dsh-ptc-plus 0.5.1 → 0.5.3

package/internal/session-journal-recovery.js

@@ -7,6 +7,11 @@ import {
   JOURNAL_KEY,
   RECOVERY_BOUNDARY_KEY,
   RECOVERY_BOUNDARY_EVENT,
+  DIAGNOSTIC_WORDING_KEY,
+  DIAGNOSTIC_WORDING_FIELDS,
+  SETTLEMENT_PROOF_KEY,
+  SETTLEMENT_PROOF_FIELDS,
+  SETTLEMENT_PROOF_VERSION,
   LEGACY_JOURNAL_VERSION,
   REPL_TOOL_NAMES,
   REWRITES_KEY,
@@ -15,16 +20,23 @@ import {
   POST_EDIT_KEY,
 } from './session-journal-schema.js'
 import {
+  diagnosticWordingDigest,
   isCanonicalSequence,
-  normalizeDerivedEditResult,
+  normalizeDeferredEditSettlement,
   normalizeJournal,
   normalizeRecoveryBoundaries,
   reduceStateOperations,
+  settlementProofDigest,
   userBindingsForJournal,
   validatedRewrites,
 } from './session-journal.js'
 import { decodeValue } from './value-wire.js'
 import { editRejectedCell } from './rejected-cell-editor.js'
+import { renderDiagnostic } from './diagnostic.js'
+import {
+  byteLength, chainOfEntries, digestOf, extendSummary, retainedClusterCount, retentionLimits, settlementBytes,
+  summaryEntry, summaryRecordOf,
+} from './projection-retention.js'
 
 const RECOVERY_BOUNDARY_EVIDENCE = Symbol('recoveryBoundaryEvidence')
 const RUN_SELECTION_CLEAR_REASONS = new Set([
@@ -39,9 +51,26 @@ const MODEL_VISIBLE_SURFACE_EVENTS = new Set([
   'tool/result',
 ])
 
-function sourceForRunCall(call) {
+/**
+ * Argument text for a call, resolved through its canonical owner.
+ *
+ * `executableCalls` retains the text once; a call event that still carries its
+ * own copy (the live fold, or an uncompacted checkpoint) is read directly. A
+ * compacted event and a pruned entry hold only digests, so derivations see
+ * `undefined` and must treat the run as unavailable rather than guess.
+ */
+function callArguments(call, executableCalls) {
+  if (typeof call?.data?.arguments === 'string') return call.data.arguments
+  const entry = executableCalls?.get?.(call?.seq)
+  const stored = entry?.event?.data?.arguments
+  return typeof stored === 'string' ? stored : undefined
+}
+
+function sourceForRunCall(call, executableCalls) {
+  const text = callArguments(call, executableCalls)
+  if (text === undefined) return undefined
   try {
-    const args = JSON.parse(call.data.arguments)
+    const args = JSON.parse(text)
     return isRecord(args) && typeof args.code === 'string' ? args.code : undefined
   } catch {
     return undefined
@@ -68,8 +97,54 @@ export function isConfirmableNoop(timeline, callSeq, resultEventIndex) {
   return call !== undefined && call.eventIndex < resultEventIndex && !timeline.results.has(callSeq)
 }
 
+/** Node indices reachable from a head by following parents. */
+function reachableFrom(nodes, head) {
+  const reachable = new Set()
+  for (let cursor = head; cursor !== undefined && !reachable.has(cursor);) {
+    reachable.add(cursor)
+    cursor = nodes[cursor]?.parent
+  }
+  return reachable
+}
+
+/**
+ * Binding names a settlement journal recorded.
+ *
+ * The recorded values are the only evidence that names a durable binding today;
+ * `unrecordedBindings` names the ones the codec could not transfer, and a
+ * `kind: "binding"` save names one explicitly. A checkpoint save never counts.
+ */
+function journalBindingNames(journal) {
+  if (journal === undefined) return []
+  return [...new Set([
+    ...(journal.values ?? []).map(value => value.name),
+    ...(journal.unrecordedBindings ?? []),
+    ...bindingNamesOfOperations(journal.operations),
+  ].filter(name => typeof name === 'string'))]
+}
+
+/** Binding names an installed node recorded. */
+function recordedBindingNames(node) {
+  return journalBindingNames(node?.journal)
+}
+
 function applyOperations(state, operations, nodeIndex) {
+  const previousHead = state.head
   const transition = reduceStateOperations(state, operations, nodeIndex)
+  if (transition.restored) {
+    const reachableBefore = reachableFrom(state.nodes, previousHead)
+    const reachableAfter = reachableFrom(state.nodes, transition.head)
+    for (const index of reachableBefore) {
+      if (reachableAfter.has(index)) continue
+      for (const name of recordedBindingNames(state.nodes[index])) state.deletedBindings.add(name)
+    }
+    // The cutting node is not reachable from the new head either: the rewind it
+    // performed ends whatever that same cell created before the cut, so its own
+    // names belong to the recorded deletion rather than to an omission.
+    if (nodeIndex !== undefined) {
+      for (const name of recordedBindingNames(state.nodes[nodeIndex])) state.deletedBindings.add(name)
+    }
+  }
   state.head = transition.head
   state.checkpoints = transition.checkpoints
   if (transition.restored) {
@@ -78,44 +153,217 @@ function applyOperations(state, operations, nodeIndex) {
   }
 }
 
+/**
+ * Adopt the relation a record states about the cell it revised.
+ *
+ * The relation belongs to the fold, because only the fold knows the path that
+ * builds the environment. An accepted edit claims the revision *replaces* the cell
+ * it edited, so the revision takes that cell's place in the recorded order: it
+ * continues from the target's parent and every cell that followed the target
+ * continues from the revision. Appending the revision after those cells instead
+ * leaves them replaying an environment the edit already rewrote, with the
+ * declarations they read gone and the revision not yet in place.
+ *
+ * `installed` says whether this settlement puts a cell on the path. A contracted
+ * revision installs nothing, so the cells that followed the target bridge to the
+ * target's parent, and only a head that was the target itself has to move.
+ *
+ * The returned record of what changed is what lets a rejected settlement put the
+ * path back: nothing this adoption did survives a settlement the fold refuses.
+ */
+function adoptSupersession(state, record, { installed }) {
+  const superseded = state.editRewritesHistory && record.supersedes !== undefined
+    ? state.nodes.findIndex(node => node.callSeq === record.supersedes) : -1
+  const adoption = {
+    superseded,
+    previousHead: state.head,
+    supersededBindings: new Set(state.supersededBindings),
+    supersessions: state.supersessions.length,
+    children: [],
+    parent: state.head,
+    head: undefined,
+  }
+  if (superseded < 0) {
+    // No relation: the settlement appends to the head, as it always has.
+    adoption.head = installed ? undefined : state.head
+    return adoption
+  }
+  const parent = state.nodes[superseded].parent
+  adoption.parent = parent
+  for (let child = 0; child < state.nodes.length; child += 1) {
+    if (state.nodes[child].parent === superseded) adoption.children.push(child)
+  }
+  // The head is the last recorded cell. It keeps its place when the target is on
+  // its path behind other cells, because those cells now reach the same head
+  // through the revision; otherwise the revision is the newest cell and the head.
+  const targetOnPath = reachableFrom(state.nodes, state.head).has(superseded)
+  if (installed) adoption.head = targetOnPath && state.head !== superseded ? state.head : undefined
+  else adoption.head = state.head === superseded ? parent : state.head
+  return adoption
+}
+
+/**
+ * Record the relation as the fact the model is owed.
+ *
+ * Only names the record proves count. A durable declaration that the replay
+ * re-establishes is not evidence about the superseded cell, and claiming it
+ * would report a binding this fold cannot see. What the revision supplies is the
+ * caller's answer, because a settlement the fold refused to install supplies
+ * nothing; a cell the fold installs supplies the names its journal recorded.
+ */
+function recordSupersession(state, record, adoption, suppliedNames) {
+  if (adoption.superseded < 0) return
+  const supplied = new Set(suppliedNames)
+  for (const name of recordedBindingNames(state.nodes[adoption.superseded])) {
+    if (!supplied.has(name)) state.supersededBindings.add(name)
+  }
+  state.supersessions.push(Object.freeze({
+    supersededCallSeq: record.supersedes,
+    supersedingCallSeq: record.call.seq,
+  }))
+}
+
+/**
+ * Fold one accepted record as a settlement of the recorded path.
+ *
+ * `installed` is false for a settlement the fold contracts: it puts no cell on the
+ * path and supplies no name, while the relation it states is still the log's fact.
+ * Either way the relation is adopted first and the state operations are applied
+ * last, so a settlement that throws leaves the path, the children it re-parented
+ * and the relation it recorded exactly as it found them.
+ */
+function applyAdoptedRecord(state, record, { journal, installed = true, restoredFromRecord = false }) {
+  const adoption = adoptSupersession(state, record, { installed })
+  const index = installed
+    ? state.nodes.push(Object.freeze({
+      code: record.code,
+      journal,
+      callSeq: record.call.seq,
+      parent: adoption.parent,
+      ...(restoredFromRecord ? { restoredFromRecord: true } : {}),
+      ...(record.result.userBindings === undefined ? {} : { userBindings: record.result.userBindings }),
+    })) - 1
+    : undefined
+  const inherited = installed ? index : adoption.parent
+  for (const child of adoption.children) {
+    state.nodes[child] = Object.freeze({ ...state.nodes[child], parent: inherited })
+  }
+  state.head = adoption.head === undefined ? index : adoption.head
+  try {
+    recordSupersession(state, record, adoption, installed ? journalBindingNames(journal) : [])
+    applyOperations(state, journal.operations, index)
+  } catch (error) {
+    if (index !== undefined) state.nodes.pop()
+    state.head = adoption.previousHead
+    for (const child of adoption.children) {
+      state.nodes[child] = Object.freeze({ ...state.nodes[child], parent: adoption.superseded })
+    }
+    state.supersededBindings = adoption.supersededBindings
+    state.supersessions.length = adoption.supersessions
+    throw error
+  }
+}
+
+/**
+ * Binding names a recorded journal operation list saves.
+ *
+ * Only a save with `kind: "binding"` creates a binding. `repl.state({ action:
+ * "save" })` records a checkpoint name in the same `save` shape, which is why an
+ * untagged save is a checkpoint: every operation recorded before the kind existed
+ * came from that control call. Treating those names as bindings made a contraction
+ * report a branch name as a dropped variable.
+ */
+export function bindingNamesOfOperations(operations) {
+  const names = new Set()
+  for (const operation of operations ?? []) {
+    if (operation.action === 'save' && operation.kind === 'binding' && typeof operation.name === 'string') {
+      names.add(operation.name)
+    }
+  }
+  return [...names]
+}
+
 function applyRecord(state, record, invalidCallSeqs) {
   const { call, code, result } = record
+  // Every binding a journal names is a binding the session log proves. Recording
+  // the names here lets recovery report a binding it could not install instead of
+  // letting an unreplayed node take it silently.
+  // Only a volatile record proves a binding today: it cannot be replayed, so its
+  // recorded values are the entire evidence. A durable settlement records values too,
+  // for the restore path that installs nodes the replay does not reach, but its
+  // bindings are still proved by replaying it; counting them here would report a
+  // binding as dropped in every contraction whose replay is supposed to be complete.
+  // A released live environment proves nothing durable either: its live-only values
+  // are contracted below instead of being reported as a binding recovery owed.
+  const recordNames = [
+    ...(result?.journal?.status === 'volatile' && state.liveOnlyLost !== true
+      ? (result.journal.values ?? []).map(value => value.name)
+      : []),
+    ...bindingNamesOfOperations(result?.journal?.operations),
+  ]
+  for (const name of recordNames) state.provenBindings.add(name)
   if (invalidCallSeqs.has(call.seq)) return
   const journal = result.journal
   if (journal.status === 'noop') return
   if (journal.status === 'discarded') {
     if (journal.volatileReason !== undefined) {
       state.trusted = false
-      state.volatileSuffix.push({ seq: call.seq, code, reason: journal.volatileReason })
+      const discardedBindings = bindingNamesOfOperations(journal.operations)
+      state.volatileSuffix.push({ seq: call.seq, code, reason: journal.volatileReason,
+        ...(discardedBindings.length === 0 ? {} : { bindings: discardedBindings }) })
     }
     return
   }
   if (journal.status === 'volatile') {
     state.trusted = false
-    state.volatileSuffix.push({ seq: call.seq, code, reason: journal.volatileReason ?? 'volatile cell' })
-    applyOperations(state, journal.operations, undefined)
+    // A volatile settlement drops its `save` operations, so the names it created
+    // survive only as the bindings the record could not transfer.
+    const volatileBindings = [...new Set([...bindingNamesOfOperations(journal.operations),
+      ...(journal.unrecordedBindings ?? [])])]
+    // A volatile cell that recorded its values keeps its place in the durable
+    // frontier: recovery installs those values instead of replaying the cell, so
+    // the completion is unverified while the bindings survive. A volatile cell
+    // whose values the codec could not transfer has nothing to install and is
+    // reported as a contraction instead of vanishing silently.
+    //
+    // Those values are the live environment's own observation, so a fold that
+    // knows the environment was released (`liveOnlyLost`) cannot install them:
+    // the owner that read `Date.now()` or `process.pid` is gone, and the next
+    // environment inherits the durable computation, not the live cache.
+    if (!state.liveOnlyLost && journal.values !== undefined && journal.values.length > 0) {
+      // The relation is adopted for this settlement too: an accepted revision that
+      // settled volatile is still the revision the record names, so it replaces its
+      // target on the path and installs its own recorded values.
+      applyAdoptedRecord(state, record, { journal, restoredFromRecord: true })
+      return
+    }
+    // A released live environment is reported as a contracted cell: the model
+    // loses whatever the live cache held, and naming those bindings would claim
+    // they were proved by the durable frontier when they never were.
+    state.volatileSuffix.push({
+      seq: call.seq,
+      code,
+      reason: state.liveOnlyLost === true
+        ? 'the live environment that observed this cell was released'
+        : journal.volatileReason ?? 'volatile cell',
+      ...(volatileBindings.length === 0 || state.liveOnlyLost === true ? {} : { bindings: volatileBindings }),
+    })
+    // A contracted revision still replaces the cell it edited. Leaving the target
+    // on the path would keep building an environment the accepted edit already
+    // ended, and the relation is what tells the model those names are withdrawn
+    // rather than lost. The settlement installs nothing, so it supplies no name:
+    // every name the target recorded is withdrawn by this record.
+    applyAdoptedRecord(state, record, { journal, installed: false })
     return
   }
   if (!state.trusted && !state.surfaceContracted) {
     state.trusted = true
     state.volatileSuffix.length = 0
   }
-  const node = Object.freeze({
-    code,
-    journal,
-    callSeq: call.seq,
-    parent: state.head,
-    ...(result.userBindings === undefined ? {} : { userBindings: result.userBindings }),
-  })
-  const index = state.nodes.push(node) - 1
-  state.head = index
-  try {
-    applyOperations(state, journal.operations, index)
-  } catch (error) {
-    state.nodes.pop()
-    state.head = node.parent
-    throw error
-  }
+  // A record may declare that it is the revision of an earlier cell. Adoption of
+  // that relation, its re-parented children and the node this record puts on the
+  // path are one settlement: a record the fold refuses leaves none of them behind.
+  applyAdoptedRecord(state, record, { journal })
 }
 
