@retaw106/mmc-oc 1.2.2 → 2.0.0

package/src/config/schema/magic-context.ts

@@ -2,6 +2,7 @@ import { z } from "zod";
 import { isValidLanguageCode } from "../../agents/language-directive";
 import { toolTemplateError } from "../../shared/historian-tool-template";
 import { isValidPromptSurfaceModelKey } from "../../shared/prompt-surface";
+import { DEFAULT_PROTECTED_TOOLS, mergeProtectedTools } from "../../shared/protected-tools-policy";
 import { AgentOverrideConfigSchema } from "./agent-overrides";
 
 export const DEFAULT_EXECUTE_THRESHOLD_PERCENTAGE = 65;
@@ -96,131 +97,66 @@ export const PromptSurfaceConfigSchema = z
 export type PromptSurfaceConfig = z.infer<typeof PromptSurfaceConfigSchema>;
 
 /**
- * The flat model-resolution fields are the only fields that move into harness
- * blocks. Keeping this inventory next to the schema gives the loader migration
- * an exhaustive contract instead of a catch-all rule.
+ * The flat historian model-resolution fields. This is the exhaustive contract
+ * for what a project-tier (repo-supplied) config must never set: the model, its
+ * fallbacks, and the per-harness qualifiers (OpenCode `variant`, Pi
+ * `thinking_level`) all merge onto the user's historian model at resolve time,
+ * so a cloned repo could otherwise force extra variant/thinking spend.
  */
-export const PER_HARNESS_MIGRATION_INVENTORY = {
-    historian: {
-        retained: [
-            "temperature",
-            "top_p",
-            "prompt",
-            "tools",
-            "disable",
-            "description",
-            "mode",
-            "color",
-            "maxSteps",
-            "permission",
-            "maxTokens",
-            "two_pass",
-            "disallowed_tools",
-        ],
-        migrated_execution: ["model", "fallback_models", "variant", "thinking_level"],
-    },
-} as const;
+export const HISTORIAN_MODEL_RESOLUTION_FIELDS = [
+    "model",
+    "fallback_models",
+    "variant",
+    "thinking_level",
+] as const;
 
-/** Harness keys that own independent hidden-agent model-selection blocks. */
-export const PER_HARNESS_MODEL_KEYS = ["opencode", "pi"] as const;
+/**
+ * The removed per-harness historian model blocks. They are no longer part of
+ * the schema; this list exists only so the loaders can detect them and REJECT
+ * the config file loudly (a parse failure → defaults / last-known-good) instead
+ * of letting Zod silently strip them (which would leave the historian with no
+ * model and look "configured but never running").
+ */
+export const LEGACY_HARNESS_BLOCK_KEYS = ["opencode", "pi"] as const;
 
