@retaw106/mmc-oc 2.2.1 → 2.4.0

package/src/config/index.test.ts

@@ -7,11 +7,7 @@ import { resolveEpochFloorForPass } from "../features/magic-context/storage-meta
 import { resolveHistorianModel } from "../shared/model-resolution";
 import { Database } from "../shared/sqlite";
 import { createTestTempDir, createTestTempDirFromPath } from "../shared/test-temp-dir";
-import {
-    getWindowOverlay,
-    reloadWindowOverlay,
-    setWindowOverlayPath,
-} from "../shared/window-geometry";
+import { WINDOW_OVERLAY_PATH_DEPRECATION_WARNING } from "./deprecated-config";
 import { loadPluginConfig, loadPluginConfigDetailed } from "./index";
 import { resolveConfigProfile } from "./profiles";
 import { getProtectedTokensTierOverrides } from "./project-security";
@@ -156,39 +152,19 @@ function loadDetailedWithConfigs(userConfigText: string, projectConfigText?: str
     }
 }
 
-describe("loadPluginConfig — Fusiform overlay reload", () => {
-    it("does not invalidate a same-path overlay during routine config reads", () => {
-        const overlayDir = createTestTempDirFromPath(join(tmpdir(), "mc-config-overlay-"));
-        const overlayPath = join(overlayDir, "window-overlay.json");
-        const configText = JSON.stringify({ models: { window_overlay_path: overlayPath } });
-        const writeOverlay = (modelId: string) =>
-            writeFileSync(
-                overlayPath,
-                JSON.stringify({
-                    schema: "fusiform-window-overlay/v1",
-                    generated_at: "2026-09-01T00:00:00Z",
-                    minted_provider_ids: [],
-                    cells: [{ provider_id: "hunt-provider", model_id: modelId, facts: {} }],
-                }),
-            );
-
-        try {
-            writeOverlay("before-rewrite");
-            loadWithUserConfig(configText);
-            expect(getWindowOverlay()?.cells[0]?.model_id).toBe("before-rewrite");
-
-            writeOverlay("after-rewrite");
-            expect(getWindowOverlay()?.cells[0]?.model_id).toBe("before-rewrite");
-
-            loadWithUserConfig(configText);
-            expect(getWindowOverlay()?.cells[0]?.model_id).toBe("before-rewrite");
+describe("loadPluginConfig — retired Fusiform window path", () => {
+    it("parses the old key but warns once that it is ignored", () => {
+        const path = "/tmp/retired-fusiform-window.json";
+        const config = loadWithUserConfig(
+            JSON.stringify({ models: { window_overlay_path: path } }),
+        );
 
-            reloadWindowOverlay(overlayPath);
-            expect(getWindowOverlay()?.cells[0]?.model_id).toBe("after-rewrite");
-        } finally {
-            setWindowOverlayPath(undefined);
-            rmSync(overlayDir, { recursive: true, force: true });
-        }
+        expect(config.models?.window_overlay_path).toBe(path);
+        const warnings = config.configWarnings?.filter((message) =>
+            message.includes("models.window_overlay_path"),
+        );
+        expect(warnings).toHaveLength(1);
+        expect(warnings?.[0]).toContain(WINDOW_OVERLAY_PATH_DEPRECATION_WARNING);
     });
 });
 

package/src/config/index.ts

@@ -13,9 +13,9 @@ import {
 } from "../shared/jsonc-parser";
 import { setOutputReserveConfig } from "../shared/models-dev-cache";
 import type { PromptSurfaceConfig } from "../shared/prompt-surface";
-import { setWindowOverlayPath } from "../shared/window-geometry";
 import { migrateLegacyAgentEnabledInMemory } from "./agent-disable";
 import { mmcProjectConfigBasePath, opencodeUserConfigBasePath } from "./config-paths";
+import { warnDeprecatedWindowOverlayPath } from "./deprecated-config";
 import {
     legacyHarnessBlockPaths,
     RemovedHistorianHarnessBlockError,
@@ -370,6 +370,7 @@ export function parsePluginConfig(
         preMigrationWarnings,
     );
     const migrated = migrateLegacyAgentEnabledInMemory(migratedExperimental, preMigrationWarnings);
+    warnDeprecatedWindowOverlayPath(migrated, preMigrationWarnings);
     const parsed = MagicContextConfigSchema.safeParse(migrated);
     const disabledHooks = Array.isArray(rawConfig.disabled_hooks)
         ? rawConfig.disabled_hooks.filter((value): value is string => typeof value === "string")
@@ -711,7 +712,6 @@ export function loadPluginConfigDetailed(
     if (profileResolution.activeProfile) config.profile = profileResolution.activeProfile;
     if (applyRuntimeGlobals) {
         setOutputReserveConfig(config.output_reserve);
-        setWindowOverlayPath(config.models?.window_overlay_path);
     }
     const leafValidationWarnings = [...(config.configWarnings ?? [])];
     if (config.configWarnings?.length) {

