lossless-core 0.1.0 → 0.1.1

package/dist/index.d.mts

@@ -1,310 +1,1002 @@
 import { Static, TSchema, Type } from "typebox";
-//#region src/assembly.d.ts
-export interface AssemblyMsg {
-  role: string;
-  content?: unknown;
-  /** AgentMessage UserMessage compatibility (Pi requires it on outgoing messages). */
-  timestamp?: number;
+/** Basename of the JSONL metrics log inside a sidecar directory. */
+export declare const METRICS_FILE = "metrics.jsonl";
+/** Size in bytes that triggers rotation (5 MiB); the full log is renamed aside. */
+export declare const METRICS_MAX_BYTES: number;
+/** Rotated generations kept beside the live log; older timestamped files are deleted. */
+export declare const METRICS_KEEP_GENERATIONS = 3;
+/** One metrics row: free-form fields plus an optional unix-ms stamp, session id, and kind. */
+export interface MetricSinkRow extends Record<string, unknown> {
+  ts?: number;
+  session?: string;
+  kind?: string;
+}
+/** The live metrics file inside a sidecar directory. */
+export declare function metricsFilePath(dir: string): string;
+/** Rename an over-budget log to `<file>.<Date.now()>` and keep only the newest generations. Never throws. */
+export declare function rotateMetricsIfNeeded(dir: string): void;
+/** Append one JSONL row, stamping `ts` in unix ms when absent; creates the dir with mode 0700. Never throws. */
+export declare function appendMetricRow(dir: string, row: Record<string, unknown>): void;
+/** Read rotated generations oldest-first plus the live log, skipping missing files and malformed lines. */
+export declare function readMetricRows(dir: string): unknown[];
+/** Characters of a body's description that stay in the preview. The message row
+ * keeps every character, so this bounds what the summarizer reads, not what is
+ * retained. */
+export declare const FILE_PREVIEW_CHARS = 1200;
+export declare const FILE_KINDS: readonly ["json", "jsonl", "csv", "tsv", "code", "text"];
+export type FileKind = (typeof FILE_KINDS)[number];
+export declare function isFileKind(value: unknown): value is FileKind;
+export interface FileDescriptor {
+  fileId: string;
+  path: string;
+  /** Characters retained in the message, not bytes on disk. */
+  bytes: number;
+  sha256: string;
+  kind: FileKind;
+  preview: string;
 }
-export interface AlignedEntry {
+export declare function fileHandle(d: FileDescriptor): string;
+export declare function filePreviewText(d: FileDescriptor): string;
+export declare function describeFile(path: string, text: string): FileDescriptor;
+/** What the body is, decided by structure rather than by extension alone: a
+ * `.ts` file holding a JSON array is JSON, and a `.txt` file holding JSON is
+ * JSON too. The parse is tried before the extension for that reason. */
+export declare function kindOf(path: string, text: string): FileKind;
+export declare function structureOf(kind: FileKind, path: string, text: string): string;
+export declare function previewOf(kind: FileKind, path: string, text: string): string;
+/** One row the pattern path scans. The text is the stored message, whole: the
+ * FTS index holds a prefix, and reading only that is the defect this path
+ * exists to fix. */
+export interface ScannedRow {
+  rowid: number;
   entryId: string;
   role: string;
   text: string;
-  /** Raw content blocks when `text` is not a faithful rendering of them
-   * (`payloadOf`). Carried so ingest stores the same bytes at every call site. */
-  payload?: string;
-  fileHint?: {
-    path: string;
-  };
+  removed: boolean;
 }
-export declare const SYNTHETIC_MARKER = "[LCM session memory";
-export declare function tailKeyOf(m: AssemblyMsg | undefined): string;
-/** Characters the estimator counts for a context: the same rendering `cutIndexFor`
- * measures, so a calibration describes the quantity every threshold here is
- * compared against. */
-export declare function contextChars(messages: readonly AssemblyMsg[]): number;
-export declare function cutIndexFor(messages: readonly AssemblyMsg[], keepRecentTokens: number): number | null;
-export interface SyntheticMessage {
-  role: "user";
-  content: string;
+/** A row that matched, with the first match's position and how many the row
+ * held. `partial` is set when the row was longer than the per-row cap, so a
+ * reader knows the scan stopped before the end of that row. */
+export interface PatternHit {
+  row: ScannedRow;
+  matches: number;
+  at: number;
+  partial: boolean;
+  scannedChars: number;
+}
+export type PatternStop = "end" | "deadline" | "page";
+export interface PatternScanOutcome {
+  hits: PatternHit[];
+  rows: number;
+  partialRows: number;
+  more: boolean;
+  stopped: PatternStop;
+  lastRowId?: number;
+  lastEntryId?: string;
+}
+export interface PatternScanOptions {
+  pattern: CompiledPattern;
+  offset: number;
+  limit: number;
+  /** Characters of one row the scan reads. Above the FTS prefix on purpose,
+   * below the size of an externalized body, and named on the hit when it bites. */
+  perRowChars: number;
+  deadlineAt: number;
+  now: () => number;
+}
+/** The characters a caller can hand a regular expression. A row longer than this
+ * is read up to the cap and the hit says so: a partial scan that looks complete
+ * is the same defect as an index that stops at 100,000 characters. */
+export declare const PATTERN_ROW_CHARS = 200000;
+/** How long one pattern call may scan. Long enough for a session's messages at
+ * 200,000 characters a row, short enough that a pathological pattern is a slow
+ * call rather than a hung session. */
+export declare const PATTERN_DEADLINE_MS = 1000;
+export declare const PATTERN_PAGE_ROWS = 200;
+/** Matches counted in one row before the scan moves on. A row that mentions a
+ * path a thousand times is one hit line, and counting the thousandth costs the
+ * deadline that the next row needs. */
+export declare const MAX_MATCHES_PER_ROW = 100;
+export declare function scanRows(rows: Iterable<ScannedRow>, opts: PatternScanOptions): PatternScanOutcome;
+/** A pattern this module compiled and validated, so a scan cannot receive a
+ * caller's own stateful `RegExp`. */
+export type CompiledPattern = RegExp & {
+  readonly __brand: "CompiledPattern";
+};
+export type PatternCompileResult = {
+  ok: true;
+  pattern: CompiledPattern;
+} | {
+  ok: false;
+  reason: string;
+};
+/** Compile a caller's pattern, with `g` for iteration and `i` unless the caller
+ * asked for case sensitivity, which is the reading the FTS path already has. A
+ * refusal is returned before any row is read. */
+export declare function compilePattern(pattern: string, caseSensitive: boolean): PatternCompileResult;
+export type LcmRole = "user" | "assistant" | "toolResult" | "custom";
+/** What a stored summary's text is worth: `clean` came from an unclipped source
+ * of clean children, `clipped` lost source before the model saw it, `mechanical`
+ * is the deterministic truncate, and `derived` was built from a non-clean source.
+ * The value is durable so a failed ancestor stays discoverable after the child
+ * that made it stale has been repaired. */
+export type SummaryQuality = "clean" | "clipped" | "mechanical" | "derived";
+export declare function isSummaryQuality(value: unknown): value is SummaryQuality;
+/** The level-3 ladder stores this prefix ahead of the mechanical truncate. It is
+ * a storage marker, so a store migration can recognise predated rows without
+ * running the summarizer. */
+export declare const TRUNCATED_SUMMARY_PREFIX = "[lcm:truncated]";
+/** Any role string Pi may emit (custom, branchSummary, bashExecution...) folds to the four stored roles. */
+export declare function normalizeRole(r: string): LcmRole;
+export interface StoredMessage {
+  id: number;
+  entryId: string;
+  role: LcmRole;
+  text: string;
+  tokens: number;
   timestamp: number;
+  /** JSON of the content blocks, present only when `text` is not a faithful
+   * rendering of them (a thinking block, an image, a signature). Absent means
+   * the derived text is the whole message. */
+  payload?: string;
+  /** Set when the entry has left the active branch. The bytes stay; search
+   * excludes the row unless a caller asks for it. */
+  removedAt?: number;
 }
-export type SummaryTier = "rich" | "terse" | "stub";
-export interface RenderableSummary {
+export interface GrepHit {
+  entryId: string;
+  role: LcmRole;
+  text: string;
+  /** The entry has left the active branch; its text is retained. */
+  removed?: boolean;
+  coveringSummaryId?: number;
+}
+export interface SummaryNode {
   id: number;
+  kind: "leaf" | "condensed";
+  text: string;
+  tokens: number;
   depth: number;
   firstEntryId: string;
   lastEntryId: string;
-  text: string;
+  createdAt: number;
+  quality: SummaryQuality;
+  /** A richer sibling text the ladder produced and did not store as primary,
+   * so the projection can serve more detail when the budget has room. */
   thoroughText?: string;
-  tier: SummaryTier;
+  thoroughTokens?: number;
 }
-export declare const STUB_CHARS = 200;
-export type PlainSummary = Omit<RenderableSummary, "tier" | "thoroughText">;
-export declare function renderSummaries(summaries: readonly RenderableSummary[]): string;
-export declare function renderFrontier(nodes: readonly PlainSummary[]): string;
-export declare function buildSynthetic(summaries: readonly RenderableSummary[]): SyntheticMessage;
-//#endregion
-//#region src/commit-policy.d.ts
-export interface AppliedSummary {
+export interface IntegritySnapshot {
+  ftsOk: boolean;
+  messageRows: number;
+  shapes: Array<{
+    id: number;
+    kind: "leaf" | "condensed";
+    depth: number;
+    messages: number;
+    children: number;
+  }>;
+  spans: Array<{
+    id: number;
+    first: string;
+    last: string;
+    firstRowid: number | null;
+    lastRowid: number | null;
+  }>;
+  duplicateSpans: Array<{
+    first: string;
+    last: string;
+    kind: string;
+    count: number;
+  }>;
+  orphanChildParents: number[];
+  deadRuns: Array<{
+    session: string | null;
+    rows: number[];
+  }>;
+  untrackedPending: number[];
+  foreignKeyViolations: number;
+  schemaVersion: number;
+  uncoveredMessages: number;
+}
+/** A fresh row, or the row that already owns the span; `existingTokens` comes
+ * from that row, so a caller reports the collision, not its intended write.
+ * `own` says whether the run that asked may count this row as its own and replace
+ * its text: a row it wrote, a committed row, or its own pending row. Another live
+ * run's pending row is none of those. */
+export type InsertSummaryResult = {
   id: number;
-  depth: number;
+  created: true;
+  own: true;
+} | {
+  id: number;
+  created: false;
+  own: boolean;
+  existingTokens: number;
+  /** The colliding row's summary text. A caller whose view cannot read the row
+   * still has to answer for the span it was given, and this is that span's
+   * summary to reuse. */
+  existingText: string;
+  foreignLive: boolean;
+};
+/** What a caller hands `insertSummary`. `run` stamps the row pending for that run;
+ * without it the row is committed memory. */
+export type InsertSummaryInput = {
+  kind: "leaf" | "condensed";
   text: string;
-  thoroughText?: string;
+  tokens: number;
+  depth: number;
   firstEntryId: string;
   lastEntryId: string;
-  tier: SummaryTier;
+  /** Defaults to `clean`: a caller that does not know the provenance quality
+   * must not invent a loss the store would then try to repair. */
+  quality?: SummaryQuality;
+  messageIds?: number[];
+  childSummaryIds?: number[];
+  fileIds?: string[];
+  thoroughText?: string;
+  run?: string;
+};
+/** What a compaction pass needs from the store: the committed memory plus, when
+ * the pass reads through `LcmStore.forRun`, the rows of its own run. `LcmStore`
+ * satisfies this with the committed-only meaning. */
+export interface PassStore extends IngestStore {
+  /** The branch range a set of entry ids occupies: the oldest and the newest row
+   * the store holds among them, or null when it holds none. Pi's context array
+   * is not branch order (it hoists the newest compaction entry to the front),
+   * while a span is a row range, so the store, whose rows are appended in
+   * branch order, is what decides which end comes first. */
+  spanBounds(entryIds: readonly string[]): {
+    firstEntryId: string;
+    lastEntryId: string;
+  } | null;
+  uncoveredMessagesInSpan(firstEntryId: string, lastEntryId: string): StoredMessage[];
+  filesForMessages(ids: readonly number[]): Array<FileDescriptor & {
+    messageId: number;
+  }>;
+  frontier(firstEntryId: string, lastEntryId: string): SummaryNode[];
+  getSummary(id: number): SummaryNode | undefined;
+  parentSummaryIds(summaryId: number): number[];
+  fileIdsForSummaries(ids: readonly number[]): string[];
+  /** Stored messages in row order, so a pass can re-read the exact source a
+   * leaf's provenance names. */
+  messagesByIds(ids: readonly number[]): StoredMessage[];
+  insertSummary(s: InsertSummaryInput): InsertSummaryResult;
+  /** `quality` is optional so a caller rewriting text it did not derive keeps
+   * the stored verdict; a replacement that knows its source passes it. */
+  updateSummaryText(id: number, text: string, tokens: number, quality?: SummaryQuality): void;
+  setThoroughText(id: number, thoroughText: string): void;
 }
-export type AssemblyAction = "quiet" | "consider-apply" | "stable" | "recommit";
-export interface CommitState {
-  cutCount: number;
-  synthetic: SyntheticMessage;
-  applied: AppliedSummary[];
-  summaryId: number;
-  appliedAtOccupancy: number;
-  tailKey: string;
+/** A node's provenance split into the two child types, each in the order the
+ * source ran: messages by row, child summaries by the row their span starts at. */
+export interface SummarySources {
+  messages: number[];
+  summaries: number[];
 }
-export declare const DEFAULT_SWAP_RATIO = 0.7;
-export declare const DEFAULT_RECUT_RATIO = 0.85;
-export declare const WINDOW_SAFETY_CEILING = 0.9;
-/** Ceiling for the resolved recut fraction: a line above 1.0 is unreachable, so
- * the pin never re-cuts and the raw tail grows past the window while "stable"
- * is reported forever. Strictly above WINDOW_SAFETY_CEILING + RECUT_ABOVE_SWAP_MARGIN. */
-export declare const RECUT_CEILING = 0.95;
-export declare const REZONE_MARGIN = 1.18;
-export interface ThresholdConfig {
-  swapAtRatio?: number;
-  swapAtTokens?: number;
-  recutAtRatio?: number;
-  recutAtTokens?: number;
-  smartZone?: number;
-}
-export type ZoneThresholds = ThresholdConfig;
-export interface ResolvedThresholds {
-  swap: number;
-  recut: number;
-  clamped: boolean;
-}
-export declare function mergeZone(global: ThresholdConfig, zone?: ZoneThresholds): ThresholdConfig;
-export declare function thresholdConflicts(cfg: ThresholdConfig, scope?: string): string[];
-export declare function effectiveThresholds(cfg: ThresholdConfig, contextWindow: number): ResolvedThresholds;
-export declare function nextAction(state: CommitState | null, occupancy: number, swapRatio: number, recutRatio: number): AssemblyAction;
-export declare function cutMayReplace(previous: CommitState | null, newCutCount: number): boolean;
-//#endregion
-//#region src/metrics.d.ts
-export declare function metricsPath(): string;
-/** The metrics log, oldest generation first, so a window longer than one
- * generation still reads as one history. */
-export declare function metricsLogFiles(): string[];
-export declare function rotateIfNeeded(path: string, maxBytes: number): void;
-export declare function pruneGenerations(path: string, keep: number): void;
-export declare function appendMetric(record: MetricRecord): void;
-export interface UsageLike {
-  input?: unknown;
-  output?: unknown;
-  cacheRead?: unknown;
-  cacheWrite?: unknown;
-  cost?: {
-    input?: unknown;
-    output?: unknown;
-    total?: unknown;
-  };
-}
-interface MetricBase {
-  /** Session tag. Absent on rows written outside a session (`gc`, `import`). */
-  session?: string;
+/** Replace a node's text only if it still holds the text the caller read. The
+ * rich tier is cleared in the same statement: it described the old source. */
+export interface SummaryTextCas {
+  id: number;
+  expectedText: string;
+  expectedTokens: number;
+  text: string;
+  tokens: number;
+  /** The verdict for the new text. A repair always writes `clean`. */
+  quality: SummaryQuality;
+}
+/** The store surface a heal run needs. It is a `PassStore` plus the committed
+ * scan and compare-and-swap write that a repair uses, so a heal cannot write
+ * through a run view whose pending rows the projection does not serve. */
+export interface HealStore extends PassStore {
+  /** Committed nodes whose quality is not clean, or whose text carries the
+   * mechanical prefix as a fallback for imported and predated rows. */
+  taintedSummaries(prefix: string): SummaryNode[];
+  summarySources(summaryId: number): SummarySources;
+  casUpdateSummaryText(update: SummaryTextCas): boolean;
+  /** Mark a clean node stale because a child changed under it. A node already
+   * non-clean keeps its verdict: mechanical and clipped are facts about its own
+   * text, and derived is already the retry marker. */
+  markSummaryDerived(id: number): boolean;
 }
-export type MetricSpan = [string, string];
-export type SummaryStage = "leaf" | "condensed";
-export type CompactionStage = "blocking" | "async" | "direct";
-export type SummaryLevel = 1 | 2 | 3;
-/** One model's turn in a summarizer chain, in the order it was tried. */
-type SummarizerAttempt = {
-  model: string;
-  outcome: "ok" | "empty";
-} | {
-  model: string;
-  outcome: "threw";
-  error: string;
-};
-export type UsageCounters = {
-  input: number | null;
-  output: number | null;
-  cacheRead: number | null;
-  cacheWrite: number | null;
-  costInput: number | null;
-  costOutput: number | null;
-  costTotal: number | null;
-};
-/** The counters to put on a row, or `undefined` when the provider billed
- * nothing (an aborted call, or a provider that reports no usage). */
-export declare function billedCounters(usage: UsageLike | undefined): UsageCounters | undefined;
-/** One metrics row per measured assistant message: no numeric counter at all
- * (aborted turn, legacy row) yields `undefined`, so it does not count as a turn
- * in the report's cache-economics averages. */
-export declare function usageRecord(usage: UsageLike | undefined): UsageRow | undefined;
-export type SummarizerStage = "blocking" | "async";
-/** Why a summarizer call failed, as far as the provider's own text says. A
- * closed set, and `unknown` is a real answer: a classification that guesses is
- * worse than a bucket that says it could not tell, and the raw message stays on
- * the row either way. `capped` is not a provider failure: it is the pass giving
- * up after too many of them, and the category beside it says which one. */
-export type SummarizerFailureCategory = "auth" | "rate-limit" | "timeout" | "unavailable" | "length" | "empty" | "capped" | "unknown";
-/** `ok` answered with usable text, `empty` answered with none, `failure` was rejected. */
-export type SummarizerOutcome = "ok" | "empty" | "failure";
-export interface SummarizerUsageOptions {
-  /** The resolved model key, as `modelKey` renders it. */
-  model: string;
-  stage?: SummarizerStage;
-  outcome: SummarizerOutcome;
-  /** The provider's own stop word, so `length` and `error` are told apart. */
-  stopReason?: string;
-  session?: string;
+export interface IngestStore {
+  hasEntry(entryId: string): boolean;
+  insertMessage(m: {
+    entryId: string;
+    role: LcmRole;
+    text: string;
+    tokens: number;
+    timestamp: number;
+    payload?: string;
+  }): number;
+  insertFile(d: FileDescriptor, firstEntryId: string): void;
+  linkMessageFile(messageId: number, fileId: string): void;
 }
-export type SummarizerUsageRow = UsageCounters & {
-  event: "lcm";
-  kind: "summarizer-usage";
-  model: string;
-  stage?: SummarizerStage;
-  outcome: SummarizerOutcome;
-  stopReason?: string;
-  session?: string;
-};
-/** One provider call the summarizer made. `usage` rows cannot carry it, since
- * those come from Pi's `message_end` for the session's own messages while the
- * summarizer talks to the model registry directly. */
-export declare function summarizerUsageRecord(usage: UsageLike | undefined, opts: SummarizerUsageOptions): SummarizerUsageRow | undefined;
-export type UsageRow = MetricBase & UsageCounters & {
-  event: "usage";
-};
-interface LcmRowBase extends MetricBase {
-  event: "lcm";
+/** Characters of a message the full-text index covers. Storage is verbatim, so
+ * this bounds the index and not the row. */
+export declare const FTS_PREFIX_CHARS = 100000;
+/** First published schema: pre-publish development stores were wiped, so every
+ * store in the wild starts here and later generations count from this one.
