
     const lines = [
+        ...(openCodeDbStatusLine ? [openCodeDbStatusLine, ""] : []),
         ...(detail.configParseFailures ?? []).map(formatConfigParseStatusLine),
         ...((detail.configParseFailures?.length ?? 0) > 0 ? [""] : []),
         "## Magic Context Status",

package/src/shared/subagent-runner.ts

@@ -1,7 +1,7 @@
 /**
  * Cross-harness subagent runner abstraction.
  *
- * Magic Context spawns three kinds of subagents — historian, dreamer, sidekick —
+ * Magic Context spawns historian and Dreamer subagents
  * each as a child "session" with its own model/prompt/tools. OpenCode and Pi
  * have very different APIs for this:
  *
@@ -15,15 +15,15 @@
  *     disk, optionally addressed via `--session <path>`.
  *
  * The runner interface below normalizes both into the same shape so the
- * actual subagent business logic (historian XML parsing, dreamer task loop,
- * sidekick augmentation) can stay harness-agnostic. Each harness ships its
+ * actual subagent business logic (historian XML parsing and Dreamer task loops)
+ * can stay harness-agnostic. Each harness ships its
  * own runner implementation; agents take a `SubagentRunner` as a dep instead
  * of reaching for `client.session.*` directly.
  *
  * Step 5a (this commit) defines the contract and ships `PiSubagentRunner`.
  * Step 5b will refactor the OpenCode-side spawn paths in
- * `compartment-runner-historian.ts`, `dreamer/runner.ts`, and
- * `sidekick/agent.ts` onto an `OpenCodeSubagentRunner` so both harnesses
+ * `compartment-runner-historian.ts` and `dreamer/runner.ts` onto an
+ * `OpenCodeSubagentRunner` so both harnesses
  * share the agent business logic instead of duplicating it. Until 5b lands,
  * OpenCode keeps its existing direct `client.session.*` calls untouched —
  * the runner contract is purely additive on the OpenCode side.
@@ -36,11 +36,11 @@ import type { ModelInput } from "./model-resolution";
  *
  * Mirrors the union of OpenCode's `session.create` + `session.prompt` body
  * fields and Pi's `--print` CLI flags, picking the shared subset that all
- * three subagent kinds (historian, dreamer, sidekick) actually use today.
+ * the historian and Dreamer subagents actually use today.
  *
  * Fields:
  * - `agent`: harness-specific agent name. OpenCode looks this up in its
- *   agent registry (`HISTORIAN_AGENT`, `DREAMER_AGENT`, `SIDEKICK_AGENT`).
+ *   agent registry (`HISTORIAN_AGENT`, `DREAMER_AGENT`).
  *   Pi has no concept of "agent name" beyond config, so this is ignored
  *   on the Pi side and used only by `OpenCodeSubagentRunner`.
  * - `systemPrompt`: full system prompt for this child run. Replaces (not
@@ -88,7 +88,7 @@ export interface SubagentRunOptions {
     /**
      * Optional progress callback. The runner invokes it for milestone events
      * during the run: spawn, first event received, terminal stop reason
-     * detected, child exit. Used by historian/dreamer/sidekick to write
+     * detected, child exit. Used by historian/dreamer to write
      * lifecycle entries to the magic-context.log without polluting the
      * normal stdout stream.
      *
@@ -104,7 +104,6 @@ export interface SubagentRunOptions {
         | "historian_editor"
         | "compressor"
         | "dreamer"
-        | "sidekick"
         | "user_memory_review"
         | "recomp"
         | undefined;
@@ -182,6 +181,11 @@ export type SubagentProgressEvent =
  *   here so the OpenCode runner can surface the child session ID for log
  *   correlation when Step 5b lands.
  */
+export interface CompletedSubagentToolCall {
+    name: string;
+    arguments: Record<string, unknown>;
+}
+
 export type SubagentRunResult =
     | {
           ok: true;
@@ -196,6 +200,9 @@ export type SubagentRunResult =
            * the real session messages.
            */
           toolCallCount?: number;
+          /** Completed, non-error tool results preserved by runners that can
+           *  reconstruct invocation/result pairs from their transcript. */
+          completedToolCalls?: CompletedSubagentToolCall[];
           meta?: Record<string, unknown>;
       }
     | {
@@ -222,7 +229,7 @@ export type SubagentRunResult =
  *
  * Each harness ships a single instance — the OpenCode plugin wires
  * `OpenCodeSubagentRunner` and the Pi plugin wires `PiSubagentRunner` in
- * its `extension` boot path. Agent code (historian, dreamer, sidekick)
+ * its `extension` boot path. Agent code (historian and dreamer)
  * receives the runner as a dep and never reaches for harness-specific
  * client APIs directly.
  */

