@retaw106/mmc-oc 2.2.0 → 2.3.0

package/src/config/index.test.ts

@@ -7,11 +7,7 @@ import { resolveEpochFloorForPass } from "../features/magic-context/storage-meta
 import { resolveHistorianModel } from "../shared/model-resolution";
 import { Database } from "../shared/sqlite";
 import { createTestTempDir, createTestTempDirFromPath } from "../shared/test-temp-dir";
-import {
-    getWindowOverlay,
-    reloadWindowOverlay,
-    setWindowOverlayPath,
-} from "../shared/window-geometry";
+import { WINDOW_OVERLAY_PATH_DEPRECATION_WARNING } from "./deprecated-config";
 import { loadPluginConfig, loadPluginConfigDetailed } from "./index";
 import { resolveConfigProfile } from "./profiles";
 import { getProtectedTokensTierOverrides } from "./project-security";
@@ -156,39 +152,19 @@ function loadDetailedWithConfigs(userConfigText: string, projectConfigText?: str
     }
 }
 
-describe("loadPluginConfig — Fusiform overlay reload", () => {
-    it("does not invalidate a same-path overlay during routine config reads", () => {
-        const overlayDir = createTestTempDirFromPath(join(tmpdir(), "mc-config-overlay-"));
-        const overlayPath = join(overlayDir, "window-overlay.json");
-        const configText = JSON.stringify({ models: { window_overlay_path: overlayPath } });
-        const writeOverlay = (modelId: string) =>
-            writeFileSync(
-                overlayPath,
-                JSON.stringify({
-                    schema: "fusiform-window-overlay/v1",
-                    generated_at: "2026-09-01T00:00:00Z",
-                    minted_provider_ids: [],
-                    cells: [{ provider_id: "hunt-provider", model_id: modelId, facts: {} }],
-                }),
-            );
-
-        try {
-            writeOverlay("before-rewrite");
-            loadWithUserConfig(configText);
-            expect(getWindowOverlay()?.cells[0]?.model_id).toBe("before-rewrite");
-
-            writeOverlay("after-rewrite");
-            expect(getWindowOverlay()?.cells[0]?.model_id).toBe("before-rewrite");
-
-            loadWithUserConfig(configText);
-            expect(getWindowOverlay()?.cells[0]?.model_id).toBe("before-rewrite");
+describe("loadPluginConfig — retired Fusiform window path", () => {
+    it("parses the old key but warns once that it is ignored", () => {
+        const path = "/tmp/retired-fusiform-window.json";
+        const config = loadWithUserConfig(
+            JSON.stringify({ models: { window_overlay_path: path } }),
+        );
 
-            reloadWindowOverlay(overlayPath);
-            expect(getWindowOverlay()?.cells[0]?.model_id).toBe("after-rewrite");
-        } finally {
-            setWindowOverlayPath(undefined);
-            rmSync(overlayDir, { recursive: true, force: true });
-        }
+        expect(config.models?.window_overlay_path).toBe(path);
+        const warnings = config.configWarnings?.filter((message) =>
+            message.includes("models.window_overlay_path"),
+        );
+        expect(warnings).toHaveLength(1);
+        expect(warnings?.[0]).toContain(WINDOW_OVERLAY_PATH_DEPRECATION_WARNING);
     });
 });
 

