@namzu/sdk 27.0.0 → 28.0.0

package/src/runtime/query/iteration/phases/advisory.ts

@@ -1,4 +1,5 @@
 import { serializeState } from '../../../../compaction/serializer.js'
+import { NAMZU } from '../../../../constants/telemetry/index.js'
 import type { AdvisoryRequest, TriggerEvaluationState } from '../../../../types/advisory/index.js'
 import { toolResultToText } from '../../../../types/message/content.js'
 import { createUserMessage } from '../../../../types/message/index.js'
@@ -53,8 +54,8 @@ export async function runAdvisoryPhase(
 	const budgetCheck = advisoryCtx.checkBudget()
 	if (!budgetCheck.allowed) {
 		ctx.log.debug('Advisory budget exhausted, skipping advisory phase', {
-			runId: ctx.runMgr.id,
-			reason: budgetCheck.reason,
+			[NAMZU.RUN_ID]: ctx.runMgr.id,
+			'namzu.runtime.reason': budgetCheck.reason,
 		})
 		return
 	}
@@ -80,9 +81,9 @@ export async function runAdvisoryPhase(
 	const advisor = advisoryCtx.registry.resolve(trigger.advisorId)
 	if (!advisor) {
 		ctx.log.warn('Advisory trigger fired but advisor not found', {
-			runId: ctx.runMgr.id,
-			triggerId: trigger.id,
-			advisorId: trigger.advisorId,
+			[NAMZU.RUN_ID]: ctx.runMgr.id,
+			'namzu.runtime.trigger_id': trigger.id,
+			'namzu.advisory.id': trigger.advisorId,
 		})
 		return
 	}
@@ -171,20 +172,20 @@ export async function runAdvisoryPhase(
 		ctx.runMgr.pushMessage(createUserMessage(sections.join('\n')))
 
 		ctx.log.info('Advisory phase completed', {
-			runId: ctx.runMgr.id,
-			iteration: iterationNum,
-			triggerId: trigger.id,
-			advisorId: advisor.id,
-			durationMs: executionResult.durationMs,
-			totalAdvisoryCalls: advisoryCtx.callHistory.length,
+			[NAMZU.RUN_ID]: ctx.runMgr.id,
+			[NAMZU.ITERATION]: iterationNum,
+			'namzu.runtime.trigger_id': trigger.id,
+			'namzu.advisory.id': advisor.id,
+			'namzu.duration_ms': executionResult.durationMs,
+			'namzu.runtime.total_advisory_calls': advisoryCtx.callHistory.length,
 		})
 	} catch (err) {
 		ctx.log.warn('Advisory phase failed', {
-			runId: ctx.runMgr.id,
-			iteration: iterationNum,
-			triggerId: trigger.id,
-			advisorId: advisor.id,
-			error: toErrorMessage(err),
+			[NAMZU.RUN_ID]: ctx.runMgr.id,
+			[NAMZU.ITERATION]: iterationNum,
+			'namzu.runtime.trigger_id': trigger.id,
+			'namzu.advisory.id': advisor.id,
+			'exception.message': toErrorMessage(err),
 		})
 	}
 }

package/src/runtime/query/iteration/phases/compaction.ts

@@ -1,43 +1,25 @@
 import { resolveContextWindow } from '../../../../compaction/context-window.js'
-import { findDanglingMessages, findSafeTrimIndex } from '../../../../compaction/dangling.js'
+import { findDanglingMessages } from '../../../../compaction/dangling.js'
+import { planCompaction } from '../../../../compaction/plan.js'
 import type { ContextReducer, ContextReduction } from '../../../../compaction/reducer.js'
 import { createSlidingWindowReducer } from '../../../../compaction/reducer.js'
 import { findRetainedIndices } from '../../../../compaction/retention.js'
 import { serializeState } from '../../../../compaction/serializer.js'
-import { clearStaleToolResults } from '../../../../compaction/tool-result-editing.js'
+import { buildCompactionMessage, isCompactionMessage } from '../../../../compaction/summary.js'
 import { buildVerifiedSummary } from '../../../../compaction/verifier.js'
 import { CHARS_PER_TOKEN } from '../../../../constants/limits.js'
-import { resolveTaskModel } from '../../../../router/task-router.js'
+import { NAMZU } from '../../../../constants/telemetry/index.js'
+import { invariants } from '../../../../invariants/index.js'
+import { resolveTaskModel } from '../../../../model-router/task-router.js'
 import type { Message } from '../../../../types/message/index.js'
-import { createSystemMessage } from '../../../../types/message/index.js'
 import type { IterationContext } from './context.js'
 import { isWorkingMemoryMessage } from './working-memory.js'
 