package/src/config/latch-permanence-guard.test.ts

@@ -153,6 +153,10 @@ const KNOWN_SLOTS: Record<string, KnownSlot> = {
         classification: "DIAGNOSTIC",
         reason: "Most-recent diagnostic: every open attempt clears or overwrites it.",
     },
+    "packages/pi-plugin/src/index.ts:loggedPiMaintenanceModelMissing": {
+        classification: "PUBLICATION",
+        reason: "Once-per-process log dedup only (plan 18): the unconfigured-maintenance diagnosis is logged once to avoid per-pass spam. It gates no behavior — buildPiMaintenanceOptions re-evaluates the model chain on every call.",
+    },
     "packages/plugin/src/shared/models-dev-cache.ts:apiCache": {
         classification: "PUBLICATION",
         reason: "Publishes last-known-good model metadata, not a failure verdict; refresh writes a later successful value.",

package/src/config/project-security.test.ts

@@ -268,6 +268,23 @@ describe("stripUnsafeProjectConfigFields", () => {
         expect(warnings.some((w) => w.includes("maintenance"))).toBe(true);
     });
 
+    it("plan 18: strips a project-injected maintenance model chain (no model hijack)", () => {
+        const raw: Record<string, unknown> = {
+            maintenance: {
+                enabled: true,
+                model: "attacker/spender",
+                fallback_models: ["attacker/backup"],
+            },
+        };
+        const warnings = stripUnsafeProjectConfigFields(raw);
+
+        // The whole-group strip removes the model fields with everything
+        // else: a cloned repo cannot redirect the user's maintenance runs
+        // onto its own (possibly billable) models.
+        expect(raw.maintenance).toBeUndefined();
+        expect(warnings.some((w) => w.includes("maintenance"))).toBe(true);
+    });
+
     it("is a no-op for a clean project config", () => {
         const raw: Record<string, unknown> = { dreamer: { model: "x" }, memory: { enabled: true } };
         const warnings = stripUnsafeProjectConfigFields(raw);

package/src/config/project-security.ts

@@ -301,8 +301,8 @@ function makeProjectThresholdWarning(field: string, reason: string): string {
  *  - `debug_rpc` — a repo must not enable process heap capture or memory diagnostics.
  *  - `allow_home_project` — only the user may opt a home-directory session
  *    into a durable project identity.
- *  - `output_reserve` / `models.window_overlay_path` — only the user may change
- *    process-wide window geometry inputs.
+ *  - `output_reserve` — only the user may change process-wide window geometry.
+ *    The deprecated `models.window_overlay_path` field is ignored at every tier.
  *  - `language`: a repo must not inject prompt text through a user preference.
  *  - `maintenance` — budgets, cooldowns, and anomaly thresholds of the
  *    automatic memory-maintenance task are user-level only; a cloned repo
@@ -398,7 +398,7 @@ export function stripUnsafeProjectConfigFields(projectRaw: Record<string, unknow
     if (isPlainObject(models) && "window_overlay_path" in models) {
         delete models.window_overlay_path;
         warnings.push(
-            "Ignoring models.window_overlay_path from project config (security: only user-level config may select model geometry metadata).",
+            "Ignoring models.window_overlay_path from project config (deprecated; this setting no longer changes model window geometry).",
         );
     }
 

package/src/config/schema/magic-context.test.ts

@@ -135,6 +135,7 @@ describe("MagicContextConfigSchema", () => {
                 },
                 maintenance: {
                     enabled: true,
+                    fallback_models: [],
                     budgets: {
                         inputTokens: 400_000,
                         outputTokens: 32_000,
@@ -159,6 +160,55 @@ describe("MagicContextConfigSchema", () => {
             expect(result).toEqual(input);
         });
 