package/src/shared/tag-transcript.ts

@@ -55,6 +55,7 @@ import {
     updateTagTokenCount,
 } from "../features/magic-context/storage-tags";
 import { makeToolCompositeKey, type Tagger } from "../features/magic-context/tagger";
+import { droppedInputMarker } from "../hooks/magic-context/dropped-input-guard";
 import { applyEditMarkerToInput } from "../hooks/magic-context/edit-marker";
 import { estimateImageTokensFromDataUrl } from "../hooks/magic-context/image-token-estimate";
 import { estimateTokens } from "../hooks/magic-context/read-session-formatting";
@@ -247,7 +248,8 @@ export function tagTranscript(
         let toolResultOrdinal = 0;
         const parts = message.parts;
         const messageHasNativeReasoning =
-            message.info.role === "assistant" && parts.some((part) => part.kind === "thinking");
+            message.requiresToolArcSkeleton ??
+            (message.info.role === "assistant" && parts.some((part) => part.kind === "thinking"));
         const contentDerivedTextIds =
             messageId !== undefined && options.textIdentityDriftMessageIds?.has(messageId) === true
                 ? buildContentDerivedTextIds(messageId, parts)
@@ -1056,8 +1058,20 @@ function buildAggregateTarget(
             }
             return occurrences[0]?.part.getText() ?? null;
         },
-        drop(): "removed" | "absent" {
-            // Replace BOTH halves with the dropped sentinel.
+        drop(): "removed" | "absent" | "incomplete" {
+            const complete =
+                occurrences.some((occ) => occ.kind === "tool_use") &&
+                occurrences.some((occ) => occ.kind === "tool_result");
+            if (!complete) return "incomplete";
+            if (
+                !requiresToolArcSkeleton &&
+                occurrences.every((occ) => occ.part.remove && occ.part.canRemove?.() !== false)
+            ) {
+                let removed = false;
+                for (const occ of occurrences) removed = occ.part.remove?.() || removed;
+                return removed ? "removed" : "absent";
+            }
+            // Adapters without structural removal retain paired sentinels.
             const sentinel = `[dropped \u00a7${tagId}\u00a7]`;
             let any = false;
             for (const occ of occurrences) {
@@ -1066,14 +1080,14 @@ function buildAggregateTarget(
             return any ? "removed" : "absent";
         },
         truncate(): "truncated" | "absent" {
-            // Skeleton-drop: replace BOTH halves' content with the one
-            // canonical `[dropped §N§]` placeholder (byte-identical to a full
-            // drop and to OpenCode). Frozen by the dropMode column → replays
-            // the same string every pass. The tool_use call survives intact.
+            // Keep the paired call shell, but replace its arguments with one
+            // non-executable marker; result halves carry the matching sentinel.
             const sentinel = `[dropped \u00a7${tagId}\u00a7]`;
             let any = false;
             for (const occ of occurrences) {
-                if (setToolContentOrText(occ.part, sentinel)) {
+                if (occ.kind === "tool_use" && occ.part.setToolInput) {
+                    if (occ.part.setToolInput(droppedInputMarker(tagId))) any = true;
+                } else if (setToolContentOrText(occ.part, sentinel)) {
                     any = true;
                 }
             }
@@ -1101,12 +1115,12 @@ function buildAggregateTarget(
             }
             return any ? "truncated" : "absent";
         },
-        // Non-mutating reclaim predicate (Pi parity with OpenCode's canDrop).
-        // Pi sentinelizes BOTH halves, so unlike OpenCode there's no
-        // result-part requirement — a target reclaims as long as it still has
-        // at least one live occurrence to sentinelize.
+        // Open invocations still belong to the current turn; only complete arcs reclaim.
         canDrop(): boolean {
-            return occurrences.length > 0;
+            return (
+                occurrences.some((occ) => occ.kind === "tool_use") &&
+                occurrences.some((occ) => occ.kind === "tool_result")
+            );
         },
         requiresToolArcSkeleton,
         // Non-mutating read of the invocation input (the tool_use occurrence
@@ -1162,8 +1176,8 @@ function buildTextTarget(
  * TagTarget for a tag-eligible tool part. Tool parts get full-drop or
  * skeleton-drop treatment from `applyFlushedStatuses` based on the stored
  * `drop_mode` column. Both render the SAME canonical `[dropped §N§]`
- * placeholder — full-drop replaces the whole pair, skeleton-drop keeps the
- * tool_use call and replaces only its output. One placeholder string,
+ * placeholder — full-drop replaces the whole pair, while skeleton-drop keeps
+ * the tool_use call with only a dropped-input marker. Marker bytes are
  * byte-identical across passes and across harnesses.
  */
 function buildToolTarget(
@@ -1190,12 +1204,10 @@ function buildToolTarget(
             return replaced ? "removed" : "absent";
         },
         truncate(): "truncated" | "absent" {
-            // Skeleton-drop: replace the tool output with the one canonical
-            // `[dropped §N§]` placeholder (byte-identical to a full drop and to
-            // OpenCode). Frozen by the dropMode column, so it replays the same
-            // string every pass. The tool_use call itself survives intact.
-            const ok = setToolContentOrText(part, `[dropped \u00a7${tagId}\u00a7]`);
-            return ok ? "truncated" : "absent";
+            const changed = part.setToolInput
+                ? part.setToolInput(droppedInputMarker(tagId))
+                : setToolContentOrText(part, `[dropped \u00a7${tagId}\u00a7]`);
+            return changed ? "truncated" : "absent";
         },
         message: {
             info: { id: message.info.id, role: message.info.role },