-/** OpenCode entry objects permit `variant` and reject Pi-only `thinking_level`. */
-const OcEntryObjectSchema = z
+/**
+ * A historian model entry: either a bare model ID string, or an object that may
+ * carry the OpenCode `variant` and/or the Pi `thinking_level` qualifier. The
+ * active harness reads only its own qualifier and ignores the other; there is
+ * no cross-harness mapping.
+ */
+const HistorianModelEntryObjectSchema = z
     .object({
-        model: z.string().describe("OpenCode model ID (for example, provider/model)."),
+        model: z.string().describe("Model ID (for example, provider/model)."),
         variant: z.string().optional().describe("OpenCode reasoning variant for this entry."),
-    })
-    .strict();
-export const OcEntrySchema = z.union([z.string(), OcEntryObjectSchema]);
-export type OcEntry = z.infer<typeof OcEntrySchema>;
-
-/** Pi entry objects permit `thinking_level` and reject OpenCode-only `variant`. */
-const PiEntryObjectSchema = z
-    .object({
-        model: z.string().describe("Pi model ID (for example, provider/model)."),
         thinking_level: PiThinkingLevelSchema.describe("Pi thinking level for this entry."),
     })
     .strict();
-export const PiEntrySchema = z.union([z.string(), PiEntryObjectSchema]);
-export type PiEntry = z.infer<typeof PiEntrySchema>;
-
-/** Strict model-resolution block used by historian.opencode. */
-export const OpenCodeHarnessBlockSchema = z
-    .object({
-        model: OcEntrySchema.optional().describe("Primary OpenCode model entry."),
-        fallback_models: z
-            .array(OcEntrySchema)
-            .optional()
-            .describe(
-                "Ordered fallback OpenCode entries. New-shape configuration requires an array; legacy singleton values migrate to a one-element array.",
-            ),
-        variant: z
-            .string()
-            .optional()
-            .describe(
-                "OpenCode reasoning variant for the primary entry when it declares none. Fallback entries declare variants per-entry.",
-            ),
-    })
-    .strict()
-    .describe("Strict OpenCode model-resolution block. It accepts no Pi vocabulary.");
-export type OpenCodeHarnessBlock = z.infer<typeof OpenCodeHarnessBlockSchema>;
-
-/** Strict model-resolution block used by historian.pi. */
-export const PiHarnessBlockSchema = z
-    .object({
-        model: PiEntrySchema.optional().describe("Primary Pi model entry."),
-        fallback_models: z
-            .array(PiEntrySchema)
-            .optional()
-            .describe(
-                "Ordered fallback Pi entries. New-shape configuration requires an array; legacy singleton values migrate to a one-element array.",
-            ),
-        thinking_level: PiThinkingLevelSchema.describe(
-            "Pi thinking level for the primary entry when it declares none. Fallback entries declare thinking levels per-entry.",
-        ),
-    })
-    .strict()
-    .describe("Strict Pi model-resolution block. It accepts no OpenCode vocabulary.");
-export type PiHarnessBlock = z.infer<typeof PiHarnessBlockSchema>;
+export const HistorianModelEntrySchema = z.union([z.string(), HistorianModelEntryObjectSchema]);
+export type HistorianModelEntry = z.infer<typeof HistorianModelEntrySchema>;
 
 /**
- * A profile may select models but must not alter execution policy. Keep this
- * separate from the full harness schemas, which also admit execution-policy
- * fields beyond model selection.
+ * A profile may select models but must not alter execution policy. It uses the
+ * same flat historian model-resolution fields; execution metadata is not
+ * allowed here.
  */
-const ProfileOpenCodeModelBlockSchema = z
+const ProfileHistorianSchema = z
     .object({
-        model: OcEntrySchema.optional().describe("Primary OpenCode model entry."),
+        model: HistorianModelEntrySchema.optional().describe("Primary historian model entry."),
         fallback_models: z
-            .array(OcEntrySchema)
+            .array(HistorianModelEntrySchema)
             .optional()
-            .describe("Ordered fallback OpenCode model entries."),
+            .describe("Ordered fallback historian model entries."),
         variant: z
             .string()
             .optional()
-            .describe("OpenCode reasoning variant for the primary model entry."),
-    })
-    .strict()
-    .describe("Strict profile-only OpenCode model-selection block.");
-const ProfilePiModelBlockSchema = z
-    .object({
-        model: PiEntrySchema.optional().describe("Primary Pi model entry."),
-        fallback_models: z
-            .array(PiEntrySchema)
-            .optional()
-            .describe("Ordered fallback Pi model entries."),
+            .describe("OpenCode reasoning variant for the primary entry. Ignored by Pi."),
         thinking_level: PiThinkingLevelSchema.describe(
-            "Pi thinking level for the primary model entry.",
+            "Pi thinking level for the primary entry. Ignored by OpenCode.",
         ),
     })
     .strict()
-    .describe("Strict profile-only Pi model-selection block.");
-const ProfileHistorianSchema = z
-    .object({
-        opencode: ProfileOpenCodeModelBlockSchema.optional(),
-        pi: ProfilePiModelBlockSchema.optional(),
-    })
-    .strict();
+    .describe("Strict profile-only historian model-selection block.");
 
 export const ConfigProfileSchema = z
     .object({
@@ -228,7 +164,7 @@ export const ConfigProfileSchema = z
     })
     .strict()
     .describe(
-        "User-owned model-selection overlay. Only historian harness model blocks are allowed.",
+        "User-owned model-selection overlay. Only the flat historian model-resolution fields are allowed.",
     );
 export type ConfigProfile = z.infer<typeof ConfigProfileSchema>;
 
