dsh-ptc-plus 0.5.1 → 0.5.3

package/internal/session-journal-schema.js

@@ -11,6 +11,8 @@ export const DERIVED_RUN_KEY = 'dshPtcPlusDerivedRun'
 export const POST_EDIT_KEY = 'dshPtcPlusPostEdit'
 export const REWRITES_KEY = 'dshPtcPlusRewrites'
 export const RECOVERY_BOUNDARY_KEY = 'dshPtcPlusRecoveryBoundaries'
+export const DIAGNOSTIC_WORDING_KEY = 'dshPtcPlusDiagnosticWording'
+export const SETTLEMENT_PROOF_KEY = 'dshPtcPlusSettlementProof'
 export const IMPORT_BOUNDARY_JOURNAL_VERSION = 7
 export const PER_NAME_USER_BINDINGS_JOURNAL_VERSION = 8
 export const LANGUAGE_SEMANTICS_JOURNAL_VERSION = 9
@@ -35,7 +37,7 @@ export const WHOLE_ENTRY_JOURNAL_FIELDS = new Set(['version', 'bindingPolicy', '
 export const PER_NAME_JOURNAL_FIELDS = new Set([...WHOLE_ENTRY_JOURNAL_FIELDS, 'userBindingsShadowPolicy', 'userBindingNames'])
 export const LANGUAGE_SEMANTICS_JOURNAL_FIELDS = new Set([...PER_NAME_JOURNAL_FIELDS, 'languageSemantics'])
 export const MODULE_TRANSFORM_JOURNAL_FIELDS = new Set([...LANGUAGE_SEMANTICS_JOURNAL_FIELDS, 'moduleTransform'])
-export const JOURNAL_FIELDS = new Set([...MODULE_TRANSFORM_JOURNAL_FIELDS, 'executionCwd'])
+export const JOURNAL_FIELDS = new Set([...MODULE_TRANSFORM_JOURNAL_FIELDS, 'executionCwd', 'values', 'unrecordedBindings'])
 export const FINGERPRINT_REUSE_JOURNAL_FIELDS = new Set([...WHOLE_ENTRY_JOURNAL_FIELDS].filter(field => field !== 'userBindingsReusePolicy'))
 export const RELATIONLESS_JOURNAL_FIELDS = new Set([...FINGERPRINT_REUSE_JOURNAL_FIELDS].filter(field => field !== 'userBindingsFingerprint'))
 export const PREDECESSOR_JOURNAL_FIELDS = new Set(['version', 'bindingMode', 'rewritePolicy', 'status', 'calls', 'operations', 'confirms', 'diagnostics', 'completion', 'volatileReason'])
@@ -52,14 +54,17 @@ export const DEFAULT_EXPORT_BINDINGS = new Set([
   LEGACY_DEFAULT_EXPORT_BINDING,
   LIVE_DEFAULT_EXPORT_BINDING,
 ])
-export const CALL_SUCCESS_FIELDS = new Set(['global', 'member', 'args', 'ok', 'value', 'settle'])
-export const CALL_ERROR_FIELDS = new Set(['global', 'member', 'args', 'ok', 'error', 'settle'])
-export const OPERATION_FIELDS = new Set(['action', 'name'])
+export const CALL_SUCCESS_FIELDS = new Set(['global', 'member', 'args', 'argsDigest', 'argsBytes', 'ok', 'value', 'settle'])
+export const CALL_ERROR_FIELDS = new Set(['global', 'member', 'args', 'argsDigest', 'argsBytes', 'ok', 'error', 'settle'])
+export const OPERATION_FIELDS = new Set(['action', 'name', 'kind'])
 export const RETURN_FIELDS = new Set(['kind', 'hasValue', 'value'])
 export const THROW_FIELDS = new Set(['kind', 'error'])
 export const ERROR_FIELDS = new Set(['kind', 'message'])
 export const EDIT_TARGET_FIELDS = new Set(['targetCallSeq'])
-export const DERIVED_RUN_FIELDS = new Set(['code', 'description'])
+export const DERIVED_RUN_FIELDS = new Set(['code', 'codeDigest', 'codeBytes', 'description'])
+export const DIAGNOSTIC_WORDING_FIELDS = new Set(['digest'])
+export const SETTLEMENT_PROOF_VERSION = 1
+export const SETTLEMENT_PROOF_FIELDS = new Set(['version', 'recordedMessage'])
 