+ * Generation 2 adds the summary quality verdict. */
+export declare const SCHEMA_VERSION = 2;
+/** A store left behind by an older build. A read-only open refuses it rather than
+ * migrating it: a search must not rewrite a file it is only reading, and a store
+ * that cannot answer this build's statements has to be a reported skip. */
+export declare class StaleStoreError extends Error {
+  readonly generation: number;
+  constructor(generation: number);
 }
-export type ContextDecisionRow = LcmRowBase & {
-  kind: "context-decision";
-  action: string;
-  occupancy: number;
-  tokens: number;
-  window: number;
-  soft: number;
-  commit: number;
-  zone?: string;
-  committed: boolean;
-  /** Present when `tokens` is the estimator's count rather than Pi's: the
-   * reported figure described a context other than the one on hand. */
-  tokensEstimated?: true;
-};
-export type ProjectionOverBudgetRow = LcmRowBase & {
-  kind: "projection-over-budget";
-  nodes: number;
-  renderedTokens: number;
-  budgetTokens: number;
-};
-export type SwapAppliedRow = LcmRowBase & {
-  kind: "swap-applied";
-  summaryId: number;
-  cutCount: number;
-  distinctBoundary: boolean;
-  appliedAtOccupancy: number;
-  nodes: number;
-  stubbed: number;
-  renderedTokens: number;
-  budgetTokens: number;
-};
-/**
- * A swap the policy did not commit. `tokens` is the occupancy that triggered
- * the bail; the kick-backoff writer names the entry it declined to kick instead.
- */
-export type SwapBlockedRow = LcmRowBase & {
-  kind: "swap-blocked";
-  reason: string;
-  occupancy: number;
-  tokens?: number;
-  entryId?: string;
-};
-export type PiCompactionRow = LcmRowBase & {
-  kind: "pi-compaction";
-  entryId: string;
-  tokens?: number;
-  window?: number;
-};
-/** One calibration sample against Pi's own count: the characters this build
- * counted for the growth of the context, the tokens Pi reported for it, and the
- * ratio the samples now support. A null ratio is the answer "cannot say", which is
- * why the row carries the sample beside it. */
-export type EstimateCalibratedRow = LcmRowBase & {
-  kind: "estimate-calibrated";
-  chars: number;
-  tokens: number;
+/** What a store knows about a model rather than about a session: the token ratio
+ * measured for it against Pi's reported usage, and the context window a provider
+ * stated when it refused an over-window request. A null ratio is a measurement that
+ * disagree with itself, which is a state the estimator reads as "keep the
+ * constant" and the report names. A null window is a model no provider has
+ * corrected, which leaves Pi's belief in place. */
+export interface ModelState {
   charsPerToken: number | null;
   samples: number;
-};
-/** A provider stated the real context window in an overflow error, which is the
- * one window number in this system that is not a belief. */
-export type WindowCorrectedRow = LcmRowBase & {
-  kind: "window-corrected";
-  model: string;
-  window: number;
-  source: string;
-};
-/** A refused request proved the window in use was too big without naming the
- * real one: the window for the next turn is floored at what the request carried,
- * and `window` is the stored correction when one exists. */
-export type WindowFloorRow = LcmRowBase & {
-  kind: "window-floor";
-  tokens: number;
-  window: number | null;
-};
-export type ConfigProblemRow = LcmRowBase & {
-  kind: "config-problem";
-  problems: string[];
-};
-export type SummaryInputClippedRow = LcmRowBase & {
-  kind: "summary-input-clipped";
-  entryId: string;
-  keptChars: number;
-  droppedChars: number;
-};
-export type SummaryFallbackStoredRow = LcmRowBase & {
-  kind: "summary-fallback-stored";
-  stage: SummaryStage;
-  span: MetricSpan;
-  sourceChars: number;
-};
-export type SummaryStoredRow = LcmRowBase & {
-  kind: "summary-stored";
-  stage: SummaryStage;
-  level: SummaryLevel;
-  depth: number;
-  tokens: number;
-  summaryId: number;
-  span: MetricSpan;
-};
-export type SummarySkippedCoveredRow = LcmRowBase & {
-  kind: "summary-skipped-covered";
-  stage: SummaryStage;
-  span: MetricSpan;
-  messages: number;
-};
-export type SummarySkippedExistingRow = LcmRowBase & {
-  kind: "summary-skipped-existing";
-  stage: SummaryStage;
-  summaryId: number;
-  depth: number;
-  span: MetricSpan;
-  attemptedTokens: number;
-  existingTokens: number;
-};
-export type SummaryOversizedRow = LcmRowBase & {
-  kind: "summary-oversized";
-  stage: SummaryStage;
-  depth: number;
+  contextWindow: number | null;
+  windowSource: string | null;
+}
+export declare const WINDOW_SOURCE_PROVIDER = "provider-error";
+export declare class LcmStore {
+  private db;
+  private dbPath;
+  /** Opened for reading a past session's store: no migration ran, so `generation`
+   * is the file's own and a caller may have to skip it. */
+  private readOnly;
+  /** The schema generation this file carries, which read-only opens do not
+   * change. A writer holds `SCHEMA_VERSION` by the time its constructor returns. */
+  readonly generation: number;
+  /** True while a `transaction` callback is running, so a reentrant call joins
+   * the open transaction instead of nesting one, which SQLite rejects. */
+  private inTransaction;
+  /** Tokens of the runs this handle has open. Two runs can overlap inside one
+   * handle, because the blocking path stops waiting for the async pass, so a
+   * token names a run and not the handle. Whether a run this handle does not
+   * hold is still running is read from the `runs` table, never from here. */
+  private liveTokens;
+  private reapedInRun;
+  private stmts;
+  constructor(dbPath: string, opts?: {
+    readOnly?: boolean;
+    queryOnly?: boolean;
+  });
+  /** Close the handle: no run of this handle survives it, and the connection is
+   * released even when a run could not be abandoned, so a failure here cannot
+   * leave a connection and a set of invisible rows behind. */
+  close(): void;
+  /** Open a run: rows written with its token are pending until `commitRun`, and
+   * the row this writes is what lets another handle tell it from a run whose
+   * writer is gone. Reaps what such a run left, which this handle cannot be. */
+  openRun(opts?: {
+    session?: string;
+  }): {
+    token: string;
+    dropped: number;
+  };
+  /** True while any run is open whose writer is still there, this handle's or
+   * another process's, which is what an import has to wait for. */
+  hasLiveRun(): boolean;
+  /** Commit a run: drop its pending rows whose child no longer resolves, then flip
+   * the rest. One transaction, so a reader never sees a half-committed run, and
+   * idempotent for a token this handle no longer holds. */
+  commitRun(token: string): {
+    committed: number;
+    dropped: number;
+  };
+  /** Delete a run's pending rows and close it. Idempotent, so a `finally` can call
+   * it after a commit has already closed the run. */
+  abandonRun(token: string): number;
+  /** A view of this store for one run: the committed memory plus that run's own
+   * rows, which is what a pass must read to see its own writes. */
+  forRun(token: string): PassStore;
+  /** True while the run that wrote a row is still going somewhere, as far as this
+   * store can tell. A run this handle holds is live; a run written by this
+   * process is live, because a pid cannot separate two handles in one process and
+   * refusing to delete is the safe answer; a run written by another process is
+   * live while its pid is. A row whose run has no record at all was written
+   * without one, which no open path does, so nothing owns it. */
+  private isRunLive;
+  /** Delete what a run left behind whose writer is gone, and its record with it.
+   * A live owner's rows are never touched, whatever handle asks, which is what
+   * makes a second handle safe to open. No reader can see the rows this removes,
+   * and each one holds the span it claims. */
+  private reapPending;
+  /** Delete this run's pending rows whose child no longer exists, deepest first: a
+   * parent that loses a child must not leave a grandparent behind. A child can go
+   * away between the frontier read that selected it and this commit. */
+  private dropUnresolvable;
+  hasEntry(entryId: string): boolean;
+  insertMessage(m: {
+    entryId: string;
+    role: LcmRole;
+    text: string;
+    tokens: number;
+    timestamp: number;
+    payload?: string;
+  }): number;
+  /** One write transaction around a group of statements, so a compaction is
+   * atomic: the node row, its provenance rows and its file links either all
+   * land or none do. `node:sqlite` ships no transaction helper, so the
+   * statements are explicit. A reentrant call joins the open transaction: the
+   * caller that opened it owns the commit, so an inner throw rolls the whole
+   * group back rather than leaving a half-applied write. */
+  transaction<T>(fn: () => T): T;
+  insertSummary(s: InsertSummaryInput): InsertSummaryResult;
+  insertFile(d: FileDescriptor, firstEntryId: string): void;
+  linkMessageFile(messageId: number, fileId: string): void;
+  filesForMessages(ids: readonly number[]): Array<FileDescriptor & {
+    messageId: number;
+  }>;
+  fileIdsForMessages(ids: readonly number[]): string[];
+  fileIdsForSummaries(ids: readonly number[]): string[];
+  filesForSummaries(ids: readonly number[]): FileDescriptor[];
+  allFiles(): Array<FileDescriptor & {
+    entryIds: string[];
+  }>;
+  /** Replace a node's text in place: the span, provenance, and created_at stay.
