@jjh32456/dsh-longlive 1.6.5 → 1.6.7

package/CHANGELOG.md

@@ -1,3 +1,11 @@
+## 1.6.7
+
+- 热截断加固：turn===0 / 无 turn 记录的组不再永久屏障（含 system/developer 指令的原地保留，只含普通消息的随旧前缀整组归档）；中段缺 turn/end 的轮只有最后启动的当前轮不可切；新增 onNoPlan 拒绝原因通道，切不了会写 'hot-truncate: 未切（reason）'，杜绝静默零进展。
+
+## 1.6.6
+
+- 热截断修复：去掉 skipPast 永久钉死（aborted/interrupted 轮只要有 turn/end 就整轮可切）；段首 system/message 永不进切段，中途注入的 system 副本随旧前缀归档。修复后真实会话一次可切 35 个 closed 轮（约 46 万 tokens），上下文回到最近 4 轮量级。
+
 # 变更记录
 
 本文件从 0.7.6 开始记录；更早的版本没有随包维护变更日志（0.7.5 及以前的 tarball 里没有

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@jjh32456/dsh-longlive",
-  "version": "1.6.5",
+  "version": "1.6.7",
   "type": "module",
   "description": "久视（longlive）：一个磁盘上的共享大脑，让每个会话都是同一个你——记忆卡、状态卡、开机卡让新会话接上同一段关系与未完成的事；配套会话卫生（热截断/备份/D2/D6 裁剪）与记忆工具（巩固/召回/程序性记忆）。1.6.4 修复记忆根可移植性（默认根 = <DSH home>/longlive-memory，一处配置贯穿全部落盘），并同步面板 0.2.5 文案与 G1-G4 修复。",
   "keywords": [

package/src/compaction/engine-core.js

@@ -342,21 +342,31 @@ function roughPointerTokens(text) {
 }
 
 /**
- * Select the oldest whole completed turns that sit outside the retention
- * window. Returns null when no safe cut exists (the common, expected answer).
+ * Select the oldest whole closed turns that sit outside the retention window.
+ * Returns null when no safe cut exists; every such refusal reports a structured
+ * reason through `helpers.onNoPlan` so a silently disabled hot truncate is
+ * observable (the engine logs it once per reason).
  *
- * The host protects surface position 0 when it holds the system prompt: a
- * user/message replacement may not shadow that node. This engine's contract is
- * stronger than the host's: a `system/message` is never part of a cut. The span
- * therefore starts at the first user/assistant node after every leading
- * system node, and a system node anywhere inside a candidate span is a hard
- * right boundary. Checkpoint nodes at the head of the span are folded into the
- * same cut, which keeps exactly one pointer.
+ * The leading run of `system/message` / `developer/message` nodes (the real
+ * system prompt at host-protected position 0) is never moved. A `system/message`
+ * re-injected by a host restart further inside the surface is an archived copy
+ * of that same prompt (host-tolerated inside a replacement range). Checkpoint
+ * nodes at the head of the span are folded into the same cut, which keeps
+ * exactly one pointer.
  */
 export function selectCutPlan(session, options, measurement, helpers = {}) {
   const table = helpers.table ?? turnTable(session);
   const groups = surfaceGroups(session, table, helpers.isCheckpointSource);
-  if (groups.length === 0) return null;
+  const onNoPlan = typeof helpers.onNoPlan === 'function' ? helpers.onNoPlan : null;
+  const noPlan = (reason, detail) => {
+    try {
+      onNoPlan?.({ reason, detail: detail === undefined ? null : detail });
+    } catch {
+      // Diagnostics never break a plan.
+    }
+    return null;
+  };
+  if (groups.length === 0) return noPlan('no-groups');
   const tokens = new Map();
   for (const node of measurement?.nodes ?? []) {
     if (node && typeof node.seq === 'number' && Number.isFinite(node.tokens)) tokens.set(node.seq, node.tokens);
@@ -370,8 +380,9 @@ export function selectCutPlan(session, options, measurement, helpers = {}) {
   };
 
   // Walk backwards until the retained suffix satisfies BOTH limits. A turn
-  // that is not completed is never part of the retained *window*, so it also
-  // cannot be cut; the scan still counts it as a completed-turn boundary stop.
+  // that is not completed counts toward the token budget but never toward the
+  // completed-turn floor, so the retained suffix may temporarily hold a few
+  // extra turns while a closed aborted turn sits inside the window.
   let keptTurns = 0;
   let keptTokens = 0;
   let boundary = -1;
@@ -385,103 +396,160 @@ export function selectCutPlan(session, options, measurement, helpers = {}) {
       break;
     }
   }
-  if (boundary <= 0) return null;
+  if (boundary <= 0) return noPlan('not-enough-turns', { groups: groups.length });
 