package/src/config/index.ts

@@ -13,9 +13,9 @@ import {
 } from "../shared/jsonc-parser";
 import { setOutputReserveConfig } from "../shared/models-dev-cache";
 import type { PromptSurfaceConfig } from "../shared/prompt-surface";
-import { setWindowOverlayPath } from "../shared/window-geometry";
 import { migrateLegacyAgentEnabledInMemory } from "./agent-disable";
 import { mmcProjectConfigBasePath, opencodeUserConfigBasePath } from "./config-paths";
+import { warnDeprecatedWindowOverlayPath } from "./deprecated-config";
 import {
     legacyHarnessBlockPaths,
     RemovedHistorianHarnessBlockError,
@@ -370,6 +370,7 @@ export function parsePluginConfig(
         preMigrationWarnings,
     );
     const migrated = migrateLegacyAgentEnabledInMemory(migratedExperimental, preMigrationWarnings);
+    warnDeprecatedWindowOverlayPath(migrated, preMigrationWarnings);
     const parsed = MagicContextConfigSchema.safeParse(migrated);
     const disabledHooks = Array.isArray(rawConfig.disabled_hooks)
         ? rawConfig.disabled_hooks.filter((value): value is string => typeof value === "string")
@@ -711,7 +712,6 @@ export function loadPluginConfigDetailed(
     if (profileResolution.activeProfile) config.profile = profileResolution.activeProfile;
     if (applyRuntimeGlobals) {
         setOutputReserveConfig(config.output_reserve);
-        setWindowOverlayPath(config.models?.window_overlay_path);
     }
     const leafValidationWarnings = [...(config.configWarnings ?? [])];
     if (config.configWarnings?.length) {

package/src/config/project-security.ts

@@ -301,8 +301,8 @@ function makeProjectThresholdWarning(field: string, reason: string): string {
  *  - `debug_rpc` — a repo must not enable process heap capture or memory diagnostics.
  *  - `allow_home_project` — only the user may opt a home-directory session
  *    into a durable project identity.
- *  - `output_reserve` / `models.window_overlay_path` — only the user may change
- *    process-wide window geometry inputs.
+ *  - `output_reserve` — only the user may change process-wide window geometry.
+ *    The deprecated `models.window_overlay_path` field is ignored at every tier.
  *  - `language`: a repo must not inject prompt text through a user preference.
  *  - `maintenance` — budgets, cooldowns, and anomaly thresholds of the
  *    automatic memory-maintenance task are user-level only; a cloned repo
@@ -398,7 +398,7 @@ export function stripUnsafeProjectConfigFields(projectRaw: Record<string, unknow
     if (isPlainObject(models) && "window_overlay_path" in models) {
         delete models.window_overlay_path;
         warnings.push(
-            "Ignoring models.window_overlay_path from project config (security: only user-level config may select model geometry metadata).",
+            "Ignoring models.window_overlay_path from project config (deprecated; this setting no longer changes model window geometry).",
         );
     }
 

package/src/config/schema/magic-context.ts

@@ -261,8 +261,8 @@ export interface MagicContextConfig {
     prompt_surface: PromptSurfaceConfig;
     /** User-only output-token reservation override. Zero disables reservation. */
     output_reserve?: number | { default: number; [modelKey: string]: number };
-    /** User-only model metadata inputs. */
-    models?: { window_overlay_path?: string };
+    /** Deprecated user-only window metadata path; parsed only so loaders can warn and ignore it. */
+    models?: { window_overlay_path?: unknown };
     /** TUI toast lifetime in milliseconds for Magic Context notifications. Default: 5000. */
     toast_duration_ms?: number;
     execute_threshold_percentage: number | { default: number; [modelKey: string]: number };
@@ -487,12 +487,16 @@ export const MagicContextConfigSchema = z.object({
         ),
     models: z
         .object({
-            window_overlay_path: z.string().trim().min(1).optional(),
+            window_overlay_path: z
+                .unknown()
+                .optional()
+                .describe(
+                    "Deprecated: ignored. Fusiform no longer publishes window-overlay data, so this setting no longer changes model window geometry. Remove this key.",
+                )
+                .meta({ deprecated: true }),
         })
         .optional()
-        .describe(
-            "User-only Fusiform window-overlay settings. The path defaults to <dataDir>/fusiform/window-overlay.json.",
-        ),
+        .describe("Deprecated user-only Fusiform window-overlay settings; ignored."),
     toast_duration_ms: z
         .number()
         .min(0)