-const COMPACTION_HEADER =
-	'[COMPACTED CONTEXT] The following is a structured summary of the conversation so far.'
-
-/**
- * Identity check for a prior compaction summary in the leading floor. Used to
- * REPLACE one in place on the per-iteration (contextWindowTokens) path so at
- * most one `[COMPACTED CONTEXT]` block ever lives in the never-trimmed floor,
- * and by the checkpoint-restore path to PRESERVE the summary across a resume
- * (it is the only surviving record of the older history the run compacted away).
- */
-export function isCompactionMessage(content: string | null | undefined): boolean {
-	return typeof content === 'string' && content.startsWith(COMPACTION_HEADER)
-}
-
-/**
- * Minimum number of compactable (older) messages required before a compaction
- * pass is worth running. When there is NOTHING between the never-trimmed
- * leading floor and the recent window, a pass would only replace nothing with a
- * `[COMPACTED CONTEXT]` summary that joins the floor — pure overhead that fires
- * again next iteration (the permanent-floor thrash, ses_055 D7). Set to the
- * literal EMPTY guard so any existing compaction consumer with ≥1 older message
- * stays byte-identical; the per-iteration Vandal path additionally defangs the
- * cost with `llmVerification:false`.
- */
-const MIN_OLDER_MESSAGES_TO_COMPACT = 1
+// `isCompactionMessage` and the header moved to `compaction/summary.ts` —
+// this phase is a layer ABOVE that module, so nothing down there could
+// reach them, and a host-callable compaction needs both. Re-exported here
+// because `runtime/query/index.ts` already imports it from this path.
+export { isCompactionMessage } from '../../../../compaction/summary.js'
 
 /**
  * How much a forced pass must shed before the turn is worth retrying.
@@ -192,19 +174,19 @@ export async function relieveOverflow(ctx: IterationContext): Promise<boolean> {
 	const meaningful = Math.max(MIN_RELIEF_CHARS, beforeChars * MIN_RELIEF_FRACTION)
 	if (shed < meaningful) {
 		ctx.log.warn('Context overflow with too little left to shed — the prompt is irreducible', {
-			runId: ctx.runMgr.id,
-			messages: before,
-			charsShed: shed,
-			neededAtLeast: Math.ceil(meaningful),
+			[NAMZU.RUN_ID]: ctx.runMgr.id,
+			'namzu.runtime.messages': before,
+			'namzu.runtime.chars_shed': shed,
+			'namzu.runtime.needed_at_least': Math.ceil(meaningful),
 		})
 		return false
 	}
 
 	ctx.log.info('Relieved a context overflow by compacting', {
-		runId: ctx.runMgr.id,
-		messagesBefore: before,
-		messagesAfter: ctx.runMgr.messages.length,
-		charsShed: shed,
+		[NAMZU.RUN_ID]: ctx.runMgr.id,
+		'namzu.runtime.messages_before': before,
+		'namzu.runtime.messages_after': ctx.runMgr.messages.length,
+		'namzu.runtime.chars_shed': shed,
 	})
 	return true
 }
@@ -229,7 +211,10 @@ function totalChars(messages: readonly { content: unknown }[]): number {
  * repairing it would trade a clear "this reducer split a tool pair" for an
  * opaque rejection a call later, with the reducer never implicated. The
  * invariant is written on {@link ContextReducer}; enforcing it where it is
- * violated is what makes it true rather than aspirational.
+ * violated is what makes it true rather than aspirational — and, below, it
+ * is registered as `compaction:no-split-tool-pair` on the shared invariant
+ * registry, so an operator can ask whether this build still holds it and
+ * how many times it has not.
  */
 /**
  * Put a compaction that shed nothing on the wire.
@@ -259,13 +244,50 @@ async function declined(
 	})
 }
 