 function recordEventSeq(record) {
@@ -132,8 +380,17 @@ function foldRecords(records, invalidCallSeqs, options = {}) {
     head: undefined,
     checkpoints: new Map(),
     volatileSuffix: [],
+    provenBindings: new Set(),
+    deletedBindings: new Set(),
+    // One recorded revision replaced the cell it edited. The relation, not a
+    // deletion, is what the log proves: the superseded cell stays in the record
+    // and off the path to the head.
+    supersessions: [],
+    supersededBindings: new Set(),
     trusted: true,
     surfaceContracted: options.surfaceContracted === true,
+    liveOnlyLost: options.liveOnlyLost === true,
+    editRewritesHistory: options.editRewritesHistory === true,
   }
   for (const record of records) {
     applyRecord(state, record, invalidCallSeqs)
@@ -224,22 +481,29 @@ export function visibleExecutableCallSeqs(session) {
     if (visibleAssistantCallSeqs.has(event.seq)) calls.add(event.seq)
   }
   const timeline = foldSessionTimeline(events)
-  for (const root of timeline.calls) {
-    const post = timeline.results.get(root.seq)?.postEdit
-    if (post !== undefined && calls.has(root.seq) && calls.has(post.targetCallSeq)) {
+  if (process.env.DEBUG_RECOVER) console.error('DEBUG events', events.length, 'results', timeline.results.size, 'calls', timelineCalls(timeline).length, 'exec', timeline.executableCalls.size)
+  for (const seq of timeline.calls) {
+    const post = timeline.results.get(seq)?.postEdit
+    // A derived execution that never ran was never published as a cell the model
+    // can see, so it is not model-visible executable history.
+    if (post !== undefined && post.derived?.unexecuted !== true
+      && calls.has(seq) && calls.has(post.targetCallSeq)) {
       calls.add(post.executionStartSeq)
     }
   }
   return calls
 }
 
-function timelineRun(call, result, eventIndex, journal) {
+function timelineRun(call, result, eventIndex, journal, executableCalls) {
   let args
-  try {
-    const parsed = JSON.parse(call.data.arguments)
-    if (isRecord(parsed)) args = Object.freeze(parsed)
-  } catch {
-    // Invalid persisted arguments cannot support derived source facts.
+  const text = callArguments(call, executableCalls)
+  if (text !== undefined) {
+    try {
+      const parsed = JSON.parse(text)
+      if (isRecord(parsed)) args = Object.freeze(parsed)
+    } catch {
+      // Invalid persisted arguments cannot support derived source facts.
+    }
   }
   return Object.freeze({
     index: eventIndex,
@@ -263,27 +527,35 @@ function timelineDerivedRun(call, result, eventIndex, derived) {
 }
 
 function successfulTimelineRun(run) {
-  return run.journal?.completion?.kind === 'return' && run.journal.status !== 'noop'
+  // A pruned settlement yields no run, so it cannot certify success either.
+  return run?.journal?.completion?.kind === 'return' && run.journal.status !== 'noop'
 }
 
-function settlementRun(settlement) {
+function settlementRun(settlement, executableCalls) {
   const publication = settlement.publication
   if (publication === undefined) return undefined
   const result = { data: { meta: { [REWRITES_KEY]: publication.postEditRewrites ?? publication.rewrites } } }
+  // A revision that never ran publishes no source of its own, so the settlement
+  // keeps its own call's source: the root cell stays the editable target and the
+  // unexecuted revision never becomes one.
+  if (publication.postEdit?.derived?.unexecuted === true || publication.derived?.unexecuted === true) {
+    return timelineJson(timelineRun(settlement.call, result, publication.index, publication.journal, executableCalls))
+  }
   if (publication.postEdit !== undefined) {
     return timelineJson(timelineDerivedRun({ seq: publication.postEdit.executionStartSeq }, result,
       publication.index, publication.postEdit.derived))
   }
   return timelineJson(publication.derived === undefined
-    ? timelineRun(settlement.call, result, publication.index, publication.journal)
+    ? timelineRun(settlement.call, result, publication.index, publication.journal, executableCalls)
     : timelineDerivedRun(settlement.call, result, publication.index, publication.derived))
 }
 
-function selectSettlementRun(selected, settlement, scope, frontier) {
+function selectSettlementRun(selected, settlement, scope, frontier, executableCalls) {
   const publication = settlement.publication
   if (publication === undefined || settlement.entry.scope !== scope
     || (frontier !== null && publication.index <= frontier.index)) return selected
-  return selected === undefined || publication.index >= selected.index ? settlementRun(settlement) : selected
+  return selected === undefined || publication.index >= selected.index
+    ? settlementRun(settlement, executableCalls) : selected
 }
 
 function editTargetForSelection(run, claimedTargets) {
@@ -416,6 +688,28 @@ function republishedTimelineResult(result, event) {
   return { ...result, eventSeq: event.seq, positionSeq: result.positionSeq ?? result.eventSeq }
 }
 
+/**
+ * Fact-shaped data for a `tool/call`: the arguments are represented by their
+ * digest pair so a stored event fact never carries the text. The text itself is
+ * retained once, in `timelineCallEvent` inside `executableCalls`. A fact that is
+ * already digested passes through unchanged, which keeps re-deriving a fact from
+ * a compacted observation byte-identical.
+ */
+function callFactData(event) {
+  const data = event?.data ?? {}
+  const value = data.arguments
+  const digested = value === undefined && typeof data.argumentsDigest === 'string'
+    ? { argumentsDigest: data.argumentsDigest, argumentsBytes: data.argumentsBytes }
+    : typeof value === 'string'
+      ? { argumentsDigest: digestOf(value), argumentsBytes: byteLength(value) }
+      : {}
+  return {
+    callId: data.callId,
+    ...(typeof data.name === 'string' ? { name: data.name } : {}),
+    ...digested,
+  }
+}
+
 function correlationEvent(event) {
   return timelineJson({ seq: event.seq, type: event.type,
     ...(['tool/ptc-dispatch-start', 'tool/ptc-dispatch'].includes(event.type) ? { data: {
@@ -423,7 +717,12 @@ function correlationEvent(event) {
       parentCallId: event.data?.parentCallId,
       subCallId: event.data?.subCallId,
       name: event.data?.name,
-      arguments: event.data?.arguments,
+      // A compacted dispatch keeps its digest pair, so re-deriving this fact from a
+      // pruned observation reproduces exactly what was stored.
+      ...(event.data?.arguments === undefined
+        ? (event.data?.argumentsDigest === undefined ? {}
+          : { argumentsDigest: event.data.argumentsDigest, argumentsBytes: event.data.argumentsBytes })
+        : { arguments: event.data.arguments }),
       ...(event.type === 'tool/ptc-dispatch' ? {
         isError: event.data?.isError,
         ...(event.data?.name === 'run_code' && event.data.meta?.[JOURNAL_KEY] !== undefined
@@ -431,7 +730,7 @@ function correlationEvent(event) {
       } : {}),
     } } : {}),
     ...(event.type === 'tool/call' && typeof event.data?.callId === 'string'
-      ? { data: timelineCallEvent(event).data } : {}),
+      ? { data: callFactData(event) } : {}),
     ...(event.type === 'tool/result' ? { data: { message: { source: {
       ...(typeof event.data?.message?.source?.callId === 'string'
         ? { callId: event.data.message.source.callId } : {}),
@@ -501,13 +800,245 @@ function timelineJson(value) {
   return deepFreeze(JSON.parse(JSON.stringify(value ?? null)))
 }
 
