pi-condense 2.10.1 → 2.10.3

package/src/reload-rearm.integration.test.ts

@@ -3,6 +3,7 @@ import { mkdtempSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 import * as actualCompat from "@earendil-works/pi-ai/compat";
+import { supersededStub } from "./supersede.js";
 
 // This must run before any module that transitively reads PI_CODING_AGENT_DIR
 // (src/config.ts's getAgentDir()) is imported/executed.
@@ -175,6 +176,7 @@ function bootExtension(
     sessionAppendCustomEntry?: (push: (type: string, data?: unknown) => void) => (type: string, data?: unknown) => string;
     branch?: any[];
     protectedTools?: string[];
+    protectedPaths?: string[];
     autoBudgetThreshold?: number | null;
     budgetTurnDelta?: number | null;
     frontierGapThresholdTokens?: number | null;
@@ -201,6 +203,7 @@ function bootExtension(
   // Omitted unless the test explicitly passes them, so the "default-null
   // inert" scenario can assert behavior with no key present at all (not an
   // explicit null), matching config.ts's own default.
+  if (options.protectedPaths !== undefined) contextPruneSettings.protectedPaths = options.protectedPaths;
   if (options.budgetTurnDelta !== undefined) contextPruneSettings.budgetTurnDelta = options.budgetTurnDelta;
   if (options.frontierGapThresholdTokens !== undefined) {
     contextPruneSettings.frontierGapThresholdTokens = options.frontierGapThresholdTokens;
@@ -916,3 +919,518 @@ describe("reload rearm (issue #6)", () => {
     expect(secondFrontier.lastAttemptedTimestamp).toBeGreaterThan(firstFrontier.lastAttemptedTimestamp);
   });
 });
+
+describe("supersede floor cadence (spec 2026-09-07)", () => {
+  const PROTECTED_PATH = "/x/skills/a/SKILL.md";
+  const PROTECTED_GLOB = "**/skills/**/*.md";
+
+  function protectedRead(id: string, ts: number, text = `content-${id}`): any[] {
+    return [
+      {
+        type: "message",
+        message: { role: "assistant", content: [{ type: "toolCall", id, name: "read", arguments: { path: PROTECTED_PATH } }] },
+      },
+      {
+        type: "message",
+        message: { role: "toolResult", toolCallId: id, toolName: "read", content: [{ type: "text", text }], timestamp: ts },
+      },
+    ];
+  }
+
+  function bashCall(id: string, ts: number, text = "x".repeat(400)): any[] {
+    return [
+      { type: "message", message: { role: "assistant", content: [{ type: "toolCall", id, name: "bash", arguments: {} }] } },
+      { type: "message", message: { role: "toolResult", toolCallId: id, toolName: "bash", content: [{ type: "text", text }], timestamp: ts } },
+    ];
+  }
+
+  async function render(branch: any[], handlers: Map<string, any>, ctx: any): Promise<any[]> {
+    const rawMessages = branch.filter((e) => e.type === "message").map((e) => e.message);
+    const res = await handlers.get("context")!({ messages: rawMessages }, ctx);
+    return res?.messages ?? rawMessages;
+  }
+
+  function toolResultText(messages: any[], toolCallId: string): string | undefined {
+    const m = messages.find((m: any) => m.role === "toolResult" && m.toolCallId === toolCallId);
+    if (!m) return undefined;
+    return Array.isArray(m.content) ? m.content.map((c: any) => c.text).join("\n") : String(m.content);
+  }
+
+  it("no rewrite between two protected reads leaves both verbatim", async () => {
+    const branch: any[] = [];
+    const { handlers, ctx } = await boot({ protectedPaths: [PROTECTED_GLOB], branch });
+
+    branch.push(...protectedRead("r1", 10));
+    await handlers.get("session_start")!({}, ctx);
+    // Prime: consumes the session_start floor=0 while only the first read
+    // exists (no candidate yet), so it cannot spuriously activate anything.