   const surfaceNodes = session?.surface?.nodes ?? [];
-  if (surfaceNodes.length === 0) return null;
+  if (surfaceNodes.length === 0) return noPlan('no-surface');
+
+  // 2026-11-06 1.6.7 hardening — no permanent barrier, no silent zero progress.
+  //
+  // 1.6.6 removed the aborted-turn freeze but treated every group without a
+  // usable turn record as an immovable open group and stopped the span before
+  // it. Three surface shapes then made the planner return null forever even
+  // though whole closed turns older than the retention window existed:
+  //   * a log truncated mid-turn leaves orphan messages at the surface head
+  //     (no turn/start) — a turn===0 group at the head (red team E1);
+  //   * the host appends a user/message between turns — a turn===0 group in
+  //     the middle (red team E3);
+  //   * a turn whose turn/end was lost by log truncation — turn N has no
+  //     endSeq but later turns exist (red team E2).
+  //
+  // Rules now:
+  //   * the whole LEADING run of system/message + developer/message nodes is
+  //     never moved (head instructions; host-protected position 0);
+  //   * a turn===0 group that carries a system/developer node is a head
+  //     instruction zone and stays in place; a turn===0 group of plain messages
+  //     is an orphan prefix and is archived with the cut (recoverable);
+  //   * a group whose turn has no turn/end is the CURRENT turn only when it is
+  //     the last started turn; an earlier turn without turn/end is abandoned
+  //     (the log was truncated inside it) and is cuttable, archived through an
+  //     inferred range up to the next turn/start;
+  //   * the planner skips a blocked head barrier and cuts the next run of
+  //     wholly-cuttable groups; if nothing is cuttable it reports the reason
+  //     through onNoPlan instead of returning null silently.
+  const groupStart = new Array(groups.length);
+  const groupEnd = new Array(groups.length);
+  const groupOfPosition = new Array(surfaceNodes.length);
+  {
+    let cursor = 0;
+    for (let index = 0; index < groups.length; index += 1) {
+      groupStart[index] = cursor;
+      for (let offset = 0; offset < groups[index].seqs.length; offset += 1) groupOfPosition[cursor++] = index;
+      groupEnd[index] = cursor - 1;
+    }
+  }
+  const typeOfSeq = (seq) => table.bySeq.get(seq)?.type;
+  const isInstructionSeq = (seq) => typeOfSeq(seq) === 'system/message' || typeOfSeq(seq) === 'developer/message';
+  const protectedSeqs = new Set();
+  {
+    let position = 0;
+    while (position < surfaceNodes.length && isInstructionSeq(surfaceNodes[position])) {
+      protectedSeqs.add(surfaceNodes[position]);
+      position += 1;
+    }
+  }
+  const lastStarted = table.turns.length > 0 ? table.turns[table.turns.length - 1] : null;
+  const turnInfoOf = (group) => (group.kind === 'turn' && group.turn !== 0 ? table.byNumber.get(group.turn) : undefined);
+  const isCurrentTurnGroup = (group) => {
+    if (group.kind !== 'turn' || group.turn === 0) return false;
+    const info = table.byNumber.get(group.turn);
+    if (info === undefined) return true;
+    return info.endSeq === null && lastStarted !== null && info.turn === lastStarted.turn;
+  };
+  const isCuttableGroup = (group) => {
+    if (group === undefined) return false;
+    if (group.kind === 'checkpoint') return true;
+    if (group.kind !== 'turn') return false;
+    // A turn===0 group is either an orphan head zone (contains instructions) or
+    // a stray message block between turns; only the latter may be archived.
+    if (group.turn === 0) return !group.seqs.some((seq) => isInstructionSeq(seq));
+    const info = table.byNumber.get(group.turn);
+    if (info === undefined) return false;
+    return !isCurrentTurnGroup(group);
+  };
+  // An abandoned turn (no turn/end, but a later turn/start exists) never got a
+  // closing event; the archive range is inferred up to the next turn/start so
+  // every one of its original events stays recoverable.
+  const resolvedEndSeq = (group) => {
+    const info = table.byNumber.get(group.turn);
+    const lastSurfaceSeq = group.seqs[group.seqs.length - 1];
+    if (info === undefined || !Number.isInteger(info.startSeq)) return lastSurfaceSeq;
+    if (Number.isInteger(info.endSeq)) return info.endSeq;
+    const next = table.turns.find((entry) => Number.isInteger(entry.startSeq) && entry.startSeq > info.startSeq);
+    if (next === undefined) return lastSurfaceSeq;
+    return Math.max(info.startSeq, next.startSeq - 1);
+  };
 
