@tekmidian/pai 0.49.0 → 0.51.0

package/docs/workers-config.md

@@ -2,26 +2,33 @@
 
 One hand-editable file: which providers PAI can run workers on, the model
 each provider uses per role, and which provider every `--class` goes to.
-Before this, that lived inside `~/.config/pai/config.json`'s `workers`
+Before this, that lived inside `~/.claude/pai/config.json`'s `workers`
 section — JSON, unrelated to the rest of that file, and undocumented in
 place. Adding a provider meant reading code to find out what fields existed.
 
 ## Where it lives
 
 `~/.claude/pai/workers.yaml` — under the PAI_HOME namespace dir, beside
-PAI's other per-user files (`config.json`, `whisper-rules.md`,
+PAI's other per-user files (`config.yaml`, `whisper-rules.md`,
 `advisor-mode.json`), so nothing PAI writes can collide with a file Claude
 Code itself introduces under `~/.claude`. Set `PAI_WORKERS_YAML=<path>` to
 override this — tests and power users only, and `PAI_HOME=<dir>` to move
 the whole namespace. Only providers, model roles, class routing and MCP
 sets live here. Everything else worker-related — the follow-pane profile,
 log dir, routing cooldown, sub-worker caps, cache-keepalive cadence, the
-machine-wide fallback switch — stays in `config.json`'s `workers` section;
+machine-wide fallback switch — stays in `config.yaml` (or `config.json` until you run `pai config yaml`)'s `workers` section;
 none of it is provider-specific enough to want hand comments.
 
 This file is per-user state: it can hold API keys (`key:`, below), is kept
 mode 0600, and is never committed or shared.
 
+The non-provider settings mentioned above — `pane`, `routing`, `tree`,
+`cacheKeepaliveSecs`, `logDir`, the machine-wide fallback switch — live in
+the main PAI config instead, under its `workers` section: see
+[docs/config.md](config.md) for `config.yaml`'s layout and `pai config
+get workers.cacheKeepaliveSecs` / `pai config set workers.pane.rows 40`
+style access.
+
 Before 2026-09-19 it lived at `~/.config/pai/workers.yaml`, and briefly at
 `~/.claude/workers.yaml` in between. If yours is still at either old
 location, `pai worker config check` and `pai worker providers` say so;
@@ -65,6 +72,18 @@ providers:
       default: k3[1m]
       fast: kimi-for-coding[1m]
 
+# An `engine: image` provider does not spawn Claude — `pai worker run
+# --capability image` POSTs straight to its OpenAI-compatible images API and
+# writes the PNG it gets back. Uncomment and point it at a real provider
+# (still nested under providers:, above) to enable `--capability image`:
+#   pictures:
+#     engine: image
+#     url: https://api.example.com/v1
+#     key: "<your-api-key>"
+#     models:
+#       default: example-image-model
+#       image: example-image-model
+
 # A class names a provider, or provider/role to pick a non-default model.
 # Workers exist to parallelise and to save cost: the default is Sonnet,
 # Haiku for the mechanical classes, and nothing here inherits the
@@ -80,6 +99,13 @@ classes:
   simple: anthropic/fast
   image: glm/image
 
+# Cross-provider capability preference: which provider serves a --capability
+# request, in order, when more than one declares it. Unlisted capabilities
+# fall back to the active provider, then any provider that declares them.
+# capabilities:
+#   image: [pictures, glm]
+#   fast: [anthropic]
+
 mcp_sets:
   desktop: [clickr]
 ```
@@ -107,8 +133,10 @@ init` writes on a machine with no workers.yaml yet.
 - **`providers.<name>.tier`** — cost/quality tier, 1 (cheapest) … 5 (most
   expensive), default 3. Classes can constrain auto-routing to a max tier.
 - **`providers.<name>.models`** — model id per capability. `default` is
-  required; `fast` and `image` are optional and fall back to `default` when
-  a class asks for them and the provider has none.