@@ -253,8 +189,10 @@ const AgentMetadataSchema = AgentOverrideConfigSchema.pick({
 });
 
 /**
- * Historian metadata remains harness-independent. Only model resolution moves to
- * the strict opencode and pi blocks; two_pass and disallowed_tools stay here.
+ * Historian metadata stays harness-independent. Model resolution uses the flat
+ * `model` / `fallback_models` fields plus the harness's own qualifier
+ * (`variant` for OpenCode, `thinking_level` for Pi); two_pass and
+ * disallowed_tools stay here.
  */
 export const HistorianConfigSchema = AgentMetadataSchema.extend({
     expand_tools: z
@@ -272,8 +210,22 @@ export const HistorianConfigSchema = AgentMetadataSchema.extend({
         .describe(
             'Readable historian tool expansions, keyed by exact host tool name. Templates override built-in defaults; false disables an expansion. Supports ${input.path}, ${output.path}, bare ${output}, array [N], [*].field, .each("${field}"), .join("separator"), .count and final .truncate(N). Missing fields are empty; placeholders default to 300 characters, lists to 10 elements, expansions to 1000 characters. Valid in user and project config; affects historian/recomp and verbose ctx_expand only, never the wire or default ctx_expand transcript.',
         ),
-    opencode: OpenCodeHarnessBlockSchema.optional(),
-    pi: PiHarnessBlockSchema.optional(),
+    model: HistorianModelEntrySchema.optional().describe(
+        "Primary historian model entry. The active harness reads its own qualifier (OpenCode variant, Pi thinking_level); the other harness's qualifier is ignored.",
+    ),
+    fallback_models: z
+        .array(HistorianModelEntrySchema)
+        .optional()
+        .describe("Ordered fallback historian model entries, tried in order."),
+    variant: z
+        .string()
+        .optional()
+        .describe(
+            "OpenCode reasoning variant for the primary entry when it declares none. Ignored by Pi.",
+        ),
+    thinking_level: PiThinkingLevelSchema.describe(
+        "Pi thinking level for the primary entry when it declares none. Ignored by OpenCode.",
+    ),
     two_pass: z
         .boolean()
         .default(false)
@@ -286,10 +238,14 @@ export const HistorianConfigSchema = AgentMetadataSchema.extend({
         .describe(
             'OpenCode only. Tools to REMOVE from the historian\'s default allow-list [read, aft_outline, aft_zoom, aft_search]. Applies to both historian and historian-editor agents. Use ["*"] to strip all tool definitions from the model request — this prevents weak instruction-following models (e.g. mistral-small-latest) from entering tool-calling loops. Individual tool names remove just that tool. Note: a user-supplied historian.permission override can re-allow a tool that disallowed_tools removed — disallowed_tools sets the baseline, permission overrides take precedence. (default: [])',
         ),
-}).optional();
+})
+    .strict()
+    .optional();
 export type HistorianConfig = NonNullable<z.infer<typeof HistorianConfigSchema>>;
 