-function timelineCallEvent(event) {
+/**
+ * Resolve one executable call entry from either the live table or the
+ * serialized checkpoint shape.
+ */
+function executableEntry(timeline, seq) {
+  const table = timeline.executableCalls
+  return typeof table?.get === 'function' ? table.get(seq) : table?.[`k${seq}`]?.[1]
+}
+
+/**
+ * The ordered executable call events.
+ *
+ * `calls` stores only the sequence order; the events themselves live once in
+ * `executableCalls`, so a checkpoint no longer serializes every call a second
+ * time.
+ */
+function timelineCalls(timeline) {
+  const calls = []
+  for (const seq of timeline.calls) {
+    const event = executableEntry(timeline, seq)?.event
+    if (event !== undefined) calls.push(event)
+  }
+  return calls
+}
+
+/**
+ * The canonical call event retained in `executableCalls`.
+ *
+ * This is the only place the argument text is kept. A replay that only has a
+ * digested fact resolves the text from the entry already stored for that seq, so
+ * a checkpointed call and a re-derived one stay byte-identical.
+ */
+function timelineCallEvent(event, executableCalls) {
+  const entry = executableCalls?.get?.(event.seq) ?? executableCalls?.[`k${event.seq}`]?.[1]
+  const stored = entry?.event?.data?.arguments
+  const text = typeof event.data.arguments === 'string'
+    ? event.data.arguments
+    : typeof stored === 'string' ? stored : undefined
   return timelineJson({ seq: event.seq, type: event.type, data: {
     callId: event.data.callId, name: event.data.name,
-    ...(REPL_TOOL_NAMES.has(event.data.name) ? { arguments: event.data.arguments } : {}),
+    ...(REPL_TOOL_NAMES.has(event.data.name)
+      ? (text === undefined
+        ? { argumentsDigest: event.data.argumentsDigest, argumentsBytes: event.data.argumentsBytes }
+        : { arguments: text })
+      : {}),
   } })
 }
 
+/** Stable digest of a stored projection fact, used by checkpoint admission. */
+export function factDigest(value) {
+  return createHash('sha256').update(JSON.stringify(value ?? null, (_key, field) => (
+    isRecord(field) ? Object.fromEntries(Object.keys(field).sort().map(key => [key, field[key]])) : field
+  ))).digest('hex')
+}
+
+function withoutFactDigests(state) {
+  // Admission compares what the projection describes, not bookkeeping whose exact
+  // value depends on when pruning happened: per-fact digests and the retained-byte
+  // counter are accounting, not session state.
+  const { retainedBytes: _retainedBytes, retentionSummary: _retentionSummary, ...rest } = state
+  const facts = rest.eventFacts
+  if (!facts.some(fact => fact.digest !== undefined)) return rest
+  return { ...rest, eventFacts: facts.map(({ digest, ...fact }) => fact) }
+}
+
+/**
+ * The retention summary an admitted checkpoint carries.
+ *
+ * A compacted checkpoint keeps no per-settlement stubs at all: dropping the whole
+ * cluster is what makes the file size independent of how many cells the session
+ * ran. What survives is one chained summary of what was dropped, so admission can
+ * still tell "never existed" from "existed and was dropped".
+ */
+export function retentionSummaryOf(state) {
+  const summary = state?.retentionSummary
+  if (summary === undefined || summary === null) return undefined
+  return summary
+}
+
+/**
+ * Prove a compacted checkpoint without replaying it.
+ *
+ * The retained window must be contiguous with the summary boundary: every
+ * settlement above `toSeq` is present and intact, every executable call that a
+ * retained settlement names is present, and the summary is a well-formed chain.
+ * Below the boundary nothing survives, which is exactly the contract of dropping
+ * a cluster. This is the weaker, stated claim admission makes for compacted
+ * states; uncompacted states keep the byte-for-byte replay equality.
+ */
+export function validateRetentionSummary(timeline, summary, logFacts) {
+  if (!isRecord(summary)) throw new TypeError('invalid PTC session-log projection retention summary')
+  const keys = Object.keys(summary)
+  if (keys.some(key => !['fromSeq', 'toSeq', 'count', 'chainDigest', 'entries'].includes(key))) {
+    throw new TypeError('invalid PTC session-log projection retention summary')
+  }
+  if (!isCanonicalSequence(summary.fromSeq) || !isCanonicalSequence(summary.toSeq)
+    || summary.fromSeq > summary.toSeq || !Number.isSafeInteger(summary.count) || summary.count < 1
+    || typeof summary.chainDigest !== 'string' || !/^[a-f0-9]{64}$/u.test(summary.chainDigest)) {
+    throw new TypeError('invalid PTC session-log projection retention summary')
+  }
+  for (const [key, pair] of Object.entries(timeline.settledResultsByEventSeq ?? {})) {
+    const seq = pair?.[0]
+    const settlement = pair?.[1]
+    if (!isCanonicalSequence(seq) || settlement === undefined) {
+      throw new TypeError('invalid PTC session-log projection retention window')
+    }
+    if (seq <= summary.toSeq) {
+      throw new TypeError(`PTC session-log projection retains settlement ${key} below its retention boundary`)
+    }
+    const callSeq = settlement.call?.seq
+    if (!isCanonicalSequence(callSeq) || timeline.executableCalls?.[`k${callSeq}`] === undefined) {
+      throw new TypeError('PTC session-log projection lost the call of a retained settlement')
+    }
+  }
+  // Admission receives no session log, so it cannot fold the dropped range. What it
+  // can prove is that the summary is internally consistent: one record per dropped
+  // cluster, ordered by result sequence, with the range and the chain derived from
+  // those records. Trusting a summary without a record per cluster is what made an
+  // earlier version forgeable. The stronger claim — that a record describes the same
+  // cluster the log still holds — is checked when a dropped cluster is refolded
+  // (`verifyRefoldedSettlement`), because that is the only point where the log and
+  // the record meet.
+  const records = summary.entries
+  if (!Array.isArray(records) || records.length !== summary.count) {
+    throw new TypeError('inconsistent PTC session-log projection retention summary')
+  }
+  let previous = -1
+  for (const record of records) {
+    if (!isRecord(record)
+      || !isCanonicalSequence(record.resultSeq) || !isCanonicalSequence(record.callSeq)
+      || typeof record.argumentsDigest !== 'string' || !/^[a-f0-9]{64}$/u.test(record.argumentsDigest)
+      || record.resultSeq <= previous) {
+      throw new TypeError('inconsistent PTC session-log projection retention summary')
+    }
+    previous = record.resultSeq
+  }
+  if (records[0].resultSeq !== summary.fromSeq || records[records.length - 1].resultSeq !== summary.toSeq
+    || chainOfEntries(records) !== summary.chainDigest) {
+    throw new TypeError('inconsistent PTC session-log projection retention summary')
+  }
+  return summary
+}
+
+/**
+ * Prove the recorded chain against the raw session log.
+ *
+ * Folds the events up to the boundary with retention disabled, derives the summary
+ * the fold would have produced for the dropped range, and requires it to equal the
+ * recorded one. A caller without the log must say so: this function throws
+ * `unverifiable PTC session-log projection retention summary` instead of accepting.
+ */
+export function verifyRetentionSummaryAgainstEvents(summary, events) {
+  if (!Array.isArray(events)) {
+    throw new TypeError('unverifiable PTC session-log projection retention summary')
+  }
+  const expected = retentionSummaryFromEvents(events, summary.toSeq)
+  if (expected === undefined
+    || expected.count !== summary.count || expected.fromSeq !== summary.fromSeq
+    || expected.toSeq !== summary.toSeq || expected.chainDigest !== summary.chainDigest) {
+    throw new TypeError('inconsistent PTC session-log projection retention summary')
+  }
+  return summary
+}
+
+/**
+ * Refold the editable cell from the log and check it against the summary.
+ *
+ * The checkpoint cannot prove that its summary describes the clusters the log
+ * still holds — admission has no log. This is the one place where both sides meet:
+ * the log is folded with pruning disabled, the settlement behind the editable run
+ * is turned into a summary record, and the record stored in the summary must equal
+ * it. A mismatch means the summary and the log disagree, which is reported to the
+ * caller instead of yielding an edit target that was never recorded.
+ */
+export function refoldEditableSettlement(events, summary) {
+  if (!Array.isArray(events)) return { run: undefined, mismatch: false }
+  let state
+  withFullRetention(() => {
+    state = createSessionTimelineState()
+    events.forEach((event, index) => {
+      if (!isRecord(event)) return
+      state = advanceSessionTimeline(state, event, isCanonicalSequence(event.seq) ? event.seq : index)
+    })
+  })
+  const run = state?.editableRun
+  if (run === undefined) return { run: undefined, mismatch: false }
+  const settled = Object.entries(state?.settledResultsByEventSeq ?? {})
+    .map(([, pair]) => pair)
+    .find(([, settlement]) => settlement?.call?.seq === run.callSeq)
+  if (settled === undefined) return { run, mismatch: false }
+  const [resultSeq, settlement] = settled
+  const recorded = summaryRecordOf(summary, Number(resultSeq))
+  if (recorded === undefined) return { run, mismatch: false }
+  const refolded = summaryEntry(settlement, Number(resultSeq))
+  const mismatch = recorded.callSeq !== refolded.callSeq || recorded.argumentsDigest !== refolded.argumentsDigest
+  return { run, mismatch }
+}
+
+/** Recompute the summary a fold of the dropped range would have produced. */
+function retentionSummaryFromEvents(events, toSeq) {
+  let state
+  withFullRetention(() => {
+    state = createSessionTimelineState()
+    events.forEach((event, index) => {
+      if (!isRecord(event)) return
+      if (isCanonicalSequence(event.seq) && event.seq > toSeq) return
+      state = advanceSessionTimeline(state, event, isCanonicalSequence(event.seq) ? event.seq : index)
+    })
+  })
+  const dropped = Object.entries(state?.settledResultsByEventSeq ?? {})
+    .map(([, pair]) => pair)
+    .filter(([resultSeq]) => Number(resultSeq) <= toSeq)
+    // The prune orders dropped entries by RESULT sequence before folding them into the
+    // chain, so summing here must use the same order; observedIndex can disagree when
+    // a nested call settles out of order.
+    .sort((left, right) => Number(left[0]) - Number(right[0]))
+    .map(([resultSeq, settlement]) => summaryEntry(settlement, Number(resultSeq)))
+  if (dropped.length === 0) return undefined
+  return extendSummary(undefined, dropped)
+}
+
+/**
+ * The identity of a call is what survives the payload window: sequence, type,
+ * callId and name. The argument text is deliberately excluded, because retention
+ * replaces it with `argumentsDigest` and an identity that hashed the text would make
+ * every observation describe a different call before and after pruning. The text is
+ * still bound by its own digest in the call entry, so excluding it hides nothing.
+ */
+function eventDigest(event) {
+  // Identity only, and only the fields every call keeps: a payload the window
+  // digested must hash the same before and after pruning, which is why the source
+  // text and the result are not part of it. A call always carries its `callId`
+  // (executable calls are admitted with one), so no second shape exists to hash.
+  const data = isRecord(event?.data) ? event.data : {}
+  const identity = { seq: event?.seq, type: event?.type,
+    data: { callId: data.callId, name: data.name ?? null } }
+  return createHash('sha256').update(JSON.stringify(identity)).digest('hex')
+}
+
 function resultIdentity(data) {
   const identity = timelineJson(isRecord(data) && isRecord(data.message)
     ? { ...data, message: { ...data.message, content: undefined } } : data)
@@ -516,6 +1047,23 @@ function resultIdentity(data) {
   ))).digest('hex')
 }
 