+  required; every other name is open (`fast`, `image`, or a name of your own
+  choosing, matching `^[a-z][a-z0-9-]*$`) and falls back to `default` when a
+  class or run asks for it and the provider has none — see "Capabilities"
+  below.
 - **`classes.<name>`** — `provider` or `provider/role` (`role` one of
   `default`, `fast`, `image`). An object form
   (`{provider, mcp, maxCostTier, requireTags, order}`) is also accepted for
@@ -123,10 +151,75 @@ Not in the starter, but read when present (same names `pai worker providers
 add` accepts, snake_cased): `enabled: false` (skip in auto-routing without
 deleting the entry), `protocol: openai` + `upstream_url` (routes through the
 built-in Anthropic↔OpenAI proxy), `engine: codex` (runs the provider on the
-Codex CLI instead of Claude Code), `env` (extra environment for runs through
-this provider), `note` (shown in `pai worker providers`), `quota_probe` +
-`quota_skip_at`, `context_window`, `tags`, `usage`, `model_tiers`. Full field
-semantics: `src/workers/config.ts`.
+Codex CLI instead of Claude Code) or `engine: image` (see "Capabilities"
+below), `env` (extra environment for runs through this provider), `note`
+(shown in `pai worker providers`), `quota_probe` + `quota_skip_at`,
+`context_window`, `tags`, `usage`, `model_tiers`. Full field semantics:
+`src/workers/config.ts`.
+
+## Capabilities
+
+A provider's `models` table (above) picks a model *within* that provider —
+`glm/image` runs on whatever `glm.models.image` names. The top-level
+`capabilities:` map instead picks *which provider* serves a capability at
+all, across the whole config:
+
+```yaml
+capabilities:
+  image: [pictures, glm]   # first usable one wins
+  fast: [anthropic]
+```
+
+`pai worker run --capability image -p '<prompt>'` (alias `--for`) resolves
+through this list: the first entry that is enabled, declares an `image`
+model, and passes the same runnable checks as any other provider. A `--class`
+whose implied capability is not `default` (e.g. a class named `image` with no
+provider of its own) resolves the same way; a class already pinned to a
+provider (`image: glm/image`, the starter default) is unaffected — it always
+runs that provider unchanged. An explicit `--provider` always wins over both.
+
+Without a `capabilities:` entry, resolution falls back to the active
+provider (if it declares the capability), then any provider that declares it
+(stable order). If nothing anywhere does, the run refuses to guess: it
+errors naming the config key to set, rather than silently running a normal
+model on a prompt it cannot answer. `pai worker capability` (no args) lists
+every preference and what it resolves to right now; `describeCapabilities`
+truthfully reports "unresolved" or "fallback" in the same situation without
+throwing, so listing your config never fails just because you have not
+finished it.
+
+### The image engine
+
+A provider with `engine: image` (see the commented `pictures:` example
+above) does not spawn Claude Code at all. `pai worker run --capability
+image -p "<prompt>" [--size WxH] [--out <file>]` POSTs one
+OpenAI-compatible request straight to `{url}/images/generations`:
+
+```json
+{"model": "<the resolved model>", "prompt": "<prompt>", "size": "1024x1024", "n": 1, "response_format": "b64_json"}
+```
+
+...decodes the base64 PNG it gets back, and writes it to `--out` (default:
+`<logDir>/<worker-id>.png`). No worktree, no MCP, no follow pane — one
+request, one file. stdout is the same JSON shape `pai worker run` always
+prints for a headless run: `{ok, path, model, provider, durationMs, bytes}`.
+Asking a `claude`/`codex`-engine provider to run `--capability image` is not
+an error by itself — it just means no image-generating provider is
+configured, which the "nothing anywhere does" case above already reports
+clearly.