 export interface MagicContextConfig {
+    /** The loader sets this to distinguish an explicit `5m` from the built-in default; users do not configure it. */
+    cacheTtlConfigured?: boolean;
     enabled: boolean;
     /** User-level setting that lets a session in the canonical home directory use project memory. */
     allow_home_project: boolean;
@@ -319,7 +275,10 @@ export interface MagicContextConfig {
      *  matching provider input limits. Values above 90% × context_limit are clamped with a warning. */
     execute_threshold_tokens?: { default?: number; [modelKey: string]: number | undefined };
     protected_tokens?: number;
-    clear_reasoning_age: number;
+    /** Deprecated and ignored. Use keep_reasoning_tokens instead. */
+    clear_reasoning_age?: unknown;
+    /** Reasoning tokens to keep on rebuilding passes; per-model map allowed. */
+    keep_reasoning_tokens?: number | Record<string, number>;
     history_budget_percentage: number;
     historian_timeout_ms: number;
     commit_cluster_trigger: {
@@ -394,15 +353,10 @@ export interface MagicContextConfig {
     };
     /** Pi-only child-process extension controls. */
     pi?: PiConfig;
-    /** Content-aware reclaim of tool output that a later call supersedes, added
-     *  to the normal age-based auto-drop: superseded todowrite/mmc_reduce/meta
-     *  outputs are dropped, and older edits to a file are compressed to a marker
-     *  that keeps only the filePath. Only runs on a transform pass that is
-     *  already rewriting the messages, so it never triggers a prompt-cache miss
-     *  on its own; when off, the messages sent to the model are byte-identical to
-     *  the age-based-only behavior. Experimental, opt-in, default off until cache
-     *  stability is proven. */
-    smart_drops: boolean;
+    /** Deprecated and ignored: supersession reclaim is always on. */
+    smart_drops?: unknown;
+    /** Keep each tool's newest N still-active results in every drop lane. */
+    protected_tools: Record<string, number>;
     /**
      * Age-tier caveman compression for long user/assistant text parts.
      * Graduated from `experimental.caveman_text_compression`; opt-in, default off.
@@ -517,16 +471,16 @@ export const MagicContextConfigSchema = z.object({
             "Select a named user-owned model profile. A valid project name overrides this user default; an empty string, null, or other non-string project value is ignored with a warning so the user selection still applies. Unknown names warn and use the base configuration.",
         ),
     profiles: ConfigProfilesSchema.optional().describe(
-        "User-level named model profiles. A profile may contain only historian model, fallback_models, OpenCode variant, and Pi thinking_level fields. Project configs may select a name but cannot define profiles.",
+        "User-level named model profiles. A profile may contain only the flat historian model-resolution fields (model, fallback_models, OpenCode variant, Pi thinking_level). Project configs may select a name but cannot define profiles.",
     ),
     historian: HistorianConfigSchema.describe(
-        "Historian metadata plus independent strict OpenCode and Pi execution blocks. Retained metadata stays at historian; model, fallback_models, variant, and thinking_level belong only in historian.opencode or historian.pi.",
+        "Historian metadata plus the flat model-resolution fields (model, fallback_models, variant, thinking_level). The active harness reads its own qualifier; the removed historian.opencode / historian.pi blocks are no longer accepted.",
     ),
     cache_ttl: z
         .union([z.string(), z.object({ default: z.string() }).catchall(z.string())])
         .default("5m")
         .describe(
-            'How long Magic Context assumes the provider\'s cached prefix stays valid. This is MC\'s own deferral gate — it does not change the provider\'s actual cache lifetime. String (e.g. "5m", "1h", "30s") or per-model object ({ default: "5m", "provider/model": "1h", "provider/*": "never" }); keys resolve most-specific first (exact provider/model, bare model ID, shorter dash-prefixes, then the provider/* wildcard). Explicit per-model entries win; otherwise GPT-5.6 and later (including gpt-6*, through any provider prefix) use a built-in 30m lifetime before the object default or 5m fallback. An unset or global "5m" opts into built-in defaults; any other global string is an explicit policy and wins. Policy is frozen per session, including across restarts; a model switch resolves against that frozen policy. /mmc-status shows the effective value and source. OpenAI documents at least 30 minutes since the latest write or reuse: https://developers.openai.com/api/docs/guides/prompt-caching (Cache lifetime and Summary of model differences). Set to "never" to mean MC never assumes expiry (for lanes kept warm externally by a cache-keep tool) — disables the idle-TTL heuristic so MC never initiates a rebuild based on elapsed time. Provider-side extended TTL is a separate request-level concern (cache_control: { ttl } in the request body).',