 export const JOURNAL_VERSIONS = new Set([LEGACY_JOURNAL_VERSION, INTERMEDIATE_JOURNAL_VERSION, PREVIOUS_JOURNAL_VERSION, USER_BINDING_RELATIONLESS_JOURNAL_VERSION, FINGERPRINT_REUSE_JOURNAL_VERSION, VERSIONED_BINDING_REUSE_JOURNAL_VERSION, IMPORT_BOUNDARY_JOURNAL_VERSION, PER_NAME_USER_BINDINGS_JOURNAL_VERSION, LANGUAGE_SEMANTICS_JOURNAL_VERSION, MODULE_TRANSFORM_JOURNAL_VERSION, JOURNAL_VERSION])
 export const USER_BINDINGS_REUSE_POLICIES = new Set([LEGACY_USER_BINDINGS_REUSE_POLICY, LIVE_USER_BINDINGS_REUSE_POLICY])

package/internal/session-journal.js

@@ -13,6 +13,7 @@ import {
   LIVE_MODULE_SEMANTICS,
 } from './repl-rewrite-contract.js'
 import { userBindingsSnapshotFromMeta } from './user-bindings.js'
+import { digestOf } from './projection-retention.js'
 import {
   JOURNAL_KEY,
   EDIT_TARGET_KEY,
@@ -62,6 +63,10 @@ import {
   JOURNAL_VERSIONS,
   USER_BINDINGS_REUSE_POLICIES,
   RECOVERY_BOUNDARY_FIELDS,
+  DIAGNOSTIC_WORDING_KEY,
+  SETTLEMENT_PROOF_KEY,
+  SETTLEMENT_PROOF_FIELDS,
+  SETTLEMENT_PROOF_VERSION,
   REPL_TOOL_NAMES,
   REWRITE_FIELDS,
   REWRITE_KINDS,
@@ -74,11 +79,104 @@ export {
   DERIVED_RUN_KEY,
   REWRITES_KEY,
   RECOVERY_BOUNDARY_KEY,
+  DIAGNOSTIC_WORDING_KEY,
+  DIAGNOSTIC_WORDING_FIELDS,
+  SETTLEMENT_PROOF_KEY,
+  SETTLEMENT_PROOF_FIELDS,
+  SETTLEMENT_PROOF_VERSION,
   JOURNAL_VERSION,
   LIVE_USER_BINDINGS_REUSE_POLICY,
   RECOVERY_BOUNDARY_EVENT,
 } from './session-journal-schema.js'
 