-  // Never include a leading system prompt in the replaced span.
+  // The span starts after the protected head run and on a user/assistant node
+  // (the pointer replaces one); a system copy skipped at the head of a turn
+  // stays outside the span exactly like 1.6.6 — it is never moved out.
   let startIndex = 0;
-  while (startIndex < surfaceNodes.length
-    && table.bySeq.get(surfaceNodes[startIndex])?.type === 'system/message') {
-    startIndex += 1;
-  }
-  // The pointer replaces a user/assistant message, so the first cut node must
-  // be one. A leading developer node is kept in place instead of cut.
+  while (startIndex < surfaceNodes.length && protectedSeqs.has(surfaceNodes[startIndex])) startIndex += 1;
   while (startIndex < surfaceNodes.length) {
-    const type = table.bySeq.get(surfaceNodes[startIndex])?.type;
+    const type = typeOfSeq(surfaceNodes[startIndex]);
     if (type === 'user/message' || type === 'assistant/message') break;
     startIndex += 1;
   }
-  if (startIndex >= surfaceNodes.length) return null;
-
-  // The cut prefix is groups[0..boundary); their surface lengths sum to the
-  // last positional index that belongs to the prefix.
-  let endIndex = -1;
-  for (let index = 0; index < boundary; index += 1) endIndex += groups[index].seqs.length;
-
-  // An aborted/unfinished turn is never cut — but it must not freeze every
-  // later cut either. Keep it in place and start the span after the LAST
-  // aborted/unfinished turn in the prefix, so the completed turns that follow
-  // it stay cuttable. (2026-11-06 hotfix: a restart-aborted turn used to make
-  // selectCutPlan return null forever, so automatic hot-truncate never fired
-  // again on that session.)
-  let skipPast = -1;
-  for (let index = 0; index < boundary; index += 1) {
-    const group = groups[index];
-    if (group.kind !== 'turn' || group.turn === 0 || group.completed) continue;
-    const lastPos = surfaceNodes.indexOf(group.seqs[group.seqs.length - 1]);
-    if (lastPos > skipPast) skipPast = lastPos;
-  }
-  if (skipPast >= 0) {
-    startIndex = Math.max(startIndex, skipPast + 1);
-    while (startIndex < surfaceNodes.length) {
-      const type = table.bySeq.get(surfaceNodes[startIndex])?.type;
-      if (type === 'user/message' || type === 'assistant/message') break;
-      startIndex += 1;
+  if (startIndex >= surfaceNodes.length) return noPlan('no-span-start');
+  const firstGroup = groupOfPosition[startIndex];
+
+  // Earliest run of consecutive cuttable groups that lies entirely before the
+  // retention boundary and holds at least one real closed turn. Runs made only
+  // of orphan messages/pointers are not worth a surface rewrite: skip them.
+  let chosenStart = -1;
+  let chosenEnd = -1;
+  for (let index = firstGroup; index < boundary; index += 1) {
+    if (!isCuttableGroup(groups[index])) continue;
+    let runEnd = index;
+    while (runEnd + 1 < boundary && isCuttableGroup(groups[runEnd + 1])) runEnd += 1;
+    let realTurns = 0;
+    for (let cursor = index; cursor <= runEnd; cursor += 1) {
+      if (groups[cursor].kind === 'turn' && groups[cursor].turn !== 0) realTurns += 1;
     }
+    if (realTurns > 0) { chosenStart = index; chosenEnd = runEnd; break; }
+    index = runEnd;
   }
-  if (endIndex < startIndex) return null;
-
-  // The host tolerates later system nodes inside a replacement range, but this
-  // engine promises never to cut one — and never to leave half a turn behind.
-  // A system node inside the candidate span excludes its whole turn, unless
-  // that turn sits at the head of the span: then keep it in place and start the
-  // span after it (a mid-turn system node must not freeze the plan forever).
-  for (let guard = 0; guard < 64; guard += 1) {
-    let headAfter = null;
-    let cutAt = null;
-    for (let index = startIndex; index <= endIndex; index += 1) {
-      if (table.bySeq.get(surfaceNodes[index])?.type !== 'system/message') continue;
-      const seq = surfaceNodes[index];
-      const owner = groups.find((group) => group.seqs.includes(seq));
-      const ownerStart = owner === undefined ? index : surfaceNodes.indexOf(owner.seqs[0]);
-      const ownerLast = owner === undefined ? index : surfaceNodes.indexOf(owner.seqs[owner.seqs.length - 1]);
-      if (ownerStart <= startIndex) { headAfter = ownerLast + 1; continue; }
-      cutAt = ownerStart - 1;
-      break;
-    }
-    if (headAfter !== null) {
-      startIndex = headAfter;
-      while (startIndex < surfaceNodes.length) {
-        const type = table.bySeq.get(surfaceNodes[startIndex])?.type;
-        if (type === 'user/message' || type === 'assistant/message') break;
-        startIndex += 1;
-      }
-      if (endIndex < startIndex) return null;
-      continue;
-    }
-    if (cutAt !== null) endIndex = Math.min(endIndex, cutAt);
-    break;
+  if (chosenStart < 0) {
+    return noPlan('blocked-prefix', {
+      firstGroup,
+      boundary,
+      blocked: groups.slice(firstGroup, boundary).map((group) => `${group.kind}:${group.turn}:${group.completed}`),
+    });
   }
-  if (endIndex < startIndex) return null;
-
-  const shadowedSeqs = surfaceNodes.slice(startIndex, endIndex + 1);
+  let spanStart = Math.max(startIndex, groupStart[chosenStart]);
+  const endIndex = groupEnd[chosenEnd];
+  if (endIndex < spanStart) return noPlan('empty-span', { chosenStart, chosenEnd });
+
+  // A system/message node *inside* the span is a host-restart re-injection of
+  // the same prompt; the host tolerates it inside a replacement range and it is
+  // archived together with the old prefix (approved 1.6.6 behaviour).
+  const shadowedSeqs = surfaceNodes.slice(spanStart, endIndex + 1);
   const shadowedSet = new Set(shadowedSeqs);
   const touchedGroups = groups.filter((group) => group.seqs.some((seq) => shadowedSet.has(seq)));
-  if (touchedGroups.some((group) => group.kind === 'turn' && group.turn !== 0 && !group.completed)) return null;
-  const cutTurnGroups = touchedGroups.filter((group) => group.kind === 'turn' && group.turn !== 0 && group.completed);
-  if (cutTurnGroups.length === 0) return null;
+  if (touchedGroups.some((group) => isCurrentTurnGroup(group))) return noPlan('current-turn-touched');
+  // No half turn: every touched turn group must be fully shadowed. The only
+  // allowed exception is a system/developer copy skipped at the head of the
+  // first group (it stays on the surface, never half-cut).
+  for (const group of touchedGroups) {
+    if (group.kind !== 'turn') continue;
+    const missing = group.seqs.filter((seq) => !shadowedSet.has(seq));
+    if (missing.some((seq) => !isInstructionSeq(seq))) return noPlan('split-group', { turn: group.turn });
+  }
+  const cutTurnGroups = touchedGroups.filter((group) => {
+    if (group.kind !== 'turn' || group.turn === 0) return false;
+    return !isCurrentTurnGroup(group);
+  });
+  if (cutTurnGroups.length === 0) return noPlan('no-turns', { chosenStart, chosenEnd });
 