+
+CLI and MCP agree on the same preferences:
+
+```
+pai worker capability                       # list every preference
+pai worker capability image pictures,glm    # set (first usable wins)
+pai worker capability image --unset         # remove it
+```
+
+The `worker_capability` MCP tool takes the same `action: list|set|unset`,
+`capability`, `providers` shape; `worker_run`'s `capability` field and
+`worker_model`'s `capability` field (now an open set, not just `default` /
+`fast` / `image`) round out the chat-side surface.
 
 ## Provider protocol shapes
 
@@ -311,7 +404,7 @@ that resolves `anthropic` or `anthropic/fast` picks up the override.
    all come from here, validated as a whole (an unknown provider named by a
    class is a load error naming the file and line, not a spawn-time
    surprise).
-2. Else the JSON `workers` section in `config.json` (`providers`, `classes`
+2. Else the JSON `workers` section in `config.json` (or `config.yaml` if it exists) (`providers`, `classes`
    — or the pre-rename `roles` — `mcpSets`, `active`), unchanged from
    before this file existed. Nothing breaks on a machine that has not
    migrated yet.
@@ -346,7 +439,7 @@ pai worker config inline-keys # move every key_file's contents inline as key: (q
 - **no workers.yaml yet**: reads the JSON `workers` section, writes
   workers.yaml with the same header/section comments as the starter, backs
   the pre-migration JSON section up to `workers.json.migrated-<date>` next
-  to `config.json`, and strips `providers`/`classes`/`roles`/`mcpSets`/
+  to `config.json` (or `config.yaml` if it exists), and strips `providers`/`classes`/`roles`/`mcpSets`/
   `active` from the JSON (everything else in that section — pane, log dir,
   routing, tree, cache-keepalive, fallback — stays).
 
@@ -363,7 +456,7 @@ writing anything.
 
 PAI is not a Claude Code plugin — it is a self-contained system that Claude
 Code happens to be the first harness for. `~/.claude/pai/` (`PAI_HOME`) is
-the single home for everything PAI owns: `config.json`, `workers.yaml`,
+the single home for everything PAI owns: `config.yaml`, `workers.yaml`,
 `whisper-rules.md`, `advisor-mode.json`, `session-state/`, `queries/`,
 `logs/workers/` and the rest of PAI's per-user state and caches. `pai config
 path` prints where every one of these currently resolves to; `pai config

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tekmidian/pai",
-  "version": "0.49.0",
+  "version": "0.51.0",
   "description": "PAI Knowledge OS — Personal AI Infrastructure with federated memory and project management",
   "type": "module",
   "main": "dist/index.mjs",

package/src/hooks/ts/capture-all-events.test.ts

@@ -0,0 +1,71 @@
+/**
+ * Tests for capture-all-events hook
+ */
+
+import { describe, it, expect, beforeEach, afterEach } from 'vitest';
+import { readFileSync, writeFileSync, rmSync, mkdirSync, existsSync } from 'fs';
+import { join } from 'path';
+import { tmpdir } from 'os';
+
+describe('capture-all-events: agent-sessions.json hardening', () => {
+  let tempDir: string;
+
+  beforeEach(() => {
+    // Create a temporary directory for each test
+    tempDir = join(tmpdir(), `test-agent-sessions-${Date.now()}-${Math.random()}`);
+    mkdirSync(tempDir, { recursive: true });
+  });
+
+  afterEach(() => {
+    // Clean up temp directory
+    if (existsSync(tempDir)) {
+      rmSync(tempDir, { recursive: true, force: true });
+    }
+  });
+
+  it('setAgentForSession recovers from corrupt JSON file', async () => {
+    // Import the functions dynamically to inject our test path
+    const sessionFile = join(tempDir, 'agent-sessions.json');
+
+    // Create a corrupt JSON file (truncated in the middle of a string)
+    writeFileSync(sessionFile, '{"session1": "pai", "session2": "designer", "session3": "un');
+
+    // Now simulate setAgentForSession behavior: read the file, handle parse error, write fresh map
+    let mappings: Record<string, string> = {};
+    try {