+            'How long Magic Context assumes the provider\'s cached prefix stays valid. This is MC\'s own deferral gate — it does not change the provider\'s actual cache lifetime. String (e.g. "5m", "1h", "30s") or per-model object ({ default: "5m", "provider/model": "1h", "provider/*": "never" }); keys resolve most-specific first (exact provider/model, bare model ID, shorter dash-prefixes, then the provider/* wildcard). Explicit per-model entries win; otherwise GPT-5.6 and later (including gpt-6*, through any provider prefix) use a built-in 30m lifetime before the object default or 5m fallback. An unset or global "5m" opts into built-in defaults; any other global string is an explicit policy and wins. User and project settings, including an explicit "5m" or object default, apply on the next pass. Only built-in defaults are frozen per session (per model), including across restarts. /mmc-status shows the effective value and source. OpenAI documents at least 30 minutes since the latest write or reuse: https://developers.openai.com/api/docs/guides/prompt-caching (Cache lifetime and Summary of model differences). Set to "never" to mean MC never assumes expiry (for lanes kept warm externally by a cache-keep tool) — disables the idle-TTL heuristic so MC never initiates a rebuild based on elapsed time. Provider-side extended TTL is a separate request-level concern (cache_control: { ttl } in the request body).',
         ),
     prompt_surface: PromptSurfaceConfigSchema.default({ default: "full" }).describe(
         "Prompt-surface presets: default is full; models use bare model IDs, provider/model, or provider/* routing keys. Guidance and tool-description overrides are user-level only. OpenCode 1.x and Pi register tool descriptions once per process (they follow the default preset). OpenCode 2 rewrites the five mmc_* descriptions per request from the draft model.",
@@ -586,10 +540,23 @@ export const MagicContextConfigSchema = z.object({
             "Positive integer token floor to protect from automatic reclaim (min: 4_000, max: 1_000_000). When omitted, the derived default is clamp(round(0.05 × usableSoft), min(16_000, round(0.08 × usableSoft)), 64_000).",
         ),
     clear_reasoning_age: z
-        .number()
-        .min(10)
-        .default(50)
-        .describe("Clear reasoning/thinking blocks older than N tags (default: 50)"),
+        .unknown()
+        .optional()
+        .describe("Deprecated and ignored. Use keep_reasoning_tokens instead.")
+        .meta({ deprecated: true }),
+    keep_reasoning_tokens: z
+        .union([
+            z.number().int().min(0).max(1_000_000),
+            z
+                .object({
+                    default: z.number().int().min(0).max(1_000_000).optional(),
+                })
+                .catchall(z.number().int().min(0).max(1_000_000)),
+        ])
+        .optional()
+        .describe(
+            "Reasoning tokens to keep on rebuilding passes. Number or per-model object; exact, shorter model keys, provider/*, then default. Omitted: fixed 10,000. 0 removes all eligible historical reasoning; newest and exempt steps always stay.",
+        ),
     history_budget_percentage: z
         .number()
         .min(0.05)
@@ -744,11 +711,13 @@ export const MagicContextConfigSchema = z.object({
     pi: PiConfigSchema.describe(
         "Pi-only child-process extension controls. This setting is user-level only; project configuration cannot choose which extensions a user's subagent children load.",
     ),
-    smart_drops: z
-        .boolean()
-        .default(false)
+    smart_drops: z.union([z.boolean(), z.record(z.string(), z.unknown())]).optional(),
+    protected_tools: z
+        .record(z.string(), z.number().int().nonnegative())
+        .default({ ...DEFAULT_PROTECTED_TOOLS })
+        .transform((map) => mergeProtectedTools(map))
         .describe(
-            "Content-aware reclaim of provably-superseded tool output, layered on the existing execute-pass auto-drop. When on: superseded todowrite (keep newest 1), spent mmc_reduce (keep newest 3), and zero-value meta (bash_status, bash_kill, mmc_note read/dismiss) outputs are dropped; older edits to a file are compressed to a filePath-preserving marker while the newest edit per file stays full. Only acts on passes already busting the cache, so it never originates a cache bust. Honors the protected-tag reserve. Experimental: opt-in, default off until cache stability is proven; when off the wire is byte-identical to the positional-only reclaim. Requires a restart.",
+            "Keep each tool's newest N still-active results in every automatic drop lane (upstream issue 621). User and project maps merge over defaults {todowrite: 1, mmc_reduce: 3}; 0 turns protection off. Names are case-insensitive and ignore leading mcp_ (upstream's ctx_reduce maps to mmc_reduce). Holds even at 95% pressure, with no byte cap: large protected outputs can reach refusal sooner. Queued drops, from the agent or historian publication, are held until newer calls displace the result and a later cache-rebuilding pass applies them. The historian's summary is unaffected; the raw result leaves at the next fold. Frozen strips are unaffected. Changes and rotation never originate a bust; dropped results are never restored.",
         ),
     caveman_text_compression: z
         .object({
@@ -964,13 +933,12 @@ export const MagicContextConfigSchema = z.object({
 