-  // Archive every original event of the cut turns, plus any checkpoint node
-  // that positionally lived inside the replaced span (a previous pointer).
+  // Archive every original event of the cut turns, plus any checkpoint node and
+  // orphan (turn===0) message that positionally lived inside the replaced span.
   const archivedSeqs = new Set();
   const archiveEvents = [];
   for (const group of cutTurnGroups) {
-    const startSeq = table.byNumber.get(group.turn)?.startSeq;
-    const endSeq = table.byNumber.get(group.turn)?.endSeq;
-    if (!Number.isInteger(startSeq) || !Number.isInteger(endSeq)) continue;
-    for (let seq = startSeq; seq <= endSeq; seq += 1) {
+    const info = table.byNumber.get(group.turn);
+    if (info === undefined || !Number.isInteger(info.startSeq)) continue;
+    const endSeq = resolvedEndSeq(group);
+    for (let seq = info.startSeq; seq <= endSeq; seq += 1) {
       const event = table.bySeq.get(seq);
       if (event === undefined || archivedSeqs.has(seq)) continue;
       archivedSeqs.add(seq);
@@ -505,13 +573,13 @@ export function selectCutPlan(session, options, measurement, helpers = {}) {
       firstSeq: seqs[0],
       lastSeq: seqs[seqs.length - 1],
       startSeq: info?.startSeq ?? seqs[0],
-      endSeq: info?.endSeq ?? seqs[seqs.length - 1],
+      endSeq: resolvedEndSeq(group),
       surfaceEvents: seqs.length,
       tokens: seqs.reduce((total, seq) => total + prices.get(seq), 0),
     };
   });
   const shadowedTokenCount = shadowedSeqs.reduce((total, seq) => total + prices.get(seq), 0);
-  if (shadowedTokenCount <= 0) return null;
+  if (shadowedTokenCount <= 0) return noPlan('zero-token');
 
   const lastTouchedIndex = groups.indexOf(touchedGroups[touchedGroups.length - 1]);
   const retainedGroups = groups.slice(lastTouchedIndex + 1);
@@ -538,7 +606,9 @@ export function selectCutPlan(session, options, measurement, helpers = {}) {
     retainedTurns,
   });
   const pointerTokens = roughPointerTokens(previewText);
-  if (shadowedTokenCount < pointerTokens + options.minCutTokens) return null;
+  if (shadowedTokenCount < pointerTokens + options.minCutTokens) {
+    return noPlan('pointer-too-large', { shadowedTokenCount, pointerTokens });
+  }
 
   return {
     start: shadowedSeqs[0],
@@ -681,7 +751,7 @@ export function buildPointerText(facts) {
   const range = firstTurn === lastTurn ? `第 ${firstTurn} 轮` : `第 ${firstTurn}–${lastTurn} 轮`;
   const lines = [
     `本会话共 ${totalTurns} 轮，其中 ${archivedTurns} 轮已压缩归档；需要原文用 session_original(turn=…) 或读归档路径：${archivePath}`,
-    `本次热截断切掉${range}（${cutTurnCount} 轮 / ${shadowedTokenCount} tokens / ${surfaceEventCount} 个表面事件）；只切已完成且早于保留窗口的轮，切点之后的原文未动。`,
+    `本次热截断切掉${range}（${cutTurnCount} 轮 / ${shadowedTokenCount} tokens / ${surfaceEventCount} 个表面事件）；只切已结束且早于保留窗口的轮（含被中止/中断的旧轮），当前未完成的轮不切，切点之后的原文未动。`,
     `归档：${eventCount} 条原始事件（JSONL，每行含 seq/turn/原始消息）` + (sha256 ? `，sha256=${sha256.slice(0, 16)}…` : '') + '。',
     `保留窗口：最近 ${retainTurns} 个已完成轮、至少 ${retainTokens} tokens（本次保留 ${retainedTurns} 轮）。`,
   ];
@@ -864,6 +934,14 @@ export function createCutEngine(deps) {
       return selectCutPlan(session, this.options, measurement, {
         table,
         isCheckpointSource: isCompactCheckpointSource,
+        // "cut, or say why not": a refusal that would otherwise be silent is
+        // logged once per reason (warnOnce) so a permanently disabled hot
+        // truncate is always observable in the host log.
+        onNoPlan: (info) => {
+          const reason = String(info?.reason ?? 'unknown');
+          const detail = info?.detail === undefined || info?.detail === null ? '' : ` ${JSON.stringify(info.detail)}`;
+          this.warnOnce(`no-plan:${reason}`, `hot-truncate: 未切（${reason}）${detail}`);
+        },
       });
     }
 

package/test/hot-truncate.test.mjs

@@ -11,7 +11,8 @@
 //                 mode=off, live-compact deference and no-op degradation.
 //
 // What is pinned here:
-//   * an open / aborted turn is never cut;
+//   * an open turn is never cut; a closed aborted turn is cut whole with the
+//     old prefix (1.6.6: it used to be a barrier that pinned everything);
 //   * only turns older than retainTurns AND retainTokens are cut;
 //   * the cut point and later surface text are untouched (only a prefix shrinks);
 //   * the archive contains every original event of the cut turns with a
@@ -395,34 +396,42 @@ test('H2 retainTurns and retainTokens both gate the cut', async () => {
   assert.equal(tokenDominant.surface.nodes.length, 1 + 10);
 });
 