+/**
+ * How many bytes of retained payload admission may replay.
+ *
+ * A stored checkpoint is proved two ways: replaying its facts reproduces it
+ * byte-for-byte, or — because that replay costs a second fold of everything the
+ * session wrote — its per-fact digests and identity chain prove continuity. This
+ * budget decides which claim a given checkpoint gets, and both replays read it
+ * through `admissionReplayBudget`, so the timeline replay here and the
+ * log-identity replay in the session-log projection cannot disagree about it.
+ */
+const ADMISSION_REPLAY_BUDGET_BYTES = 4 * 1024 * 1024
+
+/** Resolve a caller's replay budget, falling back to the shipped one. */
+export function admissionReplayBudget(bytes) {
+  return Number.isSafeInteger(bytes) && bytes > 0 ? bytes : ADMISSION_REPLAY_BUDGET_BYTES
+}
+
 export function createSessionTimelineState() {
   return {
     openTurn: false,
@@ -536,11 +1084,34 @@ export function createSessionTimelineState() {
     runSelectionHistory: [],
     lastEventIndex: null,
     eventFacts: [],
+    // Payload bytes the retained settlements still carry: the retention window
+    // keeps this bounded so a checkpoint never scales with written content.
+    retainedBytes: 0,
+    // One chained summary of the clusters the window dropped. Per-settlement stubs
+    // would still scale with the number of cells the session ran.
+    retentionSummary: null,
+    // Set once any cluster is dropped, so admission can tell "nothing was ever
+    // dropped" from "a summary was deleted". A compacted state must carry its summary.
+    compacted: false,
+    // Set when the newest cell alone exceeded the byte budget and had to go. The
+    // consumers that would have read it must say so instead of looking empty.
+    hotCellDropped: false,
     scope: 0,
   }
 }
 