+   * A caller that knows the new text's verdict passes it; a caller that does not
+   * leaves the stored verdict alone. */
+  updateSummaryText(id: number, text: string, tokens: number, quality?: SummaryQuality): void;
+  setThoroughText(id: number, thoroughText: string): void;
+  messagesInSpan(firstEntryId: string, lastEntryId: string): StoredMessage[];
+  spanBounds(entryIds: readonly string[]): {
+    firstEntryId: string;
+    lastEntryId: string;
+  } | null;
+  uncoveredMessagesInSpan(firstEntryId: string, lastEntryId: string, run?: string): StoredMessage[];
+  /** Minimal top-level cover: no summary's child, oldest first, dropping any node
+   * whose span sits inside the previous kept one, which is what keeps the cover
+   * non-nested: condensation's group span must be one no row already holds. */
+  frontier(firstEntryId: string, lastEntryId: string, run?: string): SummaryNode[];
+  grep(pattern: string, opts?: {
+    limit?: number;
+    offset?: number;
+    withinMessageIds?: ReadonlySet<number>;
+    includeRemoved?: boolean;
+  }): GrepHit[];
+  grepCount(pattern: string, opts?: {
+    withinMessageIds?: ReadonlySet<number>;
+    includeRemoved?: boolean;
+  }): number | undefined;
+  messagePage(afterRowId: number, limit: number, opts?: {
+    withinMessageIds?: ReadonlySet<number>;
+    includeRemoved?: boolean;
+  }): ScannedRow[];
+  coveringSummaryId(entryId: string): number | undefined;
+  messageByEntryId(entryId: string): StoredMessage | undefined;
+  parentSummaryIds(summaryId: number, run?: string): number[];
+  childSummaryIds(summaryId: number): number[];
+  taintedSummaries(prefix: string): SummaryNode[];
+  summarySources(summaryId: number): SummarySources;
+  /** One statement, so the text and its token count move together and a row
+   * another writer changed is reported as not updated rather than overwritten. */
+  casUpdateSummaryText(update: SummaryTextCas): boolean;
+  /** A clean node whose child changed becomes `derived`; a node that already
+   * carries a stronger verdict keeps it. Returns true when this call wrote. */
+  markSummaryDerived(id: number): boolean;
+  getSummary(id: number, run?: string): SummaryNode | undefined;
+  /** Bounded by a visited set, so a corrupt cycle cannot recurse forever. */
+  coveredMessageIds(summaryId: number, seen?: Set<number>): number[];
+  integritySnapshot(): IntegritySnapshot;
+  /** Restore the full-text index. The schema is re-applied first, because a
+   * dropped virtual table cannot be rebuilt, only recreated, and the DDL that
+   * knows how is the schema itself. Everything in it is `IF NOT EXISTS` apart
+   * from the two triggers, which are dropped and recreated on purpose. */
+  rebuildFts(): void;
+  deleteOrphanSpans(): number;
+  deleteOrphanChildren(): number;
+  reapDeadRuns(): number;
+  /** When one span is claimed twice, the row that carries provenance wins over
+   * one that cannot be expanded, and the newest wins between equals. */
+  dedupeSpans(): number;
+  /** Mark entries that left the active branch, or clear the mark when a
+   * navigation brings them back. Returns the rows the call actually changed, so
+   * a metric can tell a real change from a no-op reconciliation. */
+  setRemoved(entryIds: readonly string[], removedAt: number | null): number;
+  removedMessageCount(): number;
+  messagesByIds(ids: readonly number[]): StoredMessage[];
+  allMessages(): StoredMessage[];
+  entrySpan(): {
+    first: string;
+    last: string;
+  } | undefined;
+  coveredSize(summaryId: number): {
+    tokens: number;
+    messages: number;
+  };
+  allSummaries(): SummaryNode[];
+  messageCount(): number;
+  /** Number of stored messages whose entry id starts with `prefix`. Used by
+   * status reporting to count a family of rows (for example compaction marks
+   * and summaries) without scanning the table. */
+  entryCountWithPrefix(prefix: string): number;
+  backup(backupPath: string): void;
+  /** The calibration recorded for a model. `undefined` is a model nothing has
+   * sampled; a null ratio is one whose samples disagreed, which the caller reads
+   * as "keep the constant" rather than "no data". */
+  getModelState(modelKey: string): ModelState | undefined;
+  setModelState(modelKey: string, state: Pick<ModelState, "charsPerToken" | "samples">): void;
+  /** Records the window a provider stated. Its own statement rather than part of
+   * `setModelState`, because the two are learned at different moments: a later
+   * calibration must not clear a window, and a window must not touch samples. */
+  setModelWindow(modelKey: string, contextWindow: number, source: string): void;
+  stats(): {
+    messages: number;
+    summaries: number;
+    dbBytes: number;
+    payloadMessages: number;
+    payloadBytes: number;
+    files: number;
+    fileBytes: number;
+    removedMessages: number;
+  };
+}
+/** Reply when the caller has no store: nothing ingested yet, or the session is ephemeral. */
+export declare const NO_STORE = "LCM: no stored history for this session yet (nothing has been ingested, or the session is ephemeral).";
+/** Search scopes `lcm_grep` accepts: this session only, plus the past-session scopes. */
+export declare const RECALL_SCOPES: readonly ["session", "sessions", "all_sessions"];
+/** One of `RECALL_SCOPES`; `sessions` and `all_sessions` are equivalent and both read past sidecars. */
+export type RecallScope = (typeof RECALL_SCOPES)[number];
+/** What `lcm_expand` reads: a summary listing by id, or one message by entry id with an optional summary check. */
+export type Address = {
+  readonly kind: "summary";
+  readonly id: number;
+} | {
+  readonly kind: "entry";
+  readonly entryId: string;
+  readonly id?: number;
+};
+/** Past-search outcome: redacted text plus hit, scanned, and skipped session counts. */
+export interface RecallPastSearchResult {
+  readonly text: string;
+  readonly hits: number;
+  readonly scanned: number;
+  readonly skipped: number;
+}
+/** Past-session open outcome: the read-only store and id, or why it could not be opened. */
+export type OpenPastResult = {
+  readonly kind: "opened";
+  readonly sessionId: string;
+  readonly store: LcmStore;
+} | {
+  readonly kind: "missing" | "unreadable";
+};
+/** Host seams the recall answers read through: store lookup, redactor, metrics recorder, and past-session hooks. */
+export interface RecallToolDeps {
+  readonly storeFor: (sessionId: string | undefined) => LcmStore | undefined;
+  readonly redact: (text: string) => string;
+  readonly record?: (row: Record<string, unknown>) => void;
+  readonly sessionOf?: (sessionId: string) => string;
+  readonly isReader?: (sessionId: string) => boolean;
+  readonly searchPast?: (session: string, query: string, scope: Exclude<RecallScope, "session">, limit: unknown) => RecallPastSearchResult;
+  readonly openPast?: (session: string, pastSession: string) => OpenPastResult;
+  readonly pastSearchUnreachableText?: string;
+  readonly pastReadUnreachableText?: string;
+}
+/** Answer `lcm_grep`: the session `grepView`, or past sidecars when the scope names them; readers stay session-scoped. */
+export declare function grepAnswer(deps: RecallToolDeps, callerSessionID: string, input: unknown): string;
+/** Answer `lcm_describe`: the redacted cost and contents of one summary id, or why it missed. */
+export declare function describeAnswer(deps: RecallToolDeps, callerSessionID: string, input: unknown): string;
+/** Answer `lcm_expand`: list a summary or read one message, capped at `MAX_EXPAND_CHARS`; a foreign `session` id reads a past sidecar read-only. */
+export declare function expandAnswer(deps: RecallToolDeps, callerSessionID: string, input: unknown): string;
+/** Parse `id`/`entry_id` args into an `Address`: error text when malformed, undefined when neither is present. */
+export declare function readAddress(args: Record<string, unknown>): Address | string | undefined;
+/** Refusal text when an address names no stored summary or message, else undefined. */
+export declare function addressProblem(store: LcmStore, address: Address): string | undefined;
+/** Read a validated address with `char_offset` paging capped at `maxChars` characters. */
+export declare function readAddressed(store: LcmStore, redact: (text: string) => string, address: Address, args: Record<string, unknown>, maxChars: number): {
+  ok: boolean;
+  text: string;
+};
+/** Classify an `lcm_expand` reply as hit, miss, refused, or error for metric rows. */
+export declare function expandQueryOutcome(text: string): "hit" | "miss" | "refused" | "error";
+/** Shared redaction seam for every harness adapter. Pi passes its live
+ * config getter so a cockpit toggle takes effect immediately; OpenCode
+ * passes its resolved plugin options (which today carry no flag, so the
+ * adapter always redacts, preserving the current ignore-flag behavior in
+ * one central place). Both shapes flow into core's `makeRedact`, so the
+ * flag check lives here, not at each call site. */
+/** Flag carrier both adapters satisfy: unset redacts, `false` disables. */
+export interface RedactConfig {
+  readonly redactSecrets?: boolean;
+}
+/** One adapter for `piConfig` (via getter) and `opencodeOpts` (via value):
+ * a config value or a getter for one, out a `(text) => string` redactor. */
+export declare function makeRedactConfigAdapter(config: RedactConfig | (() => RedactConfig)): (text: string) => string;
+/** One sidecar on disk, named by its file stem. */
+export interface SidecarRef {
+  readonly id: string;
+  readonly path: string;
+}
+/** File suffix for sidecar databases. OpenCode uses `.sqlite`. */
+export declare const SIDECAR_EXTENSION = ".sqlite";
+/** Replace every character a session id cannot carry with `_`. */
+export declare function sanitizeSidecarId(sessionId: string): string;
+/** Create the sidecar directory when missing, then repair its mode. */
+export declare function ensureSidecarDir(dir: string): void;
+/** Sidecar file for a session id: sanitized stem plus extension, joined under the sidecar dir. */
+export declare function sidecarPathFor(dir: string, sessionId: string, extension?: string): string;
+/** Live sidecar refs newest-first (mtime, then id); skips non-files and one optionally excluded path. */
+export declare function listSidecarRefs(dir: string, opts?: {
+  extension?: string;
+  excludePath?: string;
+}): SidecarRef[];
+/** Delete a sidecar database and its WAL and shared-memory files. */
+export declare function dropSidecarFiles(path: string): void;
+/** Where sidecars live and which extension names them; defaults to `.sqlite`. */
+export interface SidecarStoresOptions {
+  readonly dir: string;
+  readonly extension?: string;
+}
+/** One SQLite sidecar per session, opened on first use and held for reuse. */
+export declare class SidecarStores {
+  private readonly stores;
+  /** Sidecar directory this cache reads and writes. */
+  readonly dir: string;
+  /** File extension naming sidecar databases, including the leading dot. */
+  readonly extension: string;
+  /** Open the cache, creating the dir (mode 0700) when missing; stores open lazily. */
+  constructor(options: SidecarStoresOptions);
+  /** File path for one session id under this cache's dir and extension. */
+  pathFor(sessionId: string): string;
+  /** Open-once store for a session id, reused across calls until dropped or closed. */
+  for(sessionId: string): LcmStore;
+  /** Open store already held for a session id, if any, without opening one. */
+  peek(sessionId: string): LcmStore | undefined;
+  /** Session ids with an open store in this cache. */
+  ids(): string[];
+  /** Live sidecar refs newest-first, optionally excluding one session id. */
+  list(excludeSessionId?: string): SidecarRef[];
+  /** Close the held store, forget it, and delete its database plus WAL and SHM files. */
+  drop(sessionId: string): void;
+  /** Close every held store and forget them; files stay on disk. */
+  close(): void;
+}
+/** What one call was billed, in numbers, so a pass can sum its spend.
+ * `UsageLike` in `metrics.ts` is the tolerant reader of the same facts at the
+ * metrics boundary, and a `Usage` satisfies it. */
+export interface Usage {
+  input: number;
+  output: number;
+  cacheRead: number;
+  cacheWrite: number;
+  /** A subset of `cacheWrite`, reported by hosts that split retention. */
+  cacheWrite1h?: number;
+  /** A subset of `output`, reported by hosts that expose the breakdown. */
+  reasoning?: number;
+  /** The host derived the counters from characters because the provider
+   * reported none. A cost beside it is a bounded estimate, not a bill. */
+  estimated?: true;
+  totalTokens: number;
+  cost: {
+    input: number;
+    output: number;
+    cacheRead: number;
+    cacheWrite: number;
+    total: number;
+  };
+}
+/** How core tells the operator something. A host with no UI is `none` rather
+ * than a dropped callback, so a caller has one branch and no optional to miss. */
+export type Notices = {
+  readonly kind: "none";
+} | {
+  readonly kind: "ui";
+  notify(text: string, level: "info" | "warning"): void;
+};
+/** One model the host can call. `key` is the spelling config zones and metric
+ * rows already use; `model` is the host's own handle, opaque here. */
+export interface ModelRef<Model> {
+  readonly key: string;
+  readonly reasoning: boolean;
+  readonly model: Model;
+}
+export interface ModelRequest {
+  readonly provider: string;
+  readonly id: string;
+}
+export interface CompletionRequest {
+  readonly prompt: string;
+  readonly maxTokens: number;
+}
+/** What a call came back with. `stop` is the host's own word, kept verbatim for
+ * metric rows; `capped` is the host saying the answer was cut short, which is
+ * the one thing a caller must never store. */
+export type ModelAnswer = {
+  outcome: "answer";
+  text: string;
+  stop: string;
+  usage: Usage | undefined;
+} | {
+  outcome: "failed";
+  reason: string;
+  capped: boolean;
+  stop: string;
+  usage: Usage | undefined;
+};
+export interface ModelHost<Model> {
+  readonly notices: Notices;
+  session(): ModelRef<Model> | undefined;
+  find(requested: ModelRequest): ModelRef<Model> | undefined;
+  complete(model: ModelRef<Model>, request: CompletionRequest): Promise<ModelAnswer>;
+}
+/** A tool the reader may call. The schema is the host's, passed through rather
+ * than rebuilt. */
+export interface ReaderTool {
+  name: string;
+  description: string;
+  parameters: TSchema;
+}
+export interface ReaderCall {
+  readonly id: string;
+  readonly name: string;
+  readonly arguments: Record<string, unknown>;
+}
+export interface ReaderResult {
+  readonly call: ReaderCall;
+  readonly text: string;
+}
+/** What one reader step produced. `reads` asks the caller to run the calls;
+ * `answered` means the reader is done, with whatever text it accumulated. */
+export type ReaderReply = {
+  outcome: "reads";
+  calls: readonly ReaderCall[];
+  text: string;
+  usage: Usage | undefined;
+} | {
+  outcome: "answered";
+  text: string;
+  usage: Usage | undefined;
+} | {
+  outcome: "failed";
+  reason: string;
+  usage: Usage | undefined;
+};
+export interface ReaderRequest {
+  readonly systemPrompt: string;
+  readonly brief: string;
+  readonly tools: readonly ReaderTool[];
+}
+/** One reader conversation. The host owns the transcript: `next` appends the
+ * results it is handed, appends its own reply, and calls the model. */
+export interface Reading {
+  next(results: readonly ReaderResult[]): Promise<ReaderReply>;
+}
+export interface Reader {
+  begin(request: ReaderRequest): Reading;
+}
+export declare function metricsPath(): string;
+/** The metrics log, oldest generation first, so a window longer than one
+ * generation still reads as one history. */
+export declare function metricsLogFiles(): string[];
+export declare function rotateIfNeeded(path: string, maxBytes: number): void;
+export declare function pruneGenerations(path: string, keep: number): void;
+export declare function appendMetric(record: MetricRecord): void;
+/** Where a row goes. A pass injects one sink so every row it causes reaches the
+ * same place, including the calls its completer makes. */
+export type MetricsSink = (record: MetricRecord) => void;
+export interface UsageLike {
+  input?: unknown;
+  output?: unknown;
+  cacheRead?: unknown;
+  cacheWrite?: unknown;
+  cost?: {
+    input?: unknown;
+    output?: unknown;
+    total?: unknown;
+  };
+  /** The host counted characters because the provider reported no usage. */
+  estimated?: unknown;
+}
+interface MetricBase {
+  /** Session tag. Absent on rows written outside a session (`gc`, `import`). */
+  session?: string;
+}
+export type MetricSpan = [string, string];
+export type SummaryStage = "leaf" | "condensed";
+export type CompactionStage = "blocking" | "async" | "direct" | "heal";
+export type SummaryLevel = 1 | 2 | 3;
+/** One model's turn in a summarizer chain, in the order it was tried. */
+type SummarizerAttempt = {
+  model: string;
+  outcome: "ok" | "empty";
+} | {
+  model: string;
+  outcome: "threw";
+  error: string;
+};
+export type UsageCounters = {
+  input: number | null;
+  output: number | null;
+  cacheRead: number | null;
+  cacheWrite: number | null;
+  costInput: number | null;
+  costOutput: number | null;
+  costTotal: number | null;
+};
+/** The counters to put on a row, or `undefined` when the provider billed
+ * nothing (an aborted call, or a provider that reports no usage). */
+export declare function billedCounters(usage: UsageLike | undefined): UsageCounters | undefined;
+/** One metrics row per measured assistant message: no numeric counter at all
+ * (aborted turn, legacy row) yields `undefined`, so it does not count as a turn
+ * in the report's cache-economics averages. */
+export declare function usageRecord(usage: UsageLike | undefined): UsageRow | undefined;
+/** The stage a completer ran under. Same vocabulary as `CompactionStage`, so a
+ * direct pass labels its completer rows and its engine rows alike. */
+export type SummarizerStage = CompactionStage;
+/** Why a summarizer call failed, as far as the provider's own text says. A
+ * closed set, and `unknown` is a real answer: a classification that guesses is
+ * worse than a bucket that says it could not tell, and the raw message stays on
+ * the row either way. `capped` is not a provider failure: it is the pass giving
+ * up after too many of them, and the category beside it says which one. */
+export type SummarizerFailureCategory = "auth" | "rate-limit" | "timeout" | "unavailable" | "length" | "empty" | "capped" | "unknown";
+/** `ok` answered with usable text, `empty` answered with none, `failure` was rejected. */
+export type SummarizerOutcome = "ok" | "empty" | "failure";
+export interface SummarizerUsageOptions {
+  /** The resolved model key, as `modelKey` renders it. */
+  model: string;
+  stage?: SummarizerStage;
+  outcome: SummarizerOutcome;
+  /** The provider's own stop word, so `length` and `error` are told apart. */
+  stopReason?: string;
+  session?: string;
+}
+export type SummarizerUsageRow = UsageCounters & {
+  event: "lcm";
+  kind: "summarizer-usage";
+  model: string;
+  stage?: SummarizerStage;
+  outcome: SummarizerOutcome;
+  stopReason?: string;
+  session?: string;
+  /** The counters were derived from characters, not reported by the provider. */
+  estimated?: true;
+};
+/** One provider call the summarizer made. `usage` rows cannot carry it, since
+ * those come from Pi's `message_end` for the session's own messages while the
+ * summarizer talks to the model registry directly. */
+export declare function summarizerUsageRecord(usage: UsageLike | undefined, opts: SummarizerUsageOptions): SummarizerUsageRow | undefined;
+export type UsageRow = MetricBase & UsageCounters & {
+  event: "usage";
+};
+interface LcmRowBase extends MetricBase {
+  event: "lcm";
+}
+export type ContextDecisionRow = LcmRowBase & {
+  kind: "context-decision";
+  action: string;
+  occupancy: number;
+  tokens: number;
+  window: number;
+  soft: number;
+  commit: number;
+  zone?: string;
+  committed: boolean;
+  /** Present when `tokens` is the estimator's count rather than Pi's: the
+   * reported figure described a context other than the one on hand. */
+  tokensEstimated?: true;
+};
+export type ProjectionOverBudgetRow = LcmRowBase & {
+  kind: "projection-over-budget";
+  nodes: number;
+  renderedTokens: number;
+  budgetTokens: number;
+};
+export type SwapAppliedRow = LcmRowBase & {
+  kind: "swap-applied";
+  summaryId: number;
+  cutCount: number;
+  distinctBoundary: boolean;
+  appliedAtOccupancy: number;
+  nodes: number;
+  stubbed: number;
+  renderedTokens: number;
+  budgetTokens: number;
+};
+/**
+ * A swap the policy did not commit. `tokens` is the occupancy that triggered
+ * the bail; the kick-backoff writer names the entry it declined to kick instead.