package/src/shared/auto-search-lifecycle.ts

@@ -1,4 +1,47 @@
+import type { AutoSearchHintNoHintReason } from "../features/magic-context/storage-meta-persisted";
+
 const pending = new Map<string, Set<AbortController>>();
+const unpublishedNoHints = new Map<string, Map<string, AutoSearchHintNoHintReason>>();
+
+/**
+ * A failed save can still send the user message without a search hint. Remember
+ * that no-hint decision until a later pass saves it to SQLite, including across
+ * closing and reopening the database handle. Switching or shutting down a session
+ * does not prove deletion and must not discard it. If all compare-and-swap (CAS)
+ * save retries fail and the process restarts before repair, this unsaved record
+ * is lost: that compound failure is the remaining durability gap.
+ */
+export function rememberUnpublishedAutoSearchNoHint(
+    sessionId: string,
+    messageId: string,
+    reason: AutoSearchHintNoHintReason,
+): void {
+    let messages = unpublishedNoHints.get(sessionId);
+    if (!messages) {
+        messages = new Map();
+        unpublishedNoHints.set(sessionId, messages);
+    }
+    if (!messages.has(messageId)) messages.set(messageId, reason);
+}
+
+export function getUnpublishedAutoSearchNoHint(
+    sessionId: string,
+    messageId: string,
+): AutoSearchHintNoHintReason | undefined {
+    return unpublishedNoHints.get(sessionId)?.get(messageId);
+}
+
+export function forgetUnpublishedAutoSearchNoHint(sessionId: string, messageId: string): void {
+    const messages = unpublishedNoHints.get(sessionId);
+    messages?.delete(messageId);
+    if (messages?.size === 0) unpublishedNoHints.delete(sessionId);
+}
+
+/** Deleting a session releases its unsaved no-hint records; switching away does not. */
+export function clearUnpublishedAutoSearchNoHints(sessionId?: string): void {
+    if (sessionId === undefined) unpublishedNoHints.clear();
+    else unpublishedNoHints.delete(sessionId);
+}
 
 /** Cleanup cancels optional searches and backfill, not durable served decisions. */
 export function registerAutoSearchWork(sessionId: string): {

package/src/shared/logger.ts

@@ -162,8 +162,16 @@ function flush(): void {
         let currentSize = getCurrentLogSize(logFile);
         const dataSize = Buffer.byteLength(data);
         if (currentSize > 0 && currentSize + dataSize > MAX_LOG_FILE_BYTES) {
-            rotateLogFile(logFile, currentSize);
-            currentSize = 0;
+            // Several processes share this file and each caches its size. A stale
+            // cache must not rotate a file another process already rotated: that
+            // second rotation would overwrite the full predecessor with the few
+            // lines written since. Decide on the file's real size instead.
+            flushesSinceSizeCheck = SIZE_CHECK_INTERVAL_FLUSHES;
+            currentSize = getCurrentLogSize(logFile);
+            if (currentSize > 0 && currentSize + dataSize > MAX_LOG_FILE_BYTES) {
+                rotateLogFile(logFile, currentSize);
+                currentSize = 0;
+            }
         }
         fs.appendFileSync(logFile, data, { encoding: "utf8", mode: 0o600 });
         buffer = [];

package/src/shared/models-dev-cache.ts

@@ -33,12 +33,7 @@ import { getHarness } from "./harness";
 import { modelRefLookupOrder } from "./harness-provider-map";
 import { sessionLog } from "./logger";
 import { writeStorageFileAtomicSync } from "./storage-permissions";
-import {
-    deriveWindowGeometry,
-    getWindowOverlay,
-    resolveWindowOverlayFacts,
-    type WindowGeometryResult,
-} from "./window-geometry";
+import { deriveWindowGeometry, type WindowGeometryResult } from "./window-geometry";
 
 interface OpencodeClientLike {
     config: {
@@ -515,7 +510,6 @@ export function getSdkWindowGeometry(
             output: metadata.outputLimit,
         },
         {
-            overlay: resolveWindowOverlayFacts(providerID, modelID, getWindowOverlay()),
             outputReserveOverride: resolveOutputReserve(providerID, modelID),
             harness: options?.harness ?? "opencode",
             contextCap:

package/src/shared/models-dev-temperature.ts

@@ -0,0 +1,107 @@
+/**
+ * Temperature capability from the models.dev catalog that OpenCode caches on disk.
+ *
+ * OpenCode 1 copies models.dev's `temperature` flag onto each model, but OpenCode 2's
+ * model rows, Pi's model registry and Oh My Pi's Gemini models carry no equivalent
+ * field. For those hosts the cached catalog is the only positive evidence on the
+ * machine, so a missing file, an unparsable file or a missing entry all mean "unknown"
+ * and the caller omits temperature.
+ *
+ * This module is bundled into the Pi/OMP historian child extension, so it must only
+ * depend on Node built-ins.
+ */
+import { readFileSync, statSync } from "node:fs";
+import { homedir } from "node:os";
+import { join } from "node:path";
+
+export interface CatalogTemperature {
+    temperature: boolean;
+    /** The catalog entry that decided, as `provider/model`. */
+    entry: string;
+}
+
+/**
+ * Harness provider ids that name the same models.dev provider. Codex (`openai-codex`)
+ * is deliberately absent: the ChatGPT backend is a different transport from the
+ * OpenAI API that models.dev describes, so it gets no catalog answer and no temperature.
+ */
+const CATALOG_PROVIDER_ALIASES: Readonly<Record<string, string>> = {
+    "google-antigravity": "google",
+    "opencode-zen": "opencode",
+};
+
+/** The Antigravity auth plugins register Gemini models as `google/antigravity-<model>`. */
+const ANTIGRAVITY_MODEL_PREFIX = "antigravity-";
+
+type CatalogIndex = Map<string, boolean>;
+
+let cached: { path: string; mtimeMs: number; size: number; index: CatalogIndex } | undefined;
+
+/** OpenCode reads `OPENCODE_MODELS_PATH` instead of its cache when it is set. */
+export function modelsDevCatalogPath(env: NodeJS.ProcessEnv = process.env): string {
+    if (env.OPENCODE_MODELS_PATH) return env.OPENCODE_MODELS_PATH;
+    return join(env.XDG_CACHE_HOME || join(homedir(), ".cache"), "opencode", "models.json");
+}
+
+function buildIndex(raw: unknown): CatalogIndex {
+    const index: CatalogIndex = new Map();
+    if (!raw || typeof raw !== "object" || Array.isArray(raw)) return index;
+    for (const [providerID, provider] of Object.entries(raw as Record<string, unknown>)) {
+        const models = (provider as { models?: unknown } | null)?.models;
+        if (!models || typeof models !== "object") continue;
+        for (const [modelID, model] of Object.entries(models as Record<string, unknown>)) {
+            const temperature = (model as { temperature?: unknown } | null)?.temperature;
+            if (typeof temperature === "boolean")
+                index.set(`${providerID}/${modelID}`, temperature);
+        }
+    }
+    return index;
+}
+
+function loadIndex(): CatalogIndex | undefined {
+    const path = modelsDevCatalogPath();
+    try {
+        const stat = statSync(path);
+        if (cached?.path === path && cached.mtimeMs === stat.mtimeMs && cached.size === stat.size)
+            return cached.index;
+        const index = buildIndex(JSON.parse(readFileSync(path, "utf8")));
+        cached = { path, mtimeMs: stat.mtimeMs, size: stat.size, index };
+        return index;
+    } catch {
+        // Absent or partially written catalog: no evidence either way.
+        return undefined;
+    }
+}
+
+/** Spellings to try for a harness `provider/model` reference, most specific first. */
+export function catalogCandidates(providerID: string, modelID: string): string[] {
+    const provider = Object.hasOwn(CATALOG_PROVIDER_ALIASES, providerID)
+        ? CATALOG_PROVIDER_ALIASES[providerID]
+        : providerID;
+    const candidates = [`${provider}/${modelID}`];
+    if (provider === "google" && modelID.startsWith(ANTIGRAVITY_MODEL_PREFIX))
+        candidates.push(`google/${modelID.slice(ANTIGRAVITY_MODEL_PREFIX.length)}`);
+    return candidates;
+}
+
+/**
+ * Look `provider/model` up in the cached catalogue, trying only the exact spellings from
+ * `catalogCandidates`. A malformed reference, a missing catalogue or no entry returns undefined.
+ */
+export function catalogTemperature(model: string): CatalogTemperature | undefined {
+    const slash = model.indexOf("/");
+    if (slash <= 0 || slash === model.length - 1) return undefined;
+    const index = loadIndex();
+    if (!index) return undefined;
+    for (const entry of catalogCandidates(model.slice(0, slash), model.slice(slash + 1))) {
+        const temperature = index.get(entry);
+        if (temperature !== undefined) return { temperature, entry };
+    }
+    return undefined;
+}
+
+export const __catalogTest = {
+    reset(): void {
+        cached = undefined;
+    },
+};