-export function validateSessionTimelineState(value) {
+/**
+ * Prove a stored timeline checkpoint, given the session log's own facts when the
+ * caller holds them.
+ *
+ * `replayBudgetBytes` is the caller's replay budget: a checkpoint above it is
+ * admitted on its per-fact digests and identity chain instead of a replay, and a
+ * caller that lowers the budget (a test, or a host with a cheaper fold) must
+ * lower this same claim, not a second copy of it.
+ */
+export function validateSessionTimelineState(value, logFacts, options = {}) {
+  const replayBudget = admissionReplayBudget(options.replayBudgetBytes)
+
   const requireFact = condition => {
     if (!condition) throw new TypeError('invalid PTC session-log projection timeline checkpoint')
   }
@@ -549,17 +1120,36 @@ export function validateSessionTimelineState(value) {
   const target = field => fields(field, ['callSeq', 'source']) && isCanonicalSequence(field.callSeq) && typeof field.source === 'string'
   const callEvent = event => fields(event, ['seq', 'type', 'data']) && isCanonicalSequence(event.seq) && event.type === 'tool/call'
     && isRecord(event.data) && typeof event.data.callId === 'string'
-    && fields(event.data, ['callId', 'name', 'arguments'])
+    && fields(event.data, ['callId', 'name', 'arguments', 'argumentsDigest', 'argumentsBytes'])
     && optional(event.data.name, name => typeof name === 'string')
-    && optional(event.data.arguments, args => typeof args === 'string')
+    && (event.data.arguments === undefined
+      ? (event.data.argumentsDigest === undefined
+        || (typeof event.data.argumentsDigest === 'string' && /^[a-f0-9]{64}$/u.test(event.data.argumentsDigest)
+          && isCanonicalSequence(event.data.argumentsBytes)))
+      : (typeof event.data.arguments === 'string' && event.data.argumentsDigest === undefined
+        && event.data.argumentsBytes === undefined))
   const callEntry = entry => fields(entry, ['event', 'eventIndex', 'scope', 'ambiguous', 'editTarget']) && callEvent(entry.event)
     && isCanonicalSequence(entry.eventIndex) && isCanonicalSequence(entry.scope) && entry.scope <= value.scope
     && optional(entry.ambiguous, field => field === true) && optional(entry.editTarget, target)
+  // A settlement references its call through `call` and keeps only the entry's
+  // position and claims. Storing `entry.event` as well would serialize the call
+  // event a second time — the duplication the retention work exists to remove.
+  const settlementEntry = entry => fields(entry, ['eventIndex', 'scope', 'ambiguous', 'editTarget'])
+    && isCanonicalSequence(entry.eventIndex) && isCanonicalSequence(entry.scope) && entry.scope <= value.scope
+    && optional(entry.ambiguous, field => field === true) && optional(entry.editTarget, target)
   const table = (name, keyValid, payloadValid) => {
-    requireFact(isRecord(value[name]))
+    if (!isRecord(value[name])) {
+      throw new TypeError(`invalid PTC session-log projection timeline checkpoint: table ${name} is missing`)
+    }
     for (const [key, pair] of Object.entries(value[name])) {
-      requireFact(Array.isArray(pair) && pair.length === 2 && keyValid(pair[0]) && key === `k${pair[0]}`)
-      requireFact(payloadValid(pair[1], pair[0]))
+      if (!Array.isArray(pair) || pair.length !== 2 || !keyValid(pair[0]) || key !== `k${pair[0]}`) {
+        throw new TypeError(`invalid PTC session-log projection timeline checkpoint: table ${name} entry ${key}`)
+      }
+      if (!payloadValid(pair[1], pair[0])) {
+        const problem = name === 'settledResultsByEventSeq' ? settlementProblem(pair[1]) : undefined
+        const shape = isRecord(pair[1]) ? ` keys=${Object.keys(pair[1]).join(',')}` : ` value=${JSON.stringify(pair[1])?.slice(0, 80)}`
+        throw new TypeError(`invalid PTC session-log projection timeline checkpoint: table ${name} payload ${key}${shape}${problem === undefined ? '' : ` problem=${problem}`}`)
+      }
     }
     return new Map(Object.values(value[name]))
   }
@@ -567,9 +1157,14 @@ export function validateSessionTimelineState(value) {
     'cordisTranscript', 'editTargets', 'pendingByCallId', 'seenCallIds', 'claimedEditTargets', 'editClaims',
     'ordinaryResultSeqs', 'settledResultsByEventSeq', 'scope', 'latestRun', 'editableRun', 'lastSuccessfulRunIndex',
     'unavailableResultSeq', 'unavailableResultReason', 'pruneReplacementWindow', 'runSelectionFrontier',
-    'runSelectionHistory', 'lastEventIndex', 'eventFacts']) && typeof value.openTurn === 'boolean'
+    'runSelectionHistory', 'lastEventIndex', 'eventFacts', 'retainedBytes', 'retentionSummary', 'compacted',
+    'hotCellDropped']) && typeof value.openTurn === 'boolean'
     && typeof value.found === 'boolean' && isCanonicalSequence(value.scope)
-    && Array.isArray(value.calls) && value.calls.every(callEvent) && Array.isArray(value.boundaries))
+    && typeof value.retainedBytes === 'number' && value.retainedBytes >= 0
+    && (value.retentionSummary === undefined || value.retentionSummary === null || isRecord(value.retentionSummary))
+    && typeof value.compacted === 'boolean' && typeof value.hotCellDropped === 'boolean'
+    && Array.isArray(value.calls) && value.calls.every(seq => isCanonicalSequence(seq))
+    && Array.isArray(value.boundaries))
   requireFact(value.lastEventIndex === null || isCanonicalSequence(value.lastEventIndex))
   requireFact(Array.isArray(value.runSelectionHistory))
   let boundaryScope = 0
@@ -593,9 +1188,10 @@ export function validateSessionTimelineState(value) {
     && entry.event.seq === seq && REPL_TOOL_NAMES.has(entry.event.data.name))
   requireFact(value.calls.length === executable.size)
   const callSeqs = new Set()
-  for (const call of value.calls) {
-    requireFact(!callSeqs.has(call.seq) && deepEqualJson(executable.get(call.seq)?.event, call))
-    callSeqs.add(call.seq)
+  for (const seq of value.calls) {
+    // The order list may only name stored entries, and may not repeat one.
+    requireFact(!callSeqs.has(seq) && executable.has(seq))
+    callSeqs.add(seq)
   }
   const journalFacts = result => {
     if (!isRecord(result.journal)) return false
@@ -606,7 +1202,7 @@ export function validateSessionTimelineState(value) {
     if (result.derived !== undefined) {
       const derived = result.derived
       if (!isRecord(derived)) return false
-      const normalized = normalizeDerivedEditResult({
+      const normalized = normalizeDeferredEditSettlement({
         [JOURNAL_KEY]: result.journal,
         [EDIT_TARGET_KEY]: { targetCallSeq: derived.targetCallSeq },
         [DERIVED_RUN_KEY]: { code: derived.code, description: derived.description },
@@ -618,6 +1214,8 @@ export function validateSessionTimelineState(value) {
     return true
   }
   const normalizedResult = result => {
+    // Every stored result keeps its full shape: a dropped cluster takes its result
+    // entry with it, so a digest-only result would be a shape nothing produces.
     if (!fields(result, ['eventSeq', 'eventIndex', 'positionSeq', 'error', 'journal', 'derived', 'userBindings',
       'postEdit', 'postEditError'])
       || !isCanonicalSequence(result.eventSeq) || !isCanonicalSequence(result.eventIndex)
@@ -628,7 +1226,7 @@ export function validateSessionTimelineState(value) {
       && optional(result.postEdit, post => fields(post, ['startSeq', 'executionStartSeq', 'targetCallSeq', 'derived', 'rewrites'])
         && isCanonicalSequence(post.startSeq) && isCanonicalSequence(post.executionStartSeq)
         && isCanonicalSequence(post.targetCallSeq)
-        && deepEqualJson(normalizeDerivedEditResult({
+        && deepEqualJson(normalizeDeferredEditSettlement({
           [JOURNAL_KEY]: post.derived?.journal,
           [EDIT_TARGET_KEY]: { targetCallSeq: post.targetCallSeq },
           [DERIVED_RUN_KEY]: { code: post.derived?.code, description: post.derived?.description },
@@ -657,49 +1255,75 @@ export function validateSessionTimelineState(value) {
   const claimed = table('claimedEditTargets', isCanonicalSequence, (field, seq) => trueValue(field) && executable.has(seq))
   const edits = table('editClaims', isCanonicalSequence, (seq, editSeq) => isCanonicalSequence(seq)
     && claimed.has(seq) && targets.get(editSeq)?.callSeq === seq)
-  const ordinaryObservations = table('ordinaryResultSeqs', isCanonicalSequence, (observation, seq) => fields(observation,
-    ['call', 'eventSeq', 'eventIndex']) && callEvent(observation.call) && observation.call.seq === seq
+  const ordinaryObservations = table('ordinaryResultSeqs', isCanonicalSequence, (observation, seq) =>
+    ((fields(observation, ['call', 'eventSeq', 'eventIndex']) && callEvent(observation.call) && observation.call.seq === seq
+      && value.executableCalls[`k${seq}`] === undefined)
+      || (fields(observation, ['callDigest', 'eventSeq', 'eventIndex'])
+        && typeof observation.callDigest === 'string' && /^[a-f0-9]{64}$/u.test(observation.callDigest)
+        && value.executableCalls[`k${seq}`] !== undefined
+        && eventDigest(value.executableCalls[`k${seq}`][1].event) === observation.callDigest))
     && isCanonicalSequence(observation.eventSeq) && isCanonicalSequence(observation.eventIndex)
     && value.lastEventIndex !== null && observation.eventIndex <= value.lastEventIndex
-    && (!REPL_TOOL_NAMES.has(observation.call.data.name)
+    && (observation.callDigest !== undefined || !REPL_TOOL_NAMES.has(observation.call.data.name)
       || (deepEqualJson(executable.get(seq)?.event, observation.call)
         && observation.eventIndex >= executable.get(seq).eventIndex)))
-  const settlements = table('settledResultsByEventSeq', isCanonicalSequence, settlement => fields(settlement,
-    ['call', 'entry', 'identity', 'publication', 'observedIndex', 'ordinary', 'normalized'])
-    && callEvent(settlement.call) && callEntry(settlement.entry)
-    && optional(settlement.normalized, normalizedResult)
-    && typeof settlement.ordinary === 'boolean'
-    && isCanonicalSequence(settlement.observedIndex) && value.lastEventIndex !== null
-    && settlement.observedIndex >= settlement.entry.eventIndex && settlement.observedIndex <= value.lastEventIndex
-    && deepEqualJson(settlement.call, settlement.entry.event)
-    && typeof settlement.identity === 'string' && /^[a-f0-9]{64}$/u.test(settlement.identity)
-    && (!REPL_TOOL_NAMES.has(settlement.call.data.name)
-      || deepEqualJson(executable.get(settlement.call.seq)?.event, settlement.call))
-    && optional(settlement.publication, publication => fields(publication,
-      ['index', 'journal', 'derived', 'userBindings', 'rewrites', 'postEdit', 'postEditRewrites'])
-      && deepEqualJson(publication.journal ?? null, settlement.normalized?.journal ?? null)
-      && deepEqualJson(publication.derived ?? null, settlement.normalized?.derived ?? null)
-      && deepEqualJson(publication.userBindings ?? null, settlement.normalized?.userBindings ?? null)
-      && deepEqualJson(publication.postEdit ?? null, settlement.normalized?.postEdit ?? null)
-      && deepEqualJson(publication.postEditRewrites ?? null, settlement.normalized?.postEdit?.rewrites ?? null)
-      && !settlement.entry.ambiguous && isCanonicalSequence(publication.index)
-      && publication.index === (settlement.ordinary ? settlement.observedIndex : settlement.entry.eventIndex)
-      && ((settlement.call.data.name === 'run_code' && publication.derived === undefined)
-        || (settlement.call.data.name === 'edit_run_code'
-        && publication.derived?.targetCallSeq === settlement.entry.editTarget?.callSeq
-        && publication.derived !== undefined))
-      && (publication.journal === undefined
-        ? publication.derived === undefined && publication.userBindings === undefined
-        : journalFacts(publication))
-      && deepEqualJson(validatedRewrites({ [REWRITES_KEY]: publication.rewrites }) ?? null, publication.rewrites ?? null)))
+  /**
+   * Name the clause a settlement fails, so a rejected checkpoint says which relation
+   * broke instead of only which table. The clauses are the same ones the inline
+   * predicate used to run; this only reports them.
+   */
+  const settlementProblem = settlement => {
+    if (!fields(settlement, ['call', 'entry', 'identity', 'publication', 'observedIndex', 'ordinary', 'normalized'])) return 'fields'
+    if (!callEvent(settlement.call)) return 'callEvent'
+    if (!settlementEntry(settlement.entry)) return 'entry'
+    if (!optional(settlement.normalized, normalizedResult)) return 'normalized'
+    if (typeof settlement.ordinary !== 'boolean') return 'ordinary'
+    if (!isCanonicalSequence(settlement.observedIndex) || value.lastEventIndex === null) return 'observedIndex'
+    if (settlement.observedIndex < settlement.entry.eventIndex || settlement.observedIndex > value.lastEventIndex) return 'observedIndex range'
+    if (typeof settlement.identity !== 'string' || !/^[a-f0-9]{64}$/u.test(settlement.identity)) return 'identity'
+    if (REPL_TOOL_NAMES.has(settlement.call.data.name)
+      && !deepEqualJson(executable.get(settlement.call.seq)?.event, settlement.call)) {
+      const stored = executable.get(settlement.call.seq)?.event
+      return `executable call (stored=${JSON.stringify(stored)?.slice(0, 220)} settlement=${JSON.stringify(settlement.call)?.slice(0, 220)})`
+    }
+    const publicationProblem = publication => {
+      if (!fields(publication, ['index', 'journal', 'derived', 'userBindings', 'rewrites', 'postEdit', 'postEditRewrites'])) return 'publication fields'
+      if (!deepEqualJson(publication.journal ?? null, settlement.normalized?.journal ?? null)) return 'publication journal'
+      if (!deepEqualJson(publication.derived ?? null, settlement.normalized?.derived ?? null)) return 'publication derived'
+      if (!deepEqualJson(publication.userBindings ?? null, settlement.normalized?.userBindings ?? null)) return 'publication userBindings'
+      if (!deepEqualJson(publication.postEdit ?? null, settlement.normalized?.postEdit ?? null)) return 'publication postEdit'
+      if (!deepEqualJson(publication.postEditRewrites ?? null, settlement.normalized?.postEdit?.rewrites ?? null)) return 'publication postEditRewrites'
+      if (settlement.entry.ambiguous) return 'publication ambiguity'
+      if (!isCanonicalSequence(publication.index)) return 'publication index'
+      if (publication.index !== (settlement.ordinary ? settlement.observedIndex : settlement.entry.eventIndex)) return 'publication position'
+      if (settlement.call.data.name === 'run_code' && publication.derived !== undefined) return 'publication derived target'
+      if (settlement.call.data.name === 'edit_run_code'
+        && (publication.derived === undefined
+          || publication.derived.targetCallSeq !== settlement.entry.editTarget?.callSeq)) return 'publication edit target'
+      if (publication.journal === undefined
+        ? publication.derived !== undefined || publication.userBindings !== undefined
+        : !journalFacts(publication)) return 'publication journal facts'
+      if (!deepEqualJson(validatedRewrites({ [REWRITES_KEY]: publication.rewrites }) ?? null, publication.rewrites ?? null)) return 'publication rewrites'
+      return undefined
+    }
+    if (!optional(settlement.publication, publication => publicationProblem(publication) === undefined)) return 'publication'
+    if (isRecord(settlement.publication)) {
+      const problem = publicationProblem(settlement.publication)
+      if (problem !== undefined) return problem
+    }
+    return undefined
+  }
+  const settlements = table('settledResultsByEventSeq', isCanonicalSequence, settlement => settlementProblem(settlement) === undefined)
   // Normalized event facts retain distinctions needed by the transition but
   // omit result content. Admission uses that same transition, not a second
   // partial interpretation of the materialized caches.
   requireFact(Array.isArray(value.eventFacts))
   let reconstructed = createSessionTimelineState()
   let correlationIndex = -1
+  let replayBytes = 0
+  let replayComplete = true
   for (const observation of value.eventFacts) {
-    requireFact(fields(observation, ['eventIndex', 'event', 'identity', 'hasJournal', 'normalized',
+    requireFact(fields(observation, ['eventIndex', 'event', 'digest', 'identity', 'hasJournal', 'normalized',
       'boundaries', 'boundaryFailure', 'rewrites', 'selectedTarget'])
       && isCanonicalSequence(observation.eventIndex) && observation.eventIndex > correlationIndex
       && value.lastEventIndex !== null && observation.eventIndex <= value.lastEventIndex
@@ -728,14 +1352,48 @@ export function validateSessionTimelineState(value) {
       && deepEqualJson(validatedRewrites({ [REWRITES_KEY]: observation.rewrites }) ?? null,
         observation.rewrites ?? null))
     correlationIndex = observation.eventIndex
-    reconstructed = replaySessionTimelineFact(reconstructed, observation)
+    // Replay proves byte-for-byte equality, but its cost is proportional to the
+    // retained payload of the whole session. Admission therefore replays only
+    // while that payload stays inside the budget and falls back to the per-fact
+    // digests plus the shape/identity checks above beyond it.
+    replayBytes += factDigest(observation.event).length * 4
+    if (replayBytes > replayBudget) {
+      replayComplete = false
+      continue
+    }
+    reconstructed = replaySessionTimelineFact(reconstructed, observation, executable)
+  }
+  const summary = retentionSummaryOf(value)
+  // A compacted state that lost its summary must be rejected: dropping the summary
+  // would erase the only trace of the clusters the window removed.
+  if (value.compacted === true && summary === undefined) {
+    throw new TypeError('inconsistent PTC session-log projection retention summary')
+  }
+  if (value.compacted !== true && summary !== undefined) {
+    throw new TypeError('inconsistent PTC session-log projection retention summary')
+  }
+  if (summary !== undefined) {
+    // A compacted checkpoint dropped whole clusters, so replay can never reproduce
+    // it; the summary is proved instead — against the log when the caller has it.
+    validateRetentionSummary(value, summary, logFacts)
+  } else if (replayComplete) {
+    // Non-compacted states keep the full replay equality.
+    requireFact(deepEqualJson(withoutFactDigests(reconstructed), withoutFactDigests(value)))
+  }
+  // Semantic checks run first so their diagnostics stay specific; the digest is
+  // the last line of defence and rejects a payload edit without replaying it.
+  for (const observation of value.eventFacts) {
+    if (observation.digest === undefined) continue
+    const { digest, ...rest } = observation
+    requireFact(digest === factDigest(rest))
   }
-  requireFact(deepEqualJson(reconstructed, value))
   for (const observation of ordinaryObservations.values()) {
     const settlement = settlements.get(observation.eventSeq)
     requireFact(settlement !== undefined
       ? settlement.ordinary && settlement.observedIndex === observation.eventIndex
-        && deepEqualJson(settlement.call, observation.call)
+        && (observation.callDigest === undefined
+          ? deepEqualJson(settlement.call, observation.call)
+          : eventDigest(settlement.call) === observation.callDigest)
       : value.runSelectionHistory.some(frontier => frontier.index === observation.eventIndex
         && frontier.reason === 'result-identity-mismatch'))
   }
@@ -743,7 +1401,9 @@ export function validateSessionTimelineState(value) {
     if (!settlement.ordinary) continue
     const observation = ordinaryObservations.get(settlement.call.seq)
     requireFact(observation !== undefined && observation.eventIndex === settlement.observedIndex
-      && deepEqualJson(observation.call, settlement.call))
+      && (observation.callDigest === undefined
+        ? deepEqualJson(observation.call, settlement.call)
+        : eventDigest(settlement.call) === observation.callDigest))
   }
   const publications = [...settlements.values()].filter(settlement => settlement.publication !== undefined)
   // Dispatch targets are derived from first-observed settlements and retained
@@ -789,7 +1449,7 @@ export function validateSessionTimelineState(value) {
         dispatchEdits.delete(settlement.call.seq)
         if (settlement.publication?.derived === undefined) dispatchClaims.delete(claim)
       }
-      dispatchRun = selectSettlementRun(dispatchRun, settlement, dispatchScope, dispatchFrontier)
+      dispatchRun = selectSettlementRun(dispatchRun, settlement, dispatchScope, dispatchFrontier, executable)
     }
   }
   requireFact(claimed.size === dispatchClaims.size && [...dispatchClaims].every(seq => claimed.has(seq)))
@@ -797,14 +1457,14 @@ export function validateSessionTimelineState(value) {
   let selectedRun
   let lastSuccessfulRunIndex
   for (const settlement of publications) {
-    selectedRun = selectSettlementRun(selectedRun, settlement, value.scope, value.runSelectionFrontier)
-    if (successfulTimelineRun(settlementRun(settlement))) {
+    selectedRun = selectSettlementRun(selectedRun, settlement, value.scope, value.runSelectionFrontier, executable)
+    if (successfulTimelineRun(settlementRun(settlement, executable))) {
       lastSuccessfulRunIndex = Math.max(lastSuccessfulRunIndex ?? -1, settlement.publication.index)
     }
   }
   requireFact(selectedRun === undefined || publications.some(settlement =>
     settlement.entry.scope === value.scope && !settlement.entry.ambiguous
-    && settlementRun(settlement).callSeq === selectedRun.callSeq))
+    && settlementRun(settlement, executable)?.callSeq === selectedRun.callSeq))
   requireFact(selectedRun === undefined ? value.latestRun === undefined && value.editableRun === undefined
     : deepEqualJson(value.latestRun ?? null, selectedRun) && deepEqualJson(value.editableRun ?? null, selectedRun))
   requireFact(value.lastSuccessfulRunIndex === lastSuccessfulRunIndex
@@ -838,8 +1498,8 @@ export function advanceSessionTimeline(previous, inputEvent, eventIndex = inputE
 }
 