+/**
+ * The facts one recorded diagnostic states about what happened, without the
+ * presentation it is rendered through.
+ *
+ * `help` and `source` are presentation: a historical record may carry an older
+ * generation's help wording, and a caret position is re-derived from the cell
+ * when the diagnostic is rendered. The facts below are the wording the model was
+ * told, and they must be the facts that were recorded.
+ */
+function diagnosticWordingFacts(diagnostic) {
+  return [
+    diagnostic.code,
+    diagnostic.severity,
+    diagnostic.phase,
+    diagnostic.message,
+    diagnostic.stateEffect,
+    diagnostic.dispatchState ?? null,
+    diagnosticWordingCause(diagnostic.cause),
+    diagnostic.collisions ?? null,
+  ]
+}
+
+function diagnosticWordingCause(cause) {
+  if (cause === undefined) return null
+  return cause.severity === undefined
+    ? [cause.code ?? null, cause.message]
+    : diagnosticWordingFacts(cause)
+}
+
+/**
+ * Digest of the diagnostic wording a journal records, or `undefined` when it
+ * records none.
+ *
+ * Recovery re-renders a recorded diagnostic to report what the cell did, and it
+ * cannot tell an edited diagnostic from the recorded one when the record is the
+ * only evidence: the completion message and the diagnostic that produced it are
+ * two copies of one settlement. The digest of the recorded wording is taken when
+ * the settlement is published, so a record whose wording was changed afterwards
+ * is no longer evidence for the bindings its cell declared.
+ */
+export function diagnosticWordingDigest(journal) {
+  const diagnostics = journal?.diagnostics
+  if (!Array.isArray(diagnostics) || diagnostics.length === 0) return undefined
+  return digestOf(diagnostics.map(diagnosticWordingFacts))
+}
+
+/**
+ * Digest of the one settlement a journal states: the status of its cell, its
+ * completion, and the wording of its diagnostics.
+ *
+ * A published record is the only account of its own cell, so a record edited
+ * afterwards stays self-consistent: the completion is checkable against a
+ * diagnostic, and the diagnostic against the wording digest, but all three are
+ * the same settlement. The proof is taken at publication, from the facts the
+ * settlement was published with, and every fact is represented here exactly once,
+ * so a record whose status, completion or diagnostic wording changed no longer
+ * reproduces it.
+ */
+export function settlementProofDigest(journal) {
+  const completion = journal?.completion
+  const completionFacts = completion === undefined ? null
+    : completion.kind === 'return'
+      ? [completion.kind, completion.hasValue,
+        completion.hasValue ? digestOf(completion.value) : null]
+      : [completion.kind, completion.error.kind, completion.error.message]
+  return digestOf([
+    journal?.status ?? null,
+    completionFacts,
+    diagnosticWordingDigest(journal) ?? null,
+  ])
+}
+
+/**
+ * Attach the published settlement's proof beside a journal.
+ *
+ * Every settlement states a status, so every publication carries one; a record
+ * that carries none predates this proof and keeps the older evidence.
+ */
+export function withSettlementProof(meta, journal) {
+  return {
+    ...meta,
+    [SETTLEMENT_PROOF_KEY]: {
+      version: SETTLEMENT_PROOF_VERSION,
+      recordedMessage: settlementProofDigest(journal),
+    },
+  }
+}
+
 function cloneJson(value) {
   if (value === undefined) return undefined
   return decodeValue(encodeValue(value))
@@ -96,7 +194,8 @@ function normalizeCalls(value) {
   if (!Array.isArray(value)) throw new Error('invalid dsh-ptc-plus journal calls')
   const calls = value.map((call, index) => {
     if (!isRecord(call) || typeof call.global !== 'string' || typeof call.member !== 'string'
-      || !Object.hasOwn(call, 'args') || (call.ok !== true && call.ok !== false)
+      || Object.hasOwn(call, 'args') === Object.hasOwn(call, 'argsDigest')
+      || (call.ok !== true && call.ok !== false)
       || !isCanonicalSequence(call.settle)) {
       throw new Error(`invalid dsh-ptc-plus journal call at index ${index}`)
     }
@@ -107,10 +206,17 @@ function normalizeCalls(value) {
     if (call.ok === false && typeof call.error !== 'string') {
       throw new Error(`journal call at index ${index} is missing its error`)
     }
+    const digestedArgs = Object.hasOwn(call, 'argsDigest')
+    if (digestedArgs && (typeof call.argsDigest !== 'string' || !/^[a-f0-9]{64}$/u.test(call.argsDigest)
+      || !isCanonicalSequence(call.argsBytes))) {
+      throw new Error(`invalid digested dsh-ptc-plus journal call args at index ${index}`)
+    }
     return {
       global: call.global,
       member: call.member,
-      args: normalizeValueWire(call.args),
+      ...(digestedArgs
+        ? { argsDigest: call.argsDigest, argsBytes: call.argsBytes }
+        : { args: normalizeValueWire(call.args) }),
       ok: call.ok,
       settle: call.settle,
       ...(call.ok ? { value: normalizeValueWire(call.value) } : { error: call.error }),
@@ -131,7 +237,12 @@ function normalizeOperations(value) {
       throw new Error(`invalid dsh-ptc-plus journal operation at index ${index}`)
     }
     assertOwnFields(operation, OPERATION_FIELDS, `journal operation at index ${index}`)
-    return { action: operation.action, ...(operation.name === undefined ? {} : { name: operation.name }) }
+    if (operation.kind !== undefined
+      && (operation.action !== 'save' || !['binding', 'checkpoint'].includes(operation.kind))) {
+      throw new Error(`invalid dsh-ptc-plus journal operation kind at index ${index}`)
+    }
+    return { action: operation.action, ...(operation.name === undefined ? {} : { name: operation.name }),
+      ...(operation.kind === undefined ? {} : { kind: operation.kind }) }
   })
 }
 
@@ -263,7 +374,21 @@ function normalizeUserBindingsFingerprint(value) {
   return value
 }
 
+// Fields a later journal version introduced. A record is interpreted by its own
+// version, so a field that version could not have carried is not evidence: drop it
+// rather than rejecting the whole journal. A field that carries its own historical
+// contract, such as executionCwd, stays strict; only the value-carrying fields added by the recording work are trimmed, so
+// a record written by a newer build and relabelled by a migration fixture still folds
+// with its historical meaning.
+const NEWER_JOURNAL_FIELDS = Object.freeze(['values', 'unrecordedBindings'])
+function withoutNewerJournalFields(value) {
+  const trimmed = { ...value }
+  for (const field of NEWER_JOURNAL_FIELDS) delete trimmed[field]
+  return trimmed
+}
+
 function migrateJournal(value, resolveLegacyConfirm) {
+  value = value.version === JOURNAL_VERSION ? value : withoutNewerJournalFields(value)
   if (value.version === JOURNAL_VERSION) return value
   if (value.version === MODULE_TRANSFORM_JOURNAL_VERSION) {
     assertOwnFields(value, MODULE_TRANSFORM_JOURNAL_FIELDS, 'dsh-ptc-plus journal')
@@ -358,6 +483,33 @@ function normalizeExecutionCwd(value) {
 }
 