 /** Settings whose fresh values can be used by later agent runs without changing rendered prompt bytes. */
 export const LIVE_RELOAD_CONFIG_PATHS = [
+    "cache_ttl",
     "toast_duration_ms",
-    "historian.opencode.model",
-    "historian.opencode.fallback_models",
-    "historian.opencode.variant",
-    "historian.pi.model",
-    "historian.pi.fallback_models",
-    "historian.pi.thinking_level",
+    "historian.model",
+    "historian.fallback_models",
+    "historian.variant",
+    "historian.thinking_level",
     "historian.two_pass",
     "historian.expand_tools",
     "historian.maxTokens",

package/src/config/variable.ts

@@ -31,6 +31,14 @@ export interface SubstituteResult {
      * user via logger/toast/startup notification.
      */
     warnings: string[];
+    /**
+     * The subset of {@link warnings} that are unresolved references: a missing
+     * or empty env var, a missing file, or an unreadable file that fell back to
+     * empty string. Purely advisory to the runtime (which keeps the lenient
+     * warning behavior); `config-check` treats these as hard config errors.
+     * Does not include the sensitive-path warning.
+     */
+    failures: string[];
 }
 
 const ENV_PATTERN = /\{env:([^}]+)\}/g;
@@ -78,6 +86,7 @@ function sensitiveFilePathReason(resolvedPath: string): string | null {
  */
 export function substituteConfigVariables(input: SubstituteInput): SubstituteResult {
     const warnings: string[] = [];
+    const failures: string[] = [];
     let text = input.text;
 
     if (input.isProjectConfig) {
@@ -96,7 +105,7 @@ export function substituteConfigVariables(input: SubstituteInput): SubstituteRes
                 `Project-level config no longer supports ${tokenTypes} tokens for security reasons; leaving tokens literal. Move secret expansion to user-level config.`,
             );
         }
-        return { text, warnings };
+        return { text, warnings, failures };
     }
 
     // Strip JSONC comments before substitution so tokens in comments cannot
@@ -108,9 +117,9 @@ export function substituteConfigVariables(input: SubstituteInput): SubstituteRes
         const varName = rawName.trim();
         const value = varName ? process.env[varName] : undefined;
         if (value === undefined || value === "") {
-            warnings.push(
-                `Environment variable ${varName} is not set (referenced via {env:${varName}}); using empty string`,
-            );
+            const message = `Environment variable ${varName} is not set (referenced via {env:${varName}}); using empty string`;
+            warnings.push(message);
+            failures.push(message);
             return "";
         }
 