+/**
+ * Ctx for `compaction:no-split-tool-pair`, registered just below: the
+ * candidate history a reducer just returned, not yet installed. Passed on
+ * every live call, in `applyReducer`; `namzu doctor` calls the same check
+ * with no ctx at all and reads `unknown` back, because there is no
+ * candidate reduction to ask about outside a live compaction pass.
+ */
+interface ToolPairInvariantContext {
+	readonly messages: readonly Message[]
+}
+
+/**
+ * `compaction:no-split-tool-pair` — the same {@link findDanglingMessages}
+ * call the inline `if` used to make, registered so `namzu doctor` can list
+ * it and a violation counts somewhere an operator can read. The check
+ * itself, and the decision `applyReducer` makes with its answer, are
+ * unchanged.
+ */
+invariants.register<ToolPairInvariantContext | undefined>(
+	'compaction',
+	'no-split-tool-pair',
+	(ctx) => {
+		if (!ctx) {
+			return {
+				state: 'unknown',
+				reason: 'no candidate reduction to check outside a live compaction pass',
+			}
+		}
+		return findDanglingMessages([...ctx.messages]).isValid
+			? { state: 'holds' }
+			: {
+					state: 'violated',
+					detail: 'reducer output splits a tool_use/tool_result pair across the cut',
+				}
+	},
+)
+
 async function applyReducer(
 	ctx: IterationContext,
 	reducer: ContextReducer,
 	reduction: ContextReduction,
 	measurement: {
 		measuredBy: 'provider' | 'estimate'
-		windowSource: 'config' | 'model-table' | 'default'
+		windowSource: 'config' | 'provider' | 'model-table' | 'default'
 	},
 ): Promise<void> {
 	const messages = ctx.runMgr.messages
@@ -278,9 +300,9 @@ async function applyReducer(
 	} catch (error) {
 		const message = error instanceof Error ? error.message : String(error)
 		ctx.log.warn('Context reducer threw — keeping the full history', {
-			runId: ctx.runMgr.id,
-			reason: reduction.reason,
-			error: message,
+			[NAMZU.RUN_ID]: ctx.runMgr.id,
+			'namzu.runtime.reason': reduction.reason,
+			'exception.message': message,
 		})
 		await declined(ctx, 'reducer_threw', before, message)
 		return
@@ -288,24 +310,31 @@ async function applyReducer(
 
 	if (!next || next.length >= before) {
 		ctx.log.debug('Context reducer shed nothing', {
-			runId: ctx.runMgr.id,
-			reason: reduction.reason,
-			messages: before,
+			[NAMZU.RUN_ID]: ctx.runMgr.id,
+			'namzu.runtime.reason': reduction.reason,
+			'namzu.runtime.messages': before,
 		})
 		await declined(ctx, 'shed_nothing', before)
 		return
 	}
 
-	if (!findDanglingMessages([...next]).isValid) {
+	const toolPairOutcome = await invariants.evaluate('compaction:no-split-tool-pair', {
+		messages: next,
+	})
+	if (toolPairOutcome.state === 'violated') {
 		ctx.log.warn('Context reducer split a tool pair — refusing its result', {
-			runId: ctx.runMgr.id,
-			reason: reduction.reason,
-			hint: 'use findSafeTrimIndex to move a cut off a tool_use/tool_result boundary',
+			[NAMZU.RUN_ID]: ctx.runMgr.id,
+			'namzu.runtime.reason': reduction.reason,
+			'namzu.runtime.hint':
+				'use findSafeTrimIndex to move a cut off a tool_use/tool_result boundary',
+			'namzu.runtime.detail': toolPairOutcome.detail,
 		})
 		await declined(ctx, 'split_tool_pair', before)
 		return
 	}
 
+	await recordShed(ctx, [...messages], next, reduction.reason)
+
 	messages.length = 0
 	for (const message of next) messages.push(message)
 