+ */
+export type SwapBlockedRow = LcmRowBase & {
+  kind: "swap-blocked";
+  reason: string;
+  occupancy: number;
+  tokens?: number;
+  entryId?: string;
+};
+export type PiCompactionRow = LcmRowBase & {
+  kind: "pi-compaction";
+  entryId: string;
+  tokens?: number;
+  window?: number;
+};
+/** One calibration sample against Pi's own count: the characters this build
+ * counted for the growth of the context, the tokens Pi reported for it, and the
+ * ratio the samples now support. A null ratio is the answer "cannot say", which is
+ * why the row carries the sample beside it. */
+export type EstimateCalibratedRow = LcmRowBase & {
+  kind: "estimate-calibrated";
+  chars: number;
+  tokens: number;
+  charsPerToken: number | null;
+  samples: number;
+};
+/** A provider stated the real context window in an overflow error, which is the
+ * one window number in this system that is not a belief. */
+export type WindowCorrectedRow = LcmRowBase & {
+  kind: "window-corrected";
+  model: string;
+  window: number;
+  source: string;
+};
+/** A refused request proved the window in use was too big without naming the
+ * real one: the window for the next turn is floored at what the request carried,
+ * and `window` is the stored correction when one exists. */
+export type WindowFloorRow = LcmRowBase & {
+  kind: "window-floor";
+  tokens: number;
+  window: number | null;
+};
+export type ConfigProblemRow = LcmRowBase & {
+  kind: "config-problem";
+  problems: string[];
+};
+export type SummaryInputClippedRow = LcmRowBase & {
+  kind: "summary-input-clipped";
+  entryId: string;
+  keptChars: number;
+  droppedChars: number;
+};
+export type SummaryFallbackStoredRow = LcmRowBase & {
+  kind: "summary-fallback-stored";
+  stage: SummaryStage;
+  span: MetricSpan;
+  sourceChars: number;
+  /** Absent on rows written before the node id rode along. */
+  summaryId?: number;
+};
+export type SummaryStoredRow = LcmRowBase & {
+  kind: "summary-stored";
+  stage: SummaryStage;
+  level: SummaryLevel;
+  /** Absent on rows written before quality was recorded. */
+  quality?: SummaryQuality;
+  depth: number;
+  tokens: number;
+  summaryId: number;
+  span: MetricSpan;
+  /** From just before the summarizer call to after the node row was written. */
+  durationMs: number;
+};
+export type SummarySkippedCoveredRow = LcmRowBase & {
+  kind: "summary-skipped-covered";
+  stage: SummaryStage;
+  span: MetricSpan;
+  messages: number;
+};
+export type SummarySkippedExistingRow = LcmRowBase & {
+  kind: "summary-skipped-existing";
+  stage: SummaryStage;
+  summaryId: number;
+  depth: number;
+  span: MetricSpan;
+  attemptedTokens: number;
+  existingTokens: number;
+  durationMs: number;
+};
+export type SummaryOversizedRow = LcmRowBase & {
+  kind: "summary-oversized";
+  stage: SummaryStage;
+  depth: number;
   tokens: number;
   targetTokens: number;
   sourceTokens: number;
   retried: boolean;
   level: SummaryLevel;
   span: MetricSpan;
+  /** Absent on rows written before the node id rode along. */
+  summaryId?: number;
 };
 export type SummaryReplacedRow = LcmRowBase & {
   kind: "summary-replaced";
@@ -312,6 +1004,10 @@ export type SummaryReplacedRow = LcmRowBase & {
   summaryId: number;
   beforeTokens: number;
   afterTokens: number;
+  /** Absent when the row being displaced could not be read. */
+  qualityBefore?: SummaryQuality;
+  qualityAfter: SummaryQuality;
+  durationMs: number;
 };
 export type SummaryFinalTruncatedRow = LcmRowBase & {
   kind: "summary-final-truncated";
@@ -346,6 +1042,69 @@ export type CompactionCompleteRow = LcmRowBase & {
   ingested: number;
   span: MetricSpan;
 };
+/** What one heal node did. `levelBefore` is 3 only when the stored text carries
+ * the mechanical prefix; a clean-looking node derived from tainted children has
+ * no level of its own, which is why the detection walks provenance. `levelAfter`
+ * is null when nothing was stored, so a rejected level-3 answer leaves the old
+ * text and no quality claim behind. */
+export type HealNodeOutcomeKind = "repaired" | "improved" | "failed" | "blocked" | "skipped" | "changed";
+/** Why a heal run stopped. `dry-run` reports a plan without a model call. */
+export type HealStopReason = "done" | "dry-run" | "max-nodes" | "max-calls" | "token-budget" | "llm-capped";
+export type HealStartRow = LcmRowBase & {
+  kind: "heal-start";
+  candidates: number;
+  taintedNodes: number;
+  maxNodes: number;
+  maxCalls: number;
+  maxTokens: number;
+  targetTokens: number;
+  /** The effective whole-node source window and the request cap that bounded it. */
+  sourceTokens: number;
+  callBudgetTokens: number;
+  dryRun: boolean;
+};
+export type HealNodeRow = LcmRowBase & {
+  kind: "heal-node";
+  summaryId: number;
+  depth: number;
+  nodeKind: SummaryStage;
+  tainted: boolean;
+  qualityBefore: SummaryQuality;
+  /** Present only when this run stored a replacement; a failed node keeps the
+   * quality the store already holds. */
+  qualityAfter?: SummaryQuality;
+  levelBefore: SummaryLevel | null;
+  levelAfter: SummaryLevel | null;
+  beforeTokens: number;
+  afterTokens: number | null;
+  calls: number;
+  outcome: HealNodeOutcomeKind;
+  reason?: string;
+  /** Source facts only. Source and summary text never reach the metrics log. */
+  sourceTokens?: number;
+  sourceChars?: number;
+  sourceClipped?: boolean;
+};
+export type HealCompleteRow = LcmRowBase & {
+  kind: "heal-complete";
+  stop: HealStopReason;
+  candidates: number;
+  attempted: number;
+  repaired: number;
+  improved: number;
+  failed: number;
+  blocked: number;
+  blockedSource: number;
+  skipped: number;
+  changedCount: number;
+  notAttempted: number;
+  calls: number;
+  tokens: number;
+  sourceTokens: number;
+  callBudgetTokens: number;
+  repairedIds: number[];
+  improvedIds: number[];
+};
 /** A summarizer call that answered with nothing, or that threw. An empty answer
  * is its own reason, so only a throw needs the category that says why. */
 export type SummarizerErrorRow = LcmRowBase & {
@@ -534,505 +1293,369 @@ export type RetrievalRow = LcmRowBase & {
   steps: number;
   retrievedTokens: number;
   stop: string;
-  reason?: string;
-  scope?: "summary" | "entry";
-  summaryId?: number;
-  entryId?: string;
-} & Partial<UsageCounters>;
-export type ImportRow = MetricBase & {
-  event: "lcm";
-  kind: "import";
-  db: string;
-} & ({
-  refused: string;
-} | {
-  messagesInserted: number;
-  messagesSkipped: number;
-  summariesInserted: number;
-  summariesSkipped: number;
-});
-export type LcmMetricRecord = ContextDecisionRow | ProjectionOverBudgetRow | SwapAppliedRow | SwapBlockedRow | PiCompactionRow | EstimateCalibratedRow | WindowCorrectedRow | WindowFloorRow | ConfigProblemRow | SummaryInputClippedRow | SummaryFallbackStoredRow | SummaryStoredRow | SummarySkippedCoveredRow | SummarySkippedExistingRow | SummaryOversizedRow | SummaryReplacedRow | SummaryFinalTruncatedRow | CondensationStalledRow | CondensationReducedRow | CompactionCompleteRow | SummarizerErrorRow | SummarizerCappedRow | SummarizerFallbackRow | SummarizerModelRow | SummarizerUsageRow | CompactionErrorRow | CompactionAwaitedRow | CompactionQueuedRow | CompactionQueuedDroppedRow | CompactionTimeoutClearedRow | CompactionStaleRow | CompactionAbandonedRow | CompactionNoopRow | GcDeletedRow | StoreMigratedRow | BranchRemovedRow | FileExternalizedRow | LargeInlineRow | RecallRow | RetrievalRow | EvalRow | ImportRow;
-export type MetricRecord = UsageRow | LcmMetricRecord;
-//#endregion
-//#region src/files.d.ts
-/** Characters of a body's description that stay in the preview. The message row
- * keeps every character, so this bounds what the summarizer reads, not what is
- * retained. */
-export declare const FILE_PREVIEW_CHARS = 1200;
-export declare const FILE_KINDS: readonly ["json", "jsonl", "csv", "tsv", "code", "text"];
-export type FileKind = (typeof FILE_KINDS)[number];
-export declare function isFileKind(value: unknown): value is FileKind;
-export interface FileDescriptor {
-  fileId: string;
-  path: string;
-  /** Characters retained in the message, not bytes on disk. */
-  bytes: number;
-  sha256: string;
-  kind: FileKind;
-  preview: string;
-}
-export declare function fileHandle(d: FileDescriptor): string;
-export declare function filePreviewText(d: FileDescriptor): string;
-export declare function describeFile(path: string, text: string): FileDescriptor;
-/** What the body is, decided by structure rather than by extension alone: a
- * `.ts` file holding a JSON array is JSON, and a `.txt` file holding JSON is
- * JSON too. The parse is tried before the extension for that reason. */
-export declare function kindOf(path: string, text: string): FileKind;
-export declare function structureOf(kind: FileKind, path: string, text: string): string;
-export declare function previewOf(kind: FileKind, path: string, text: string): string;
-//#endregion
-//#region src/pattern-scan.d.ts
-/** One row the pattern path scans. The text is the stored message, whole: the
- * FTS index holds a prefix, and reading only that is the defect this path
- * exists to fix. */
-export interface ScannedRow {
-  rowid: number;
-  entryId: string;
-  role: string;
-  text: string;
-  removed: boolean;
-}
-/** A row that matched, with the first match's position and how many the row
- * held. `partial` is set when the row was longer than the per-row cap, so a
- * reader knows the scan stopped before the end of that row. */
-export interface PatternHit {
-  row: ScannedRow;
-  matches: number;
-  at: number;
-  partial: boolean;
-  scannedChars: number;
-}
-export type PatternStop = "end" | "deadline" | "page";
-export interface PatternScanOutcome {
-  hits: PatternHit[];
-  rows: number;
-  partialRows: number;
-  more: boolean;
-  stopped: PatternStop;
-  lastRowId?: number;
-  lastEntryId?: string;
-}
-export interface PatternScanOptions {
-  pattern: CompiledPattern;
-  offset: number;
-  limit: number;
-  /** Characters of one row the scan reads. Above the FTS prefix on purpose,
-   * below the size of an externalized body, and named on the hit when it bites. */
-  perRowChars: number;
-  deadlineAt: number;
-  now: () => number;
-}
-/** The characters a caller can hand a regular expression. A row longer than this
- * is read up to the cap and the hit says so: a partial scan that looks complete
- * is the same defect as an index that stops at 100,000 characters. */
-export declare const PATTERN_ROW_CHARS = 200000;
-/** How long one pattern call may scan. Long enough for a session's messages at
- * 200,000 characters a row, short enough that a pathological pattern is a slow
- * call rather than a hung session. */
-export declare const PATTERN_DEADLINE_MS = 1000;
-export declare const PATTERN_PAGE_ROWS = 200;
-/** Matches counted in one row before the scan moves on. A row that mentions a
- * path a thousand times is one hit line, and counting the thousandth costs the
- * deadline that the next row needs. */
-export declare const MAX_MATCHES_PER_ROW = 100;
-export declare function scanRows(rows: Iterable<ScannedRow>, opts: PatternScanOptions): PatternScanOutcome;
-/** A pattern this module compiled and validated, so a scan cannot receive a
- * caller's own stateful `RegExp`. */
-export type CompiledPattern = RegExp & {
-  readonly __brand: "CompiledPattern";
-};
-export type PatternCompileResult = {
-  ok: true;
-  pattern: CompiledPattern;
+  reason?: string;
+  scope?: "summary" | "entry";
+  summaryId?: number;
+  entryId?: string;
+} & Partial<UsageCounters>;
+export type ImportRow = MetricBase & {
+  event: "lcm";
+  kind: "import";
+  db: string;
+} & ({
+  refused: string;
 } | {
-  ok: false;
-  reason: string;
-};
-/** Compile a caller's pattern, with `g` for iteration and `i` unless the caller
- * asked for case sensitivity, which is the reading the FTS path already has. A
- * refusal is returned before any row is read. */
-export declare function compilePattern(pattern: string, caseSensitive: boolean): PatternCompileResult;
-//#endregion
-//#region src/store.d.ts
-export type LcmRole = "user" | "assistant" | "toolResult" | "custom";
-/** Any role string Pi may emit (custom, branchSummary, bashExecution...) folds to the four stored roles. */
-export declare function normalizeRole(r: string): LcmRole;
-export interface StoredMessage {
-  id: number;
-  entryId: string;
-  role: LcmRole;
-  text: string;
-  tokens: number;
-  timestamp: number;
-  /** JSON of the content blocks, present only when `text` is not a faithful
-   * rendering of them (a thinking block, an image, a signature). Absent means
-   * the derived text is the whole message. */
-  payload?: string;
-  /** Set when the entry has left the active branch. The bytes stay; search
-   * excludes the row unless a caller asks for it. */
-  removedAt?: number;
+  messagesInserted: number;
+  messagesSkipped: number;
+  summariesInserted: number;
+  summariesSkipped: number;
+});
+export type LcmMetricRecord = ContextDecisionRow | ProjectionOverBudgetRow | SwapAppliedRow | SwapBlockedRow | PiCompactionRow | EstimateCalibratedRow | WindowCorrectedRow | WindowFloorRow | ConfigProblemRow | SummaryInputClippedRow | SummaryFallbackStoredRow | SummaryStoredRow | SummarySkippedCoveredRow | SummarySkippedExistingRow | SummaryOversizedRow | SummaryReplacedRow | SummaryFinalTruncatedRow | CondensationStalledRow | CondensationReducedRow | CompactionCompleteRow | HealStartRow | HealNodeRow | HealCompleteRow | SummarizerErrorRow | SummarizerCappedRow | SummarizerFallbackRow | SummarizerModelRow | SummarizerUsageRow | CompactionErrorRow | CompactionAwaitedRow | CompactionQueuedRow | CompactionQueuedDroppedRow | CompactionTimeoutClearedRow | CompactionStaleRow | CompactionAbandonedRow | CompactionNoopRow | GcDeletedRow | StoreMigratedRow | BranchRemovedRow | FileExternalizedRow | LargeInlineRow | RecallRow | RetrievalRow | EvalRow | ImportRow;
+export type MetricRecord = UsageRow | LcmMetricRecord;
+export interface LlmComplete {
+  (systemPrompt: string, userText: string, maxTokens: number): Promise<string>;
+  /** Where this completer's rows go. Absent means the metrics log. */
+  readonly metrics?: MetricsSink;
 }
-export interface GrepHit {
-  entryId: string;
-  role: LcmRole;
+export interface EscalationResult {
   text: string;
-  /** The entry has left the active branch; its text is retained. */
-  removed?: boolean;
-  coveringSummaryId?: number;
+  level: 1 | 2 | 3;
+  sourceTokens: number;
+  retried: boolean;
+  thoroughText?: string;
 }
-export interface SummaryNode {
-  id: number;
-  kind: "leaf" | "condensed";
+export declare function summarizeWithEscalation(items: Array<{
+  role: string;
   text: string;
-  tokens: number;
-  depth: number;
-  firstEntryId: string;
-  lastEntryId: string;
-  createdAt: number;
-  /** A richer sibling text the ladder produced and did not store as primary,
-   * so the projection can serve more detail when the budget has room. */
-  thoroughText?: string;
-  thoroughTokens?: number;
+}>, targetTokens: number, llm: LlmComplete, session?: string): Promise<EscalationResult>;
+/** Summarize with the terse rung only, for a source that is already a summary:
+ * the thorough ladder would spend two provider calls re-summarizing text that
+ * was made thorough once. Here the terse answer is the only ask, so a result
+ * that does not reduce the source falls to the deterministic truncate. */
+export declare function summarizeTerse(items: Array<{
+  role: string;
+  text: string;
+}>, targetTokens: number, llm: LlmComplete, session?: string): Promise<EscalationResult>;
+export declare function deterministicTruncate(text: string, targetTokens: number): string;
+export interface SummarizerConfig {
+  /** One model id, or an ordered fallback chain. `auto` is the session model. */
+  summarizer?: string | string[];
+  /** Tokens one request may cost, estimate plus output cap, before it is refused
+   * rather than paid for. A backstop, not a throttle. */
+  summarizerTokensPerCall?: number;
+  /** Tokens one pass may spend across all its calls, counted from what the
+   * provider reported. Reaching it finishes the pass mechanically. */
+  summarizerTokensPerPass?: number;
 }
-export interface IntegritySnapshot {
-  ftsOk: boolean;
-  messageRows: number;
-  shapes: Array<{
-    id: number;
-    kind: "leaf" | "condensed";
-    depth: number;
-    messages: number;
-    children: number;
-  }>;
-  spans: Array<{
-    id: number;
-    first: string;
-    last: string;
-    firstRowid: number | null;
-    lastRowid: number | null;
-  }>;
-  duplicateSpans: Array<{
-    first: string;
-    last: string;
-    kind: string;
-    count: number;
-  }>;
-  orphanChildParents: number[];
-  deadRuns: Array<{
-    session: string | null;
-    rows: number[];
-  }>;
-  untrackedPending: number[];
-  foreignKeyViolations: number;
-  schemaVersion: number;
-  uncoveredMessages: number;
+/**
+ * Thinking tokens are charged against the completion budget, so a reasoning
+ * model can spend the whole cap before it emits any text. The headroom sits on
+ * top of the caller's request, so the requested output size does not change.