+        it("parses both maintenance model spellings and distinguishes absent from empty fallbacks", () => {
+            const stringForm = MagicContextConfigSchema.parse({
+                maintenance: { enabled: true, model: "openai/gpt-6-luna" },
+            }).maintenance;
+            expect(stringForm.model).toBe("openai/gpt-6-luna");
+            expect(stringForm.fallback_models).toBeUndefined();
+            expect(
+                MagicContextConfigSchema.parse({
+                    maintenance: { fallback_models: [] },
+                }).maintenance.fallback_models,
+            ).toEqual([]);
+
+            const objectForm = MagicContextConfigSchema.parse({
+                maintenance: {
+                    enabled: true,
+                    model: { model: "xiaomi/mimo-v2.6-flash", variant: "high" },
+                    fallback_models: ["openai/gpt-6-luna", { model: "p/l", thinking_level: "off" }],
+                },
+            }).maintenance;
+            // Object entries keep both harness qualifiers verbatim — the
+            // active harness reads its own, no cross-harness mapping.
+            expect(objectForm.model).toEqual({
+                model: "xiaomi/mimo-v2.6-flash",
+                variant: "high",
+            });
+            expect(objectForm.fallback_models).toEqual([
+                "openai/gpt-6-luna",
+                { model: "p/l", thinking_level: "off" },
+            ]);
+        });
+
+        it("plan 18: rejects blank maintenance model references at parse time (no silent executor flow)", () => {
+            expect(
+                MagicContextConfigSchema.safeParse({
+                    maintenance: { enabled: true, model: "   " },
+                }).success,
+            ).toBe(false);
+            expect(
+                MagicContextConfigSchema.safeParse({
+                    maintenance: { enabled: true, model: { model: "" } },
+                }).success,
+            ).toBe(false);
+            expect(
+                MagicContextConfigSchema.safeParse({
+                    maintenance: { enabled: true, fallback_models: ["ok/one", "  "] },
+                }).success,
+            ).toBe(false);
+        });
+
         it("accepts a boolean storage permission policy and rejects non-booleans", () => {
             expect(
                 MagicContextConfigSchema.parse({

package/src/config/schema/magic-context.ts

@@ -135,6 +135,23 @@ const HistorianModelEntryObjectSchema = z
 export const HistorianModelEntrySchema = z.union([z.string(), HistorianModelEntryObjectSchema]);
 export type HistorianModelEntry = z.infer<typeof HistorianModelEntrySchema>;
 