 /** Validate and detach one journal emitted by the runtime. */
+/**
+ * Values a volatile settlement recorded for the bindings it created.
+ *
+ * A volatile cell cannot be replayed, so the record carries the values it
+ * produced and recovery installs them without running the cell again. Names the
+ * codec could not transfer are kept apart so a contraction can name them
+ * instead of pretending they were never created.
+ */
+function normalizeJournalValues(values) {
+  if (values === undefined) return undefined
+  if (!Array.isArray(values)) throw new Error('invalid dsh-ptc-plus journal values')
+  return Object.freeze(values.map(entry => {
+    if (!isRecord(entry) || typeof entry.name !== 'string' || entry.name === '') {
+      throw new Error('invalid dsh-ptc-plus journal value entry')
+    }
+    return Object.freeze({ name: entry.name, wire: normalizeValueWire(entry.wire) })
+  }))
+}
+
+function normalizeUnrecordedBindings(names) {
+  if (names === undefined) return undefined
+  if (!Array.isArray(names) || names.some(name => typeof name !== 'string' || name === '')) {
+    throw new Error('invalid dsh-ptc-plus journal unrecorded bindings')
+  }
+  return Object.freeze([...new Set(names)])
+}
+
 export function normalizeJournal(value, options = {}) {
   if (!isRecord(value)) throw new Error('invalid dsh-ptc-plus journal')
   if (!JOURNAL_VERSIONS.has(value.version)
@@ -387,6 +539,8 @@ export function normalizeJournal(value, options = {}) {
     migrated.completion,
     migrated.status === 'durable' || migrated.status === 'volatile',
   )
+  const recordedValues = normalizeJournalValues(migrated.values)
+  const unrecordedBindings = normalizeUnrecordedBindings(migrated.unrecordedBindings)
   if ((migrated.status === 'discarded' || migrated.status === 'noop')
     && (calls.length !== 0 || operations.length !== 0)) {
     throw new Error(`${migrated.status} dsh-ptc-plus journal must not contain calls or operations`)
@@ -416,11 +570,19 @@ export function normalizeJournal(value, options = {}) {
     diagnostics: Object.freeze(diagnostics),
     ...(completion === undefined ? {} : { completion }),
     ...(migrated.volatileReason === undefined ? {} : { volatileReason: migrated.volatileReason }),
+    ...(recordedValues === undefined ? {} : { values: recordedValues }),
+    ...(unrecordedBindings === undefined ? {} : { unrecordedBindings }),
   })
 }
 