+ */
+export declare const REASONING_HEADROOM = 4096;
+export interface ResolvedChain<Model> {
+  /** The models to try, in order and deduped. Empty when nothing resolves. */
+  models: ModelRef<Model>[];
+  /** Configured entries the host could not resolve, in order. */
+  unresolved: string[];
+  requested: string[];
 }
-/** A fresh row, or the row that already owns the span; `existingTokens` comes
- * from that row, so a caller reports the collision, not its intended write.
- * `own` says whether the run that asked may count this row as its own and replace
- * its text: a row it wrote, a committed row, or its own pending row. Another live
- * run's pending row is none of those. */
-export type InsertSummaryResult = {
-  id: number;
-  created: true;
-  own: true;
+/** Expand the configured chain: `auto` (the session model) goes last unless the
+ * chain names it, so one bad entry still leaves the session able to summarize. */
+export declare function resolveModels<Model>(host: ModelHost<Model>, config: SummarizerConfig): ResolvedChain<Model>;
+/** The one rendering of a resolved chain. The level travels with the warning so
+ * no caller can pick a different notify level for the same chain. */
+export type ChainReport = {
+  level: "info";
+  state: string;
 } | {
-  id: number;
-  created: false;
-  own: boolean;
-  existingTokens: number;
-  /** The colliding row's summary text. A caller whose view cannot read the row
-   * still has to answer for the span it was given, and this is that span's
-   * summary to reuse. */
-  existingText: string;
-  foreignLive: boolean;
+  level: "warning";
+  state: string;
+  warning: string;
 };
-/** What a caller hands `insertSummary`. `run` stamps the row pending for that run;
- * without it the row is committed memory. */
-export type InsertSummaryInput = {
-  kind: "leaf" | "condensed";
-  text: string;
-  tokens: number;
-  depth: number;
+export declare function describeSummarizerChain<Model>(chain: ResolvedChain<Model>): ChainReport;
+/** The span every call from one completer summarizes. The failure cap is per
+ * span, so a completer is built with the span it will be asked about. */
+export interface SummarizedSpan {
   firstEntryId: string;
   lastEntryId: string;
-  messageIds?: number[];
-  childSummaryIds?: number[];
-  fileIds?: string[];
-  thoroughText?: string;
-  run?: string;
-};
-/** What a compaction pass needs from the store: the committed memory plus, when
- * the pass reads through `LcmStore.forRun`, the rows of its own run. `LcmStore`
- * satisfies this with the committed-only meaning. */
-export interface PassStore extends IngestStore {
-  /** The branch range a set of entry ids occupies: the oldest and the newest row
-   * the store holds among them, or null when it holds none. Pi's context array
-   * is not branch order (it hoists the newest compaction entry to the front),
-   * while a span is a row range, so the store, whose rows are appended in
-   * branch order, is what decides which end comes first. */
-  spanBounds(entryIds: readonly string[]): {
-    firstEntryId: string;
-    lastEntryId: string;
-  } | null;
-  uncoveredMessagesInSpan(firstEntryId: string, lastEntryId: string): StoredMessage[];
-  filesForMessages(ids: readonly number[]): Array<FileDescriptor & {
-    messageId: number;
-  }>;
-  frontier(firstEntryId: string, lastEntryId: string): SummaryNode[];
-  getSummary(id: number): SummaryNode | undefined;
-  parentSummaryIds(summaryId: number): number[];
-  fileIdsForSummaries(ids: readonly number[]): string[];
-  insertSummary(s: InsertSummaryInput): InsertSummaryResult;
-  updateSummaryText(id: number, text: string, tokens: number): void;
-  setThoroughText(id: number, thoroughText: string): void;
 }
-export interface IngestStore {
-  hasEntry(entryId: string): boolean;
-  insertMessage(m: {
-    entryId: string;
-    role: LcmRole;
-    text: string;
-    tokens: number;
-    timestamp: number;
-    payload?: string;
-  }): number;
-  insertFile(d: FileDescriptor, firstEntryId: string): void;
-  linkMessageFile(messageId: number, fileId: string): void;
+export interface MakeLlmOptions {
+  session: string;
+  stage?: SummarizerStage;
+  span: SummarizedSpan;
+  /** Where every row this completer writes goes. Defaults to the metrics log. */
+  sink?: MetricsSink;
+}
+/** Failed walks in a row before a pass stops calling the model and lets the
+ * ladder's deterministic truncate finish the span. One is too eager, because a
+ * single transport blip would turn a whole span mechanical; past three, another
+ * call carries no new information about the provider and costs its latency. */
+export declare const SUMMARIZER_FAILURE_CAP = 3;
+/** What one request may cost before it is refused instead of paid for. It exists
+ * for a pathological chunk rather than for a normal one. */
+export declare const SUMMARIZER_CALL_TOKENS = 60000;
+/** What one pass may spend across all of its calls. */
+export declare const SUMMARIZER_PASS_TOKENS = 250000;
+export declare function retriableCategory(category: SummarizerFailureCategory): boolean;
+/** How long a span whose calls were capped is left alone. Shorter than the kick
+ * backoff (`KICK_BACKOFF_MS`) on purpose: this guards a retry inside one turn,
+ * it is not the breaker that stops re-kicks across turns. */
+export declare const FAILED_SPAN_TTL_MS = 60000;
+/** What a failed span is identified by: the two ends a caller asked about and
+ * the chain it asked. A different model is a different attempt, not the same
+ * failure, so the chain is part of the key. */
+export declare function spanFingerprint(span: SummarizedSpan, chain: readonly string[]): string;
+/**
+ * A call that reached no usable answer. `category` is what the provider's own
+ * text says: a best-effort read that answers `unknown` rather than guessing, and
+ * `capped` when the caller should stop asking rather than the provider failing.
+ */
+export declare class SummarizerFailure extends Error {
+  readonly category: SummarizerFailureCategory;
+  constructor(message: string, category: SummarizerFailureCategory);
+}
+/** Which bucket a provider's error text falls in. A 5xx or a dropped connection
+ * is `unavailable` before it is `timeout`, because the gateway's own timeout is
+ * a request that never reached a model. */
+export declare function classifyFailure(text: string | undefined): SummarizerFailureCategory;
+export declare function makeLlm<Model>(host: ModelHost<Model>, config: SummarizerConfig, opts: MakeLlmOptions): LlmComplete | null;
+/** Sessions share the process, so each one gets to see the config it runs, and
+ * a session that starts fresh should not inherit a refusal from the last one. */
+export declare function resetSummarizerState(): void;
+/** Tokens one bounded repair run may spend across all of its calls. A heal
+ * re-derives nodes a pass already paid for, so it carries its own budget. */
+export declare const SUMMARIZER_HEAL_TOKENS = 120000;
+/** Tokens one repaired node targets when the caller names none. It matches
+ * the heal engine's own fallback, so an unresolved option still repairs. */
+export declare const DEFAULT_SUMMARY_TOKENS = 1500;
+export interface SummarizerOptions {
+  /** One model id, or an ordered fallback chain. `auto` is the session model. */
+  readonly summarizer?: string | string[];
+  /** Tokens one request may cost, estimate plus output cap, before it is
+   * refused rather than paid for. */
+  readonly summarizerTokensPerCall?: number;
+  /** Tokens one pass may spend across all of its calls. */
+  readonly summarizerTokensPerPass?: number;
+  /** Tokens one on-demand heal run may spend across all of its calls. */
+  readonly summarizerTokensPerHeal?: number;
+}
+/** The engine config for these options. An unresolved budget keeps the core
+ * default, which is also what a direct caller that passes no options gets. */
+export declare function summarizerConfig(options: SummarizerOptions): SummarizerConfig;
+export interface HealBudgetOptions {
+  /** Tokens one repaired node targets. */
+  readonly summaryTokens?: number;
+  /** Estimated tokens one heal node may read as source. Unset derives the
+   * engine default; this is the explicit override for large sources. */
+  readonly healSourceTokens?: number;
+  /** Tokens one summarizer request may cost. */
+  readonly summarizerTokensPerCall?: number;
+}
+/** Calibrated heal budgets in tokens: node target, per-call cap, and optional source window. */
+export interface HealBudgets {
+  readonly targetTokens: number;
+  readonly callBudgetTokens: number;
+  readonly sourceTokens?: number;
+}
+/** The calibrated heal target and source window. A null ratio keeps the
+ * configured reading, which is what an uncalibrated host passes. */
+export declare function healBudgets(options?: HealBudgetOptions, charsPerToken?: number | null): HealBudgets;
+export declare const CHARS_PER_TOKEN = 4;
+/** Samples below this count say nothing: with two points any line fits, and the
+ * first turns of a session are exactly where the overhead has not cancelled. */
+export declare const CALIBRATION_MIN_SAMPLES = 3;
+/** Samples kept in memory. A cap keeps the median describing the recent turns of
+ * the session rather than its whole history, which is what a model switch inside
+ * one session would otherwise be unable to move. */
+export declare const CALIBRATION_SAMPLE_CAP = 8;
+/** One observation of the same session: how many characters this build counted in
+ * the messages, and how many tokens Pi reported for the request that carried
+ * them. Sampling differences rather than totals is what cancels the system prompt
+ * and tool definitions, which this build never counts. */
+export interface EstimateSample {
+  chars: number;
+  tokens: number;
+}
+export declare function estimateTokens(text: string): number;
+export declare function tokensFromChars(chars: number): number;
+/** A reported count below this share of the estimate describes a context other
+ * than the one on hand: Pi reports its last measurement, and after a resume that
+ * measurement belongs to the previous process. The estimator's own error is
+ * bounded by the calibration band, which is a factor of two in either direction
+ * around the constant, so anything below a quarter is a different turn rather
+ * than a miscount. A reported count too high only compacts early, which is why
+ * this looks one way. */
+export declare const STALE_REPORT_SHARE = 0.25;
+export declare function calibrate(samples: readonly EstimateSample[]): number | null;
+/** A configured token budget in the units `estimateTokens` counts. The estimator
+ * counts chars / 4, so a model whose real ratio is 6 needs 1.5 times the
+ * configured number of estimated tokens accumulated before it has kept the
+ * context the user asked for. Without a ratio the budget is left alone, which is
+ * the constant's own reading of it. */
+export declare function scaledBudget(tokens: number, charsPerToken: number | null): number;
+/** A window outside this band is a misread rather than a model: no provider
+ * serves a context under a thousand tokens or over a hundred million, and a
+ * number outside it means a pattern caught the request count, a status code, or
+ * something else that was not a limit. A refused parse is the floor path, which
+ * costs one conservative turn instead of a wrong permanent window. */
+export declare const WINDOW_MIN = 1000;
+export declare const WINDOW_MAX = 100000000;
+/** The window in tokens a provider stated in an overflow message, or null when
+ * the message does not name one. Null is an answer: the caller keeps Pi's belief
+ * and arms the one-shot floor, which is all a body like "400/413 status code (no
+ * body)" can support. */
+export declare function windowFromError(errorMessage: string | undefined): number | null;
+export declare const WINDOW_PATTERN_EXAMPLES: readonly string[];
+/** Either provider spelling hosts use: OpenCode names `providerID`, Pi names
+ * `provider`. The key ignores any other field, including an OpenCode variant,
+ * because a variant changes settings and not the model itself. */
+export interface ModelIdentity {
+  readonly providerID?: string;
+  readonly provider?: string;
+  readonly id?: string;
+}
+/** A ref wrapper hosts pass around: the model beside its computed key. Only
+ * the nested model matters for the spelling. */
+export interface ModelKeyRef {
+  readonly model?: ModelIdentity | undefined;
+  readonly key?: string;
+  readonly reasoning?: boolean;
+}
+/** The spelling config zones and metric rows use: `provider/id`. A wrapper
+ * with a `model` field (a core `ModelRef` or a Pi context) is unwrapped, so a
+ * direct model and a ref to one spell the same. Missing or empty parts spell
+ * empty, the way Pi names no model before one is active. */
+export declare function modelKey(input: ModelIdentity | ModelKeyRef | undefined | null): string;
+/** The fields a window lookup matches on. An OpenCode `ModelRef` carries an
+ * optional variant besides these, which still satisfies this shape. */
+export interface WindowModel {
+  readonly providerID: string;
+  readonly id: string;
 }
-/** Characters of a message the full-text index covers. Storage is verbatim, so
- * this bounds the index and not the row. */
-export declare const FTS_PREFIX_CHARS = 100000;
-/** First published schema: pre-publish development stores were wiped, so every
- * store in the wild starts here and later generations count from this one. */
-export declare const SCHEMA_VERSION = 1;
-/** A store left behind by an older build. A read-only open refuses it rather than
- * migrating it: a search must not rewrite a file it is only reading, and a store
- * that cannot answer this build's statements has to be a reported skip. */
-export declare class StaleStoreError extends Error {
-  readonly generation: number;
-  constructor(generation: number);
+/** One catalogue entry reduced to what the lookup reads. */
+export interface WindowCatalogEntry {
+  readonly providerID: string;
+  readonly id: string;
+  readonly limit: {
+    readonly context: number;
+  };
 }
-/** What a store knows about a model rather than about a session: the token ratio
- * measured for it against Pi's reported usage, and the context window a provider
- * stated when it refused an over-window request. A null ratio is a measurement that
- * disagree with itself, which is a state the estimator reads as "keep the
- * constant" and the report names. A null window is a model no provider has
- * corrected, which leaves Pi's belief in place. */
-export interface ModelState {
-  charsPerToken: number | null;
-  samples: number;
-  contextWindow: number | null;
-  windowSource: string | null;
+/** The catalogue source the lookup reads. It is the `list` half of the host
+ * model domain; the synchronous `get` stays host side. */
+export interface WindowListDomain {
+  list(input?: unknown): Promise<unknown>;
+}
+/** The context the lookup reads the catalogue from. Only the optional model
+ * domain matters, so any host context with that shape satisfies it. */
+export interface WindowLookupContext {
+  readonly model?: WindowListDomain | undefined;
+}
+/** The model window lookup both assembly seams read. */
+export type WindowOf<M extends WindowModel = WindowModel> = (model: M) => Promise<number>;
+/** The model window both assembly seams read. The context projection measures
+ * occupancy against it, and the blocking checkpoint reads the same figure for
+ * its metric rows, so the catalogue is asked once for the plugin lifetime. A
+ * catalogue that failed once is asked again on the next request: the host may
+ * still be starting. */
+export declare function createWindowLookup<M extends WindowModel = WindowModel>(ctx: WindowLookupContext, fallback: number): WindowOf<M>;
+export interface AssemblyMsg {
+  role: string;
+  content?: unknown;
+  /** AgentMessage UserMessage compatibility (Pi requires it on outgoing messages). */
+  timestamp?: number;
 }
-export declare const WINDOW_SOURCE_PROVIDER = "provider-error";
-export declare class LcmStore {
-  private db;
-  private dbPath;
-  /** Opened for reading a past session's store: no migration ran, so `generation`
-   * is the file's own and a caller may have to skip it. */
-  private readOnly;
-  /** The schema generation this file carries, which read-only opens do not
-   * change. A writer holds `SCHEMA_VERSION` by the time its constructor returns. */
-  readonly generation: number;
-  /** True while a `transaction` callback is running, so a reentrant call joins
-   * the open transaction instead of nesting one, which SQLite rejects. */
-  private inTransaction;
-  /** Tokens of the runs this handle has open. Two runs can overlap inside one
-   * handle, because the blocking path stops waiting for the async pass, so a
-   * token names a run and not the handle. Whether a run this handle does not
-   * hold is still running is read from the `runs` table, never from here. */
-  private liveTokens;
-  private reapedInRun;
-  private stmts;
-  constructor(dbPath: string, opts?: {
-    readOnly?: boolean;
-    queryOnly?: boolean;
-  });
-  /** Close the handle: no run of this handle survives it, and the connection is
-   * released even when a run could not be abandoned, so a failure here cannot
-   * leave a connection and a set of invisible rows behind. */
-  close(): void;
-  /** Open a run: rows written with its token are pending until `commitRun`, and
-   * the row this writes is what lets another handle tell it from a run whose
-   * writer is gone. Reaps what such a run left, which this handle cannot be. */
-  openRun(opts?: {
-    session?: string;
-  }): {
-    token: string;
-    dropped: number;
-  };
-  /** True while any run is open whose writer is still there, this handle's or
-   * another process's, which is what an import has to wait for. */
-  hasLiveRun(): boolean;
-  /** Commit a run: drop its pending rows whose child no longer resolves, then flip
-   * the rest. One transaction, so a reader never sees a half-committed run, and
-   * idempotent for a token this handle no longer holds. */
-  commitRun(token: string): {
-    committed: number;
-    dropped: number;
-  };
-  /** Delete a run's pending rows and close it. Idempotent, so a `finally` can call
-   * it after a commit has already closed the run. */
-  abandonRun(token: string): number;
-  /** A view of this store for one run: the committed memory plus that run's own
-   * rows, which is what a pass must read to see its own writes. */
-  forRun(token: string): PassStore;
-  /** True while the run that wrote a row is still going somewhere, as far as this
-   * store can tell. A run this handle holds is live; a run written by this
-   * process is live, because a pid cannot separate two handles in one process and
-   * refusing to delete is the safe answer; a run written by another process is
-   * live while its pid is. A row whose run has no record at all was written
-   * without one, which no open path does, so nothing owns it. */
-  private isRunLive;
-  /** Delete what a run left behind whose writer is gone, and its record with it.