 /** Reconstruct an already validated normalized fact at its recorded cut. */
-export function replaySessionTimelineFact(previous, fact) {
-  return advanceTimelineEvent(previous, fact.event, fact.eventIndex, fact)
+export function replaySessionTimelineFact(previous, fact, retainedCalls) {
+  return advanceTimelineEvent(previous, fact.event, fact.eventIndex, fact, retainedCalls)
 }
 
 function dispatchPairWithinRoot(facts, call, resultEvent, startSeq) {
@@ -860,7 +1520,7 @@ function dispatchPairWithinRoot(facts, call, resultEvent, startSeq) {
   return { start: starts[0], settled: settlements[0] }
 }
 
-function normalizePostEditFact(facts, call, resultEvent, result, replayPostEdit) {
+function normalizePostEditFact(facts, call, resultEvent, result, replayPostEdit, executableCalls) {
   const post = replayPostEdit === undefined ? resultEvent.data?.meta?.[POST_EDIT_KEY] : {
     startSeq: replayPostEdit.startSeq,
     executionStartSeq: replayPostEdit.executionStartSeq,
@@ -909,11 +1569,17 @@ function normalizePostEditFact(facts, call, resultEvent, result, replayPostEdit)
   }
   let derived
   try {
-    derived = normalizeDerivedEditResult(post.meta, target?.callSeq)
+    derived = normalizeDeferredEditSettlement(post.meta, target?.callSeq)
+    // The derived metadata is a published settlement of its own, so it carries the
+    // same proof the root journal does. Comparing the two recorded journal copies
+    // proves only that they agree with each other; an edit that changed both and
+    // left this proof behind no longer reproduces the settlement it published, and
+    // its journal is then not evidence for the bindings the revision declares.
+    requireRecordedSettlementProof(post.meta, derived.journal)
   } catch (error) {
     return fail(error.message)
   }
-  if (target?.source === undefined || sourceForRunCall(call) === undefined) {
+  if (target?.source === undefined || sourceForRunCall(call, executableCalls) === undefined) {
     return fail('nested edit has no selected source')
   }
   const edit = editRejectedCell(start.data.arguments, target.source)
@@ -946,7 +1612,63 @@ function normalizePostEditFact(facts, call, resultEvent, result, replayPostEdit)
     ...(rewrites === undefined ? {} : { rewrites }) }
 }
 
-function advanceTimelineEvent(previous, inputEvent, eventIndex, replayFact) {
+/**
+ * A published journal records the digest of the wording its diagnostics state.
+ *
+ * Recovery reports a failed cell by re-rendering its recorded diagnostic, and the
+ * completion message and that diagnostic are two copies of one settlement, so a
+ * record whose diagnostic text was edited can re-derive both consistently. The
+ * digest is taken when the settlement is published, before either copy can change.
+ * A record that carries no digest predates it and keeps the older evidence; one
+ * whose diagnostics no longer hash to it is not evidence for its cell's bindings.
+ */
+function requireRecordedDiagnosticWording(meta, journal) {
+  if (!isRecord(meta) || !Object.hasOwn(meta, DIAGNOSTIC_WORDING_KEY)) return
+  const recorded = meta[DIAGNOSTIC_WORDING_KEY]
+  if (!isRecord(recorded) || Reflect.ownKeys(recorded).length !== DIAGNOSTIC_WORDING_FIELDS.size
+    || Reflect.ownKeys(recorded).some(key => !DIAGNOSTIC_WORDING_FIELDS.has(key))) {
+    throw new Error('invalid recorded diagnostic wording')
+  }
+  if (recorded.digest !== diagnosticWordingDigest(journal)) {
+    throw new Error('journal diagnostic wording does not match its recorded digest')
+  }
+}
+
+/**
+ * A published settlement proves its own facts, and the Host's copy of its outcome
+ * must still agree with them.
+ *
+ * Recovery reads a record as evidence for the bindings its cell declared, and the
+ * record is the only account of its cell: editing the status, the completion or a
+ * diagnostic leaves the record self-consistent, because the completion is rendered
+ * from the same diagnostic that was edited. The proof recorded at publication is
+ * one digest over exactly those facts, so an edited record no longer reproduces it.
+ * A record that carries no proof predates it and keeps the older evidence.
+ *
+ * The retained `isError` is the Host's copy of the same outcome and not a fact this
+ * plugin can recompute, so an edit that also rewrites the proof still has to agree
+ * with it. That relation is the one a deferred edit already proves before it is
+ * published.
+ */
+function requireRecordedSettlementProof(meta, journal, isError = undefined) {
+  if (isError !== undefined && isError !== (journal.status === 'discarded'
+    || journal.completion?.kind === 'throw')) {
+    throw new Error('journal settlement does not agree with the tool result it settled')
+  }
+  if (!isRecord(meta) || !Object.hasOwn(meta, SETTLEMENT_PROOF_KEY)) return
+  const recorded = meta[SETTLEMENT_PROOF_KEY]
+  if (!isRecord(recorded) || Reflect.ownKeys(recorded).length !== SETTLEMENT_PROOF_FIELDS.size
+    || Reflect.ownKeys(recorded).some(key => !SETTLEMENT_PROOF_FIELDS.has(key))
+    || recorded.version !== SETTLEMENT_PROOF_VERSION
+    || typeof recorded.recordedMessage !== 'string') {
+    throw new Error('invalid recorded settlement proof')
+  }
+  if (recorded.recordedMessage !== settlementProofDigest(journal)) {
+    throw new Error('journal facts do not match their recorded settlement proof')
+  }
+}
+
+function advanceTimelineEvent(previous, inputEvent, eventIndex, replayFact, retainedCalls) {
   const nested = inputEvent?.type === 'tool/ptc-dispatch-start'
     || inputEvent?.type === 'tool/ptc-dispatch'
   if (nested && inputEvent.data?.name !== 'edit_run_code'
@@ -1044,7 +1766,7 @@ function advanceTimelineEvent(previous, inputEvent, eventIndex, replayFact) {
     if (event?.type === 'tool/ptc-dispatch') continue
     if (event?.type === 'tool/call' && typeof event.data?.callId === 'string') {
       const executable = REPL_TOOL_NAMES.has(event.data.name)
-      let entry = { event: timelineCallEvent(event), eventIndex, scope }
+      let entry = { event: timelineCallEvent(event, retainedCalls ?? state.executableCalls), eventIndex, scope }
       if (executable) {
         if (isCanonicalSequence(event.seq) && state.executableCalls.has(event.seq)) {
           // A sequence collision disproves both sources, but not the earlier
@@ -1073,7 +1795,7 @@ function advanceTimelineEvent(previous, inputEvent, eventIndex, replayFact) {
             editClaims.set(event.seq, target.callSeq)
           }
         }
-        state.calls = [...state.calls, entry.event]
+        state.calls = [...state.calls, event.seq]
         if (isCanonicalSequence(event.seq)) {
           state.executableCalls.set(event.seq, entry)
         }
@@ -1136,7 +1858,12 @@ function advanceTimelineEvent(previous, inputEvent, eventIndex, replayFact) {
         clearRunSelection('duplicate-result')
         continue
       }
-      ordinaryResultSeqs.set(callSeq, timelineJson({ call,
+      // Non-REPL tools never enter `executableCalls` (only executable REPL calls
+      // are retained there), so their observation keeps the call event itself.
+      // REPL calls keep the digest and resolve the event through executableCalls,
+      // which is why one table has two legal shapes.
+      ordinaryResultSeqs.set(callSeq, timelineJson({
+        ...(state.executableCalls.get(callSeq) === undefined ? { call } : { callDigest: eventDigest(call) }),
         eventSeq: isCanonicalSequence(event.seq) ? event.seq : callSeq, eventIndex }))
     }
     if (call !== undefined && typeof callId === 'string' && call.data.callId !== callId) {
@@ -1183,13 +1910,15 @@ function advanceTimelineEvent(previous, inputEvent, eventIndex, replayFact) {
         }
         try {
           if (call.data.name === 'edit_run_code') {
-            const derived = normalizeDerivedEditResult(meta, entry.editTarget?.callSeq)
+            const derived = normalizeDeferredEditSettlement(meta, entry.editTarget?.callSeq)
             normalized = {
               ...raw,
               journal: derived.journal,
               derived,
               ...(derived.userBindings === undefined ? {} : { userBindings: derived.userBindings }),
             }
+            requireRecordedDiagnosticWording(meta, derived.journal)
+            requireRecordedSettlementProof(meta, derived.journal)
           } else if (call.data.name === 'run_code') {
             const rawJournal = meta[JOURNAL_KEY]
             const resolveLegacyConfirm = rawJournal?.version === LEGACY_JOURNAL_VERSION
@@ -1203,15 +1932,38 @@ function advanceTimelineEvent(previous, inputEvent, eventIndex, replayFact) {
               }
               : undefined
             const journal = normalizeJournal(rawJournal, { resolveLegacyConfirm })
+        // A throw cell's completion message is the rendering of its own diagnostic.
+        // A record whose message no longer matches was edited after the fact, so it
+        // is not evidence for the bindings that cell declared.
+        {
+          let code
+          try { code = JSON.parse(call.data.arguments)?.code } catch { code = undefined }
+          const firstDiagnostic = journal.diagnostics?.[0]
+          if (journal.completion?.kind === 'throw' && firstDiagnostic !== undefined
+            && typeof code === 'string'
+            && journal.completion.error?.message !== renderDiagnostic(firstDiagnostic, code)) {
+            throw new Error('journal completion does not match its diagnostic')
+          }
+        }
             const userBindings = userBindingsForJournal(meta, journal)
             normalized = {
               ...raw,
               journal,
               ...(userBindings === undefined ? {} : { userBindings }),
             }
+            requireRecordedDiagnosticWording(meta, journal)
+            // The Host states the outcome of the cell it settled; a record whose
+            // completion or status contradicts it was edited after publication. The
+            // Host records that outcome on the result message it appends, so the
+            // message is read first; a log that carries it on the event instead is
+            // read the same way.
+            const hostIsError = typeof event.data?.message?.isError === 'boolean'
+              ? event.data.message.isError
+              : typeof event.data?.isError === 'boolean' ? event.data.isError : undefined
+            requireRecordedSettlementProof(meta, journal, hostIsError)
             let postEdit
             try {
-              postEdit = normalizePostEditFact(state.eventFacts, call, event, normalized)
+              postEdit = normalizePostEditFact(state.eventFacts, call, event, normalized, undefined, state.executableCalls)
             } catch (error) {
               postEdit = { error: `unproved deferred edit: ${error.message}` }
             }
@@ -1235,7 +1987,7 @@ function advanceTimelineEvent(previous, inputEvent, eventIndex, replayFact) {
         if (replayFact.boundaries !== undefined) observation.boundaries = replayFact.boundaries
         if (replayFact.boundaryFailure !== undefined) observation.boundaryFailure = replayFact.boundaryFailure
         if (normalized.postEdit !== undefined) {
-          const checked = normalizePostEditFact(state.eventFacts, call, event, normalized, normalized.postEdit)
+          const checked = normalizePostEditFact(state.eventFacts, call, event, normalized, normalized.postEdit, state.executableCalls)
           if (checked?.error !== undefined || !deepEqualJson(checked, normalized.postEdit)) {
             throw new TypeError(`invalid PTC session-log projection deferred edit fact: ${checked?.error ?? 'derived fact changed'}`)
           }
@@ -1251,7 +2003,11 @@ function advanceTimelineEvent(previous, inputEvent, eventIndex, replayFact) {
       if (isCanonicalSequence(resultSeq)) state.results.set(resultSeq, timelineJson(normalized))
       state.found = true
     }
-    const settlement = call === undefined ? undefined : { call, entry, identity: observation.identity,
+    const settlement = call === undefined ? undefined : { call, entry: {
+      eventIndex: entry?.eventIndex, scope: entry?.scope,
+      ...(entry?.ambiguous === true ? { ambiguous: true } : {}),
+      ...(entry?.editTarget === undefined ? {} : { editTarget: entry.editTarget }),
+    }, identity: observation.identity,
       observedIndex: eventIndex, ordinary: !prunedReplacement,
       ...(normalized === undefined ? {} : { normalized }) }
     if (settlement !== undefined && entry.scope === scope
@@ -1272,6 +2028,7 @@ function advanceTimelineEvent(previous, inputEvent, eventIndex, replayFact) {
     }
     if (settlement !== undefined && isCanonicalSequence(event.seq)) {
       settledResultsByEventSeq.set(event.seq, settlement)
+      state.retainedBytes += settlementBytes(settlement)
     }
 