-/** Validate the required persisted relation that makes one edit result executable history. */
-export function normalizeDerivedEditResult(meta, expectedTargetCallSeq) {
+/**
+ * Completion error kind of a cell that never reached the runtime because it could
+ * not be measured. Such a settlement records that nothing ran, so it can prove an
+ * accepted edit's dispatch relation without proving any executed state.
+ */
+export const UNMEASURED_CELL_ERROR_KIND = 'budget-unavailable'
+
+function normalizeDerivedRelation(meta, expectedTargetCallSeq, { allowUnexecuted }) {
   if (!isCanonicalSequence(expectedTargetCallSeq)) {
     throw new Error('derived edit does not identify an eligible target call')
   }
@@ -433,24 +595,61 @@ export function normalizeDerivedEditResult(meta, expectedTargetCallSeq) {
     || target.targetCallSeq !== expectedTargetCallSeq) {
     throw new Error('derived edit target does not match the eligible target call')
   }
-  if (!isRecord(derived) || typeof derived.code !== 'string' || typeof derived.description !== 'string') {
+  // A derived run outside the payload window keeps the digest of its source instead
+  // of the text. Every field except the source is kept, so the deferred-edit
+  // relation stays checkable in both shapes; the text is refolded from the log when
+  // a consumer needs it.
+  const digestedCode = isRecord(derived) && !Object.hasOwn(derived, 'code')
+  if (!isRecord(derived) || typeof derived.description !== 'string'
+    || (digestedCode
+      ? typeof derived.codeDigest !== 'string' || !/^[a-f0-9]{64}$/u.test(derived.codeDigest)
+        || !isCanonicalSequence(derived.codeBytes)
+      : typeof derived.code !== 'string')) {
     throw new Error('invalid dsh-ptc-plus derived run metadata')
   }
   assertOwnFields(derived, DERIVED_RUN_FIELDS, 'derived run metadata')
   const journal = normalizeJournal(meta[JOURNAL_KEY])
-  if (journal.status === 'noop') throw new Error('derived edit journal must not be noop')
+  // Only the current deferred edit relation may prove itself with a settlement
+  // that never ran, and only for the unmeasured route: a rejected source, an
+  // aborted cell or a lost helper are different facts and keep the historical
+  // rule that a derived edit journal must record an execution.
+  const unexecuted = journal.status === 'noop'
+    && journal.completion?.error?.kind === UNMEASURED_CELL_ERROR_KIND
+  if (journal.status === 'noop' && !(allowUnexecuted && unexecuted)) {
+    throw new Error('derived edit journal must not be noop')
+  }
   const recoveryBoundaries = meta[RECOVERY_BOUNDARY_KEY] === undefined
     ? undefined
     : normalizeRecoveryBoundaries(meta[RECOVERY_BOUNDARY_KEY])
   const userBindings = userBindingsForJournal(meta, journal)
-  return Object.freeze({
+  return {
     targetCallSeq: target.targetCallSeq,
-    code: derived.code,
+    ...(digestedCode
+      ? { codeDigest: derived.codeDigest, codeBytes: derived.codeBytes }
+      : { code: derived.code }),
     description: derived.description,
     journal,
+    ...(unexecuted ? { unexecuted: true } : {}),
     ...(recoveryBoundaries === undefined ? {} : { recoveryBoundaries }),
     ...(userBindings === undefined ? {} : { userBindings }),
-  })
+  }
+}
+
+/** Validate the required persisted relation that makes one edit result executable history. */
+export function normalizeDerivedEditResult(meta, expectedTargetCallSeq) {
+  return Object.freeze(normalizeDerivedRelation(meta, expectedTargetCallSeq, { allowUnexecuted: false }))
+}
+
+/**
+ * Validate the relation one accepted deferred edit records for itself.
+ *
+ * The current deferred relation additionally admits a settlement that proves the
+ * revision never ran, because the root cell's own execution stays provable then.
+ * The historical top-level editor relation does not: it keeps requiring an
+ * executed derived run.
+ */
+export function normalizeDeferredEditSettlement(meta, expectedTargetCallSeq) {
+  return Object.freeze(normalizeDerivedRelation(meta, expectedTargetCallSeq, { allowUnexecuted: true }))
 }
 
 export function userBindingsForJournal(meta, journal) {
@@ -492,8 +691,8 @@ function validateUserBindingNameProviders(journal, snapshot) {
 /** Compare only the required persisted relation for one derived edit. */
 export function derivedEditResultsEqual(leftMeta, rightMeta, expectedTargetCallSeq) {
   try {
-    const left = encodeValue(normalizeDerivedEditResult(leftMeta, expectedTargetCallSeq))
-    const right = encodeValue(normalizeDerivedEditResult(rightMeta, expectedTargetCallSeq))
+    const left = encodeValue(normalizeDeferredEditSettlement(leftMeta, expectedTargetCallSeq))
+    const right = encodeValue(normalizeDeferredEditSettlement(rightMeta, expectedTargetCallSeq))
     return JSON.stringify(left) === JSON.stringify(right)
   } catch {
     return false
@@ -1108,8 +1307,9 @@ export function reduceStateOperations({ nodes, head, checkpoints }, operations,
 /** Merge the journal into the tool result's private metadata. */
 export function withJournal(meta, journal) {
   const base = isRecord(meta) ? { ...meta } : meta === undefined ? {} : { value: cloneJson(meta) }
-  base[JOURNAL_KEY] = normalizeJournal(journal)
-  return base
+  const normalized = normalizeJournal(journal)
+  base[JOURNAL_KEY] = normalized
+  return withSettlementProof(base, normalized)
 }
 