+    await render(branch, handlers, ctx);
+
+    branch.push(...protectedRead("r2", 30));
+    // No flush/compression/cold-cache event between the two reads.
+    const rendered = await render(branch, handlers, ctx);
+
+    expect(toolResultText(rendered, "r1")).toBe("content-r1");
+    expect(toolResultText(rendered, "r2")).toBe("content-r2");
+  });
+
+  it("an indexed flush whose unprotected result precedes the older read stubs it", async () => {
+    const branch: any[] = [];
+    const { handlers, ctx, appended } = await boot({ protectedPaths: [PROTECTED_GLOB], branch });
+
+    branch.push(...bashCall("bash1", 10));
+    branch.push(...protectedRead("r1", 20));
+    await handlers.get("session_start")!({}, ctx);
+    await render(branch, handlers, ctx); // prime: consume floor=0, single occurrence so far
+
+    branch.push(...protectedRead("r2", 30));
+
+    // bootExtension's default ctx.getContextUsage() is 0.6, above the 0.5
+    // autoBudgetThreshold, so this turn_end flushes immediately.
+    await handlers.get("turn_end")!(
+      {
+        message: { role: "assistant", content: [{ type: "toolCall", id: "bash1", name: "bash", arguments: {} }] },
+        toolResults: [
+          { role: "toolResult", toolCallId: "bash1", toolName: "bash", content: [{ type: "text", text: "x".repeat(400) }], timestamp: 10 },
+        ],
+        turnIndex: 1,
+      },
+      ctx,
+    );
+
+    expect(appended.some((e) => e.type === "context-prune-index")).toBe(true);
+
+    const rendered = await render(branch, handlers, ctx);
+    expect(toolResultText(rendered, "r1")).toBe(supersededStub(PROTECTED_PATH));
+    expect(toolResultText(rendered, "r2")).toBe("content-r2");
+    // Phase 1 (unrelated to supersede) already stubs bash1's own result.
+    expect(toolResultText(rendered, "bash1")).not.toBe("x".repeat(400));
+  });
+
+  it("an indexed flush whose unprotected result follows the older read leaves it verbatim (floor is positional)", async () => {
+    const branch: any[] = [];
+    const { handlers, ctx, appended } = await boot({ protectedPaths: [PROTECTED_GLOB], branch });
+
+    branch.push(...protectedRead("r1", 10));
+    await handlers.get("session_start")!({}, ctx);
+    await render(branch, handlers, ctx); // prime
+
+    branch.push(...bashCall("bash1", 20));
+    branch.push(...protectedRead("r2", 30));
+
+    await handlers.get("turn_end")!(
+      {
+        message: { role: "assistant", content: [{ type: "toolCall", id: "bash1", name: "bash", arguments: {} }] },
+        toolResults: [
+          { role: "toolResult", toolCallId: "bash1", toolName: "bash", content: [{ type: "text", text: "x".repeat(400) }], timestamp: 20 },
+        ],
+        turnIndex: 1,
+      },
+      ctx,
+    );
+
+    expect(appended.some((e) => e.type === "context-prune-index")).toBe(true);
+
+    const rendered = await render(branch, handlers, ctx);
+    // Floor = 20 (bash1's resultTimestamp); r1's timestamp (10) is before it,
+    // so the floor never reaches it even though a real rewrite just happened.