@@ -315,11 +344,11 @@ async function applyReducer(
 	ctx.runMgr.clearLastPromptTokens?.()
 
 	ctx.log.info('Context reduced', {
-		runId: ctx.runMgr.id,
-		reason: reduction.reason,
-		oldMessageCount: before,
-		newMessageCount: messages.length,
-		charsShed: beforeChars - totalChars(messages),
+		[NAMZU.RUN_ID]: ctx.runMgr.id,
+		'namzu.runtime.reason': reduction.reason,
+		'namzu.runtime.old_message_count': before,
+		'namzu.runtime.new_message_count': messages.length,
+		'namzu.runtime.chars_shed': beforeChars - totalChars(messages),
 	})
 
 	// This path emitted NOTHING on success, and it is the path a host-supplied
@@ -345,6 +374,44 @@ async function applyReducer(
 	})
 }
 
+/**
+ * Record what a pass is about to remove, before it removes it.
+ *
+ * The ordering is the whole mechanism. `transcript.jsonl` is append-only
+ * and `emitEvent` reaches it synchronously with the pass, while `persist()`
+ * overwrites `messages.json` wholesale later in the loop — so emitting HERE
+ * makes the record durable before the deletion is. Emitted after the array
+ * install, a crash between the two loses exactly what this exists to keep.
+ *
+ * Diffed by identity, not by index. Both shed paths can retain messages
+ * from the middle of the history — the structured one keeps whatever the
+ * working-memory pass re-pinned — so "everything before the cut" would
+ * record messages that are still there.
+ */
+async function recordShed(
+	ctx: IterationContext,
+	before: readonly Message[],
+	after: readonly Message[],
+	reason: 'threshold' | 'overflow',
+): Promise<void> {
+	if (ctx.compactionConfig?.recordShedHistory === false) return
+
+	const kept = new Set<Message>(after)
+	const shed = before.filter((m) => !kept.has(m))
+	// Nothing shed, nothing to record. A pass that only rewrote the floor
+	// emits no event rather than an empty one nobody can distinguish from a
+	// real record of nothing.
+	if (shed.length === 0) return
+
+	await ctx.emitEvent?.({
+		type: 'compaction_shed',
+		runId: ctx.runMgr.id,
+		iteration: ctx.runMgr.currentIteration,
+		messages: shed,
+		reason,
+	})
+}
+
 export async function runCompactionCheck(
 	ctx: IterationContext,
 	options?: { force?: boolean },
@@ -363,7 +430,11 @@ export async function runCompactionCheck(
 	// number. Nothing in the estate ever set `contextWindowTokens`, so the
 	// fallback WAS the behavior, and the shipped CLI's 1M budget put the
 	// trigger at ~700k. See `compaction/context-window.ts`.
-	const window = resolveContextWindow(config.contextWindowTokens, ctx.runConfig.model)
+	const window = resolveContextWindow(
+		config.contextWindowTokens,
+		ctx.runConfig.model,
+		ctx.providerContextWindow,
+	)
 	const budget = window.tokens
 
 	const usage = estimatedTokens / budget
@@ -401,14 +472,14 @@ export async function runCompactionCheck(
 	if (!manager) return
 
 	ctx.log.info('Compaction threshold reached — compacting context', {
-		runId: ctx.runMgr.id,
-		contextTokens: estimatedTokens,
-		measuredBy: measured.source,
-		window: budget,
-		windowSource: window.source,
-		usage: Math.round(usage * 100),
-		triggerThreshold: config.triggerThreshold,
-		slotCount: manager.slotCount(),
+		[NAMZU.RUN_ID]: ctx.runMgr.id,
+		'namzu.runtime.context_tokens': estimatedTokens,
+		'namzu.runtime.measured_by': measured.source,
+		'namzu.runtime.window': budget,
+		'namzu.runtime.window_source': window.source,
+		'namzu.runtime.usage': Math.round(usage * 100),
+		'namzu.runtime.trigger_threshold': config.triggerThreshold,
+		'namzu.runtime.slot_count': manager.slotCount(),
 	})
 