 /** Validate and detach one rewrite record emitted by the runtime. */

package/internal/session-log-view.js

@@ -1,5 +1,6 @@
 import {
-  advanceSessionTimeline, createSessionTimelineState, replaySessionTimelineFact, validateSessionTimelineState,
+  advanceSessionTimeline, createSessionTimelineState, factDigest, replaySessionTimelineFact, withFullRetention,
+  retentionSummaryOf, validateRetentionSummary, validateSessionTimelineState, admissionReplayBudget,
 } from './session-journal-recovery.js'
 import { isCanonicalSequence } from './session-journal.js'
 import { advanceSessionSurface, readSessionLog, sessionEvents } from './session-events.js'
@@ -38,7 +39,7 @@ function isContextStep(event) {
     || (event?.type === 'user/message' && event.data?.source?.kind === 'user')
 }
 
-export const SESSION_LOG_PROJECTION_KEY = 'ptcPlusSessionLog'
+const SESSION_LOG_PROJECTION_KEY = 'ptcPlusSessionLog'
 
 function emptyLogState() {
   return { timeline: createSessionTimelineState(), contextStep: 0,
@@ -46,6 +47,19 @@ function emptyLogState() {
     systemPromptSnapshots: [], ptcMessages: [], runtimeMessagesBySeq: {}, visibleRuntimeMessages: [], surfaceNodes: [], logFacts: [] }
 }
 
+/**
+ * Digest fields are validated per fact against their own bytes, so the replay
+ * comparison must ignore them: a v10 checkpoint has no digests and must still be
+ * admissible (the host refolds on the version mismatch), while a v11 one has been
+ * digest-checked already.
+ */
+function withoutFactDigests(state) {
+  const facts = state.timeline.eventFacts
+  if (!facts.some(fact => fact.digest !== undefined)) return state
+  return { ...state, timeline: { ...state.timeline,
+    eventFacts: facts.map(({ digest, ...rest }) => rest) } }
+}
+
 export function runtimeMessageFacts(records, initial = {}) {
   const facts = { ...initial }
   for (const record of records) {
@@ -115,10 +129,11 @@ function applyLogEvent(state, event, index = event?.seq,
   return next
 }
 