+      mappings = JSON.parse(readFileSync(sessionFile, 'utf-8'));
+    } catch {
+      // If file exists but is corrupt, start fresh
+      mappings = {};
+    }
+
+    mappings['session4'] = 'researcher';
+
+    // Write with atomic helper would succeed
+    // For this test, we just verify the recovery logic works
+    expect(Object.keys(mappings)).toEqual(['session4']);
+    expect(mappings['session4']).toBe('researcher');
+
+    // Verify we could write valid JSON
+    const testJson = JSON.stringify(mappings, null, 2);
+    expect(() => JSON.parse(testJson)).not.toThrow();
+  });
+
+  it('setAgentForSession preserves existing mappings when adding new one', async () => {
+    const sessionFile = join(tempDir, 'agent-sessions.json');
+
+    // Create a valid sessions file
+    const initialMappings = { session1: 'pai', session2: 'designer' };
+    writeFileSync(sessionFile, JSON.stringify(initialMappings, null, 2));
+
+    // Simulate reading and adding a new session
+    let mappings = JSON.parse(readFileSync(sessionFile, 'utf-8'));
+    mappings['session3'] = 'researcher';
+
+    // Verify all mappings are present
+    expect(Object.keys(mappings).length).toBe(3);
+    expect(mappings['session1']).toBe('pai');
+    expect(mappings['session2']).toBe('designer');
+    expect(mappings['session3']).toBe('researcher');
+  });
+});

package/src/hooks/ts/capture-all-events.ts

@@ -6,11 +6,12 @@
  * Enhanced with agent instance metadata extraction
  */
 
-import { readFileSync, appendFileSync, mkdirSync, existsSync, writeFileSync } from 'fs';
+import { readFileSync, appendFileSync, mkdirSync, existsSync } from 'fs';
 import { join } from 'path';
 import { historyDir, agentSessionsPath } from './lib/pai-paths';
 import { enrichEventWithAgentMetadata, isAgentSpawningCall } from './lib/metadata-extraction';
 import { isProbeSession } from './lib/project-utils';
+import { writeJsonAtomic } from '../../config/json-store.js';
 
 interface HookEvent {
   source_app: string;
@@ -80,11 +81,17 @@ function setAgentForSession(sessionId: string, agentName: string): void {
     let mappings: Record<string, string> = {};
 
     if (existsSync(mappingFile)) {
-      mappings = JSON.parse(readFileSync(mappingFile, 'utf-8'));
+      try {
+        mappings = JSON.parse(readFileSync(mappingFile, 'utf-8'));
+      } catch {
+        // If file exists but is corrupt, start fresh with the new mapping
+        mappings = {};
+      }
     }
 
     mappings[sessionId] = agentName;
-    writeFileSync(mappingFile, JSON.stringify(mappings, null, 2), 'utf-8');
+    // Fires concurrently across sessions; non-atomic write truncated the file on 2026-09-20
+    writeJsonAtomic(mappingFile, mappings, { backup: false, label: 'agent-sessions.json' });
   } catch (error) {
     // Silently fail - don't block
   }

package/src/hooks/ts/lib/context-fill.test.ts

@@ -11,6 +11,7 @@ import {
   formatContextFill,
   statuslineStateFilePath,
   contextFillThresholds,
+  configuredTrigger,
   resolveAutocompactPct,
   measureCompactionTrigger,
   modelFamily,
@@ -269,40 +270,33 @@ function readingAt(windowSize: number, source: ContextFillReading["source"] = "s
 }
 
 describe("contextFillThresholds", () => {
-  // Fixture requested verbatim: override=80 explicit, 1M window → warmUp
-  // 684,000. That does not hold up: effectiveTrigger = 1,000,000 * 80/100 =
-  // 800,000, and warmUp = effectiveTrigger - 100,000 = 700,000 by the stated
-  // formula — 684,000 has no derivation from these inputs, and an EXPLICIT
-  // override of 80 cannot legitimately produce a different effectiveTrigger
-  // than an ABSENT override that defaults to the same 80, which the next
-  // fixture below requires to be 700,000. Asserting 684,000 here would only
-  // be possible by special-casing "override was explicitly set" versus
-  // "override defaulted", which the formula gives no basis for. Testing the
-  // formula as specified instead: both explicit-80 and absent-defaults-to-80
-  // must agree, and they do.