-   * A live owner's rows are never touched, whatever handle asks, which is what
-   * makes a second handle safe to open. No reader can see the rows this removes,
-   * and each one holds the span it claims. */
-  private reapPending;
-  /** Delete this run's pending rows whose child no longer exists, deepest first: a
-   * parent that loses a child must not leave a grandparent behind. A child can go
-   * away between the frontier read that selected it and this commit. */
-  private dropUnresolvable;
-  hasEntry(entryId: string): boolean;
-  insertMessage(m: {
-    entryId: string;
-    role: LcmRole;
-    text: string;
-    tokens: number;
-    timestamp: number;
-    payload?: string;
-  }): number;
-  /** One write transaction around a group of statements, so a compaction is
-   * atomic: the node row, its provenance rows and its file links either all
-   * land or none do. `node:sqlite` ships no transaction helper, so the
-   * statements are explicit. A reentrant call joins the open transaction: the
-   * caller that opened it owns the commit, so an inner throw rolls the whole
-   * group back rather than leaving a half-applied write. */
-  transaction<T>(fn: () => T): T;
-  insertSummary(s: InsertSummaryInput): InsertSummaryResult;
-  insertFile(d: FileDescriptor, firstEntryId: string): void;
-  linkMessageFile(messageId: number, fileId: string): void;
-  filesForMessages(ids: readonly number[]): Array<FileDescriptor & {
-    messageId: number;
-  }>;
-  fileIdsForMessages(ids: readonly number[]): string[];
-  fileIdsForSummaries(ids: readonly number[]): string[];
-  filesForSummaries(ids: readonly number[]): FileDescriptor[];
-  allFiles(): Array<FileDescriptor & {
-    entryIds: string[];
-  }>;
-  /** Replace a node's text in place: the span, provenance, and created_at stay. */
-  updateSummaryText(id: number, text: string, tokens: number): void;
-  setThoroughText(id: number, thoroughText: string): void;
-  messagesInSpan(firstEntryId: string, lastEntryId: string): StoredMessage[];
-  spanBounds(entryIds: readonly string[]): {
-    firstEntryId: string;
-    lastEntryId: string;
-  } | null;
-  uncoveredMessagesInSpan(firstEntryId: string, lastEntryId: string, run?: string): StoredMessage[];
-  /** Minimal top-level cover: no summary's child, oldest first, dropping any node
-   * whose span sits inside the previous kept one, which is what keeps the cover
-   * non-nested: condensation's group span must be one no row already holds. */
-  frontier(firstEntryId: string, lastEntryId: string, run?: string): SummaryNode[];
-  grep(pattern: string, opts?: {
-    limit?: number;
-    offset?: number;
-    withinMessageIds?: ReadonlySet<number>;
-    includeRemoved?: boolean;
-  }): GrepHit[];
-  grepCount(pattern: string, opts?: {
-    withinMessageIds?: ReadonlySet<number>;
-    includeRemoved?: boolean;
-  }): number | undefined;
-  messagePage(afterRowId: number, limit: number, opts?: {
-    withinMessageIds?: ReadonlySet<number>;
-    includeRemoved?: boolean;
-  }): ScannedRow[];
-  coveringSummaryId(entryId: string): number | undefined;
-  messageByEntryId(entryId: string): StoredMessage | undefined;
-  parentSummaryIds(summaryId: number, run?: string): number[];
-  childSummaryIds(summaryId: number): number[];
-  getSummary(id: number, run?: string): SummaryNode | undefined;
-  /** Bounded by a visited set, so a corrupt cycle cannot recurse forever. */
-  coveredMessageIds(summaryId: number, seen?: Set<number>): number[];
-  integritySnapshot(): IntegritySnapshot;
-  /** Restore the full-text index. The schema is re-applied first, because a
-   * dropped virtual table cannot be rebuilt, only recreated, and the DDL that
-   * knows how is the schema itself. Everything in it is `IF NOT EXISTS` apart
-   * from the two triggers, which are dropped and recreated on purpose. */
-  rebuildFts(): void;
-  deleteOrphanSpans(): number;
-  deleteOrphanChildren(): number;
-  reapDeadRuns(): number;
-  /** When one span is claimed twice, the row that carries provenance wins over
-   * one that cannot be expanded, and the newest wins between equals. */
-  dedupeSpans(): number;
-  /** Mark entries that left the active branch, or clear the mark when a
-   * navigation brings them back. Returns the rows the call actually changed, so
-   * a metric can tell a real change from a no-op reconciliation. */
-  setRemoved(entryIds: readonly string[], removedAt: number | null): number;
-  removedMessageCount(): number;
-  messagesByIds(ids: number[]): StoredMessage[];
-  allMessages(): StoredMessage[];
-  entrySpan(): {
-    first: string;
-    last: string;
-  } | undefined;
-  coveredSize(summaryId: number): {
-    tokens: number;
-    messages: number;
-  };
-  allSummaries(): SummaryNode[];
-  messageCount(): number;
-  backup(backupPath: string): void;
-  /** The calibration recorded for a model. `undefined` is a model nothing has
-   * sampled; a null ratio is one whose samples disagreed, which the caller reads
-   * as "keep the constant" rather than "no data". */
-  getModelState(modelKey: string): ModelState | undefined;
-  setModelState(modelKey: string, state: Pick<ModelState, "charsPerToken" | "samples">): void;
-  /** Records the window a provider stated. Its own statement rather than part of
-   * `setModelState`, because the two are learned at different moments: a later
-   * calibration must not clear a window, and a window must not touch samples. */
-  setModelWindow(modelKey: string, contextWindow: number, source: string): void;
-  stats(): {
-    messages: number;
-    summaries: number;
-    dbBytes: number;
-    payloadMessages: number;
-    payloadBytes: number;
-    files: number;
-    fileBytes: number;
-    removedMessages: number;
+export interface AlignedEntry {
+  entryId: string;
+  role: string;
+  text: string;
+  /** Raw content blocks when `text` is not a faithful rendering of them
+   * (`payloadOf`). Carried so ingest stores the same bytes at every call site. */
+  payload?: string;
+  fileHint?: {
+    path: string;
   };
 }
-//#endregion
-//#region src/summarize.d.ts
-export interface LlmComplete {
-  (systemPrompt: string, userText: string, maxTokens: number): Promise<string>;
+export declare const SYNTHETIC_MARKER = "[LCM session memory";
+export declare function tailKeyOf(m: AssemblyMsg | undefined): string;
+/** Characters the estimator counts for a context: the same rendering `cutIndexFor`
+ * measures, so a calibration describes the quantity every threshold here is
+ * compared against. */
+export declare function contextChars(messages: readonly AssemblyMsg[]): number;
+export declare function cutIndexFor(messages: readonly AssemblyMsg[], keepRecentTokens: number): number | null;
+export interface SyntheticMessage {
+  role: "user";
+  content: string;
+  timestamp: number;
 }
-export interface EscalationResult {
+export type SummaryTier = "rich" | "terse" | "stub";
+export interface RenderableSummary {
+  id: number;
+  depth: number;
+  firstEntryId: string;
+  lastEntryId: string;
   text: string;
-  level: 1 | 2 | 3;
-  sourceTokens: number;
-  retried: boolean;
   thoroughText?: string;
+  tier: SummaryTier;
 }
-export declare function summarizeWithEscalation(items: Array<{
-  role: string;
-  text: string;
-}>, targetTokens: number, llm: LlmComplete, session?: string): Promise<EscalationResult>;
-/** Summarize with the terse rung only, for a source that is already a summary:
- * the thorough ladder would spend two provider calls re-summarizing text that
- * was made thorough once. Here the terse answer is the only ask, so a result
- * that does not reduce the source falls to the deterministic truncate. */
-export declare function summarizeTerse(items: Array<{
-  role: string;
+export declare const STUB_CHARS = 200;
+export type PlainSummary = Omit<RenderableSummary, "tier" | "thoroughText">;
+export declare function renderSummaries(summaries: readonly RenderableSummary[]): string;
+export declare function renderFrontier(nodes: readonly PlainSummary[]): string;
+export declare function buildSynthetic(summaries: readonly RenderableSummary[]): SyntheticMessage;
+export interface AppliedSummary {
+  id: number;
+  depth: number;
   text: string;
-}>, targetTokens: number, llm: LlmComplete, session?: string): Promise<EscalationResult>;
-export declare function deterministicTruncate(text: string, targetTokens: number): string;
-//#endregion
-//#region src/compaction-engine.d.ts
+  thoroughText?: string;
+  firstEntryId: string;
+  lastEntryId: string;
+  tier: SummaryTier;
+}
+export type AssemblyAction = "quiet" | "consider-apply" | "stable" | "recommit";
+export interface CommitState {
+  cutCount: number;
+  synthetic: SyntheticMessage;
+  applied: AppliedSummary[];
+  summaryId: number;
+  appliedAtOccupancy: number;
+  tailKey: string;
+}
+export declare const DEFAULT_SWAP_RATIO = 0.7;
+export declare const DEFAULT_RECUT_RATIO = 0.85;
+export declare const WINDOW_SAFETY_CEILING = 0.9;
+/** Ceiling for the resolved recut fraction: a line above 1.0 is unreachable, so
+ * the pin never re-cuts and the raw tail grows past the window while "stable"
+ * is reported forever. Strictly above WINDOW_SAFETY_CEILING + RECUT_ABOVE_SWAP_MARGIN. */
+export declare const RECUT_CEILING = 0.95;
+export declare const REZONE_MARGIN = 1.18;
+/** One model's thresholds. A token field takes precedence over its ratio
+ * counterpart when both are set. */
+export interface ThresholdConfig {
+  /** Swap when the request reaches this share of the model window. */
+  swapAtRatio?: number;
+  /** Swap when the request reaches this many tokens; takes precedence over
+   * `swapAtRatio`. */
+  swapAtTokens?: number;
+  /** Re-cut when the request reaches this share of the model window. */
+  recutAtRatio?: number;
+  /** Re-cut when the request reaches this many tokens; takes precedence over
+   * `recutAtRatio`. */
+  recutAtTokens?: number;
+  /** Swap at this absolute token count, deriving the recut from it. */
+  smartZone?: number;
+}
+export type ZoneThresholds = ThresholdConfig;
+export interface ResolvedThresholds {
+  swap: number;
+  recut: number;
+  clamped: boolean;
+}
+export declare function mergeZone(global: ThresholdConfig, zone?: ZoneThresholds): ThresholdConfig;
+export declare function thresholdConflicts(cfg: ThresholdConfig, scope?: string): string[];
+export declare function effectiveThresholds(cfg: ThresholdConfig, contextWindow: number): ResolvedThresholds;
+export declare function nextAction(state: CommitState | null, occupancy: number, swapRatio: number, recutRatio: number): AssemblyAction;
+export declare function cutMayReplace(previous: CommitState | null, newCutCount: number): boolean;
 /** Deepest condensed node the DAG may grow. With MAX_DAG_FANOUT children this
  * covers 8^8 leaf chunks, so it is a structural assert, not a tuning knob: a
  * pass that cannot meet its budget reports `condensation-stalled` rather than
@@ -1081,7 +1704,7 @@ export declare function runCompaction(store: PassStore, input: CompactionInput,
    * fallback event cannot be attributed to a session. */
   session?: string;
   maxDepth?: number;
-  stage?: "blocking" | "async" | "direct";
+  stage?: CompactionStage;
 }): Promise<CompactionOutcome>;
 /** The next group to condense: the oldest run of adjacent same-depth nodes, at
  * the shallowest depth with a run of two or more, capped at MAX_DAG_FANOUT.