-export function createSessionLogProjection() {
+export function createSessionLogProjection(options = {}) {
+  const replayBudget = admissionReplayBudget(options.replayBudgetBytes)
   return Object.freeze({
     key: SESSION_LOG_PROJECTION_KEY,
-    stateVersion: 9,
+    stateVersion: 13,
     stateSchema: Object.freeze({ parse(value) {
       if (!isJsonValue(value) || !isRecord(value) || !isRecord(value.timeline)
         || typeof value.timeline.openTurn !== 'boolean' || typeof value.timeline.found !== 'boolean'
@@ -134,12 +149,17 @@ export function createSessionLogProjection() {
         || !isRecord(value.runtimeMessagesBySeq) || !isRecord(value.timeline.cordisTranscript)) {
         throw new TypeError('invalid PTC session-log projection checkpoint')
       }
-      validateSessionTimelineState(value.timeline)
       if (!Array.isArray(value.logFacts)) throw new TypeError('invalid PTC session-log projection checkpoint facts')
-      const timelineFacts = new Map(value.timeline.eventFacts.map(fact => [fact.eventIndex, fact]))
-      let reconstructed = emptyLogState()
+      validateSessionTimelineState(value.timeline, value.logFacts, { replayBudgetBytes: replayBudget })
+      // Admission proves digest-bound continuity and frontier agreement, not a
+      // byte-for-byte replay equality of argument text. Replaying the whole log
+      // here would cost the host a second fold of every event (and the retained
+      // payloads make that fold proportional to everything the session wrote), so
+      // this validates the identity chain the projection itself maintains:
+      // ordered log facts whose indices agree with the timeline facts, each
+      // timeline fact carrying a digest that matches the log fact it points at,
+      // and a frontier that names the processed cut.
       let lastIndex = -1
-      let timelineCount = 0
       for (const fact of value.logFacts) {
         if (!isRecord(fact) || Object.keys(fact).some(key => !['index', 'event'].includes(key))
           || !isCanonicalSequence(fact.index) || fact.index <= lastIndex
@@ -148,23 +168,79 @@ export function createSessionLogProjection() {
           throw new TypeError('invalid PTC session-log projection checkpoint facts')
         }
         lastIndex = fact.index
+      }
+      // Strictly increasing indices are what makes this index one-to-one, so a
+      // duplicate cannot reach the identity loop below. The per-fact digest is
+      // already required by `validateSessionTimelineState` above, which reads the
+      // same equality from the same facts.
+      const factsByIndex = new Map(value.logFacts.map(fact => [fact.index, fact]))
+      for (const timelineFact of value.timeline.eventFacts) {
+        const logFact = factsByIndex.get(timelineFact.eventIndex)
+        if (logFact === undefined) {
+          throw new TypeError('inconsistent PTC session-log projection checkpoint event identity')
+        }
+        if (logFact.event.seq !== timelineFact.event.seq || logFact.event.type !== timelineFact.event.type) {
+          throw new TypeError('inconsistent PTC session-log projection checkpoint event identity')
+        }
+      }
+      // Replay is the strongest admission check, but replaying every fact costs a
+      // second fold whose payload is proportional to everything the session wrote.
+      // Admission therefore replays while the retained payload stays inside the
+      // budget and falls back to the identity chain above (ordered facts, per-fact
+      // digests, frontier agreement) beyond it. Small checkpoints keep the full
+      // byte-for-byte proof; large ones prove digest-bound continuity instead.
+      // Admission proves digest-bound continuity and frontier agreement, not a
+      // byte-for-byte replay equality of argument text: replay runs only while the
+      // retained payload stays inside a fixed budget, and every retained fact
+      // carries a digest over its own bytes, so beyond that budget a payload edit
+      // is still rejected without folding the whole session a second time.
+      const summaryPresent = retentionSummaryOf(value.timeline) !== undefined
+      // A compacted checkpoint dropped whole clusters, so replaying the log can no
+      // longer reach the stored state. Admission proves the summary instead (below)
+      // and skips the replay entirely: it is both impossible to satisfy and the
+      // most expensive thing this file does.
+      const timelineFacts = new Map(value.timeline.eventFacts.map(fact => [fact.eventIndex, fact]))
+      let replayBytes = 0
+      let replayComplete = true
+      let reconstructed = emptyLogState()
+      for (const fact of summaryPresent ? [] : value.logFacts) {
         const timelineFact = timelineFacts.get(fact.index)
-        if (timelineFact !== undefined) {
-          if (!deepEqualJson(presentationEvent(timelineFact.event), fact.event)) {
-            throw new TypeError('inconsistent PTC session-log projection checkpoint event identity')
+        if (timelineFact === undefined) {
+          if (advanceSessionTimeline(reconstructed.timeline, fact.event, fact.index) !== reconstructed.timeline) {
+            throw new TypeError('inconsistent PTC session-log projection checkpoint missing timeline facts')
+          }
+        } else {
+          replayBytes += factDigest(timelineFact.event).length * 4
+          if (replayBytes > replayBudget) {
+            replayComplete = false
+            continue
           }
-          timelineCount += 1
-        }
-        if (timelineFact === undefined
-          && advanceSessionTimeline(reconstructed.timeline, fact.event, fact.index) !== reconstructed.timeline) {
-          throw new TypeError('inconsistent PTC session-log projection checkpoint missing timeline facts')
         }
         const timeline = timelineFact === undefined ? reconstructed.timeline
-          : replaySessionTimelineFact(reconstructed.timeline, timelineFact)
+          : replaySessionTimelineFact(reconstructed.timeline, timelineFact, value.timeline.executableCalls)
         reconstructed = applyLogEvent(reconstructed, fact.event, fact.index, timeline)
       }
-      if (timelineCount !== timelineFacts.size || !deepEqualJson(reconstructed, value)) {
-        throw new TypeError('inconsistent PTC session-log projection checkpoint facts')
+      // A compacted checkpoint cannot be compared with the fold that produced it:
+      // the payload it dropped is gone from its own side. Admission proves the cut
+      // instead (below it stubs, at or above it text), which is the weaker, stated
+      // claim for compacted states. Non-compacted states keep the full comparison.
+      const summary = retentionSummaryOf(value.timeline)
+      if (summary === undefined) {
+        if (replayComplete && !deepEqualJson(withoutFactDigests(reconstructed), withoutFactDigests(value))) {
+          throw new TypeError('inconsistent PTC session-log projection checkpoint facts')
+        }
+      } else {
+        // A compacted checkpoint dropped its old clusters, so replay can never
+        // reproduce it. Admission proves the summary instead: the retained window is
+        // contiguous with the boundary, nothing below it survives, and the chain is
+        // recomputed from the logged dropped range so the summary cannot certify
+        // itself.
+        // A compacted checkpoint cannot prove its chain from its own state: the fold
+        // that dropped the clusters also dropped the observations, and `logFacts`
+        // hold presentation facts only. Admission claims the boundary and range here;
+        // callers that hold the raw log verify the chain with
+        // `verifyRetentionSummaryAgainstEvents`.
+        validateRetentionSummary(value.timeline, summary)
       }
       return deepFreeze(value)
     } }),
@@ -173,6 +249,24 @@ export function createSessionLogProjection() {
   })
 }
 