package/src/shared/processed-image-eligibility.test.ts

@@ -0,0 +1,68 @@
+import { expect, test } from "bun:test";
+import { createProcessedImageEligibility } from "./processed-image-eligibility";
+
+const messages = ["old", "image", "answer", "tail"];
+
+test("image position age inherits its next positive tag, never zero or an earlier tag", () => {
+    const policy = createProcessedImageEligibility(
+        messages,
+        new Map([
+            ["old", 1],
+            ["answer", 6],
+        ]),
+        { watermark: 1 },
+    );
+    expect(policy.ageTags.get("image")).toBe(6);
+    expect(policy.mayStrip("image")).toBe(false);
+    expect(policy.ageTags.has("tail")).toBe(false);
+    expect(policy.mayStrip("tail")).toBe(false);
+    const own = createProcessedImageEligibility(
+        messages,
+        new Map([
+            ["image", 3],
+            ["answer", 6],
+        ]),
+        { watermark: 4 },
+    );
+    expect(own.ageTags.get("image")).toBe(3);
+    expect(own.mayStrip("image")).toBe(true);
+});
+
+test("answered image-only positions outside the protected window are eligible", () => {
+    const policy = createProcessedImageEligibility(
+        messages,
+        new Map([
+            ["answer", 3],
+            ["tail", 5],
+        ]),
+        { watermark: 4, protectedCutoff: 5, contextPercentage: 94.99 },
+    );
+    expect(policy.ageTags.get("image")).toBe(3);
+    expect(policy.mayStrip("image")).toBe(true);
+});
+
+test("image positions inside the protected window stay below the 95 percent emergency", () => {
+    const policy = createProcessedImageEligibility(messages, new Map([["answer", 6]]), {
+        watermark: 10,
+        protectedCutoff: 5,
+        contextPercentage: 94.99,
+    });
+    expect(policy.mayStrip("image")).toBe(false);
+});
+
+test("image positions follow emergency drops when the newest window yields at 95 percent", () => {
+    for (const contextPercentage of [95, 99]) {
+        const policy = createProcessedImageEligibility(messages, new Map([["answer", 6]]), {
+            watermark: 10,
+            protectedCutoff: 5,
+            contextPercentage,
+        });
+        expect(policy.mayStrip("image")).toBe(true);
+        const notDroppedYet = createProcessedImageEligibility(messages, new Map([["answer", 11]]), {
+            watermark: 10,
+            protectedCutoff: 5,
+            contextPercentage,
+        });
+        expect(notDroppedYet.mayStrip("image")).toBe(false);
+    }
+});