-test('H3 aborted turns never freeze later cuts (and are never cut themselves)', async () => {
+test('H3 closed aborted turns are cut with the old prefix and never freeze later cuts', async () => {
   const session = new MockSession();
   for (let turn = 1; turn <= 3; turn += 1) addTurn(session, turn, { completed: false });
   for (let turn = 4; turn <= 9; turn += 1) addTurn(session, turn, { completed: true });
   addTurn(session, 10, { open: true });
-  // 2026-11-06 hotfix: a restart-aborted prefix used to make the plan null
-  // forever. The fixed planner skips past the aborted turns and still cuts the
-  // completed turns that follow (retain window keeps the last 4 completed).
-  const { engine } = engineFor({ archiveDir: caseDir('archive'), perEvent: 5000, retainTurns: 4, retainTokens: 0, autoMinTokens: 0 });
+  // 1.6.6 hotfix: 1.6.5 still skipped past aborted turns, so when aborted turns
+  // recur near the tail the span collapsed to "the one completed turn after the
+  // last aborted turn" (the 396k-token bug). A turn with turn/end is closed and
+  // cuttable as a whole, so the prefix is removed in one plan.
+  const dir = caseDir('archive');
+  const { engine } = engineFor({ archiveDir: dir, perEvent: 5000, retainTurns: 4, retainTokens: 0, autoMinTokens: 0 });
   const result = await engine.compactIfNeeded(makeAgent(session), 'pressure', new AbortController().signal);
-  assert.ok(result, 'completed turns after the aborted prefix are still cuttable');
-  assert.equal(result.shadowedSeqs.length, 4, 'only turns 4 and 5 (2 surface nodes each) are cut');
+  assert.ok(result, 'aborted turns must not block the prefix cut');
+  assert.equal(result.shadowedSeqs.length, 10, 'turns 1-5 (2 surface nodes each) are cut');
+  const archive = readArchive(path.join(dir, fs.readdirSync(dir).find((name) => name.endsWith('.jsonl'))));
+  assert.deepEqual(archive.header.cutTurns.map((entry) => entry.turn), [1, 2, 3, 4, 5]);
   assert.equal(pointerEvents(session).length, 1);
+  // Only the four retained completed turns and the open turn stay.
+  assert.equal(session.surface.nodes.length, 1 + 8 + 2);
   const summary = pointerEvents(session)[0];
   const pointer = session.events[summary.seq + 1];
-  assert.match(pointer.data.content[0].text, /第 4–5 轮/);
+  assert.match(pointer.data.content[0].text, /第 1–5 轮/);
 });
 
 // ---------------------------------------------------------------------------
 // Archive
 // ---------------------------------------------------------------------------
 