+    expect(toolResultText(rendered, "r1")).toBe("content-r1");
+    expect(toolResultText(rendered, "r2")).toBe("content-r2");
+  });
+
+  it("a protected-only turn sets no floor", async () => {
+    const branch: any[] = [];
+    const { handlers, ctx, appended } = await boot({ protectedPaths: [PROTECTED_GLOB], branch });
+
+    branch.push(...protectedRead("r1", 10));
+    await handlers.get("session_start")!({}, ctx);
+    await render(branch, handlers, ctx); // prime
+
+    branch.push(...protectedRead("r2", 30));
+
+    await handlers.get("turn_end")!(
+      {
+        message: {
+          role: "assistant",
+          content: [
+            { type: "toolCall", id: "r1", name: "read", arguments: { path: PROTECTED_PATH } },
+            { type: "toolCall", id: "r2", name: "read", arguments: { path: PROTECTED_PATH } },
+          ],
+        },
+        toolResults: [
+          { role: "toolResult", toolCallId: "r1", toolName: "read", content: [{ type: "text", text: "content-r1" }], timestamp: 10 },
+          { role: "toolResult", toolCallId: "r2", toolName: "read", content: [{ type: "text", text: "content-r2" }], timestamp: 30 },
+        ],
+        turnIndex: 1,
+      },
+      ctx,
+    );
+
+    expect(appended.some((e) => e.type === "context-prune-index")).toBe(false);
+
+    const rendered = await render(branch, handlers, ctx);
+    expect(toolResultText(rendered, "r1")).toBe("content-r1");
+    expect(toolResultText(rendered, "r2")).toBe("content-r2");
+  });
+
+  const COLD_CACHE_EVENTS = ["session_start", "session_tree", "model_select", "session_compact", "thinking_level_select"];
+
+  for (const eventName of COLD_CACHE_EVENTS) {
+    it(`${eventName} activates every pending supersession (floor = 0)`, async () => {
+      const branch: any[] = [];
+      const { handlers, ctx } = await boot({ protectedPaths: [PROTECTED_GLOB], branch });
+
+      branch.push(...protectedRead("r1", 10));
+      await handlers.get("session_start")!({}, ctx);
+      await render(branch, handlers, ctx); // prime
+
+      branch.push(...protectedRead("r2", 30));
+      const beforeEvent = await render(branch, handlers, ctx);
+      expect(toolResultText(beforeEvent, "r1")).toBe("content-r1");
+      expect(toolResultText(beforeEvent, "r2")).toBe("content-r2");
+
+      await handlers.get(eventName)!({}, ctx);
+
+      const afterEvent = await render(branch, handlers, ctx);
+      expect(toolResultText(afterEvent, "r1")).toBe(supersededStub(PROTECTED_PATH));
+      expect(toolResultText(afterEvent, "r2")).toBe("content-r2");
+    });
+  }
+
+  it("stays sticky after cold-cache activation: the older read stays stubbed on a later render with no new event", async () => {
+    const branch: any[] = [];
+    const { handlers, ctx } = await boot({ protectedPaths: [PROTECTED_GLOB], branch });
+
+    branch.push(...protectedRead("r1", 10));
+    await handlers.get("session_start")!({}, ctx);
+    await render(branch, handlers, ctx); // prime
+
+    branch.push(...protectedRead("r2", 30));
+    await handlers.get("model_select")!({}, ctx);
+
+    const first = await render(branch, handlers, ctx);
+    expect(toolResultText(first, "r1")).toBe(supersededStub(PROTECTED_PATH));
+
+    const second = await render(branch, handlers, ctx);
+    expect(toolResultText(second, "r1")).toBe(supersededStub(PROTECTED_PATH));
+    expect(toolResultText(second, "r2")).toBe("content-r2");
+  });
+
+  it("chain compression lowers the floor: the older read stubs inside the compressed chain's <protected-output>, the newer read stays raw", async () => {
+    // Chain 0 mixes an unprotected bash call with the OLD protected read in the
+    // same turn, so the chain gets a real per-batch summary (a fully-protected
+    // chain is intentionally never compressed - chain-compressor.ts fullyProtected
+    // guard) while still carrying protectedToolCallIds for the read.