package/src/shared/processed-image-eligibility.ts

@@ -0,0 +1,41 @@
+/**
+ * Shared processed-image age and recency policy for both OpenCode adapters.
+ * Use the owning message's positive maximum tag; an untagged image-only message
+ * inherits the next positive tagged message after it, never age zero or a tag
+ * from an earlier message. Without either tag, retain the image at the live tail.
+ * A positive dropped-tag watermark must cover that position. Below 95% usage,
+ * retain every position at or beyond the protected newest-window cutoff. At
+ * 95% and above only that window yields, exactly as for emergency tool drops;
+ * independent per-tool protections still apply. Content before retained provider-signed
+ * thinking must stay unchanged unless an existing whole-turn rewrite removes that
+ * thinking first. Callers enforce these protections, later-assistant/stable-id checks, durable
+ * persistence and rewrite-only discovery. Frozen replay bypasses eligibility.
+ */
+export function createProcessedImageEligibility<T>(
+    messages: readonly T[],
+    messageTagNumbers: ReadonlyMap<T, number>,
+    options: { watermark: number; protectedCutoff?: number | null; contextPercentage?: number },
+): { ageTags: ReadonlyMap<T, number>; mayStrip: (message: T) => boolean } {
+    const ageTags = new Map<T, number>();
+    let nextTag: number | undefined;
+    for (let index = messages.length - 1; index >= 0; index--) {
+        const message = messages[index];
+        const ownTag = messageTagNumbers.get(message);
+        if (ownTag !== undefined && Number.isFinite(ownTag) && ownTag > 0) nextTag = ownTag;
+        if (nextTag !== undefined) ageTags.set(message, nextTag);
+    }
+    return {
+        ageTags,
+        mayStrip: (message) => {
+            const age = ageTags.get(message);
+            return (
+                options.watermark > 0 &&
+                age !== undefined &&
+                age <= options.watermark &&
+                ((options.contextPercentage ?? 0) >= 95 ||
+                    options.protectedCutoff == null ||
+                    age < options.protectedCutoff)
+            );
+        },
+    };
+}

package/src/shared/processed-image-position-review.json

@@ -0,0 +1,20 @@
+[
+    { "name": "own maximum wins over a later smaller tag", "tags": [[2, 10, 4], [3]], "target": 0, "watermark": 8, "cutoff": null, "percentage": 60, "age": 10, "eligible": false },
+    { "name": "own maximum at watermark", "tags": [[2, 10, 4], [30]], "target": 0, "watermark": 10, "cutoff": null, "percentage": 60, "age": 10, "eligible": true },
+    { "name": "first later tag not largest later tag", "tags": [[], [3], [20]], "target": 0, "watermark": 3, "cutoff": null, "percentage": 60, "age": 3, "eligible": true },
+    { "name": "first later message contributes its own maximum", "tags": [[], [2, 9], [3]], "target": 0, "watermark": 5, "cutoff": null, "percentage": 60, "age": 9, "eligible": false },
+    { "name": "skip empty and zero tags when looking forward", "tags": [[1], [], [0], [4]], "target": 1, "watermark": 4, "cutoff": null, "percentage": 60, "age": 4, "eligible": true },
+    { "name": "zero own tag inherits later positive", "tags": [[0], [7]], "target": 0, "watermark": 6, "cutoff": null, "percentage": 60, "age": 7, "eligible": false },
+    { "name": "preceding tag cannot age live tail", "tags": [[1], [], []], "target": 1, "watermark": 100, "cutoff": null, "percentage": 60, "age": null, "eligible": false },
+    { "name": "all untagged is ineligible", "tags": [[], []], "target": 0, "watermark": 100, "cutoff": null, "percentage": 60, "age": null, "eligible": false },
+    { "name": "watermark zero even with emergency", "tags": [[], [1]], "target": 0, "watermark": 0, "cutoff": 1, "percentage": 95, "age": 1, "eligible": false },
+    { "name": "age above watermark even with emergency", "tags": [[], [7]], "target": 0, "watermark": 6, "cutoff": 1, "percentage": 100, "age": 7, "eligible": false },
+    { "name": "cutoff inclusive at 94.99 percent", "tags": [[5], [8]], "target": 0, "watermark": 9, "cutoff": 5, "percentage": 94.99, "age": 5, "eligible": false },
+    { "name": "inside cutoff is a range not set membership", "tags": [[], [6]], "target": 0, "watermark": 9, "cutoff": 5, "percentage": 60, "age": 6, "eligible": false },
+    { "name": "below cutoff is eligible", "tags": [[4], [8]], "target": 0, "watermark": 9, "cutoff": 5, "percentage": 94.99, "age": 4, "eligible": true },
+    { "name": "exactly 95 waives cutoff", "tags": [[], [6]], "target": 0, "watermark": 9, "cutoff": 5, "percentage": 95, "age": 6, "eligible": true },
+    { "name": "above 95 waives cutoff", "tags": [[5], [8]], "target": 0, "watermark": 9, "cutoff": 5, "percentage": 95.01, "age": 5, "eligible": true },
+    { "name": "emergency cannot invent tail age", "tags": [[1], []], "target": 1, "watermark": 100, "cutoff": 1, "percentage": 100, "age": null, "eligible": false },
+    { "name": "own positive tag overrides later greater tag", "tags": [[2], [20]], "target": 0, "watermark": 2, "cutoff": 3, "percentage": 60, "age": 2, "eligible": true },
+    { "name": "last message with own tag is aged", "tags": [[1], [4]], "target": 1, "watermark": 4, "cutoff": null, "percentage": 60, "age": 4, "eligible": true }
+]