 	// Try the cheap, NON-destructive reclaim first: clear the output of old,
@@ -418,126 +489,100 @@ export async function runCompactionCheck(
 	// already read and moved past. Clearing those keeps every message
 	// verbatim, and keeps `tool_use` ↔ `tool_result` pairing intact by
 	// construction, because nothing moves.
-	if (config.clearToolResults !== false) {
-		const edit = clearStaleToolResults(ctx.runMgr.messages, {
-			...(config.keepRecentToolResults !== undefined
-				? { keepRecentToolResults: config.keepRecentToolResults }
-				: {}),
-			...(config.minToolResultCharsToClear !== undefined
-				? { minCharsToClear: config.minToolResultCharsToClear }
-				: {}),
-			...(config.preserveToolResultsFrom ? { preserveTools: config.preserveToolResultsFrom } : {}),
+	//
+	// The decision is `planCompaction`'s; installing it is this file's. The
+	// planner touches no `ctx` at all, which is what lets the boundary
+	// arithmetic be tested without a run.
+	const clearPlan = planCompaction({
+		messages: ctx.runMgr.messages,
+		config,
+		contextWindowTokens: budget,
+		estimatedTokens,
+		...(options?.force ? { force: true } : {}),
+	})
+
+	if (clearPlan.kind === 'cleared') {
+		// Element-wise, not a rebuild: the edit is length-preserving by
+		// construction (only `content` changes), so writing entries back
+		// keeps the live array identity the rest of the run holds.
+		const live = ctx.runMgr.messages
+		clearPlan.messages.forEach((msg, i) => {
+			live[i] = msg
 		})
 
-		if (edit.clearedCount > 0) {
-			// Element-wise, not a rebuild: the edit is length-preserving by
-			// construction (only `content` changes), so writing entries back
-			// keeps the live array identity the rest of the run holds.
-			const live = ctx.runMgr.messages
-			edit.messages.forEach((msg, i) => {
-				live[i] = msg
-			})
+		ctx.log.info('Cleared stale tool results instead of compacting', {
+			[NAMZU.RUN_ID]: ctx.runMgr.id,
+			'namzu.runtime.cleared': clearPlan.clearedCount,
+			'namzu.runtime.chars_reclaimed': clearPlan.charsReclaimed,
+			'namzu.runtime.reclaimed_tokens': clearPlan.reclaimedTokens,
+		})
 
-			const reclaimedTokens = Math.ceil(edit.charsReclaimed / CHARS_PER_TOKEN)
-			ctx.log.info('Cleared stale tool results instead of compacting', {
-				runId: ctx.runMgr.id,
-				cleared: edit.clearedCount,
-				charsReclaimed: edit.charsReclaimed,
-				reclaimedTokens,
-			})
+		// Emitted BEFORE the return so the insufficient branch is not the
+		// silent one: a clear that fell through to summarization edited the
+		// history exactly as much as one that did not.
+		await ctx.emitEvent?.({
+			type: 'compaction_tool_results_cleared',
+			runId: ctx.runMgr.id,
+			iteration: ctx.runMgr.currentIteration,
+			clearedCount: clearPlan.clearedCount,
+			charsReclaimed: clearPlan.charsReclaimed,
+			reclaimedTokens: clearPlan.reclaimedTokens,
+			reliefWasEnough: clearPlan.reliefWasEnough,
+		})
 
-			// If that was enough, stop here and keep the history verbatim.
-			// The measurement is an estimate either way; the provider's own
-			// count for the NEXT turn will correct it, and an over-eager
-			// summarization is far more costly than one late pass.
-			//
-			// NOT on a forced pass. A forced pass runs because the provider
-			// REJECTED the prompt as too long, which is a measurement — and
-			// this branch would answer it with the same estimate the provider
-			// just refuted, declare success after clearing one result, and
-			// hand back a history that overflows again on the retry. The
-			// estimate is the thing that was proven wrong; it does not get to
-			// end the pass.
-			if (
-				!options?.force &&
-				(estimatedTokens - reclaimedTokens) / budget < config.triggerThreshold
-			) {
-				return
-			}
-		}
+		// If that was enough, stop here and keep the history verbatim. The
+		// measurement is an estimate either way; the provider's own count for
+		// the NEXT turn will correct it, and an over-eager summarization is
+		// far more costly than one late pass.
+		if (clearPlan.reliefWasEnough) return
 	}
 