+    function closedChain(index: number, extraToolCalls: { id: string; name: string; args: any; text: string }[], startTs: number) {
+      const msgs: any[] = [];
+      let t = startTs;
+      msgs.push({ type: "message", message: { role: "user", content: [{ type: "text", text: `do task ${index}` }], timestamp: t } });
+      msgs.push({
+        type: "message",
+        message: {
+          role: "assistant",
+          content: extraToolCalls.map((c) => ({ type: "toolCall", id: c.id, name: c.name, arguments: c.args })),
+        },
+      });
+      for (const c of extraToolCalls) {
+        t += 100;
+        msgs.push({
+          type: "message",
+          message: { role: "toolResult", toolCallId: c.id, toolName: c.name, content: [{ type: "text", text: c.text }], timestamp: t },
+        });
+      }
+      t += 1000;
+      msgs.push({ type: "message", message: { role: "assistant", content: [{ type: "text", text: `done ${index}` }], timestamp: t } });
+      return { msgs, startUserTimestamp: startTs };
+    }
+
+    const chain0 = closedChain(
+      0,
+      [
+        { id: "c0-bash", name: "bash", args: {}, text: "x".repeat(400) },
+        { id: "c0-read", name: "read", args: { path: PROTECTED_PATH }, text: "content-r1" },
+      ],
+      1000,
+    );
+    const chain1 = closedChain(1, [{ id: "c1-bash", name: "bash", args: {}, text: "y".repeat(400) }], 5000);
+    const chain2 = closedChain(2, [{ id: "c2-bash", name: "bash", args: {}, text: "z".repeat(400) }], 9000);
+    const chain3 = closedChain(3, [{ id: "c3-bash", name: "bash", args: {}, text: "w".repeat(400) }], 13000);
+
+    const branch: any[] = [...chain0.msgs, ...chain1.msgs, ...chain2.msgs, ...chain3.msgs];
+    const { handlers, ctx, appended } = await boot({
+      protectedPaths: [PROTECTED_GLOB],
+      chainCompressionEnabled: true,
+      rollingWindow: 3,
+      branch,
+    });
+
+    await handlers.get("session_start")!({}, ctx);
+    await render(branch, handlers, ctx); // prime: only one occurrence of the protected path exists so far
+
+    // message_end drives an unconditional agent-message flush: summarizes the
+    // four turns, then compresses whichever chains fall outside rollingWindow=3
+    // (chain0, the oldest of four).
+    await handlers.get("message_end")!(
+      { message: { role: "assistant", content: [{ type: "text", text: "done" }] } },
+      ctx,
+    );
+
+    const chainEntries = appended.filter((e) => e.type === "context-prune-chain");
+    const chain0Entry = chainEntries.find((e) => (e.data as any).startUserTimestamp === chain0.startUserTimestamp);
+    if (!chain0Entry) {
+      throw new Error(`chain0 was not compressed - chainEntries: ${JSON.stringify(chainEntries.map((e) => e.data))}`);
+    }
+    expect(((chain0Entry.data as any).protectedToolCallIds ?? []).includes("c0-read")).toBe(true);
+
+    // The newer read of the same path, added after compression - never indexed,
+    // never compressed, must stay the winner.
+    branch.push(...protectedRead("r2", 20000));
+
+    const rendered = await render(branch, handlers, ctx);
+
+    const compressedChainMsg = rendered.find(
+      (m: any) => m.role === "user" && Array.isArray(m.content) && m.content[0]?.text?.includes(`id="${(chain0Entry.data as any).blockId}"`),
+    );
+    expect(compressedChainMsg).toBeDefined();
+    const chainText = compressedChainMsg.content[0].text as string;
+    expect(chainText).toContain('<protected-output tool="read">');
+    expect(chainText).toContain(supersededStub(PROTECTED_PATH));
+
+    expect(toolResultText(rendered, "r2")).toBe("content-r2");
+  });
+
+  it("a skipped-trivial batch (below minBatchChars) sets no floor", async () => {
+    const branch: any[] = [];
+    const { handlers, ctx, appended } = await boot({ protectedPaths: [PROTECTED_GLOB], branch });
+
+    // minBatchChars is hardcoded to 1 in this harness's settings fixture, so an
+    // empty result (0 raw chars) is the only way to land below it and take the
+    // trivial path instead of an actual LLM call.