-test('H3b mid-turn system node at the head of the span does not freeze later cuts', async () => {
-  // 2026-11-06 second hotfix: the candidate span can start at a turn whose
-  // first surface node is an assistant message and whose later node is a
-  // system/message (host-injected). The old system-node guard trimmed the
-  // span to nothing; the fixed planner keeps that head turn in place and
-  // starts the span after it.
+test('H3b a mid-turn system node is archived with its old prefix instead of freezing the plan', async () => {
+  // 1.6.6: 1.6.5 kept the whole turn containing a host-injected system node in
+  // place and started the span after it. When such injections land inside
+  // several completed turns (every host restart re-emits the prompt mid-turn),
+  // that rule pinned ≈100k tokens permanently: real session 2026-11-06 turns
+  // 66/72/75. The protected copy is the leading one at surface 0 (see H28); a
+  // later injected copy is host-tolerated inside a replacement range, so it is
+  // archived with the prefix it belongs to.
   const session = new MockSession();
   for (let turn = 1; turn <= 3; turn += 1) addTurn(session, turn, { completed: false });
   session.append('turn/start', { turn: 4 });
@@ -455,13 +464,212 @@ test('H3b mid-turn system node at the head of the span does not freeze later cut
   session.append('turn/end', { turn: 4, reason: { kind: 'completed' } });
   for (let turn = 5; turn <= 10; turn += 1) addTurn(session, turn, { completed: true });
   addTurn(session, 11, { open: true });
-  const { engine } = engineFor({ archiveDir: caseDir('archive'), perEvent: 5000, retainTurns: 4, retainTokens: 0, autoMinTokens: 0 });
+  const dir = caseDir('archive');
+  const { engine } = engineFor({ archiveDir: dir, perEvent: 5000, retainTurns: 4, retainTokens: 0, autoMinTokens: 0 });
   const result = await engine.compactIfNeeded(makeAgent(session), 'pressure', new AbortController().signal);
-  assert.ok(result, 'a mid-turn system node at the span head must not freeze the plan');
-  assert.equal(result.shadowedSeqs.length, 4, 'turns 5 and 6 (2 surface nodes each) are cut');
+  assert.ok(result, 'a mid-turn system node must not freeze the prefix cut');
+  assert.equal(result.shadowedSeqs.length, 13, 'turns 1-6 (2+2+2+3+2+2 surface nodes) are cut');
+  const archive = readArchive(path.join(dir, fs.readdirSync(dir).find((name) => name.endsWith('.jsonl'))));
+  assert.deepEqual(archive.header.cutTurns.map((entry) => entry.turn), [1, 2, 3, 4, 5, 6]);
+  assert.equal(session.surface.nodes.length, 1 + 8 + 2, 'pointer + four retained turns + open turn');
   const summary = pointerEvents(session)[0];
   const pointer = session.events[summary.seq + 1];
-  assert.match(pointer.data.content[0].text, /第 5–6 轮/);
+  assert.match(pointer.data.content[0].text, /第 1–6 轮/);
+});
+
+test('H30 a mid-surface aborted turn does not collapse the plan to one turn (396k regression)', async () => {
+  // Real session 2026-11-06 shape: the log has many completed turns, one
+  // restart-aborted turn near the tail, and the retention boundary right after
+  // it. 1.6.5 moved the span past the aborted turn, so the cut became "one
+  // completed turn / 6-18k tokens" while the whole older prefix stayed. The
+  // new planner must cut the entire prefix, aborted turn included, so that
+  // only the four retained completed turns and the open turn are left.
+  const session = new MockSession();
+  for (let turn = 1; turn <= 10; turn += 1) addTurn(session, turn, { completed: true });
+  addTurn(session, 11, { completed: false }); // aborted, closed
+  for (let turn = 12; turn <= 20; turn += 1) addTurn(session, turn, { completed: true });
+  addTurn(session, 21, { open: true });
+  const dir = caseDir('archive');
+  const { engine } = engineFor({ archiveDir: dir, perEvent: 5000, retainTurns: 4, retainTokens: 0, autoMinTokens: 0 });
+  const result = await engine.compactIfNeeded(makeAgent(session), 'pressure', new AbortController().signal);
+  assert.ok(result);
+  assert.equal(result.shadowedSeqs.length, 32, '16 turns x 2 surface nodes, aborted turn included');
+  const archive = readArchive(path.join(dir, fs.readdirSync(dir).find((name) => name.endsWith('.jsonl'))));
+  assert.deepEqual(archive.header.cutTurns.map((entry) => entry.turn), [1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16]);
+  // pointer + turns 17-20 (8 nodes) + open turn 21 (2 nodes)
+  assert.equal(session.surface.nodes.length, 1 + 8 + 2);
+  const abortedUser = session.events.find((event) => event.type === 'user/message' && event.data.id === 'user-11');
+  assert.equal(session.surface.nodes.includes(abortedUser.seq), false, 'the aborted turn left the surface');
+  const openUser = session.events.find((event) => event.type === 'user/message' && event.data.id === 'user-21');
+  assert.equal(session.surface.nodes.includes(openUser.seq), true, 'the open turn is never cut');
+  assert.match(result.summary[0].text, /第 1–16 轮/);
+});
+
+test('H30b real-session shape: head system + mid-surface injected system + aborted turns', async () => {
+  // Mirrors session-e219dedf on 2026-11-06: the real system prompt sits at
+  // surface 0 and must stay; a restart injects a second system/message in the
+  // middle of the surface (inside turn 12); several turns are aborted; the
+  // current turn is open. A single cut must remove the whole old prefix and
+  // leave exactly the four retained completed turns plus the open turn.
+  const session = new MockSession();
+  addTurnWithSystemHead(session, 1);
+  for (let turn = 2; turn <= 20; turn += 1) {
+    if (turn === 12) {
+      session.append('turn/start', { turn: 12 });
+      session.append('user/message', {
+        id: 'user-12', role: 'user', content: [{ type: 'text', text: '第 12 轮用户消息' }],
+        source: { kind: 'user', clientTimeZone: 'Asia/Shanghai' },
+      }, { surfaceOp: 'append' });
+      session.append('assistant/message', {
+        turn: 12, step: 1,
+        message: {
+          id: 'assistant-12', role: 'assistant',
+          source: { kind: 'model', provider: 'test', model: 'test' },
+          content: [{ type: 'text', text: '第 12 轮回答' }],
+        },
+      }, { surfaceOp: 'append' });
+      session.append('system/message', {
+        turn: 12, step: 2,
+        message: {
+          id: 'system-12', role: 'system', source: { kind: 'system-prompt' },
+          content: [{ type: 'text', text: 'You are an AI agent powered by DeepSeek Harness.' }],
+        },
+      }, { surfaceOp: 'append' });
+      session.append('turn/end', { turn: 12, reason: { kind: 'completed' } });
+      continue;
+    }
+    if (turn === 8 || turn === 15) addTurn(session, turn, { completed: false });
+    else addTurn(session, turn, { completed: true });
+  }
+  addTurn(session, 21, { open: true });
+  const systemEvent = session._events.find((event) => event.type === 'system/message');
+  const injected = session._events.filter((event) => event.type === 'system/message')[1];
+  assert.ok(systemEvent && injected);
+  const dir = caseDir('archive');
+  const { engine } = engineFor({ archiveDir: dir, perEvent: 5000, retainTurns: 4, retainTokens: 0, autoMinTokens: 0 });
+  const result = await engine.compactIfNeeded(makeAgent(session), 'pressure', new AbortController().signal);
+  assert.ok(result, 'the 396k shape must produce a plan');
+  const archive = readArchive(path.join(dir, fs.readdirSync(dir).find((name) => name.endsWith('.jsonl'))));
+  assert.deepEqual(archive.header.cutTurns.map((entry) => entry.turn), [1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16]);
+  assert.equal(result.shadowedSeqs.includes(systemEvent.seq), false, 'the head system prompt is never cut');
+  assert.equal(result.shadowedSeqs.includes(injected.seq), true, 'the injected copy goes with the old prefix');
+  assert.equal(session.surface.nodes[0], systemEvent.seq, 'head system prompt stays at surface 0');