+	// Second call, over the history the clear above may have just edited.
+	// `skipToolResultClear` because that step already ran and installed its
+	// result; asking again would clear nothing and say so as a `cleared`
+	// with a zero count, which is a shape this branch would have to ignore.
 	const messages = ctx.runMgr.messages
-	if (messages.length < config.keepRecentMessages + 2) {
-		ctx.log.debug('Not enough messages to compact', {
-			messageCount: messages.length,
-			keepRecentMessages: config.keepRecentMessages,
-		})
-		return
-	}
+	const plan = planCompaction({
+		messages,
+		config,
+		contextWindowTokens: budget,
+		estimatedTokens,
+		skipToolResultClear: true,
+		...(options?.force ? { force: true } : {}),
+	})
 
-	const systemMessages: typeof messages = []
-	for (const msg of messages) {
-		if (msg.role !== 'system') break
-		systemMessages.push(msg)
-	}
-	if (systemMessages.length === 0) return
-
-	// Tool-pair atomicity guard. A naive cut at `length - keepRecentMessages`
-	// can land BETWEEN an assistant-with-toolCalls (which would be dropped into
-	// `olderMessages`) and its `tool` results (kept in `recentMessages`),
-	// leaving orphaned `tool_result` blocks at the head of the recent window.
-	// The provider then emits a `tool_result` with no matching
-	// `tool_use` and the API rejects the next turn with a 400 — so compaction,
-	// whose whole job is to keep a long run alive, instead kills it. Snap the
-	// boundary FORWARD to a safe point (existing `findSafeTrimIndex`, previously
-	// only wired to the unused ConversationManager strategy classes) so no pair
-	// is split. Any message this moves out of the recent window is already
-	// represented in the extracted WorkingState the summary is built from.
-	const naiveKeepStart = messages.length - config.keepRecentMessages
-	let keepStart = -1
-	for (let candidate = naiveKeepStart; candidate > systemMessages.length; candidate--) {
-		if (findSafeTrimIndex(messages, candidate) === candidate) {
-			keepStart = candidate
-			break
+	if (plan.kind !== 'plan') {
+		// One log line per reason, with the fields each one was already
+		// reporting. The planner names the reason; what it means to an
+		// operator reading a run is this file's to say.
+		if (plan.kind === 'skip') {
+			switch (plan.reason) {
+				case 'too_few_messages':
+					ctx.log.debug('Not enough messages to compact', {
+						'namzu.runtime.message_count': messages.length,
+						'namzu.runtime.keep_recent_messages': config.keepRecentMessages,
+					})
+					break
+				case 'no_safe_cut':
+					ctx.log.debug('Skipping compaction — no safe cut at or below the naive boundary', {
+						[NAMZU.RUN_ID]: ctx.runMgr.id,
+						'namzu.runtime.system_messages': messages.filter((m) => m.role === 'system').length,
+						'namzu.runtime.message_count': messages.length,
+					})
+					break
+				case 'too_few_older':
+					ctx.log.debug('Skipping compaction — too few older messages', {
+						[NAMZU.RUN_ID]: ctx.runMgr.id,
+					})
+					break
+				case 'no_system_floor':
+					break
+			}
 		}
-	}
-
-	// No safe boundary at or below naive. Either every candidate splits a pair-set
-	// (one assistant fanning out more calls than the recent window holds), or naive
-	// itself sits inside the leading system prefix — which would otherwise
-	// duplicate those prompts into `recentMessages`. Skipping costs one iteration's
-	// worth of context headroom; cutting anyway costs the live turn. The condition
-	// is self-clearing: the next assistant message moves naive past the tool block.
-	if (keepStart < 0) {
-		ctx.log.debug('Skipping compaction — no safe cut at or below the naive boundary', {
-			runId: ctx.runMgr.id,
-			naiveKeepStart,
-			systemMessages: systemMessages.length,
-			messageCount: messages.length,
-		})
 		return
 	}
 