+    branch.push(...bashCall("bash1", 10, ""));
+    branch.push(...protectedRead("r1", 20));
+    await handlers.get("session_start")!({}, ctx);
+    await render(branch, handlers, ctx); // prime
+
+    branch.push(...protectedRead("r2", 30));
+
+    await handlers.get("turn_end")!(
+      {
+        message: { role: "assistant", content: [{ type: "toolCall", id: "bash1", name: "bash", arguments: {} }] },
+        toolResults: [
+          { role: "toolResult", toolCallId: "bash1", toolName: "bash", content: [{ type: "text", text: "" }], timestamp: 10 },
+        ],
+        turnIndex: 1,
+      },
+      ctx,
+    );
+
+    expect(appended.some((e) => e.type === "context-prune-index")).toBe(false);
+    const frontierEntries = appended.filter((e) => e.type === "context-prune-frontier");
+    expect(frontierEntries.length).toBe(1);
+    expect((frontierEntries[0].data as any).outcome).toBe("skipped-trivial");
+
+    const rendered = await render(branch, handlers, ctx);
+    expect(toolResultText(rendered, "r1")).toBe("content-r1");
+    expect(toolResultText(rendered, "r2")).toBe("content-r2");
+  });
+
+  it("a skipped-oversized batch (summary longer than raw) sets no floor", async () => {
+    const branch: any[] = [];
+    const { handlers, ctx, appended } = await boot({ protectedPaths: [PROTECTED_GLOB], branch });
+
+    // A 1-char raw result clears minBatchChars=1 (not trivial) but the mocked
+    // summarizer's decorated output is always longer than 1 char, so
+    // shouldSkipOversized (index.ts) fires and the batch never indexes.
+    branch.push(...bashCall("bash1", 10, "x"));
+    branch.push(...protectedRead("r1", 20));
+    await handlers.get("session_start")!({}, ctx);
+    await render(branch, handlers, ctx); // prime
+
+    branch.push(...protectedRead("r2", 30));
+
+    await handlers.get("turn_end")!(
+      {
+        message: { role: "assistant", content: [{ type: "toolCall", id: "bash1", name: "bash", arguments: {} }] },
+        toolResults: [
+          { role: "toolResult", toolCallId: "bash1", toolName: "bash", content: [{ type: "text", text: "x" }], timestamp: 10 },
+        ],
+        turnIndex: 1,
+      },
+      ctx,
+    );
+
+    expect(appended.some((e) => e.type === "context-prune-index")).toBe(false);
+    const frontierEntries = appended.filter((e) => e.type === "context-prune-frontier");
+    expect(frontierEntries.length).toBe(1);
+    expect((frontierEntries[0].data as any).outcome).toBe("skipped-oversized");
+
+    const rendered = await render(branch, handlers, ctx);
+    expect(toolResultText(rendered, "r1")).toBe("content-r1");
+    expect(toolResultText(rendered, "r2")).toBe("content-r2");
+  });
+
+  it("a dedup alias registered in a fully-deduped (skipped-deduped) batch still lowers the floor", async () => {
+    // Batch 1 (turn 1): a real bash result R, flushed and indexed normally.
+    // Its own resultTimestamp (500) is deliberately AFTER the older protected
+    // read (100), so on its own it could never explain that read's
+    // activation. Batch 2 (turn 2) resends the identical bash content at an
+    // EARLIER timestamp (90, <= the older read's 100) — content-hash dedup
+    // (indexer.lookupByContent/registerDuplicate) turns it into a pure alias,
+    // no LLM call, batch outcome skipped-deduped — but the alias's own
+    // timestamp still feeds floorSources (index.ts, unconditionally, before
+    // the per-batch outcome switch), so it alone must be what activates the
+    // supersession, isolating G4's "alias counts regardless of outcome" claim
+    // from the ordinary indexed-flush floor path already covered above.