     const claimedTarget = editClaims.get(callSeq)
@@ -1281,8 +2038,9 @@ function advanceTimelineEvent(previous, inputEvent, eventIndex, replayFact) {
     }
     if (entry === undefined || entry.scope !== scope) continue
     const publishRun = () => {
-      const run = settlementRun(settlement)
-      state.latestRun = selectSettlementRun(state.latestRun, settlement, scope, state.runSelectionFrontier)
+      const run = settlementRun(settlement, state.executableCalls)
+      state.latestRun = selectSettlementRun(state.latestRun, settlement, scope, state.runSelectionFrontier,
+        state.executableCalls)
       state.editableRun = state.latestRun
       if (successfulTimelineRun(run)) {
         state.lastSuccessfulRunIndex = Math.max(state.lastSuccessfulRunIndex ?? -1, run.index)
@@ -1302,7 +2060,13 @@ function advanceTimelineEvent(previous, inputEvent, eventIndex, replayFact) {
     }
     publishRun()
   }
-  state.eventFacts[state.eventFacts.length - 1] = timelineJson(observation)
+  // Digest the serialized fact (undefined fields dropped) so admission can
+  // re-digest exactly the bytes it received.
+  const plainObservation = JSON.parse(JSON.stringify(observation))
+  plainObservation.digest = factDigest(plainObservation)
+  state.eventFacts[state.eventFacts.length - 1] = timelineJson(plainObservation)
+  pruneRetention(state, { settled: settledResultsByEventSeq, executable: state.executableCalls, results: state.results,
+    ordinary: ordinaryResultSeqs })
   return Object.fromEntries(Object.entries({ ...state,
     executableCalls: state.executableCalls.table, results: state.results.table, editTargets: state.editTargets.table,
     pendingByCallId: pendingByCallId.table, seenCallIds: seenCallIds.table,
@@ -1312,6 +2076,285 @@ function advanceTimelineEvent(previous, inputEvent, eventIndex, replayFact) {
   }).filter(([_key, value]) => value !== undefined))
 }
 