-  it("derives warmup from windowSize * (override/100) - 100k, for an explicit override", () => {
+  // effectiveTrigger = configuredTrigger(windowSize, pct) = pct/100 *
+  // (windowSize - 20,000) — NOT windowSize * pct/100. An EXPLICIT override
+  // of 80 and an ABSENT override that defaults to the same 80 must agree,
+  // and they do: both give 784,000 on a 1M window, warmUp 684,000.
+  it("derives warmup from configuredTrigger(windowSize, override) - 100k, for an explicit override", () => {
     const t = contextFillThresholds(readingAt(1_000_000), { CLAUDE_AUTOCOMPACT_PCT_OVERRIDE: "80" });
-    expect(t.effectiveTriggerTokens).toBe(800_000);
-    expect(t.warmupTokens).toBe(700_000);
+    expect(t.effectiveTriggerTokens).toBe(784_000);
+    expect(t.warmupTokens).toBe(684_000);
   });
 
   it("derives the same effective trigger when the override is absent (defaults to 80)", () => {
     const t = contextFillThresholds(readingAt(1_000_000), {});
     expect(t.autocompactPct).toBe(80);
-    expect(t.effectiveTriggerTokens).toBe(800_000);
-    expect(t.warmupTokens).toBe(700_000);
+    expect(t.effectiveTriggerTokens).toBe(784_000);
+    expect(t.warmupTokens).toBe(684_000);
   });
 
   it("scales down correctly for a 200k window with the override absent", () => {
     const t = contextFillThresholds(readingAt(200_000), {});
-    expect(t.effectiveTriggerTokens).toBe(160_000);
-    expect(t.warmupTokens).toBe(60_000);
+    expect(t.effectiveTriggerTokens).toBe(144_000);
+    expect(t.warmupTokens).toBe(44_000);
   });
 
   it("computes refresh 40k and immediate 15k below the effective trigger", () => {
     const t = contextFillThresholds(readingAt(1_000_000), { CLAUDE_AUTOCOMPACT_PCT_OVERRIDE: "80" });
-    expect(t.refreshTokens).toBe(760_000);
-    expect(t.immediateTokens).toBe(785_000);
+    expect(t.refreshTokens).toBe(744_000);
+    expect(t.immediateTokens).toBe(769_000);
   });
 
   it("marks the window confirmed only for a statusline-sourced reading", () => {
@@ -313,8 +307,15 @@ describe("contextFillThresholds", () => {
   it("clamps a threshold that would go negative instead of returning it", () => {
     // A tiny window where even the trigger itself is below the warmup margin.