+/**
+ * A maintenance model entry (plan 18): the same string/object shape as a
+ * historian model entry, but blank references are REJECTED at parse time —
+ * a blank primary must surface as a config diagnostic, never silently flow
+ * into the hidden executor or get corrected to some other model.
+ */
+const MaintenanceModelEntrySchema = HistorianModelEntrySchema.superRefine((entry, ctx) => {
+    const model = typeof entry === "string" ? entry : entry.model;
+    if (typeof model !== "string" || model.trim().length === 0) {
+        ctx.addIssue({
+            code: "custom",
+            message:
+                "maintenance model entries must be non-empty: a bare provider/model string or { model, variant?, thinking_level? }",
+        });
+    }
+});
+
 /**
  * A profile may select models but must not alter execution policy. It uses the
  * same flat historian model-resolution fields; execution metadata is not
@@ -261,8 +278,8 @@ export interface MagicContextConfig {
     prompt_surface: PromptSurfaceConfig;
     /** User-only output-token reservation override. Zero disables reservation. */
     output_reserve?: number | { default: number; [modelKey: string]: number };
-    /** User-only model metadata inputs. */
-    models?: { window_overlay_path?: string };
+    /** Deprecated user-only window metadata path; parsed only so loaders can warn and ignore it. */
+    models?: { window_overlay_path?: unknown };
     /** TUI toast lifetime in milliseconds for Magic Context notifications. Default: 5000. */
     toast_duration_ms?: number;
     execute_threshold_percentage: number | { default: number; [modelKey: string]: number };
@@ -400,6 +417,13 @@ export interface MagicContextConfig {
      */
     maintenance: {
         enabled: boolean;
+        /**
+         * Primary maintenance model entry. When absent, inherit historian
+         * model configuration; never inherit the main-session model.
+         */
+        model?: HistorianModelEntry;
+        /** Ordered fallbacks; absent inherits historian fallbacks only with an inherited primary. */
+        fallback_models?: HistorianModelEntry[];
         /** Per-run four-dimensional budget (decision 9; provisional, calibrated in P3/P4). */
         budgets: {
             inputTokens: number;
@@ -487,12 +511,16 @@ export const MagicContextConfigSchema = z.object({
         ),
     models: z
         .object({
-            window_overlay_path: z.string().trim().min(1).optional(),
+            window_overlay_path: z
+                .unknown()
+                .optional()
+                .describe(
+                    "Deprecated: ignored. Fusiform no longer publishes window-overlay data, so this setting no longer changes model window geometry. Remove this key.",
+                )
+                .meta({ deprecated: true }),
         })
         .optional()
-        .describe(
-            "User-only Fusiform window-overlay settings. The path defaults to <dataDir>/fusiform/window-overlay.json.",
-        ),
+        .describe("Deprecated user-only Fusiform window-overlay settings; ignored."),
     toast_duration_ms: z
         .number()
         .min(0)
@@ -796,6 +824,15 @@ export const MagicContextConfigSchema = z.object({
                 .describe(
                     "Enable the automatic memory-maintenance task (default: true). USER-LEVEL ONLY — the whole maintenance group is stripped from project-tier config.",
                 ),
+            model: MaintenanceModelEntrySchema.optional().describe(
+                "Primary maintenance model entry: a bare provider/model string or { model, variant? (OpenCode), thinking_level? (Pi) }. USER-LEVEL ONLY. When absent, inherit historian model configuration. If neither has a primary, automatic passes skip and manual runs refuse. The main-session model is never inherited.",
+            ),
+            fallback_models: z
+                .array(MaintenanceModelEntrySchema)
+                .optional()
+                .describe(
+                    "Ordered fallback maintenance model entries, tried after CALL failures only. When absent and the primary is inherited, inherit historian fallbacks; explicit [] disables fallbacks. Illegal manifests, permission refusals, and exhausted budgets never switch models.",
+                ),
             budgets: z
                 .object({
                     inputTokens: z
@@ -918,7 +955,7 @@ export const MagicContextConfigSchema = z.object({
             anomalyThreshold: { absoluteRows: 10, poolFraction: 0.25 },
         })
         .describe(
-            "Automatic memory-maintenance run controls (dreamer replacement). USER-LEVEL ONLY: the whole group is stripped from project-tier config so a cloned repository cannot raise budgets, relax cooldowns, or loosen the anomaly guard.",
+            "Automatic memory-maintenance run controls (dreamer replacement). USER-LEVEL ONLY: project-tier config cannot pick maintenance models or change run controls. An absent model inherits historian model configuration, never the session model.",
         ),
 });
 

package/src/shared/auto-search-lifecycle.ts

@@ -1,4 +1,47 @@
+import type { AutoSearchHintNoHintReason } from "../features/magic-context/storage-meta-persisted";
+
 const pending = new Map<string, Set<AbortController>>();
+const unpublishedNoHints = new Map<string, Map<string, AutoSearchHintNoHintReason>>();
+
+/**
+ * A failed save can still send the user message without a search hint. Remember
+ * that no-hint decision until a later pass saves it to SQLite, including across
+ * closing and reopening the database handle. Switching or shutting down a session
+ * does not prove deletion and must not discard it. If all compare-and-swap (CAS)
+ * save retries fail and the process restarts before repair, this unsaved record
+ * is lost: that compound failure is the remaining durability gap.
+ */
+export function rememberUnpublishedAutoSearchNoHint(
+    sessionId: string,
+    messageId: string,
+    reason: AutoSearchHintNoHintReason,
+): void {
+    let messages = unpublishedNoHints.get(sessionId);
+    if (!messages) {
+        messages = new Map();
+        unpublishedNoHints.set(sessionId, messages);
+    }
+    if (!messages.has(messageId)) messages.set(messageId, reason);
+}
+
+export function getUnpublishedAutoSearchNoHint(
+    sessionId: string,
+    messageId: string,
+): AutoSearchHintNoHintReason | undefined {
+    return unpublishedNoHints.get(sessionId)?.get(messageId);
+}
+
+export function forgetUnpublishedAutoSearchNoHint(sessionId: string, messageId: string): void {
+    const messages = unpublishedNoHints.get(sessionId);
+    messages?.delete(messageId);
+    if (messages?.size === 0) unpublishedNoHints.delete(sessionId);
+}
+
+/** Deleting a session releases its unsaved no-hint records; switching away does not. */
+export function clearUnpublishedAutoSearchNoHints(sessionId?: string): void {
+    if (sessionId === undefined) unpublishedNoHints.clear();
+    else unpublishedNoHints.delete(sessionId);
+}
 