@@ -1090,8 +1713,6 @@ export declare function runCompaction(store: PassStore, input: CompactionInput,
 export declare function condensationGroup(frontier: readonly SummaryNode[], opts?: {
   maxDepth?: number;
 }): SummaryNode[] | undefined;
-//#endregion
-//#region src/context-policy.d.ts
 export interface ContextPolicyInput {
   rawMessages: readonly AssemblyMsg[];
   getCtxEntries: () => readonly AlignedEntry[];
@@ -1120,299 +1741,105 @@ export type BailReason = "nothing-to-age" | "no-boundary" | "tail-exceeds-entrie
 export type NonEmpty<T> = readonly [T, ...T[]];
 export interface ContextPolicyBase {
   commitState: CommitState | null;
-  metrics: LcmMetricRecord[];
-  pinnedModelKey: string;
-  pinnedWindow: number;
-  clampNotified: boolean;
-  clampWarning?: string;
-}
-export type ContextPolicyResult = ContextPolicyBase & ({
-  outcome: "quiet";
-} | {
-  outcome: "reapply";
-  messages: AssemblyMsg[];
-} | {
-  outcome: "swap";
-  messages: AssemblyMsg[];
-} | {
-  outcome: "bail";
-  reason: BailReason;
-  messages?: AssemblyMsg[];
-} | {
-  outcome: "kick";
-  reason: "summary-missing";
-  aged: NonEmpty<AlignedEntry>;
-  /** The span this kick is about, in the order the store resolves one. The
-   * adapter keys its latch on it, so the latch and the coverage check
-   * cannot disagree about which boundary is missing. */
-  span: {
-    firstEntryId: string;
-    lastEntryId: string;
-  };
-  messages?: AssemblyMsg[];
-});
-export interface ContextPolicyDeps {
-  thresholds: (cfg: ThresholdConfig, window: number) => ResolvedThresholds;
-  nextAction: (state: CommitState | null, occupancy: number, swap: number, recut: number) => AssemblyAction;
-  cutIndexFor: (msgs: readonly AssemblyMsg[], keepRecentTokens: number) => number | null;
-  cutMayReplace: (previous: CommitState | null, newCutCount: number) => boolean;
-  frontier: (firstEntryId: string, lastEntryId: string) => SummaryNode[];
-  /** The aged set's own ends as a span: branch order, and only entries the store
-   * holds. Pi's context array is not branch order (it hoists the newest
-   * compaction entry to the front), and a span whose ends are inverted resolves
-   * to nothing, so this answers with the end pair a store query can use. Null
-   * when the store holds none of the aged entries, which is a state rather than
-   * a kick. */
-  spanBounds: (aged: NonEmpty<AlignedEntry>) => {
-    firstEntryId: string;
-    lastEntryId: string;
-  } | null;
-  buildSynthetic: (summaries: readonly RenderableSummary[]) => CommitState["synthetic"];
-  /** The mask node text passes through on its way to a model. The store keeps
-   * the bytes, so every read seam takes this rather than storing a masked
-   * copy; `makeRedact` is the provider a real caller passes. */
-  redact: (text: string) => string;
-}
-export interface FailedBoundary {
-  attempts: number;
-  lastAt: number;
-}
-export declare const KICK_MAX_ATTEMPTS = 3;
-export declare const KICK_BACKOFF_MS: number;
-export declare function shouldKickBoundary(latch: FailedBoundary | undefined, now: number): boolean;
-export declare function applyContextPolicy(input: ContextPolicyInput, deps: ContextPolicyDeps): ContextPolicyResult;
-export interface CompactionBounds {
-  startEntryId?: string;
-  firstKeptEntryId: string;
-}
-/** Blocking-regime span (session_before_compact), computed the way Pi's
- * prepareCompaction does: branch entries from the previous compaction's first
- * kept entry up to but excluding the new one, minus compaction rows. Entry ids,
- * not message text, so bash and branch-summary rows align. An unknown
- * firstKeptEntryId yields an empty span, so the caller falls back to Pi. */
-export declare function resolveCompactionSpan(branchMsgs: readonly AlignedEntry[], bounds: CompactionBounds): AlignedEntry[];
-//#endregion
-//#region src/integrity.d.ts
-export type FindingKind = "fts-index" | "summary-span" | "summary-shape" | "orphan-child" | "duplicate-span" | "foreign-key" | "schema-version" | "dead-run" | "coverage";
-export interface Finding {
-  kind: FindingKind;
-  /** `violation` is an invariant the DAG depends on; `coverage` is a count. */
-  severity: "violation" | "info";
-  count: number;
-  detail: string;
-  sample: string[];
-}
-export interface IntegrityReport {
-  /** How many checks ran, so "no findings" cannot be confused with "no checks". */
-  checks: number;
-  findings: Finding[];
-}
-export declare function checkIntegrity(store: LcmStore): IntegrityReport;
-/** Fix what can be fixed without guessing: the derived index, rows whose span no
- * longer exists, nodes whose child no longer resolves, rows a run whose writer is
- * gone left behind, and predated duplicate spans. An inverted span is left
- * alone, because which end is right needs the session file. */
-export declare function repairIntegrity(store: LcmStore): string[];
-//#endregion
-//#region src/host.d.ts
-/** What one call was billed, in numbers, so a pass can sum its spend.
- * `UsageLike` in `metrics.ts` is the tolerant reader of the same facts at the
- * metrics boundary, and a `Usage` satisfies it. */
-export interface Usage {
-  input: number;
-  output: number;
-  cacheRead: number;
-  cacheWrite: number;
-  /** A subset of `cacheWrite`, reported by hosts that split retention. */
-  cacheWrite1h?: number;
-  /** A subset of `output`, reported by hosts that expose the breakdown. */
-  reasoning?: number;
-  totalTokens: number;
-  cost: {
-    input: number;
-    output: number;
-    cacheRead: number;
-    cacheWrite: number;
-    total: number;
-  };
-}
-/** How core tells the operator something. A host with no UI is `none` rather
- * than a dropped callback, so a caller has one branch and no optional to miss. */
-export type Notices = {
-  readonly kind: "none";
-} | {
-  readonly kind: "ui";
-  notify(text: string, level: "info" | "warning"): void;
-};
-/** One model the host can call. `key` is the spelling config zones and metric
- * rows already use; `model` is the host's own handle, opaque here. */
-export interface ModelRef<Model> {
-  readonly key: string;
-  readonly reasoning: boolean;
-  readonly model: Model;
-}
-export interface ModelRequest {
-  readonly provider: string;
-  readonly id: string;
-}
-export interface CompletionRequest {
-  readonly prompt: string;
-  readonly maxTokens: number;
-}
-/** What a call came back with. `stop` is the host's own word, kept verbatim for
- * metric rows; `capped` is the host saying the answer was cut short, which is
- * the one thing a caller must never store. */
-export type ModelAnswer = {
-  outcome: "answer";
-  text: string;
-  stop: string;
-  usage: Usage | undefined;
-} | {
-  outcome: "failed";
-  reason: string;
-  capped: boolean;
-  stop: string;
-  usage: Usage | undefined;
-};
-export interface ModelHost<Model> {
-  readonly notices: Notices;
-  session(): ModelRef<Model> | undefined;
-  find(requested: ModelRequest): ModelRef<Model> | undefined;
-  complete(model: ModelRef<Model>, request: CompletionRequest): Promise<ModelAnswer>;
-}
-/** A tool the reader may call. The schema is the host's, passed through rather
- * than rebuilt. */
-export interface ReaderTool {
-  name: string;
-  description: string;
-  parameters: TSchema;
-}
-export interface ReaderCall {
-  readonly id: string;
-  readonly name: string;
-  readonly arguments: Record<string, unknown>;
-}
-export interface ReaderResult {
-  readonly call: ReaderCall;
-  readonly text: string;
+  metrics: LcmMetricRecord[];
+  pinnedModelKey: string;
+  pinnedWindow: number;
+  clampNotified: boolean;
+  clampWarning?: string;
 }
-/** What one reader step produced. `reads` asks the caller to run the calls;
- * `answered` means the reader is done, with whatever text it accumulated. */
-export type ReaderReply = {
-  outcome: "reads";
-  calls: readonly ReaderCall[];
-  text: string;
-  usage: Usage | undefined;
+export type ContextPolicyResult = ContextPolicyBase & ({
+  outcome: "quiet";
 } | {
-  outcome: "answered";
-  text: string;
-  usage: Usage | undefined;
+  outcome: "reapply";
+  messages: AssemblyMsg[];
 } | {
-  outcome: "failed";
-  reason: string;
-  usage: Usage | undefined;
-};
-export interface ReaderRequest {
-  readonly systemPrompt: string;
-  readonly brief: string;
-  readonly tools: readonly ReaderTool[];
-}
-/** One reader conversation. The host owns the transcript: `next` appends the
- * results it is handed, appends its own reply, and calls the model. */
-export interface Reading {
-  next(results: readonly ReaderResult[]): Promise<ReaderReply>;
-}
-export interface Reader {
-  begin(request: ReaderRequest): Reading;
-}
-//#endregion
-//#region src/llm.d.ts
-export interface SummarizerConfig {
-  /** One model id, or an ordered fallback chain. `auto` is the session model. */
-  summarizer?: string | string[];
-  /** Tokens one request may cost, estimate plus output cap, before it is refused
-   * rather than paid for. A backstop, not a throttle. */
-  summarizerTokensPerCall?: number;
-  /** Tokens one pass may spend across all its calls, counted from what the
-   * provider reported. Reaching it finishes the pass mechanically. */
-  summarizerTokensPerPass?: number;
+  outcome: "swap";
+  messages: AssemblyMsg[];
+} | {
+  outcome: "bail";
+  reason: BailReason;
+  messages?: AssemblyMsg[];
+} | {
+  outcome: "kick";
+  reason: "summary-missing";
+  aged: NonEmpty<AlignedEntry>;
+  /** The span this kick is about, in the order the store resolves one. The
+   * adapter keys its latch on it, so the latch and the coverage check
+   * cannot disagree about which boundary is missing. */
+  span: {
+    firstEntryId: string;
+    lastEntryId: string;
+  };
+  messages?: AssemblyMsg[];
+});
+export interface ContextPolicyDeps {
+  thresholds: (cfg: ThresholdConfig, window: number) => ResolvedThresholds;
+  nextAction: (state: CommitState | null, occupancy: number, swap: number, recut: number) => AssemblyAction;
+  cutIndexFor: (msgs: readonly AssemblyMsg[], keepRecentTokens: number) => number | null;
+  cutMayReplace: (previous: CommitState | null, newCutCount: number) => boolean;
+  frontier: (firstEntryId: string, lastEntryId: string) => SummaryNode[];
+  /** The aged set's own ends as a span: branch order, and only entries the store
+   * holds. Pi's context array is not branch order (it hoists the newest
+   * compaction entry to the front), and a span whose ends are inverted resolves
+   * to nothing, so this answers with the end pair a store query can use. Null
+   * when the store holds none of the aged entries, which is a state rather than
+   * a kick. */
+  spanBounds: (aged: NonEmpty<AlignedEntry>) => {
+    firstEntryId: string;
+    lastEntryId: string;
+  } | null;
+  buildSynthetic: (summaries: readonly RenderableSummary[]) => CommitState["synthetic"];
+  /** The mask node text passes through on its way to a model. The store keeps
+   * the bytes, so every read seam takes this rather than storing a masked
+   * copy; `makeRedact` is the provider a real caller passes. */
+  redact: (text: string) => string;
 }
-/**
- * Thinking tokens are charged against the completion budget, so a reasoning
- * model can spend the whole cap before it emits any text. The headroom sits on
- * top of the caller's request, so the requested output size does not change.
- */
-export declare const REASONING_HEADROOM = 4096;
-export interface ResolvedChain<Model> {
-  /** The models to try, in order and deduped. Empty when nothing resolves. */
-  models: ModelRef<Model>[];
-  /** Configured entries the host could not resolve, in order. */
-  unresolved: string[];
-  requested: string[];
+export interface FailedBoundary {
+  attempts: number;
+  lastAt: number;
 }
-/** Expand the configured chain: `auto` (the session model) goes last unless the
- * chain names it, so one bad entry still leaves the session able to summarize. */
-export declare function resolveModels<Model>(host: ModelHost<Model>, config: SummarizerConfig): ResolvedChain<Model>;
-/** The one rendering of a resolved chain. The level travels with the warning so
- * no caller can pick a different notify level for the same chain. */
-export type ChainReport = {
-  level: "info";
-  state: string;
-} | {
-  level: "warning";
-  state: string;
-  warning: string;
+export declare const KICK_MAX_ATTEMPTS = 3;
+export declare const KICK_BACKOFF_MS: number;
+export declare function shouldKickBoundary(latch: FailedBoundary | undefined, now: number): boolean;
+export declare function applyContextPolicy(input: ContextPolicyInput, deps: ContextPolicyDeps): ContextPolicyResult;
+/** The frontier as the projection renders it: every node redacted on its way to
+ * a model, and the degradation ladder walked only until the render fits the
+ * summary budget. The blocking compaction hook calls this too, so the text it
+ * hands the host is the text the projection would have sent. */
+export declare function renderableFrontier(frontier: readonly SummaryNode[], summaryTokens: number, redact: (text: string) => string): {
+  applied: AppliedSummary[];
+  renderedTokens: number;
 };
-export declare function describeSummarizerChain<Model>(chain: ResolvedChain<Model>): ChainReport;
-/** The span every call from one completer summarizes. The failure cap is per
- * span, so a completer is built with the span it will be asked about. */
-export interface SummarizedSpan {
-  firstEntryId: string;
-  lastEntryId: string;
+export interface CompactionBounds {
+  startEntryId?: string;
+  firstKeptEntryId: string;
 }
-export interface MakeLlmOptions {
-  session: string;
-  stage?: SummarizerStage;
-  span: SummarizedSpan;
+/** Blocking-regime span (session_before_compact), computed the way Pi's
+ * prepareCompaction does: branch entries from the previous compaction's first
+ * kept entry up to but excluding the new one, minus compaction rows. Entry ids,
+ * not message text, so bash and branch-summary rows align. An unknown
+ * firstKeptEntryId yields an empty span, so the caller falls back to Pi. */
+export declare function resolveCompactionSpan(branchMsgs: readonly AlignedEntry[], bounds: CompactionBounds): AlignedEntry[];
+export type FindingKind = "fts-index" | "summary-span" | "summary-shape" | "orphan-child" | "duplicate-span" | "foreign-key" | "schema-version" | "dead-run" | "coverage";
+export interface Finding {
+  kind: FindingKind;
+  /** `violation` is an invariant the DAG depends on; `coverage` is a count. */
+  severity: "violation" | "info";
+  count: number;
+  detail: string;
+  sample: string[];
 }
-/** Failed walks in a row before a pass stops calling the model and lets the
- * ladder's deterministic truncate finish the span. One is too eager, because a
- * single transport blip would turn a whole span mechanical; past three, another
- * call carries no new information about the provider and costs its latency. */
-export declare const SUMMARIZER_FAILURE_CAP = 3;
-/** What one request may cost before it is refused instead of paid for. It exists
- * for a pathological chunk rather than for a normal one. */
-export declare const SUMMARIZER_CALL_TOKENS = 60000;
-/** What one pass may spend across all of its calls. */
-export declare const SUMMARIZER_PASS_TOKENS = 250000;
-export declare function retriableCategory(category: SummarizerFailureCategory): boolean;
-/** How long a span whose calls were capped is left alone. Shorter than the kick
- * backoff (`KICK_BACKOFF_MS`) on purpose: this guards a retry inside one turn,
- * it is not the breaker that stops re-kicks across turns. */
-export declare const FAILED_SPAN_TTL_MS = 60000;
-/** What a failed span is identified by: the two ends a caller asked about and
- * the chain it asked. A different model is a different attempt, not the same
- * failure, so the chain is part of the key. */
-export declare function spanFingerprint(span: SummarizedSpan, chain: readonly string[]): string;
-/**
- * A call that reached no usable answer. `category` is what the provider's own
- * text says: a best-effort read that answers `unknown` rather than guessing, and
- * `capped` when the caller should stop asking rather than the provider failing.