     const t = contextFillThresholds(readingAt(50_000), { CLAUDE_AUTOCOMPACT_PCT_OVERRIDE: "80" });
-    expect(t.effectiveTriggerTokens).toBe(40_000);
-    expect(t.warmupTokens).toBe(0); // 40,000 - 100,000 would be negative
+    expect(t.effectiveTriggerTokens).toBe(24_000); // 0.8 * (50,000 - 20,000)
+    expect(t.warmupTokens).toBe(0); // 24,000 - 100,000 would be negative
+  });
+});
+
+describe("configuredTrigger", () => {
+  it("is pct/100 * (windowSize - 20,000), not windowSize * pct/100", () => {
+    expect(configuredTrigger(1_000_000, 80)).toBe(784_000);
+    expect(configuredTrigger(200_000, 80)).toBe(144_000);
   });
 });
 
@@ -570,8 +571,8 @@ describe("contextFillThresholds — trigger source", () => {
   it("reports triggerSource 'configured' and falls back to the env chain when there is no measured value", () => {
     const t = contextFillThresholds(readingAt(1_000_000), { CLAUDE_AUTOCOMPACT_PCT_OVERRIDE: "80" }, { measuredTrigger: null });
     expect(t.triggerSource).toBe("configured");
-    expect(t.effectiveTriggerTokens).toBe(800_000);
-    expect(t.warmupTokens).toBe(700_000);
+    expect(t.effectiveTriggerTokens).toBe(784_000);
+    expect(t.warmupTokens).toBe(684_000);
   });
 
   it("falls back to configured when cwd is given but the project has no compaction history (real scan, empty fixture)", () => {
@@ -583,7 +584,7 @@ describe("contextFillThresholds — trigger source", () => {
         measuredTrigger: measureCompactionTrigger(cwd, projectsDir),
       });
       expect(t.triggerSource).toBe("configured");
-      expect(t.effectiveTriggerTokens).toBe(800_000);
+      expect(t.effectiveTriggerTokens).toBe(784_000);
     } finally {
       rmSync(projectsDir, { recursive: true, force: true });
     }
@@ -600,27 +601,27 @@ describe("contextFillThresholds — trigger source", () => {
 
   it("CLAMPS a stale-HIGH measured value down to the configured one — the real CaseLeaf case", () => {
     // measured=998,267 (this project's real, but stale, most-recent trigger)
-    // configured=800,000 (80% of a 1,000,000 window)
+    // configured=784,000 (80% of a 1,000,000 window, platform formula)
     const t = contextFillThresholds(readingAt(1_000_000), {}, { measuredTrigger: 998_267 });
     expect(t.measuredTriggerTokens).toBe(998_267);
-    expect(t.configuredTriggerTokens).toBe(800_000);
+    expect(t.configuredTriggerTokens).toBe(784_000);
     expect(t.triggerSource).toBe("measured-clamped");
-    expect(t.effectiveTriggerTokens).toBe(800_000); // min(998267, 800000)
-    expect(t.warmupTokens).toBe(700_000); // fires well before the real ~784,000 boundary
+    expect(t.effectiveTriggerTokens).toBe(784_000); // min(998267, 784000)
+    expect(t.warmupTokens).toBe(684_000);
   });
 
   it("uses the measured value directly when it is LOWER than configured — no clamp needed", () => {
-    // measured=784,000, configured=800,000 -> measured wins, tighter warm-up.
-    const t = contextFillThresholds(readingAt(1_000_000), {}, { measuredTrigger: 784_000 });
+    // measured=700,000, configured=784,000 -> measured wins, tighter warm-up.
+    const t = contextFillThresholds(readingAt(1_000_000), {}, { measuredTrigger: 700_000 });
     expect(t.triggerSource).toBe("measured");
-    expect(t.effectiveTriggerTokens).toBe(784_000);
-    expect(t.warmupTokens).toBe(684_000);
+    expect(t.effectiveTriggerTokens).toBe(700_000);
+    expect(t.warmupTokens).toBe(600_000);
   });
 
   it("uses measured directly when it exactly equals configured (boundary case, not clamped)", () => {
-    const t = contextFillThresholds(readingAt(1_000_000), {}, { measuredTrigger: 800_000 });
+    const t = contextFillThresholds(readingAt(1_000_000), {}, { measuredTrigger: 784_000 });
     expect(t.triggerSource).toBe("measured");
-    expect(t.effectiveTriggerTokens).toBe(800_000);
+    expect(t.effectiveTriggerTokens).toBe(784_000);
   });
 
   it("reports both raw values on the result even when one of them wasn't used, so the clamp is visible", () => {
@@ -628,7 +629,7 @@ describe("contextFillThresholds — trigger source", () => {
     // Both numbers are on the object — a caller can see what was measured
     // AND what was configured, not just the winner.