-	const recentMessages = messages.slice(keepStart)
-	const olderMessages = messages.slice(systemMessages.length, keepStart)
-
-	// D7: nothing meaningful to compact — skip instead of thrashing the
-	// permanent leading floor every iteration (and avoid an LLM verification
-	// call when there is no older history to summarize).
-	//
-	// This guard used to be gated on `contextWindowTokens != null` to keep
-	// the tokenBudget path byte-identical. That path's actual behavior was
-	// "never fires", so there is nothing left to preserve — and now that the
-	// trigger works, an ungated consumer would thrash. Same for the prior-
-	// summary replacement below.
-	if (olderMessages.length < MIN_OLDER_MESSAGES_TO_COMPACT) {
-		ctx.log.debug('Skipping compaction — too few older messages', {
-			runId: ctx.runMgr.id,
-			olderMessages: olderMessages.length,
-		})
-		return
-	}
+	const { systemMessages, olderMessages, recentMessages, keepStart } = plan
 
 	let compactedContent: string
 
@@ -550,7 +595,7 @@ export async function runCompactionCheck(
 		const compactionModel = resolveTaskModel('compaction', ctx.taskRouter, ctx.runConfig.model)
 		compactedContent = await buildVerifiedSummary(
 			manager,
-			olderMessages,
+			olderMessages as Message[],
 			ctx.provider,
 			config,
 			(usage) =>
@@ -570,7 +615,7 @@ export async function runCompactionCheck(
 		compactedContent = serializeState(manager.getState())
 	}
 
-	const compactionMessage = createSystemMessage(`${COMPACTION_HEADER}\n\n${compactedContent}`)
+	const compactionMessage = buildCompactionMessage(compactedContent)
 
 	// Drop any PRIOR `[COMPACTED CONTEXT]` summary from the leading floor —
 	// `serializeState` is cumulative, so the new summary supersedes it.
@@ -610,12 +655,14 @@ export async function runCompactionCheck(
 			// Re-pin as the last leading system message, before the summary.
 			newMessages.splice(preservedSystem.length, 0, priorSlot)
 			ctx.log.warn('Re-pinned working-memory slot dropped by compaction', {
-				runId: ctx.runMgr.id,
+				[NAMZU.RUN_ID]: ctx.runMgr.id,
 			})
 		}
 	}
 
 	const oldCount = messages.length
+	await recordShed(ctx, [...messages], newMessages, options?.force ? 'overflow' : 'threshold')
+
 	messages.length = 0
 	for (const msg of newMessages) {
 		messages.push(msg)
@@ -639,23 +686,24 @@ export async function runCompactionCheck(
 	const reachedReset = newEstimate / budget <= config.resetThreshold
 	if (!reachedReset) {
 		ctx.log.warn('Compaction did not reach its reset threshold — context may still be tight', {
-			runId: ctx.runMgr.id,
-			afterUsage: Math.round((newEstimate / budget) * 100),
-			resetThreshold: Math.round(config.resetThreshold * 100),
-			hint: 'lower keepRecentMessages, or raise the context window if the model supports one',
+			[NAMZU.RUN_ID]: ctx.runMgr.id,
+			'namzu.runtime.after_usage': Math.round((newEstimate / budget) * 100),
+			'namzu.runtime.reset_threshold': Math.round(config.resetThreshold * 100),
+			'namzu.runtime.hint':
+				'lower keepRecentMessages, or raise the context window if the model supports one',
 		})
 	}
 
 	ctx.log.info('Context compacted', {
-		runId: ctx.runMgr.id,
-		oldMessageCount: oldCount,
-		newMessageCount: messages.length,
-		removedMessages: oldCount - messages.length,
-		oldTokenEstimate: estimatedTokens,
-		newTokenEstimate: newEstimate,
-		reductionPercent: Math.round((1 - newEstimate / estimatedTokens) * 100),
-		reachedReset,
-		slotCount: manager.slotCount(),
+		[NAMZU.RUN_ID]: ctx.runMgr.id,
+		'namzu.runtime.old_message_count': oldCount,
+		'namzu.runtime.new_message_count': messages.length,
+		'namzu.runtime.removed_messages': oldCount - messages.length,
+		'namzu.runtime.old_token_estimate': estimatedTokens,
+		'namzu.runtime.new_token_estimate': newEstimate,
+		'namzu.runtime.reduction_percent': Math.round((1 - newEstimate / estimatedTokens) * 100),
+		'namzu.runtime.reached_reset': reachedReset,
+		'namzu.runtime.slot_count': manager.slotCount(),
 	})
 
 	// Compaction is destructive and was, until now, completely silent: no