+    const R = "R".repeat(400);
+    const branch: any[] = [];
+    const { handlers, ctx, appended } = await boot({ protectedPaths: [PROTECTED_GLOB], branch });
+
+    branch.push(...protectedRead("r_old", 100));
+    await handlers.get("session_start")!({}, ctx);
+    await render(branch, handlers, ctx); // prime: single occurrence so far
+
+    branch.push(...bashCall("bashOrig", 500, R));
+    await handlers.get("turn_end")!(
+      {
+        message: { role: "assistant", content: [{ type: "toolCall", id: "bashOrig", name: "bash", arguments: {} }] },
+        toolResults: [{ role: "toolResult", toolCallId: "bashOrig", toolName: "bash", content: [{ type: "text", text: R }], timestamp: 500 }],
+        turnIndex: 1,
+      },
+      ctx,
+    );
+    expect(appended.some((e) => e.type === "context-prune-index")).toBe(true);
+
+    branch.push(...bashCall("bashDup", 90, R));
+    await handlers.get("turn_end")!(
+      {
+        message: { role: "assistant", content: [{ type: "toolCall", id: "bashDup", name: "bash", arguments: {} }] },
+        toolResults: [{ role: "toolResult", toolCallId: "bashDup", toolName: "bash", content: [{ type: "text", text: R }], timestamp: 90 }],
+        turnIndex: 2,
+      },
+      ctx,
+    );
+
+    const dedupAliasEntries = appended.filter((e) => e.type === "context-prune-dedup-alias");
+    expect(dedupAliasEntries.length).toBe(1);
+    const frontierEntries = appended.filter((e) => e.type === "context-prune-frontier");
+    expect(frontierEntries[frontierEntries.length - 1].data && (frontierEntries[frontierEntries.length - 1].data as any).outcome).toBe(
+      "skipped-deduped",
+    );
+    // The alias's own resultTimestamp (90) is <= the older read's (100) — the
+    // property that lets it, alone, explain the activation below.
+
+    branch.push(...protectedRead("r_new", 99999));
+    const rendered = await render(branch, handlers, ctx);
+
+    expect(toolResultText(rendered, "r_old")).toBe(supersededStub(PROTECTED_PATH));
+    expect(toolResultText(rendered, "r_new")).toBe("content-r_new");
+  });
+
+  it("a chain-compression floor (anchor timestamp) is distinguishable from the indexed-result floor", async () => {
+    // Every unprotected indexed result across all four chains (5000/7000/8000)
+    // is timestamped AFTER the older protected read (100). Only chain0's
+    // startUserTimestamp (10, the compression anchor) is timestamped before
+    // it — so only compressEligible's separate lowerFloor(startUserTimestamp)
+    // call (index.ts, after the per-batch flush's own lowerFloor call) can
+    // explain the older read's activation, isolating the chain-anchor floor
+    // source from the ordinary indexed-batch floor source already covered
+    // above.
+    function closedChain(startTs: number, toolCalls: { id: string; name: string; args: any; text: string }[]) {
+      const msgs: any[] = [];
+      msgs.push({ type: "message", message: { role: "user", content: [{ type: "text", text: `task ${startTs}` }], timestamp: startTs } });
+      msgs.push({
+        type: "message",
+        message: { role: "assistant", content: toolCalls.map((c) => ({ type: "toolCall", id: c.id, name: c.name, arguments: c.args })) },
+      });
+      for (const c of toolCalls) {
+        msgs.push({
+          type: "message",
+          message: { role: "toolResult", toolCallId: c.id, toolName: c.name, content: [{ type: "text", text: c.text }], timestamp: (c as any).ts },
+        });
+      }
+      msgs.push({ type: "message", message: { role: "assistant", content: [{ type: "text", text: `done ${startTs}` }], timestamp: startTs + 1 } });
+      return msgs;
+    }
+
+    const chain0 = closedChain(10, [{ id: "c0-bash", name: "bash", args: {}, text: "x".repeat(400), ts: 5000 } as any]);