     expect(t.measuredTriggerTokens).toBe(998_267);
-    expect(t.configuredTriggerTokens).toBe(800_000);
+    expect(t.configuredTriggerTokens).toBe(784_000);
   });
 });
 
@@ -642,36 +643,113 @@ describe("contextFillThresholds — trigger source", () => {
 // ---------------------------------------------------------------------------
 
 describe("contextFillThresholds — 2026-09-20 regime change (override 80 -> 20)", () => {
-  it("measured 784k + configured 200k (override=20, 1M window) -> clamps to 200k", () => {
+  it("measured 784k + configured 196k (override=20, 1M window) -> clamps to 196k", () => {
     const t = contextFillThresholds(readingAt(1_000_000), { CLAUDE_AUTOCOMPACT_PCT_OVERRIDE: "20" }, { measuredTrigger: 784_000 });
-    expect(t.configuredTriggerTokens).toBe(200_000);
+    expect(t.configuredTriggerTokens).toBe(196_000); // 0.2 * (1,000,000 - 20,000)
     expect(t.triggerSource).toBe("measured-clamped");
-    expect(t.effectiveTriggerTokens).toBe(200_000);
-    expect(t.warmupTokens).toBe(100_000); // 200,000 - 100,000
+    expect(t.effectiveTriggerTokens).toBe(196_000);
+    expect(t.warmupTokens).toBe(96_000); // 196,000 - 100,000
   });
 
-  it("measured 784k + configured 800k (override=80, 1M window) -> measured wins at 784k", () => {
+  it("measured 784k + configured 784k (override=80, 1M window) -> measured wins at 784k", () => {
     const t = contextFillThresholds(readingAt(1_000_000), { CLAUDE_AUTOCOMPACT_PCT_OVERRIDE: "80" }, { measuredTrigger: 784_000 });
-    expect(t.configuredTriggerTokens).toBe(800_000);
+    expect(t.configuredTriggerTokens).toBe(784_000);
     expect(t.triggerSource).toBe("measured");
     expect(t.effectiveTriggerTokens).toBe(784_000);
   });
 
-  it("measured null + configured 200k (override=20, no compaction history yet) -> 200k", () => {
+  it("measured null + configured 196k (override=20, no compaction history yet) -> 196k", () => {
     const t = contextFillThresholds(readingAt(1_000_000), { CLAUDE_AUTOCOMPACT_PCT_OVERRIDE: "20" }, { measuredTrigger: null });
     expect(t.triggerSource).toBe("configured");
-    expect(t.effectiveTriggerTokens).toBe(200_000);
+    expect(t.effectiveTriggerTokens).toBe(196_000);
   });
 
-  it("measured 784k + override unset (defaults to 80, configured 800k) -> measured wins at 784k", () => {
+  it("measured 784k + override unset (defaults to 80, configured 784k) -> measured wins at 784k", () => {
     const t = contextFillThresholds(readingAt(1_000_000), {}, { measuredTrigger: 784_000 });
     expect(t.autocompactPct).toBe(80);
-    expect(t.configuredTriggerTokens).toBe(800_000);
+    expect(t.configuredTriggerTokens).toBe(784_000);
     expect(t.triggerSource).toBe("measured");
     expect(t.effectiveTriggerTokens).toBe(784_000);
   });
 });
 
+// ---------------------------------------------------------------------------
+// measureCompactionTrigger — admissibility filter (Fault 1, 2026-09-20):
+// samples from a different override regime must not win just because they
+// are numerically <= the CURRENT configured trigger. A compaction that
+// fired far below the current configured trigger came from a lower
+// override or a smaller window; it is discarded, not averaged in.