@@ -119,7 +128,7 @@ export function substituteConfigVariables(input: SubstituteInput): SubstituteRes
 
     const fileMatches = Array.from(text.matchAll(FILE_PATTERN));
     if (fileMatches.length === 0) {
-        return { text, warnings };
+        return { text, warnings, failures };
     }
 
     const configDir = input.configPath ? dirname(input.configPath) : process.cwd();
@@ -164,9 +173,9 @@ export function substituteConfigVariables(input: SubstituteInput): SubstituteRes
         }
 
         if (!existsSync(filePath)) {
-            warnings.push(
-                `File not found for ${token} (resolved to ${filePath}); using empty string`,
-            );
+            const message = `File not found for ${token} (resolved to ${filePath}); using empty string`;
+            warnings.push(message);
+            failures.push(message);
             continue;
         }
 
@@ -175,9 +184,9 @@ export function substituteConfigVariables(input: SubstituteInput): SubstituteRes
             contents = readFileSync(filePath, "utf-8").trim();
         } catch (error) {
             const message = error instanceof Error ? error.message : String(error);
-            warnings.push(
-                `Failed to read file for ${token} (${filePath}): ${message}; using empty string`,
-            );
+            const warning = `Failed to read file for ${token} (${filePath}): ${message}; using empty string`;
+            warnings.push(warning);
+            failures.push(warning);
             continue;
         }
 
@@ -188,5 +197,5 @@ export function substituteConfigVariables(input: SubstituteInput): SubstituteRes
     }
 
     output += text.slice(cursor);
-    return { text: output, warnings };
+    return { text: output, warnings, failures };
 }

package/src/shared/auto-search-lifecycle.ts

@@ -0,0 +1,27 @@
+const pending = new Map<string, Set<AbortController>>();
+
+/** Cleanup cancels optional searches and backfill, not durable served decisions. */
+export function registerAutoSearchWork(sessionId: string): {
+    signal: AbortSignal;
+    done: () => void;
+} {
+    const controller = new AbortController();
+    const work = pending.get(sessionId) ?? new Set<AbortController>();
+    pending.set(sessionId, work);
+    work.add(controller);
+    return {
+        signal: controller.signal,
+        done: () => {
+            work.delete(controller);
+            if (pending.get(sessionId) === work && work.size === 0) pending.delete(sessionId);
+        },
+    };
+}
+
+export function cancelAutoSearchWork(sessionId?: string): void {
+    for (const [id, work] of pending) {
+        if (sessionId !== undefined && id !== sessionId) continue;
+        pending.delete(id);
+        for (const controller of work) controller.abort();
+    }
+}

package/src/shared/cache-ttl-display.test.ts

@@ -45,7 +45,7 @@ describe("resolveCacheTtlDisplay", () => {
         });
 
         expect(configured.source).toBe("config");
-        expect(session).toEqual({ value: "45m", source: "session", modelKey });
+        expect(session).toEqual({ value: "1h", source: "config", modelKey });
         expect(fallback).toEqual({ value: "5m", source: "default", modelKey });
     });
 

package/src/shared/cache-ttl-display.ts

@@ -10,7 +10,7 @@ export interface CacheTtlDisplay {
 }
 
 export interface ResolveCacheTtlDisplayArgs {
-    frozen?: ResolvedCacheTtl;
+    frozen?: ResolvedCacheTtl & { builtInDefault?: ResolvedCacheTtl };
     configured: MagicContextConfig["cache_ttl"];
     configuredExplicitly: boolean;
     modelKey: string | undefined;
@@ -20,12 +20,22 @@ export interface ResolveCacheTtlDisplayArgs {
 }
 
 /**
- * Resolve status-only TTL text without changing the scheduler's persisted truth.
- * Use the session value only when its persisted model key matches the model being
- * displayed; otherwise use live config because the session value may be for another model.
+ * Resolve the lifetime shown in status without changing the value saved for the scheduler.
+ * The next pass uses current settings; a saved built-in lifetime applies only to the same
+ * model, even after an override is removed.
  */
 export function resolveCacheTtlDisplay(args: ResolveCacheTtlDisplayArgs): CacheTtlDisplay {
-    if (args.frozen) return args.frozen;
+    const resolved = resolveModelCacheTtl(
+        args.configured,
+        args.modelKey,
+        args.configuredExplicitly,
+    );
+    if (resolved.source === "config") return resolved;
+    if (args.frozen && (!args.modelKey || args.frozen.modelKey === args.modelKey)) {
+        return args.frozen.source === "config"
+            ? (args.frozen.builtInDefault ?? resolved)
+            : args.frozen;
+    }
     if (
         (args.sessionModelKey && (!args.modelKey || args.sessionModelKey === args.modelKey)) ||
         (!args.modelKey && !args.sessionModelKey && args.sessionValue !== "5m")
@@ -37,22 +47,13 @@ export function resolveCacheTtlDisplay(args: ResolveCacheTtlDisplayArgs): CacheT
         };
     }
 