 /** Cleanup cancels optional searches and backfill, not durable served decisions. */
 export function registerAutoSearchWork(sessionId: string): {

package/src/shared/logger.ts

@@ -162,8 +162,16 @@ function flush(): void {
         let currentSize = getCurrentLogSize(logFile);
         const dataSize = Buffer.byteLength(data);
         if (currentSize > 0 && currentSize + dataSize > MAX_LOG_FILE_BYTES) {
-            rotateLogFile(logFile, currentSize);
-            currentSize = 0;
+            // Several processes share this file and each caches its size. A stale
+            // cache must not rotate a file another process already rotated: that
+            // second rotation would overwrite the full predecessor with the few
+            // lines written since. Decide on the file's real size instead.
+            flushesSinceSizeCheck = SIZE_CHECK_INTERVAL_FLUSHES;
+            currentSize = getCurrentLogSize(logFile);
+            if (currentSize > 0 && currentSize + dataSize > MAX_LOG_FILE_BYTES) {
+                rotateLogFile(logFile, currentSize);
+                currentSize = 0;
+            }
         }
         fs.appendFileSync(logFile, data, { encoding: "utf8", mode: 0o600 });
         buffer = [];

package/src/shared/model-suggestion-retry.ts

@@ -361,8 +361,12 @@ async function abortChildRun(client: Client, sessionId: string): Promise<void> {
  * Everything else (auth errors, ProviderModelNotFoundError without suggestion,
  * rate limits, transient network failures, etc.) is considered retryable on a
  * different model.
+ * Exported as the shared fallback-switch classifier (plan 18): the
+ * memory-maintenance attempt loop reuses this exact predicate so "which
+ * failures may switch models" has ONE definition across historian and
+ * maintainer call sites.
  */
-function isNonRetryable(error: unknown, externalSignal?: AbortSignal): boolean {
+export function isNonRetryable(error: unknown, externalSignal?: AbortSignal): boolean {
     if (
         externalSignal?.aborted ||
         (error instanceof HiddenCompletionRefusal && error.terminal) ||

package/src/shared/models-dev-cache.ts

@@ -33,12 +33,7 @@ import { getHarness } from "./harness";
 import { modelRefLookupOrder } from "./harness-provider-map";
 import { sessionLog } from "./logger";
 import { writeStorageFileAtomicSync } from "./storage-permissions";
-import {
-    deriveWindowGeometry,
-    getWindowOverlay,
-    resolveWindowOverlayFacts,
-    type WindowGeometryResult,
-} from "./window-geometry";
+import { deriveWindowGeometry, type WindowGeometryResult } from "./window-geometry";
 
 interface OpencodeClientLike {
     config: {
@@ -515,7 +510,6 @@ export function getSdkWindowGeometry(
             output: metadata.outputLimit,
         },
         {
-            overlay: resolveWindowOverlayFacts(providerID, modelID, getWindowOverlay()),
             outputReserveOverride: resolveOutputReserve(providerID, modelID),
             harness: options?.harness ?? "opencode",
             contextCap:

package/src/shared/models-dev-temperature.ts

@@ -0,0 +1,107 @@
+/**
+ * Temperature capability from the models.dev catalog that OpenCode caches on disk.
+ *
+ * OpenCode 1 copies models.dev's `temperature` flag onto each model, but OpenCode 2's
+ * model rows, Pi's model registry and Oh My Pi's Gemini models carry no equivalent
+ * field. For those hosts the cached catalog is the only positive evidence on the
+ * machine, so a missing file, an unparsable file or a missing entry all mean "unknown"
+ * and the caller omits temperature.
+ *
+ * This module is bundled into the Pi/OMP historian child extension, so it must only
+ * depend on Node built-ins.
+ */
+import { readFileSync, statSync } from "node:fs";
+import { homedir } from "node:os";
+import { join } from "node:path";
+
+export interface CatalogTemperature {
+    temperature: boolean;
+    /** The catalog entry that decided, as `provider/model`. */
+    entry: string;
+}
+
+/**
+ * Harness provider ids that name the same models.dev provider. Codex (`openai-codex`)
+ * is deliberately absent: the ChatGPT backend is a different transport from the
+ * OpenAI API that models.dev describes, so it gets no catalog answer and no temperature.
+ */
+const CATALOG_PROVIDER_ALIASES: Readonly<Record<string, string>> = {
+    "google-antigravity": "google",
+    "opencode-zen": "opencode",
+};
+
+/** The Antigravity auth plugins register Gemini models as `google/antigravity-<model>`. */
+const ANTIGRAVITY_MODEL_PREFIX = "antigravity-";
+
+type CatalogIndex = Map<string, boolean>;
+
+let cached: { path: string; mtimeMs: number; size: number; index: CatalogIndex } | undefined;
+
+/** OpenCode reads `OPENCODE_MODELS_PATH` instead of its cache when it is set. */
+export function modelsDevCatalogPath(env: NodeJS.ProcessEnv = process.env): string {
+    if (env.OPENCODE_MODELS_PATH) return env.OPENCODE_MODELS_PATH;
+    return join(env.XDG_CACHE_HOME || join(homedir(), ".cache"), "opencode", "models.json");
+}
+
+function buildIndex(raw: unknown): CatalogIndex {
+    const index: CatalogIndex = new Map();
+    if (!raw || typeof raw !== "object" || Array.isArray(raw)) return index;
+    for (const [providerID, provider] of Object.entries(raw as Record<string, unknown>)) {
+        const models = (provider as { models?: unknown } | null)?.models;
+        if (!models || typeof models !== "object") continue;
+        for (const [modelID, model] of Object.entries(models as Record<string, unknown>)) {
+            const temperature = (model as { temperature?: unknown } | null)?.temperature;
+            if (typeof temperature === "boolean")
+                index.set(`${providerID}/${modelID}`, temperature);
+        }
+    }
+    return index;
+}
+
+function loadIndex(): CatalogIndex | undefined {
+    const path = modelsDevCatalogPath();
+    try {
+        const stat = statSync(path);
+        if (cached?.path === path && cached.mtimeMs === stat.mtimeMs && cached.size === stat.size)
+            return cached.index;
+        const index = buildIndex(JSON.parse(readFileSync(path, "utf8")));
+        cached = { path, mtimeMs: stat.mtimeMs, size: stat.size, index };
+        return index;
+    } catch {
+        // Absent or partially written catalog: no evidence either way.
+        return undefined;
+    }
+}
+
+/** Spellings to try for a harness `provider/model` reference, most specific first. */
+export function catalogCandidates(providerID: string, modelID: string): string[] {
+    const provider = Object.hasOwn(CATALOG_PROVIDER_ALIASES, providerID)
+        ? CATALOG_PROVIDER_ALIASES[providerID]
+        : providerID;
+    const candidates = [`${provider}/${modelID}`];
+    if (provider === "google" && modelID.startsWith(ANTIGRAVITY_MODEL_PREFIX))
+        candidates.push(`google/${modelID.slice(ANTIGRAVITY_MODEL_PREFIX.length)}`);
+    return candidates;
+}
+
+/**
+ * Look `provider/model` up in the cached catalogue, trying only the exact spellings from
+ * `catalogCandidates`. A malformed reference, a missing catalogue or no entry returns undefined.
+ */
+export function catalogTemperature(model: string): CatalogTemperature | undefined {
+    const slash = model.indexOf("/");
+    if (slash <= 0 || slash === model.length - 1) return undefined;
+    const index = loadIndex();
+    if (!index) return undefined;
+    for (const entry of catalogCandidates(model.slice(0, slash), model.slice(slash + 1))) {
+        const temperature = index.get(entry);
+        if (temperature !== undefined) return { temperature, entry };
+    }
+    return undefined;
+}
+
+export const __catalogTest = {
+    reset(): void {
+        cached = undefined;
+    },
+};