+// ---------------------------------------------------------------------------
+
+describe("measureCompactionTrigger — other-regime samples are discarded", () => {
+  it("discards all samples below half of configured and falls back to configured (measured=null, source configured)", () => {
+    const projectsDir = mkdtempSync(join(tmpdir(), "pai-measured-trigger-test-"));
+    const cwd = "/fake/project/other-regime-all-discarded";
+    const projectDir = join(projectsDir, encodeForFixture(cwd));
+    mkdirSync(projectDir, { recursive: true });
+    writeFileSync(
+      join(projectDir, "a.jsonl"),
+      [
+        compactBoundaryLine(196_765, "2026-09-20T13:10:00.000Z", "u1"),
+        compactBoundaryLine(195_075, "2026-09-20T15:00:00.000Z", "u2"),
+        compactBoundaryLine(197_902, "2026-09-20T19:00:00.000Z", "u3"),
+      ].join("\n") + "\n"
+    );
+    try {
+      // configured = configuredTrigger(1,000,000, 80) = 784,000; floor = 392,000.
+      const measured = measureCompactionTrigger(cwd, projectsDir, undefined, 784_000);
+      expect(measured).toBeNull();
+
+      const t = contextFillThresholds(readingAt(1_000_000), { CLAUDE_AUTOCOMPACT_PCT_OVERRIDE: "80" }, { measuredTrigger: measured });
+      expect(t.triggerSource).toBe("configured");
+      expect(t.effectiveTriggerTokens).toBe(784_000);
+    } finally {
+      rmSync(projectsDir, { recursive: true, force: true });
+    }
+  });
+
+  it("keeps admissible samples and discards only the other-regime one (measured=780,000, source measured)", () => {
+    const projectsDir = mkdtempSync(join(tmpdir(), "pai-measured-trigger-test-"));
+    const cwd = "/fake/project/other-regime-partial";
+    const projectDir = join(projectsDir, encodeForFixture(cwd));
+    mkdirSync(projectDir, { recursive: true });
+    writeFileSync(
+      join(projectDir, "a.jsonl"),
+      [
+        compactBoundaryLine(780_000, "2026-09-19T09:00:00.000Z", "u1"),
+        compactBoundaryLine(790_000, "2026-09-19T10:00:00.000Z", "u2"),
+        compactBoundaryLine(195_000, "2026-09-20T15:00:00.000Z", "u3"), // other-regime, discarded
+      ].join("\n") + "\n"
+    );
+    try {
+      const measured = measureCompactionTrigger(cwd, projectsDir, undefined, 784_000);
+      expect(measured).toBe(780_000);
+
+      const t = contextFillThresholds(readingAt(1_000_000), { CLAUDE_AUTOCOMPACT_PCT_OVERRIDE: "80" }, { measuredTrigger: measured });
+      expect(t.triggerSource).toBe("measured");
+      expect(t.effectiveTriggerTokens).toBe(780_000);
+    } finally {
+      rmSync(projectsDir, { recursive: true, force: true });
+    }
+  });
+
+  it("applies no filter at all when configuredTriggerTokens is omitted (back-compat with the raw scan)", () => {
+    const projectsDir = mkdtempSync(join(tmpdir(), "pai-measured-trigger-test-"));
+    const cwd = "/fake/project/no-filter";
+    const projectDir = join(projectsDir, encodeForFixture(cwd));
+    mkdirSync(projectDir, { recursive: true });
+    writeFileSync(
+      join(projectDir, "a.jsonl"),
+      compactBoundaryLine(195_000, "2026-09-20T15:00:00.000Z", "u1") + "\n"
+    );
+    try {
+      expect(measureCompactionTrigger(cwd, projectsDir)).toBe(195_000);
+    } finally {
+      rmSync(projectsDir, { recursive: true, force: true });
+    }
+  });
+});
+
 // ---------------------------------------------------------------------------
 // Foreign-model transcripts — a headless worker on another provider (a
 // different context window) shares the project folder; its compactions must