package/src/shared/transcript.ts

@@ -167,6 +167,11 @@ export interface TranscriptPart {
      */
     replaceWithSentinel(sentinelText: string): boolean;
 
+    /** Remove one half of a complete tool arc. Callers must remove both halves together. */
+    remove?(): boolean;
+    /** Refuse structural deletion when the adapter cannot match provider-native identity safely. */
+    canRemove?(): boolean;
+
     /**
      * Optional: serialized byte size of the part's REAL payload, including
      * non-text content (images, structured data) that `getText()` can't
@@ -187,6 +192,8 @@ export interface TranscriptPart {
  * use `info.id` for cross-pass correlation, never the message reference.
  */
 export interface TranscriptMessage {
+    /** Override when the receiving protocol does not merge adjacent assistant reasoning turns. */
+    requiresToolArcSkeleton?: boolean;
     /**
      * Lightweight metadata exposed for tagging, sentinel persistence, and
      * cross-pass correlation. Adapters fill these from harness-native

package/src/shared/window-geometry.test.ts

@@ -4,6 +4,7 @@ import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { resolveLimit, resolveOutputReserve } from "./models-dev-cache";
 import {
+    applyProvenInputFloor,
     deriveWindowGeometry,
     formatWindowDerivationLine,
     parseWindowOverlay,
@@ -298,6 +299,49 @@ describe("window geometry", () => {
         expect(hooked?.derivation.reserve).toBe(30_000);
     });
 
+    test("keeps shared-upfront emergency headroom below the separate absolute wall", () => {
+        const result = deriveWindowGeometry(
+            "openai-codex",
+            "gpt-5.6-sol",
+            { context: 272_000, output: 128_000 },
+            { providerLimit: { context: 272_000 }, harness: "pi" },
+        );
+
+        expect(result?.usableSoft).toBe(204_000);
+        expect(result?.usableHard).toBe(204_000);
+        expect(result?.usableHard).toBeLessThan(result?.derivation.absoluteWall ?? 0);
+        expect(result?.derivation.absoluteWall).toBe(272_000);
+        expect((result?.derivation.absoluteWall ?? 0) - (result?.usableHard ?? 0)).toBe(
+            result?.derivation.reserve,
+        );
+        expect(result?.derivation.windowSource).toBe("provider");
+    });
+
+    test("bounds proof at trusted absolute walls but retains the static-catalog escape hatch", () => {
+        const trusted = deriveWindowGeometry(
+            "openai-codex",
+            "gpt-5.6-sol",
+            { context: 272_000, output: 128_000 },
+            { providerLimit: { context: 272_000 }, harness: "pi" },
+        );
+        expect(trusted).toBeDefined();
+        const raisedWithinWall = applyProvenInputFloor(trusted!, 255_834);
+        expect(raisedWithinWall.geometry.usableSoft).toBe(255_834);
+        expect(raisedWithinWall.geometry.usableHard).toBe(204_000);
+        const refused = applyProvenInputFloor(trusted!, 593_717);
+        expect(refused.refused).toEqual({ reading: 593_717, absoluteWall: 272_000 });
+        expect(refused.geometry.usableSoft).toBe(204_000);
+        expect(refused.geometry.usableHard).toBe(204_000);
+
+        const staticFallback = deriveWindowGeometry("custom", "model", { context: 30_000 });
+        expect(staticFallback).toBeDefined();
+        const escaped = applyProvenInputFloor(staticFallback!, 90_000);
+        expect(escaped.refused).toBeUndefined();
+        expect(escaped.geometry.usableSoft).toBe(90_000);
+        expect(escaped.geometry.usableHard).toBe(90_000);
+        expect(escaped.geometry.derivation.absoluteWall).toBe(90_000);
+    });
+
     test("clamps an inversion and logs it", () => {
         const logs: string[] = [];
         const result = deriveWindowGeometry(