-    const resolved = resolveModelCacheTtl(args.configured, args.modelKey);
-    if (
-        resolved.source === "default" &&
-        typeof args.configured === "string" &&
-        args.configuredExplicitly
-    )
-        return { ...resolved, source: "config" };
     return resolved;
 }
 
 export function formatCacheTtlDisplay(display: CacheTtlDisplay): string {
-    if (display.source === "OpenAI GPT-5.6+ default")
-        return `Cache TTL: ${display.value} (${display.source})`;
     if (display.source === "session") return `Cache TTL: ${display.value} (session)`;
     if (display.source === "config") {
-        return `Cache TTL: ${display.value} (config for ${display.modelKey ?? "current model"})`;
+        return `Cache TTL: ${display.value} (your config)`;
     }
-    return `Cache TTL: ${display.value} (default — no cache_ttl for ${display.modelKey ?? "unknown model"})`;
+    return `Cache TTL: ${display.value} (built-in default, frozen for this session)`;
 }

package/src/shared/model-cache-ttl.test.ts

@@ -29,8 +29,8 @@ describe("known model cache TTL", () => {
         expect(resolveCacheTtl("5m", "openai/gpt-6")).toBe("30m");
         expect(resolveCacheTtl("10m", "openai/gpt-6")).toBe("10m");
     });
-    it("honors per-model entries before built-ins and built-ins before object defaults", () => {
-        expect(resolveCacheTtl({ default: "10m" }, "openai/gpt-6")).toBe("30m");
+    it("honors per-model entries and configured defaults before built-ins", () => {
+        expect(resolveCacheTtl({ default: "10m" }, "openai/gpt-6")).toBe("10m");
         expect(resolveCacheTtl({ default: "10m", "gpt-6": "5m" }, "openai/gpt-6")).toBe("5m");
         expect(resolveCacheTtl({ default: "10m", "openai/*": "never" }, "openai/gpt-6")).toBe(
             "never",

package/src/shared/model-cache-ttl.ts

@@ -28,6 +28,8 @@ const MODEL_CACHE_LIFETIMES = [
 export function resolveModelCacheTtl(
     config: CacheTtlConfig | undefined,
     modelKey: string | undefined,
+    configuredExplicitly = typeof config === "object" ||
+        (typeof config === "string" && config !== "5m"),
 ): ResolvedCacheTtl {
     if (config && typeof config !== "string") {
         const match =
@@ -37,11 +39,13 @@ export function resolveModelCacheTtl(
             modelKey !== "default"
                 ? config[modelKey]
                 : resolveModelConfigValue(config, modelKey)?.value;
-        if (match !== undefined) return { value: match, source: "config", modelKey };
+        const value = match ?? config.default;
+        if (value !== undefined && configuredExplicitly)
+            return { value, source: "config", modelKey };
     }
-    // A non-5m global string is an explicit policy. The generic 5m default is
-    // not evidence of provider eviction: documented lifetimes avoid paid rewrites.
-    if (typeof config === "string" && config !== "5m")
+    // The loader supplies provenance: an explicit 5m is policy too. Older callers
+    // without that bit still distinguish non-default strings from the schema's 5m.
+    if (typeof config === "string" && configuredExplicitly)
         return { value: config, source: "config", modelKey };
     const model =
         canonicalModelIdentity(modelKey ?? "")