+    const chain1 = closedChain(6000, [{ id: "c1-read", name: "read", args: { path: PROTECTED_PATH }, text: "content-r_old", ts: 100 } as any]);
+    const chain2 = closedChain(9000, [{ id: "c2-bash", name: "bash", args: {}, text: "y".repeat(400), ts: 7000 } as any]);
+    const chain3 = closedChain(13000, [{ id: "c3-bash", name: "bash", args: {}, text: "z".repeat(400), ts: 8000 } as any]);
+
+    const branch: any[] = [...chain0, ...chain1, ...chain2, ...chain3];
+    const { handlers, ctx, appended } = await boot({
+      protectedPaths: [PROTECTED_GLOB],
+      chainCompressionEnabled: true,
+      rollingWindow: 3,
+      branch,
+    });
+
+    await handlers.get("session_start")!({}, ctx);
+    await render(branch, handlers, ctx); // prime: only c1-read exists so far, no second occurrence
+
+    await handlers.get("message_end")!(
+      { message: { role: "assistant", content: [{ type: "text", text: "done" }] } },
+      ctx,
+    );
+
+    const chainEntries = appended.filter((e) => e.type === "context-prune-chain");
+    const chain0Entry = chainEntries.find((e) => (e.data as any).startUserTimestamp === 10);
+    if (!chain0Entry) {
+      throw new Error(`chain0 was not compressed - chainEntries: ${JSON.stringify(chainEntries.map((e) => e.data))}`);
+    }
+    expect((chain0Entry.data as any).startUserTimestamp).toBeLessThanOrEqual(100);
+
+    branch.push(...protectedRead("r_new", 99999));
+    const rendered = await render(branch, handlers, ctx);
+
+    expect(toolResultText(rendered, "c1-read")).toBe(supersededStub(PROTECTED_PATH));
+    expect(toolResultText(rendered, "r_new")).toBe("content-r_new");
+  });
+
+  it("combined lowering is monotonic: a later, higher-timestamp floor source cannot raise floor back up", async () => {
+    // The task's suggested shape (one indexed flush + one compression in the
+    // same turn) is exercised above by the chain-anchor test; this covers the
+    // explicitly-allowed alternative instead: two floor sources, in either
+    // order, across separate turns — the low value (10) is set first, the
+    // high value (1000) arrives after, and the floor must stay clamped at the
+    // min (10), not get overwritten by the later, higher call.
+    const branch: any[] = [];
+    const { handlers, ctx } = await boot({ protectedPaths: [PROTECTED_GLOB], branch });
+
+    branch.push(...protectedRead("r_mid", 500));
+    await handlers.get("session_start")!({}, ctx);
+    await render(branch, handlers, ctx); // prime: single occurrence so far
+
+    branch.push(...bashCall("bashLow", 10));
+    await handlers.get("turn_end")!(
+      {
+        message: { role: "assistant", content: [{ type: "toolCall", id: "bashLow", name: "bash", arguments: {} }] },
+        toolResults: [
+          { role: "toolResult", toolCallId: "bashLow", toolName: "bash", content: [{ type: "text", text: "x".repeat(400) }], timestamp: 10 },
+        ],
+        turnIndex: 1,
+      },
+      ctx,
+    );
+
+    branch.push(...bashCall("bashHigh", 1000));
+    await handlers.get("turn_end")!(
+      {
+        message: { role: "assistant", content: [{ type: "toolCall", id: "bashHigh", name: "bash", arguments: {} }] },
+        toolResults: [
+          { role: "toolResult", toolCallId: "bashHigh", toolName: "bash", content: [{ type: "text", text: "y".repeat(400) }], timestamp: 1000 },
+        ],
+        turnIndex: 2,
+      },
+      ctx,
+    );
+
+    branch.push(...protectedRead("r_new", 99999));
+    const rendered = await render(branch, handlers, ctx);
+
+    // r_mid (500) sits between the low floor source (10) and the high one
+    // (1000): only a floor still clamped at 10 explains its activation.
+    expect(toolResultText(rendered, "r_mid")).toBe(supersededStub(PROTECTED_PATH));
+    expect(toolResultText(rendered, "r_new")).toBe("content-r_new");
+  });
+});