+  // head system + pointer + four retained turns (8 nodes) + open turn (2 nodes)
+  assert.equal(session.surface.nodes.length, 1 + 1 + 8 + 2);
+  assert.equal(session.surface.nodes.includes(injected.seq), false, 'injected copy left the surface');
+});
+
+// ---------------------------------------------------------------------------
+// 1.6.7 hardening: barriers must never disable hot truncate silently
+// ---------------------------------------------------------------------------
+
+/** Append a message-shaped event that belongs to no turn (no turn/start). */
+function orphanMessage(session, type, id, text) {
+  const data = type === 'assistant/message'
+    ? { message: { id, role: 'assistant', content: [{ type: 'text', text }] } }
+    : { role: type === 'system/message' ? 'system' : 'user', id, content: [{ type: 'text', text }] };
+  return session.append(type, data, { surfaceOp: 'append' });
+}
+
+test('H35 head truncated mid-turn (orphan messages before the system prompt) still cuts', async () => {
+  // Red team E1: raw log truncation drops the head turn/start, leaving orphan
+  // user/assistant surface nodes before the re-appended system prompt. 1.6.6
+  // treated the turn===0 group as open => plan null forever. Now the orphan
+  // block/head instructions are kept in place and the closed turns after them
+  // are cut (red team E1: null -> [1,2]).
+  const session = new MockSession();
+  const orphanU = orphanMessage(session, 'user/message', 'orphan-u', 'orphan-mid-turn');
+  orphanMessage(session, 'assistant/message', 'orphan-a', 'orphan answer');
+  const headSystem = orphanMessage(session, 'system/message', 'head-sys', 'HEAD-SYSTEM');
+  for (let turn = 1; turn <= 7; turn += 1) {
+    if (turn === 7) addTurn(session, turn, { open: true });
+    else addTurn(session, turn, { completed: true });
+  }
+  const dir = caseDir('archive');
+  const { engine } = engineFor({ archiveDir: dir, perEvent: 5000, retainTurns: 4, retainTokens: 0, autoMinTokens: 0 });
+  const result = await engine.compactIfNeeded(makeAgent(session), 'pressure', new AbortController().signal);
+  assert.ok(result, 'the head barrier must not disable the planner (E1 was null before)');
+  const file = fs.readdirSync(dir).find((name) => name.endsWith('.jsonl'));
+  const parsed = readArchive(path.join(dir, file));
+  assert.deepEqual(parsed.header.cutTurns.map((entry) => entry.turn), [1, 2]);
+  assert.equal(result.shadowedSeqs.includes(headSystem.seq), false, 'head system instruction is never cut');
+  assert.equal(session.surface.nodes.includes(headSystem.seq), true, 'head system instruction stays on the surface');
+  assert.equal(session.surface.nodes.includes(orphanU.seq), true, 'orphan head block stays in place');
+});
+
+test('H36 a stray user/message between turns does not pin the prefix (red team E3)', async () => {
+  const session = new MockSession();
+  const headSystem = orphanMessage(session, 'system/message', 'head-sys', 'HEAD');
+  addTurn(session, 1, { completed: true });
+  const stray = session.append('user/message', {
+    id: 'between-turns', role: 'user', content: [{ type: 'text', text: 'between-turns' }],
+  }, { surfaceOp: 'append' });
+  for (let turn = 2; turn <= 7; turn += 1) {
+    if (turn === 7) addTurn(session, turn, { open: true });
+    else addTurn(session, turn, { completed: true });
+  }
+  const dir = caseDir('archive');
+  const { engine } = engineFor({ archiveDir: dir, perEvent: 5000, retainTurns: 4, retainTokens: 0, autoMinTokens: 0 });
+  const result = await engine.compactIfNeeded(makeAgent(session), 'pressure', new AbortController().signal);
+  assert.ok(result, 'the stray turn-0 group must not freeze the cut (E3 cut only [1] before)');
+  const file = fs.readdirSync(dir).find((name) => name.endsWith('.jsonl'));
+  const parsed = readArchive(path.join(dir, file));
+  assert.deepEqual(parsed.header.cutTurns.map((entry) => entry.turn), [1, 2]);
+  assert.equal(result.shadowedSeqs.includes(stray.seq), true, 'the stray message is inside the cut span');
+  assert.equal(session.surface.nodes.includes(stray.seq), false, 'the stray message left the surface');
+  assert.equal(session.surface.nodes.includes(headSystem.seq), true, 'the head system instruction stays');
+  assert.equal(parsed.records.some((record) => record.seq === stray.seq), true, 'the stray message is recoverable from the archive');
+});
+
+test('H37 a mid-log turn missing turn/end does not block later cuts (red team E2)', async () => {
+  const session = new MockSession();
+  orphanMessage(session, 'system/message', 'head-sys', 'HEAD');
+  addTurn(session, 1, { completed: true });
+  const abandonedStart = session.events.length;
+  addTurn(session, 2, { open: true }); // turn/end lost by log truncation
+  const abandonedEnd = session.events.length - 1;
+  for (let turn = 3; turn <= 6; turn += 1) addTurn(session, turn, { completed: true });
+  addTurn(session, 7, { open: true }); // the real current turn
+  const currentUser = session.events.find((event) => event.type === 'user/message' && event.data.id === 'user-7');
+  const dir = caseDir('archive');
+  const { engine } = engineFor({ archiveDir: dir, perEvent: 5000, retainTurns: 4, retainTokens: 0, autoMinTokens: 0 });
+  const result = await engine.compactIfNeeded(makeAgent(session), 'pressure', new AbortController().signal);
+  assert.ok(result, 'an abandoned mid-log unclosed turn must not freeze the planner');
+  const file = fs.readdirSync(dir).find((name) => name.endsWith('.jsonl'));
+  const parsed = readArchive(path.join(dir, file));
+  assert.deepEqual(parsed.header.cutTurns.map((entry) => entry.turn), [1, 2], 'turns before the retention window are cut');
+  const abandoned = parsed.header.cutTurns.find((entry) => entry.turn === 2);
+  assert.ok(abandoned.endSeq > abandoned.startSeq, 'abandoned turn archive range is inferred, not empty');
+  assert.equal(parsed.records.some((record) => record.turn === 2), true, 'abandoned turn events are recoverable');
+  assert.equal(session.surface.nodes.includes(currentUser.seq), true, 'the current open turn is never cut');
+  assert.equal(session.surface.nodes.some((seq) => seq >= abandonedStart && seq <= abandonedEnd), false, 'the abandoned turn left the surface');
+  assert.equal(result.shadowedSeqs.includes(currentUser.seq), false);
+});
+
+test('H38 "cut or say why": a blocked prefix logs a structured refusal instead of silence', async () => {
+  // Normal case: not enough completed turns yet.
+  const small = new MockSession();
+  addTurn(small, 1, { completed: true });
+  addTurn(small, 2, { completed: false });
+  addTurn(small, 3, { open: true });
+  const { engine, ctx } = engineFor({ archiveDir: caseDir('archive'), perEvent: 5000, retainTurns: 4, retainTokens: 0, autoMinTokens: 0 });
+  const none = await engine.compactIfNeeded(makeAgent(small), 'pressure', new AbortController().signal);
+  assert.equal(none, null);
+  assert.match(ctx.text('warn'), /未切（not-enough-turns）/);
+
+  // Blocked prefix: the only groups older than the boundary are a turn===0
+  // system zone, so there is nothing whole to cut. The reason must be visible.
+  const blocked = new MockSession();
+  orphanMessage(blocked, 'system/message', 'head-sys', 'HEAD');
+  for (let turn = 1; turn <= 5; turn += 1) {
+    if (turn === 5) addTurn(blocked, turn, { open: true });
+    else addTurn(blocked, turn, { completed: true });
+  }
+  const second = engineFor({ archiveDir: caseDir('archive'), perEvent: 5000, retainTurns: 4, retainTokens: 0, autoMinTokens: 0 });
+  const blockedResult = await second.engine.compactIfNeeded(makeAgent(blocked), 'pressure', new AbortController().signal);
+  assert.equal(blockedResult, null, 'nothing cuttable yet');
+  assert.match(second.ctx.text('warn'), /未切（blocked-prefix）/);
+  assert.match(second.ctx.text('warn'), /head-sys|blocked-prefix/);
 });
 