package/src/shared/processed-image-position-review.test.ts

@@ -0,0 +1,19 @@
+import { expect, test } from "bun:test";
+import { createProcessedImageEligibility } from "./processed-image-eligibility";
+import cases from "./processed-image-position-review.json";
+
+// OpenCode, Rust and Pi can reuse these cases: each row supplies per-message
+// tag numbers rather than provider-specific message objects or image encodings.
+for (const row of cases) {
+    test(`independent image position table: ${row.name}`, () => {
+        const messages = row.tags.map((_, i) => `message-${i}`);
+        const tags = new Map(messages.map((message, i) => [message, Math.max(0, ...row.tags[i])]));
+        const policy = createProcessedImageEligibility(messages, tags, {
+            watermark: row.watermark,
+            protectedCutoff: row.cutoff,
+            contextPercentage: row.percentage,
+        });
+        expect(policy.ageTags.get(messages[row.target]) ?? null).toBe(row.age);
+        expect(policy.mayStrip(messages[row.target])).toBe(row.eligible);
+    });
+}

package/src/shared/project-directory-key.ts

@@ -20,6 +20,26 @@ export function projectDirectoryKey(directory: string): string {
     return path.resolve(directory);
 }
 
+/**
+ * Whether two spellings name the same directory, judged by spelling alone.
+ *
+ * Hosts and the plugin do not agree on how to write a directory: OpenCode 2 on
+ * Windows stores a session's directory as `D:/work/app` while the plugin's own
+ * location is `D:\work\app`, and a drive letter can arrive in either case.
+ * Both sides go through `projectDirectoryKey`, so separators, Windows case,
+ * `\\?\` prefixes, trailing separators and `.`/`..` segments cannot make one
+ * directory look like two. POSIX paths keep their case. Symlinks are not
+ * resolved here; callers that must follow them use `canonicalProjectDirectory`.
+ *
+ * An empty spelling never matches anything: `path.resolve("")` is the process's
+ * working directory, and a session with no recorded directory must not be
+ * taken for one in the directory the process happens to run in.
+ */
+export function sameProjectDirectory(a: string, b: string): boolean {
+    if (a.length === 0 || b.length === 0) return false;
+    return projectDirectoryKey(a) === projectDirectoryKey(b);
+}
+
 let realpathForCanonicalDirectory: (directory: string) => string = (directory) =>
     realpathSync.native(directory);
 