- */
-export declare class SummarizerFailure extends Error {
-  readonly category: SummarizerFailureCategory;
-  constructor(message: string, category: SummarizerFailureCategory);
+export interface IntegrityReport {
+  /** How many checks ran, so "no findings" cannot be confused with "no checks". */
+  checks: number;
+  findings: Finding[];
 }
-/** Which bucket a provider's error text falls in. A 5xx or a dropped connection
- * is `unavailable` before it is `timeout`, because the gateway's own timeout is
- * a request that never reached a model. */
-export declare function classifyFailure(text: string | undefined): SummarizerFailureCategory;
-export declare function makeLlm<Model>(host: ModelHost<Model>, config: SummarizerConfig, opts: MakeLlmOptions): ((systemPrompt: string, userText: string, maxTokens: number) => Promise<string>) | null;
-/** Sessions share the process, so each one gets to see the config it runs, and
- * a session that starts fresh should not inherit a refusal from the last one. */
-export declare function resetSummarizerState(): void;
-//#endregion
-//#region src/report.d.ts
+export declare function checkIntegrity(store: LcmStore): IntegrityReport;
+/** Fix what can be fixed without guessing: the derived index, rows whose span no
+ * longer exists, nodes whose child no longer resolves, rows a run whose writer is
+ * gone left behind, and predated duplicate spans. An inverted span is left
+ * alone, because which end is right needs the session file. */
+export declare function repairIntegrity(store: LcmStore): string[];
 type Row = MetricRecord;
 type KeysOf<T> = T extends unknown ? keyof T : never;
 type ValueOf<T, K> = T extends unknown ? (K extends keyof T ? T[K] : never) : never;
@@ -1435,8 +1862,6 @@ export declare function depthStats(summaries: readonly {
   tokens: number;
 }[]): DepthStat[];
 export declare function buildReport(events: readonly MetricsEvent[]): string;
-//#endregion
-//#region src/diagnose.d.ts
 export interface FactConfig {
   swapAtTokens?: number;
   recutAtTokens?: number;
@@ -1523,43 +1948,6 @@ export declare function hostVersion(hostPackage: string, from: string | URL): st
  * or named something else is not the answer, so a wrong anchor fails the name
  * check instead of reporting a stranger's version. */
 export declare function packageVersionNear(from: string, name: string): string | undefined;
-//#endregion
-//#region src/estimate-tokens.d.ts
-export declare const CHARS_PER_TOKEN = 4;
-/** Samples below this count say nothing: with two points any line fits, and the
- * first turns of a session are exactly where the overhead has not cancelled. */
-export declare const CALIBRATION_MIN_SAMPLES = 3;
-/** Samples kept in memory. A cap keeps the median describing the recent turns of
- * the session rather than its whole history, which is what a model switch inside
- * one session would otherwise be unable to move. */
-export declare const CALIBRATION_SAMPLE_CAP = 8;
-/** One observation of the same session: how many characters this build counted in
- * the messages, and how many tokens Pi reported for the request that carried
- * them. Sampling differences rather than totals is what cancels the system prompt
- * and tool definitions, which this build never counts. */
-export interface EstimateSample {
-  chars: number;
-  tokens: number;
-}
-export declare function estimateTokens(text: string): number;
-export declare function tokensFromChars(chars: number): number;
-/** A reported count below this share of the estimate describes a context other
- * than the one on hand: Pi reports its last measurement, and after a resume that
- * measurement belongs to the previous process. The estimator's own error is
- * bounded by the calibration band, which is a factor of two in either direction
- * around the constant, so anything below a quarter is a different turn rather
- * than a miscount. A reported count too high only compacts early, which is why
- * this looks one way. */
-export declare const STALE_REPORT_SHARE = 0.25;
-export declare function calibrate(samples: readonly EstimateSample[]): number | null;
-/** A configured token budget in the units `estimateTokens` counts. The estimator
- * counts chars / 4, so a model whose real ratio is 6 needs 1.5 times the
- * configured number of estimated tokens accumulated before it has kept the
- * context the user asked for. Without a ratio the budget is left alone, which is
- * the constant's own reading of it. */
-export declare function scaledBudget(tokens: number, charsPerToken: number | null): number;
-//#endregion
-//#region src/eval.d.ts
 /** The seed CI runs. Fixed, so a change in the answer is a change in the engine
  * rather than a change in the fixture. */
 export declare const SMALL_SEED = 20260915;
@@ -1629,8 +2017,6 @@ export interface EvalRunOptions {
 }
 export declare function runEval(opts: EvalOptions, run: EvalRunOptions): Promise<EvalResult>;
 export declare function formatEvalTable(results: readonly EvalResult[]): string;
-//#endregion
-//#region src/export.d.ts
 /** The format this build writes, and the only one it reads. A range reads as a
  * compatibility promise while the row readers ignore the number, and the store,
  * not the file, holds the truth: a file that does not fit is re-exported. */
@@ -1663,6 +2049,8 @@ export interface ExportSummaryRow {
   depth: number;
   firstEntryId: string;
   lastEntryId: string;
+  /** Absent in files written before the quality verdict existed. */
+  quality?: SummaryQuality;
   messageEntryIds: string[];
   childOrdinals: number[];
 }
@@ -1683,12 +2071,158 @@ export declare function exportTranscript(store: LcmStore): {
   summaries: SummaryNode[];
   toJSONL: () => string;
 };
-//#endregion
-//#region src/format.d.ts
 export declare function fmtTokens(n: number): string;
 export declare function fmtBytes(n: number): string;
-//#endregion
-//#region src/home-paths.d.ts
+export declare function fmtDuration(ms: number): string;
+/** The mechanical marker shared with the store migration and import fallback.
+ * Detection prefers the quality verdict and keeps this as the legacy signal. */
+export declare const HEAL_TRUNCATED_PREFIX = "[lcm:truncated]";
+export declare const HEAL_TARGET_TOKENS = 1500;
+/** The source-to-summary ratio the default window follows. A heal reads more
+ * than it writes, but a repair that cannot see the source cannot be clean. */
+export declare const HEAL_SOURCE_TARGET_FACTOR = 8;
+export declare const HEAL_SOURCE_MIN_TOKENS = 3000;
+export declare const HEAL_SOURCE_MAX_TOKENS = 24000;
+/** One repair may read a source larger than its window, but only as a bounded
+ * map-reduce: the fanout matches the DAG's maximum child count, so a windowed
+ * repair cannot grow calls without a limit. */
+export declare const HEAL_MAX_WINDOWS_PER_NODE = 8;
+/** Room for the system prompt and the summary instruction under a call cap. */
+export declare const HEAL_PROMPT_TOKENS = 1024;
+/** Kept for callers that still name the old constant. The value is the floor,
+ * not a fixed per-message clip. */
+export declare const HEAL_LEAF_CHUNK_TOKENS = 3000;
+export declare const HEAL_MAX_NODES = 32;
+export declare const HEAL_TOKEN_BUDGET = 250000;
+export interface HealSourceBudgetInput {
+  targetTokens?: number;
+  /** An explicit source window. The derived default is `8 * targetTokens`,
+   * clamped to the source floor and ceiling and then to the call budget. */
+  sourceTokens?: number;
+  callBudgetTokens?: number;
+}
+export interface HealInput {
+  /** Session tag for every engine row and every ladder call this run makes. */
+  session?: string;
+  /** Tokens one repaired node targets. A result above twice this is rejected. */
+  targetTokens?: number;
+  /** Estimated tokens one map window may read. Defaults to `8 * targetTokens`,
+   * clamped to 3,000 through 24,000 and to the request budget. A larger leaf
+   * source uses up to eight windows and one reduce; it is never clipped to a
+   * per-message slice. */
+  sourceTokens?: number;
+  /** @deprecated Use `sourceTokens`. Kept so a caller from the first heal
+   * release keeps working; it now means the same per-window budget. */
+  leafChunkTokens?: number;
+  /** Tokens one summarizer request may cost. The source window is clamped so
+   * its prompt, output, and reserve fit this cap. */
+  callBudgetTokens?: number;
+  /** Nodes this run may attempt. Ancestors only run after their children. */
+  maxNodes?: number;
+  /** Model calls this run may make. Defaults to twice `maxNodes`. */
+  maxCalls?: number;
+  /** Estimated tokens this run may spend. The provider's own budget still runs. */
+  maxTokens?: number;
+  /** Report the plan and make no model call. */
+  dryRun?: boolean;
+  /** Masks text on its way to the model and into the replacement node. */
+  redact?: (text: string) => string;
+  /** Override for tests and imports; the deterministic prefix is the default. */
+  truncatedPrefix?: string;
+}
+export interface HealCandidate {
+  id: number;
+  nodeKind: "leaf" | "condensed";
+  depth: number;
+  quality: SummaryQuality;
+  /** The node's own text is the deterministic truncate, either by verdict or by
+   * the prefix fallback. */
+  mechanical: boolean;
+  /** The node is a seed: its quality is not clean, or its text carries the
+   * mechanical prefix. */
+  tainted: boolean;
+  /** Candidate parents, in id order. A dry run reports the dependency shape
+   * through these edges; repair order is always child before parent. */
+  parents: number[];
+}
+export interface HealNodeResult {
+  id: number;
+  nodeKind: "leaf" | "condensed";
+  depth: number;
+  tainted: boolean;
+  qualityBefore: SummaryQuality;
+  /** The quality this run stored, or absent when the old row stands. A failed
+   * node keeps its persisted verdict, which is what the next run seeds on. */
+  qualityAfter?: SummaryQuality;
+  outcome: HealNodeOutcomeKind;
+  reason?: string;
+  /** 3 when the text is the deterministic truncate, null otherwise. */
+  levelBefore: SummaryLevel | null;
+  /** The level stored by this run, or null when the old text stands. */
+  levelAfter: SummaryLevel | null;
+  beforeTokens: number;
+  afterTokens: number | null;
+  calls: number;
+  /** Source facts for the attempted node. They never include source text. */
+  sourceTokens?: number;
+  sourceChars?: number;
+  sourceClipped?: boolean;
+}
+export interface HealCounts {
+  candidates: number;
+  tainted: number;
+  attempted: number;
+  /** Nodes whose new text is clean. An improved node is not a repair. */
+  repaired: number;
+  /** Nodes whose text changed but remains clipped or derived. */
+  improved: number;
+  failed: number;
+  /** Dependency-blocked plus source-blocked nodes. */
+  blocked: number;
+  /** The source-blocked subset of `blocked`. */
+  blockedSource: number;
+  skipped: number;
+  changed: number;
+  notAttempted: number;
+}
+export interface HealOutcome {
+  dryRun: boolean;
+  stop: HealStopReason;
+  /** The effective map window for this run, in estimated tokens. */
+  sourceTokens: number;
+  callBudgetTokens: number;
+  candidates: HealCandidate[];
+  nodes: HealNodeResult[];
+  repaired: number[];
+  improved: number[];
+  failed: number[];
+  blocked: number[];
+  /** The subset of `blocked` whose source exceeded the window. */
+  blockedSource: number[];
+  skipped: number[];
+  changed: number[];
+  notAttempted: number[];
+  calls: number;
+  tokens: number;
+  counts: HealCounts;
+}
+/** The source window a repair is allowed to read, in estimated tokens.
+ *
+ * The default is a multiple of the summary target, so the one quality knob a
+ * user already tunes moves the source with it. A fixed source window has the
+ * failure this policy exists to remove: every larger input clips at the same
+ * place forever. The window is still bounded by the request cap, so a large
+ * source cannot turn into a prompt the provider will refuse.
+ */
+export declare function healSourceBudget(input?: HealSourceBudgetInput): number;
+/**
+ * Re-derive mechanical summaries from the source they still point at, then
+ * recompute every ancestor whose child changed. The messages table is never
+ * written: a leaf is rebuilt from its exact provenance rows, a condensed node
+ * from its exact children, and only a node whose text still matches the read
+ * that produced the replacement is written at all.
+ */
+export declare function runHeal(store: HealStore, input: HealInput, llm: LlmComplete): Promise<HealOutcome>;
 /** Escape hatch for a live session that carries a test signal for another
  * reason, so the guard can never brick one. */
 export declare const ALLOW_REAL_HOME_FLAG = "LCM_ALLOW_REAL_HOME";
@@ -1697,8 +2231,6 @@ export declare function isUnderTempDir(path: string): boolean;
  * guard covers them all instead of one per call site. A test run refuses a path
  * outside its temp home rather than touching the real config. */
 export declare function lcmHomePath(...segments: string[]): string;
-//#endregion
-//#region src/import.d.ts
 export interface ImportResult {
   messagesInserted: number;
   messagesSkipped: number;
@@ -1719,8 +2251,6 @@ export type ParsedExport = {
  * the caller can report a line number. */
 export declare function parseExport(text: string): ParsedExport;
 export declare function importTranscript(store: LcmStore, rows: readonly ExportRow[]): ImportResult;
-//#endregion
-//#region src/ingest.d.ts
 export interface IngestibleEntry {
   entryId: string;
   role: LcmRole;
@@ -1789,23 +2319,6 @@ export declare function ingestEntries(store: IngestStore, entries: readonly Inge
     largeFileChars: number;
   };
 }): IngestStats;
-//#endregion
-//#region src/overflow-window.d.ts
-/** A window outside this band is a misread rather than a model: no provider
- * serves a context under a thousand tokens or over a hundred million, and a
- * number outside it means a pattern caught the request count, a status code, or
- * something else that was not a limit. A refused parse is the floor path, which
- * costs one conservative turn instead of a wrong permanent window. */
-export declare const WINDOW_MIN = 1000;
-export declare const WINDOW_MAX = 100000000;
-/** The window in tokens a provider stated in an overflow message, or null when
- * the message does not name one. Null is an answer: the caller keeps Pi's belief
- * and arms the one-shot floor, which is all a body like "400/413 status code (no
- * body)" can support. */
-export declare function windowFromError(errorMessage: string | undefined): number | null;
-export declare const WINDOW_PATTERN_EXAMPLES: readonly string[];
-//#endregion
-//#region src/recall-view.d.ts
 export declare const GREP_PAGE_HITS = 20;
 export type ViewResult = {
   ok: true;
@@ -1827,6 +2340,8 @@ export declare function grepView(store: LcmStore, redact: (text: string) => stri
    * names. A page cannot express where a clock ran out. */
   after?: string;
   now?: () => number;
+  /** Tool the continuation marker names. Defaults to `lcm_expand_query`. */
+  expandTool?: string;
 }): ViewResult;
 export declare function describeView(store: LcmStore, redact: (text: string) => string, id: number): ViewResult;
 /** List the summary's messages, or read one of them as a window of characters.
@@ -1847,8 +2362,6 @@ export type ExpandParams = {
 };
 export declare function expandView(store: LcmStore, redact: (text: string) => string, params: ExpandParams): ViewResult;
 export declare function historyManifest(store: LcmStore, limit: number): string;
-//#endregion
-//#region src/redact.d.ts
 /** Redactor that re-reads the flag on every call, so a cockpit toggle takes
  * effect immediately: a getter, because patchConfig replaces the config object
  * and closing over it would pin the session-start value. */
@@ -1856,8 +2369,6 @@ export declare function makeRedact(getConfig: () => {
   redactSecrets?: boolean;
 }): (text: string) => string;
 export declare function redactSecrets(text: string): string;
-//#endregion
-//#region src/retention.d.ts
 export declare const SCRATCH_MAX_AGE_MS: number;
 export interface DbFootprint {
   path: string;
@@ -1880,8 +2391,6 @@ export declare function retentionCandidates(opts: {
   now: number;
   scratchMaxAgeMs: number;
 }): GcCandidate[];
-//#endregion
-//#region src/retrieval.d.ts
 export declare const RETRIEVAL_STEPS = 6;
 export declare const MANIFEST_NODES = 20;
 export declare const MAX_EXPAND_CHARS = 20000;
@@ -1927,8 +2436,6 @@ export type RetrievalRun = (RetrievalBase & {
   reason: string;
 });
 export declare function runRetrieval(store: LcmStore, request: RetrievalRequest, reader: Reader): Promise<RetrievalRun>;
-//#endregion
-//#region src/sessions.d.ts
 /** Most recent past sessions one scan considers. A cap, not a promise: the
  * deadline below is what bounds the work. */
 export declare const SESSION_SCAN_LIMIT = 20;
@@ -2015,5 +2522,5 @@ export declare function sessionsForScope(opts: {
   excludeHash?: string;
   limit?: number;
 }): SessionRef[];
-//#endregion
+export {};
 //# sourceMappingURL=index.d.mts.map