+/**
+ * The disposer a session projection registration handed back.
+ *
+ * Two registration contracts are published: an earlier host returns a disposer and a
+ * newer one returns a `ProjectionHandle` (`stateOf`/`readerFor`/`dispose`, possibly
+ * async). Every projection this plugin registers goes through this reader, because a
+ * registration that only understands the earlier shape drops the projection — and
+ * with it the fact that the host accepted it — on the newer contract.
+ * @param {unknown} registration - what `sessionProjections.register` returned.
+ * @returns {(() => unknown)|undefined} the release call, or undefined when the answer
+ *   names neither contract.
+ */
+export function projectionRegistrationDisposer(registration) {
+  if (typeof registration === 'function') return () => registration()
+  if (typeof registration?.dispose === 'function') return () => registration.dispose()
+  return undefined
+}
+
 export function createSessionLogOwner(ctx) {
   const projection = createSessionLogProjection()
   let registeredService
@@ -180,8 +274,10 @@ export function createSessionLogOwner(ctx) {
     try {
       scope.effect(() => {
         const registry = scope.sessionProjections
-        const unregister = registry.register(projection)
-        if (typeof unregister !== 'function') throw new Error('ptc-plus: sessionProjections.register did not return a disposer')
+        const unregister = projectionRegistrationDisposer(registry.register(projection))
+        if (unregister === undefined) {
+          throw new Error('ptc-plus: sessionProjections.register returned neither a disposer nor a handle')
+        }
         registeredService = registry
         return async () => {
           await unregister()
@@ -207,7 +303,7 @@ export function createSessionLogOwner(ctx) {
 }
 
 /** Project session events into immutable facts consumed by prompt presentation. */
-export function projectSessionLog(agent, requestedEdit, projectedState) {
+export function projectSessionLog(agent, requestedEdit, projectedState, options = {}) {
   const events = projectedState === undefined ? sessionEvents(agent?.session) : undefined
   if (projectedState === undefined && !Array.isArray(events)) {
     return Object.freeze({
@@ -226,7 +322,13 @@ export function projectSessionLog(agent, requestedEdit, projectedState) {
   }
   let state = projectedState ?? emptyLogState()
   if (projectedState === undefined) {
-    for (let index = 0; index < events.length; index += 1) state = applyLogEvent(state, events[index], index)
+    const fold = () => {
+      for (let index = 0; index < events.length; index += 1) state = applyLogEvent(state, events[index], index)
+    }
+    // A consumer that needs a dropped cluster refolds the same slice with pruning
+    // disabled; the checkpointed state never carries the flag.
+    if (options.retainAll === true) withFullRetention(fold)
+    else fold()
   }
   const { timeline, contextStep, systemPromptSnapshots, ptcMessages, runtimeMessagesBySeq } = state
   const requestedEntry = requestedEdit === undefined
@@ -243,9 +345,10 @@ export function projectSessionLog(agent, requestedEdit, projectedState) {
   let visibleRuntimeMessages = projectedState === undefined ? undefined : state.visibleRuntimeMessages
   if (projectedState === undefined) try {
     const nodes = agent?.session?.surface?.nodes
-    const knownSeqs = events === undefined ? undefined : new Set(events.map(event => event?.seq))
-    if (Array.isArray(nodes) && nodes.every(seq => isCanonicalSequence(seq)
-      && (knownSeqs === undefined ? seq < agent.session.seq : knownSeqs.has(seq)))) {
+    // `events` is an array here: the caller either passed a projected state or
+    // sessionEvents produced one, so the undefined arm could never run.
+    const knownSeqs = new Set(events.map(event => event?.seq))
+    if (Array.isArray(nodes) && nodes.every(seq => isCanonicalSequence(seq) && knownSeqs.has(seq))) {
       visibleRuntimeMessages = Object.freeze(nodes.flatMap(seq => {
         const record = runtimeMessagesBySeq[`k${seq}`]
         return record === undefined ? [] : [record]
@@ -266,6 +369,10 @@ export function projectSessionLog(agent, requestedEdit, projectedState) {
     editableRun,
     repairSource: editableRun?.source,
     cordisTranscript,
+    retentionSummary: timeline.retentionSummary ?? undefined,
+    // Consumers must be able to tell "the newest cell was dropped for budget" from
+    // "there never was a cell"; both would otherwise look like an undefined run.
+    hotCellDropped: timeline.hotCellDropped === true,
     ...(requestedEdit === undefined ? {} : { requestedEditTarget }),
   })
 }