package/src/shared/recovery-reasoning-prefix.test.ts

@@ -0,0 +1,34 @@
+import { expect, test } from "bun:test";
+import { recoveryReasoningPrefixes } from "./recovery-reasoning-prefix";
+
+for (const key of ["content", "parts"] as const) {
+    test(`recovery reasoning ${key}: exact preceding messages and same-message parts`, () => {
+        const messages = [
+            { role: "user", [key]: [{ type: "text", text: "original" }] },
+            {
+                role: "assistant",
+                [key]: [
+                    { type: "text", text: "before" },
+                    { type: "thinking", thinkingSignature: "first" },
+                    { type: "text", text: "between" },
+                    { type: "redacted_thinking", data: "opaque" },
+                    { type: "text", text: "after" },
+                ],
+            },
+        ];
+        const original = recoveryReasoningPrefixes(messages, key);
+        expect(original).toHaveLength(2);
+        const edited = structuredClone(messages);
+        edited[0]![key]![0]!.text = "changed";
+        expect(recoveryReasoningPrefixes(edited, key)).not.toEqual(original);
+        const parts = structuredClone(messages);
+        parts[1]![key]![2]!.text = "changed";
+        expect(recoveryReasoningPrefixes(parts, key)[0]).toBe(original[0]);
+        expect(recoveryReasoningPrefixes(parts, key)[1]).not.toBe(original[1]);
+        const suffix = structuredClone(messages);
+        suffix[1]![key]![4]!.text = "changed";
+        expect(recoveryReasoningPrefixes(suffix, key)).toEqual(original);
+        suffix[1]![key]!.splice(3, 1);
+        expect(recoveryReasoningPrefixes(suffix, key)).not.toEqual(original);
+    });
+}

package/src/shared/recovery-reasoning-prefix.ts

@@ -0,0 +1,35 @@
+/**
+ * Serialize each request prefix ending at a thinking/reasoning part, including
+ * earlier messages and earlier parts of that message. Comparing these snapshots
+ * detects edits to bytes authenticated by a kept signature, or missing blocks.
+ * Include reasoning without a visible signature too: a host may carry its
+ * provider signature in fields this helper does not interpret.
+ */
+export function recoveryReasoningPrefixes(
+    messages: readonly unknown[],
+    partsKey: "parts" | "content",
+): string[] {
+    const prefixes: string[] = [];
+    for (let index = 0; index < messages.length; index++) {
+        const message = messages[index] as Record<string, unknown> | null;
+        const parts = message?.[partsKey];
+        if (!Array.isArray(parts)) continue;
+        for (let p = 0; p < parts.length; p++) {
+            const type = (parts[p] as { type?: string } | null)?.type;
+            if (
+                type !== "thinking" &&
+                type !== "reasoning" &&
+                type !== "redactedThinking" &&
+                type !== "redacted_thinking"
+            )
+                continue;
+            prefixes.push(
+                JSON.stringify([
+                    ...messages.slice(0, index),
+                    { ...message, [partsKey]: parts.slice(0, p + 1) },
+                ]),
+            );
+        }
+    }
+    return prefixes;
+}

package/src/shared/sqlite-acquisition-routing.test.ts

@@ -118,7 +118,7 @@ test("exhausted routed acquisition never enters the callback or multiplies privi
         db.close();
         rmSync(dir, { recursive: true, force: true });
     }
-});
+}, 30_000);
 
 for (const mode of ["run", "get", "all", "exec"] as const) {
     test(`foreground ${mode} autocommit waits share one turn budget and restore production timeout`, () => {
@@ -147,7 +147,8 @@ for (const mode of ["run", "get", "all", "exec"] as const) {
                 }
                 expect(() => db.exec("BEGIN IMMEDIATE")).toThrow("acquisition remained busy");
             });
-            expect(performance.now() - started).toBeLessThan(650);
+            expect(performance.now() - started).toBeGreaterThanOrEqual(1900);
+            expect(performance.now() - started).toBeLessThan(2600);
             expect(db.prepare("PRAGMA busy_timeout").get()).toEqual({ timeout: 5000 });
             expect(db.prepare("SELECT * FROM result").all()).toEqual([]);
             blocker.exec("ROLLBACK");
@@ -159,5 +160,5 @@ for (const mode of ["run", "get", "all", "exec"] as const) {
             db.close();
             rmSync(dir, { recursive: true, force: true });
         }
-    });
+    }, 30_000);
 }