package/src/shared/processed-image-eligibility.test.ts

@@ -0,0 +1,68 @@
+import { expect, test } from "bun:test";
+import { createProcessedImageEligibility } from "./processed-image-eligibility";
+
+const messages = ["old", "image", "answer", "tail"];
+
+test("image position age inherits its next positive tag, never zero or an earlier tag", () => {
+    const policy = createProcessedImageEligibility(
+        messages,
+        new Map([
+            ["old", 1],
+            ["answer", 6],
+        ]),
+        { watermark: 1 },
+    );
+    expect(policy.ageTags.get("image")).toBe(6);
+    expect(policy.mayStrip("image")).toBe(false);
+    expect(policy.ageTags.has("tail")).toBe(false);
+    expect(policy.mayStrip("tail")).toBe(false);
+    const own = createProcessedImageEligibility(
+        messages,
+        new Map([
+            ["image", 3],
+            ["answer", 6],
+        ]),
+        { watermark: 4 },
+    );
+    expect(own.ageTags.get("image")).toBe(3);
+    expect(own.mayStrip("image")).toBe(true);
+});
+
+test("answered image-only positions outside the protected window are eligible", () => {
+    const policy = createProcessedImageEligibility(
+        messages,
+        new Map([
+            ["answer", 3],
+            ["tail", 5],
+        ]),
+        { watermark: 4, protectedCutoff: 5, contextPercentage: 94.99 },
+    );
+    expect(policy.ageTags.get("image")).toBe(3);
+    expect(policy.mayStrip("image")).toBe(true);
+});
+
+test("image positions inside the protected window stay below the 95 percent emergency", () => {
+    const policy = createProcessedImageEligibility(messages, new Map([["answer", 6]]), {
+        watermark: 10,
+        protectedCutoff: 5,
+        contextPercentage: 94.99,
+    });
+    expect(policy.mayStrip("image")).toBe(false);
+});
+
+test("image positions follow emergency drops when the newest window yields at 95 percent", () => {
+    for (const contextPercentage of [95, 99]) {
+        const policy = createProcessedImageEligibility(messages, new Map([["answer", 6]]), {
+            watermark: 10,
+            protectedCutoff: 5,
+            contextPercentage,
+        });
+        expect(policy.mayStrip("image")).toBe(true);
+        const notDroppedYet = createProcessedImageEligibility(messages, new Map([["answer", 11]]), {
+            watermark: 10,
+            protectedCutoff: 5,
+            contextPercentage,
+        });
+        expect(notDroppedYet.mayStrip("image")).toBe(false);
+    }
+});

package/src/shared/processed-image-eligibility.ts

@@ -0,0 +1,41 @@
+/**
+ * Shared processed-image age and recency policy for both OpenCode adapters.
+ * Use the owning message's positive maximum tag; an untagged image-only message
+ * inherits the next positive tagged message after it, never age zero or a tag
+ * from an earlier message. Without either tag, retain the image at the live tail.
+ * A positive dropped-tag watermark must cover that position. Below 95% usage,
+ * retain every position at or beyond the protected newest-window cutoff. At
+ * 95% and above only that window yields, exactly as for emergency tool drops;
+ * independent per-tool protections still apply. Content before retained provider-signed
+ * thinking must stay unchanged unless an existing whole-turn rewrite removes that
+ * thinking first. Callers enforce these protections, later-assistant/stable-id checks, durable
+ * persistence and rewrite-only discovery. Frozen replay bypasses eligibility.
+ */
+export function createProcessedImageEligibility<T>(
+    messages: readonly T[],
+    messageTagNumbers: ReadonlyMap<T, number>,
+    options: { watermark: number; protectedCutoff?: number | null; contextPercentage?: number },
+): { ageTags: ReadonlyMap<T, number>; mayStrip: (message: T) => boolean } {
+    const ageTags = new Map<T, number>();
+    let nextTag: number | undefined;
+    for (let index = messages.length - 1; index >= 0; index--) {
+        const message = messages[index];
+        const ownTag = messageTagNumbers.get(message);
+        if (ownTag !== undefined && Number.isFinite(ownTag) && ownTag > 0) nextTag = ownTag;
+        if (nextTag !== undefined) ageTags.set(message, nextTag);
+    }
+    return {
+        ageTags,
+        mayStrip: (message) => {
+            const age = ageTags.get(message);
+            return (
+                options.watermark > 0 &&
+                age !== undefined &&
+                age <= options.watermark &&
+                ((options.contextPercentage ?? 0) >= 95 ||
+                    options.protectedCutoff == null ||
+                    age < options.protectedCutoff)
+            );
+        },
+    };
+}