 test('H4 archive: atomic JSONL, exact event count, sha256, append-only', async () => {
@@ -525,7 +733,7 @@ test('H5 pointer text carries N/M, session_original(turn=…), and the archive p
   const text = result.summary[0].text;
   assert.match(text, /本会话共 9 轮，其中 3 轮已压缩归档；需要原文用 session_original\(turn=…\) 或读归档路径：/);
   assert.ok(text.includes(dir), 'archive directory is in the pointer');
-  assert.match(text, /只切已完成且早于保留窗口的轮/);
+  assert.match(text, /只切已结束且早于保留窗口的轮/);
   assert.match(text, /保留窗口：最近 6 个已完成轮、至少 0 tokens（本次保留 6 轮）/);
 
   const pointerEvent = session.events[result.summarySeq + 1];
@@ -586,7 +794,12 @@ test('H28 a system prompt at surface 0 is never cut; the pointer lands at positi
   assert.equal(parsed.header.cutTurns[0].startSeq, 0, 'the archive still covers the whole turn');
 });
 
-test('H29 a system message inside the candidate span stops the cut before its turn', async () => {
+test('H29 a mid-span host-injected system message is archived with the old prefix', async () => {
+  // 1.6.6: the head system prompt is still never cut (H28). A host-injected
+  // system/message in the middle of the surface is a duplicate re-emitted by a
+  // restart; the host tolerates it inside a replacement range, and keeping it
+  // outside pinned every following turn forever. It is archived with the old
+  // prefix instead of stopping the cut before its turn.
   const session = new MockSession();
   addTurn(session, 1);
   addTurnWithSystemInside(session, 2);
@@ -596,12 +809,12 @@ test('H29 a system message inside the candidate span stops the cut before its tu
   const dir = caseDir('archive');
   const { engine } = engineFor({ archiveDir: dir });
   const result = await engine.compactNow(makeAgent(session), new AbortController().signal);
-  assert.ok(result, 'the safe prefix before the system message is still cuttable');
-  assert.equal(result.shadowedSeqs.includes(systems[0].seq), false);
+  assert.ok(result, 'the old prefix is cuttable');
+  assert.equal(result.shadowedSeqs.includes(systems[0].seq), true, 'the injected copy is archived with the prefix');
   const file = fs.readdirSync(dir).find((name) => name.endsWith('.jsonl'));
   const parsed = readArchive(path.join(dir, file));
-  assert.deepEqual(parsed.header.cutTurns.map((entry) => entry.turn), [1], 'only turn 1 is cut');
-  assert.equal(session.surface.nodes.includes(systems[0].seq), true, 'the system node remains on the surface');
+  assert.deepEqual(parsed.header.cutTurns.map((entry) => entry.turn), [1, 2], 'turn 1 and the injected turn 2 are cut');
+  assert.equal(session.surface.nodes.includes(systems[0].seq), false, 'the injected copy left the surface with its turn');
 });
 
 test('H6 successive cuts update the cumulative archived count and fold the old pointer', async () => {