+/**
+ * Refold a session while keeping every payload.
+ *
+ * A consumer that needs a cluster the retention window dropped cannot rebuild it
+ * from the checkpoint. The session log still has the events, so the caller refolds
+ * that slice with pruning disabled and reads the cluster from there. The flag is
+ * scoped to one synchronous fold; the checkpointed state never sees it.
+ */
+let fullRetentionDepth = 0
+export function withFullRetention(run) {
+  fullRetentionDepth += 1
+  try {
+    return run()
+  } finally {
+    fullRetentionDepth -= 1
+  }
+}
+
+/**
+ * Drop the oldest settlements entirely and fold them into one summary.
+ *
+ * The projection is a fold shortcut, not the log. Keeping a digest stub per settled
+ * cell still made a checkpoint proportional to how many cells the session ran (450
+ * stubs cost ~1.7 MB before any payload), so the whole cluster is dropped instead:
+ * the settlement, its executable call, its ordinary observation and its normalized
+ * result. What survives is one chained summary of what was dropped, which is what
+ * makes the size a function of the window rather than of the session.
+ *
+ * Consumers that need a dropped cell must refold it from the session log; when the
+ * log cannot supply it they report `retention-pruned` instead of guessing.
+ */
+/**
+ * A call event whose argument text is gone keeps its identity and the digest of
+ * exactly the bytes it used to carry, so a refold can prove the text it recovers
+ * is the text the checkpoint once held.
+ */
+function digestArgumentData(data) {
+  if (!isRecord(data) || typeof data.arguments !== 'string') return data
+  const { arguments: text, ...rest } = data
+  return { ...rest, argumentsDigest: digestOf(text), argumentsBytes: byteLength(text) }
+}
+
+/**
+ * A republication clones a call event into its own settlement, so the same call can
+ * appear twice: once in `executableCalls` and once in a settlement that names its
+ * sequence. Whichever copy the retention window digests, every copy of that call must
+ * end up in the same shape, or a checkpoint would describe one call two ways. The
+ * pass is idempotent and runs on every prune, so a clone added after the window moved
+ * still lands on the retained shape — the fold and the replay both go through it.
+ */
+function digestSettlementCallCopies(tables) {
+  for (const pair of Object.values(tables.settled.table)) {
+    const [, settlement] = pair
+    if (!isRecord(settlement) || !isRecord(settlement.call)) continue
+    if (typeof settlement.call.data?.arguments !== 'string') continue
+    const retained = tables.executable.get(settlement.call.seq)
+    if (typeof retained?.event?.data?.argumentsDigest !== 'string') continue
+    tables.settled.set(pair[0], { ...settlement, call: { ...settlement.call, data: digestArgumentData(settlement.call.data) } })
+  }
+}
+
+/**
+ * A journal outside the payload window keeps everything recovery reads — status,
+ * operations, user binding evidence, confirms, completion and per-call metadata —
+ * and replaces each call's argument wire with its digest. Byte-for-byte equality
+ * of argument text is what the window gives up; identity is not.
+ */
+export function digestJournalArguments(journal) {
+  if (process.env.DIGEST_SKIP_JOURNAL === '1') return journal
+  if (!isRecord(journal) || !Array.isArray(journal.calls)) return journal
+  return { ...journal, calls: journal.calls.map(call => {
+    if (!isRecord(call) || !Object.hasOwn(call, 'args')) return call
+    const { args, ...rest } = call
+    return { ...rest, argsDigest: digestOf(args), argsBytes: byteLength(args) }
+  }) }
+}
+
+function pruneRetention(state, tables) {
+  if (fullRetentionDepth > 0) return
+  const entries = Object.entries(tables.settled.table)
+    .map(([, pair]) => ({ settlement: pair[1], resultSeq: pair[0] }))
+    .filter(entry => entry.settlement !== undefined)
+    .sort((left, right) => left.settlement.observedIndex - right.settlement.observedIndex)
+  if (entries.length === 0) return
+  const limits = retentionLimits()
+  // The count window is order-only so a replayed fold prunes identically. A
+  // configured cluster cap of 0 means the count window never folds anything and
+  // the payload budget is the only bound.
+  const keepClusters = limits.clusters === 0 ? entries.length : Math.min(entries.length, limits.clusters)
+  const keepFrom = Math.max(0, entries.length - keepClusters)
+  // The runs a consumer reads synchronously — the latest publication and the cell
+  // an edit would capture — stay inside the window even when newer settlements
+  // pushed them past the count. Dropping them would turn "editable" into "pruned"
+  // for the cell the user is actually looking at.
+  const pinnedCallSeqs = new Set([state.latestRun?.callSeq, state.editableRun?.callSeq]
+    .filter(callSeq => isCanonicalSequence(callSeq)))
+  // Only a cluster beyond the configured cluster cap is folded into the interval
+  // summary. Every other cluster stays, with its payload text replaced by digests,
+  // so recovery evidence never depends on refolding the session log.
+  const folded = new Set(entries.slice(0, keepFrom)
+    .filter(entry => pinnedCallSeqs.has(entry.settlement.call?.seq) === false)
+    .map(entry => entry.resultSeq))
+  const mustPrune = new Set(folded)
+  // A cumulative byte cap, not only a per-entry one: the window has to be a constant
+  // regardless of how large the retained cells are, otherwise 32 cells of 200 KB
+  // still put 6.4 MB in every checkpoint. Walk newest-first and stop retaining once
+  // the payload budget is spent. A single entry larger than the whole budget is
+  // dropped too: the bound wins over keeping the hot cell, and the edit path refolds
+  // that cell from the session log when it is needed.
+  const retainedPayloadBytes = (entry, executable = tables.executable) => {
+    const callSeq = entry.settlement.call?.seq
+    const stored = callSeq === undefined ? undefined : executable.get(callSeq)
+    const executableArguments = stored?.event?.data?.arguments
+    return settlementBytes(entry.settlement)
+      + (typeof executableArguments === 'string' ? byteLength(executableArguments) : 0)
+  }
+  let retainedTotal = 0
+  const newestFirst = [...entries].reverse()
+  for (const [index, entry] of newestFirst.entries()) {
+    const bytes = retainedPayloadBytes(entry)
+    const pinned = pinnedCallSeqs.has(entry.settlement.call?.seq)
+    // The run a consumer reads synchronously keeps its text even past the count
+    // window: the window bounds how much history stays readable, never the cell the
+    // user is looking at. Only the byte budget can digest a pinned cell.
+    const outsidePayloadWindow = index >= limits.runs && !pinned
+    const overBudget = bytes > limits.bytes
+    if (overBudget || outsidePayloadWindow || (index > 0 && !pinned && retainedTotal + bytes > limits.bytes)) {
+      mustPrune.add(entry.resultSeq)
+      continue
+    }
+    retainedTotal += bytes
+  }
+  if (mustPrune.size === 0) return
+  const droppedCallSeqs = new Set()
+  const droppedResultSeqs = new Set()
+  const dropped = []
+  const digested = new Set([...mustPrune].filter(resultSeq => !folded.has(resultSeq)))
+  const digestedResultSeqs = new Set()
+  const digestedHotCell = state.latestRun !== undefined && entries.some(entry => (
+    digested.has(entry.resultSeq) && entry.settlement.call?.seq === state.latestRun?.callSeq))
+  for (const entry of entries) {
+    if (!digested.has(entry.resultSeq)) continue
+    const callSeq = entry.settlement.call?.seq
+    if (callSeq !== undefined && tables.executable.has(callSeq)) {
+      const stored = tables.executable.get(callSeq)
+      tables.executable.set(callSeq, { ...stored, event: { ...stored.event, data: digestArgumentData(stored.event.data) } })
+      digestSettlementCallCopies(tables)
+    }
+    // The result keeps every field recovery reads — status, operations, user
+    // binding evidence, confirms, completion and call metadata — and loses only
+    // the argument wire of each call.
+    for (const key of [entry.resultSeq, callSeq]) {
+      if (key === undefined || !tables.results.has(key)) continue
+      const result = tables.results.get(key)
+      if (!isRecord(result) || result.journal === undefined) continue
+      tables.results.set(key, { ...result, journal: digestJournalArguments(result.journal) })
+    }
+    // The settlement keeps its normalized and publication entries because recovery
+    // and the run derivations read them; only the journal argument wire and the
+    // derived source are replaced by digests, which is exactly the payload the
+    // window bounds. Identity, observations and result metadata stay.
+    const digestJournalEntry = value => value === undefined ? undefined : {
+      ...value,
+      ...(value.journal === undefined ? {} : { journal: digestJournalArguments(value.journal) }),
+
+    }
+    tables.settled.set(entry.resultSeq, {
+      ...entry.settlement,
+      ...(callSeq === undefined
+        ? {}
+        : { call: { ...entry.settlement.call, data: digestArgumentData(entry.settlement.call.data) } }),
+      ...(entry.settlement.normalized === undefined
+        ? {}
+        : { normalized: digestJournalEntry(entry.settlement.normalized) }),
+      ...(entry.settlement.publication === undefined
+        ? {}
+        : { publication: digestJournalEntry(entry.settlement.publication) }),
+    })
+    digestedResultSeqs.add(Number(entry.resultSeq))
+    state.retainedBytes = Math.max(0, state.retainedBytes - settlementBytes(entry.settlement))
+  }
+  for (const entry of entries) {
+    if (!mustPrune.has(entry.resultSeq)) continue
+    if (!folded.has(entry.resultSeq)) continue
+    const callSeq = entry.settlement.call?.seq
+    dropped.push(summaryEntry(entry.settlement, Number(entry.resultSeq)))
+    tables.settled.delete(entry.resultSeq)
+    if (callSeq !== undefined) {
+      tables.executable.delete(callSeq)
+      if (tables.ordinary?.has(callSeq)) tables.ordinary.delete(callSeq)
+      droppedCallSeqs.add(callSeq)
+    }
+    // `results` is keyed by the RESULT sequence on the ordinary path and by the CALL
+    // sequence on the republication path, so drop both keys when either exists.
+    for (const key of [entry.resultSeq, callSeq]) {
+      if (key === undefined) continue
+      if (tables.results.has(key)) tables.results.delete(key)
+    }
+    droppedResultSeqs.add(entry.resultSeq)
+    state.retainedBytes = Math.max(0, state.retainedBytes - settlementBytes(entry.settlement))
+  }
+  // A digested cluster kept its identity, so the ordered call list keeps its seq;
+  // a folded cluster is gone and takes its seq with it.
+  state.calls = state.calls.filter(callSeq => !droppedCallSeqs.has(callSeq))
+  // The hot run can be lost either way: a folded cluster no longer exists, and a
+  // digested one no longer holds the source a run is built from. Consumers that
+  // need it refold from the session log, and report the notice until they do.
+  if (state.latestRun !== undefined
+    && (droppedCallSeqs.has(state.latestRun.callSeq) || digestedHotCell)) {
+    state.latestRun = undefined
+    state.editableRun = undefined
+  }
+  // `hotCellDropped` describes the retained set, not the route the fold took to it.
+  // It holds exactly when the newest settlement no longer carries its payload:
+  // either it was folded away, or its argument text was digested. Recomputing it
+  // from the table on every prune keeps a replayed fold — which reaches the same set
+  // by a different route — from disagreeing with the stored one.
+  const newestEntry = entries[entries.length - 1]
+  const newestStored = newestEntry === undefined ? undefined : tables.settled.get(newestEntry.resultSeq)
+  state.hotCellDropped = newestEntry !== undefined
+    && (newestStored === undefined || newestStored.call?.data?.arguments === undefined)
+  // `retainedBytes` is a property of the retained set, not a running total: a fold
+  // that digests a cluster after it was counted would otherwise carry a different
+  // value than a fold that reaches the same set by another route. Recompute it from
+  // the table so both sides agree, and so the number always describes what is there.
+  state.retainedBytes = entries.reduce((total, entry) => {
+    const stored = tables.settled.get(entry.resultSeq)
+    return stored === undefined ? total : total + settlementBytes(stored)
+  }, 0)
+  if (dropped.length === 0 && digested.size === 0) return
+  if (dropped.length !== 0) {
+    state.compacted = true
+    dropped.sort((left, right) => left.resultSeq - right.resultSeq)
+    state.retentionSummary = extendSummary(state.retentionSummary, dropped)
+  }
+  // The facts of a folded cluster keep their identity and digests but lose the
+  // payload text, for the same reason the cluster itself is gone.
+  // A fact per event is itself linear in the session length, so a folded cluster
+  // takes its tool/call and tool/result facts with it. Admission for a compacted
+  // checkpoint proves the summary instead of replaying those facts.
+  state.eventFacts = state.eventFacts.filter(fact => {
+    if (fact.event?.type === 'tool/call' && droppedCallSeqs.has(fact.event.seq)) return false
+    if (fact.normalized !== undefined && droppedResultSeqs.has(Number(fact.normalized.eventSeq))) return false
+    return true
+  })
+  // A digested cluster keeps its facts, but they carry the digest-only journal too:
+  // the fact list is a second copy of the same result content. Rewriting the payload
+  // invalidates the fact's own digest, so it is recomputed here — admission checks
+  // that digest against the bytes it receives.
+  state.eventFacts = state.eventFacts.map(fact => {
+    if (fact.normalized === undefined || !digestedResultSeqs.has(Number(fact.normalized.eventSeq))) return fact
+    const { digest: _digest, ...rest } = fact
+    const next = { ...rest, normalized: digestJournalArguments(fact.normalized) }
+    next.digest = factDigest(next)
+    return next
+  })
+  // A dispatch fact names the cell an edit would capture, and that target carries
+  // the cell's source. Once the payload is digested the fold can no longer derive
+  // that source, so the fact must record the same "no target" the fold would
+  // produce now; leaving the old text behind would both duplicate the payload and
+  // fail the round-trip check that compares the fact with its re-derivation.
+  const digestedCallSeqs = new Set(entries
+    .filter(entry => digested.has(entry.resultSeq))
+    .map(entry => Number(entry.settlement.call?.seq)))
+  if (digestedCallSeqs.size !== 0) {
+    let rewritten = false
+    state.eventFacts = state.eventFacts.map(fact => {
+      const target = fact.selectedTarget
+      if (!isRecord(target) || !digestedCallSeqs.has(Number(target.callSeq))) return fact
+      const { digest: _digest, ...rest } = fact
+      const next = { ...rest, selectedTarget: null }
+      next.digest = factDigest(next)
+      rewritten = true
+      return timelineJson(next)
+    })
+    if (rewritten) state.eventFacts = state.eventFacts.map(fact => timelineJson(fact))
+  }
+}
+
 export function sessionTimelineValue(checkpoint) {
   return { ...checkpoint,
     executableCalls: new Map(Object.values(checkpoint.executableCalls)),
@@ -1334,10 +2377,17 @@ export function foldSessionTimeline(events) {
 export function recoverJournal(session, currentCallSeq, options = {}) {
   const events = sessionEvents(session)
   if (!Array.isArray(events)) {
-    return { nodes: [], head: undefined, checkpoints: new Map(), volatileSuffix: [], available: true }
-  }
-  const timeline = foldSessionTimeline(events)
-  const calls = timeline.calls.filter(call => call.seq !== currentCallSeq)
+    return { nodes: [], head: undefined, checkpoints: new Map(), volatileSuffix: [], provenBindings: [], available: true }
+  }
+  // Recovery rebuilds bindings from the cell sources and journals. A checkpoint
+  // outside the payload window keeps those as digests, so the fold is repeated with
+  // retention disabled on the same slice: the log is the authority, and reading it
+  // costs one extra fold only when a digested cluster is present.
+  const folded = foldSessionTimeline(events)
+  const needsPayload = [...folded.executableCalls.values()]
+    .some(entry => typeof entry?.event?.data?.arguments !== 'string')
+  const timeline = needsPayload ? withFullRetention(() => foldSessionTimeline(events)) : folded
+  const calls = timelineCalls(timeline).filter(call => call.seq !== currentCallSeq)
   const { executableCalls, results, found } = timeline
   const visibleCalls = options?.visibleCallSeqs
   const appliedBoundaries = options?.[RECOVERY_BOUNDARY_EVIDENCE]
@@ -1407,7 +2457,12 @@ export function recoverJournal(session, currentCallSeq, options = {}) {
   const records = []
   const orderedRecords = []
   const contractedCallRanges = []
-  let state = foldRecords(records, invalidCallSeqs)
+  // A live environment that was released cannot lend its recorded live-only
+  // values to the environment that replaces it. The flag belongs to the fold, so
+  // every re-fold below carries it.
+  const foldOptions = { liveOnlyLost: options?.liveOnlyLost === true,
+    editRewritesHistory: options?.editRewritesHistory === true }
+  let state = foldRecords(records, invalidCallSeqs, foldOptions)
   let boundaryIndex = 0
   const carrierCallSeqForBoundary = boundary => boundary.carrierCallSeq
   const isContractedCallSeq = (callSeq) => contractedCallRanges.some(range => (
@@ -1428,6 +2483,7 @@ export function recoverJournal(session, currentCallSeq, options = {}) {
       if (record.call.seq >= contractionSeq) invalidCallSeqs.add(record.call.seq)
     }
     state = foldRecords(records, invalidCallSeqs, {
+      ...foldOptions,
       surfaceContracted: state.surfaceContracted,
     })
     registerUnavailable({ seq: carrierCallSeq ?? boundary.failedCallSeq, reason }, state)
@@ -1487,6 +2543,7 @@ export function recoverJournal(session, currentCallSeq, options = {}) {
         }
       }
       state = foldRecords(records, invalidCallSeqs, {
+        ...foldOptions,
         surfaceContracted: resolvesUnavailable ? false : state.surfaceContracted,
       })
       if (resolvesUnavailable) {
@@ -1510,13 +2567,19 @@ export function recoverJournal(session, currentCallSeq, options = {}) {
       if (result.postEditError !== undefined) {
         invalidResultReasons.set(call.seq, result.postEditError)
         registerUnavailable({ seq: call.seq, reason: result.postEditError })
-      } else if (result.postEdit !== undefined) {
+      } else if (result.postEdit !== undefined && result.postEdit.derived.unexecuted !== true) {
+        // A derived execution that never ran proves no state of its own, so it is
+        // not folded as a record; the root cell's own record already carries the
+        // proof of the accepted edit.
         const postEdit = result.postEdit
         orderedRecords.push({
           call: timeline.eventFacts.find(fact => fact.event.seq === postEdit.executionStartSeq).event,
           code: postEdit.derived.code,
           result: { eventSeq: result.eventSeq, journal: postEdit.derived.journal,
             derived: postEdit.derived, userBindings: postEdit.derived.userBindings },
+          // The revision names the cell it edits. Whether that relation replaces
+          // the target or appends to it is the fold's decision, not the log's.
+          supersedes: postEdit.targetCallSeq,
           hidden: visibleCalls instanceof Set && (!visibleCalls.has(call.seq)
             || !visibleCalls.has(postEdit.targetCallSeq)),
         })
@@ -1566,13 +2629,38 @@ export function recoverJournal(session, currentCallSeq, options = {}) {
   }
   applyBoundariesBefore(Number.POSITIVE_INFINITY)
   if (unavailableBoundary !== undefined) registerUnavailable(unavailableBoundary, state)
-  return {
+  // The names the session log proves stay off the enumerable history shape so
+  // every existing consumer sees the same object it saw before; recovery-only
+  // readers (the missing-binding notice) reach them through this property.
+  const history = {
     nodes: state.nodes,
     head: state.head,
     checkpoints: state.checkpoints,
     volatileSuffix: state.volatileSuffix,
     available: found && !state.surfaceContracted && unavailableBoundary === undefined,
   }
+  history.provenBindings = [...state.provenBindings]
+  // Recovery-only, like the proved names: the enumerable history shape is a
+  // contract other readers compare against, so the deletion set stays off it.
+  Object.defineProperty(history, 'deletedBindings', {
+    value: [...state.deletedBindings],
+    enumerable: false,
+    configurable: true,
+  })
+  // The supersession relation is recovery evidence of the same kind: which cell
+  // each revision replaced, and which proved names the path no longer supplies
+  // because of it. Both stay off the enumerable shape for the same reason.
+  Object.defineProperty(history, 'supersessions', {
+    value: [...state.supersessions],
+    enumerable: false,
+    configurable: true,
+  })
+  Object.defineProperty(history, 'supersededBindings', {
+    value: [...state.supersededBindings],
+    enumerable: false,
+    configurable: true,
+  })
+  return history
 }
 
 /** Prove that recovery consumes every persisted boundary at its declared frontier. */