pi-condense 2.13.0 → 2.14.0

package/CHANGELOG.md

@@ -7,6 +7,25 @@ Published to npm as [`pi-condense`](https://www.npmjs.com/package/pi-condense) (
 Pushing a `vX.Y.Z` tag triggers `.github/workflows/release.yml`, which runs the tests and
 publishes via OIDC trusted publishing. See `.agents/skills/release/SKILL.md`.
 
+## [2.14.0] - 2026-11-08
+
+### Changed
+
+- The compiled-against pi packages (`@earendil-works/pi-ai`, `pi-coding-agent`, `pi-tui`) move from `^1.3.0` to `^1.5.0`; the runtime floor stays pi >= 1.3.0 (`streamSimple`).
+
+### Added
+
+- Protected tool names and path globs also cover a result's recorded nested calls, including reads inside codemode scripts. Incomplete nested-call records keep the whole result inline verbatim even above the spill threshold and with path matching disabled; protected scripted reads are not superseded by later reads of the same path. (#27)
+- Paid synthetic behavioral evals measure downstream context quality after summarization and pruning, with frozen committed baselines for both summarizers and an eval-needed decision gate for every repository change. Offline harness tests remain separate from paid runs. (#22)
+- A private-session replay harness (`npm run eval:replay`) rebuilds real tool-call batches from session files into a corpus outside every checkout, summarizes each with production and a `--candidate` module, scores both against strings the assistant later reused, and fails on regressions; `matrix` compares model x thinking cells on retention, latency and cost. Synthetic eval reports now count evidence retained in the summary separately from evidence recovered on demand. (#23)
+
+## [2.13.1] - 2026-10-22
+
+### Changed
+
+- The summarizer idle default is 45s instead of 20s, allowing queued providers longer before session-model takeover; the silent-primary wait is 45s on initial detection and each failed 10-minute probe. Explicit settings keep their values. (#21)
+- Immediate session-model rescue notices include the primary failure reason, including idle/ceiling timeout or provider error text; deferred fallback notices remain unchanged. (#21)
+
 ## [2.13.0] - 2026-10-20
 
 ### Changed

package/PRUNING.md

@@ -633,15 +633,17 @@ Implementation: `src/pruner.ts` `pruneMessages(messages, indexer)` returns `{ me
 
 ### Protected tools & paths
 
-A tool call is protected if **either** its `toolName` is in `protectedTools` **or** its `args.path` (string) matches any glob in `protectedPaths`. Protected calls are filtered out **at capture time** - they never enter the `pendingBatches` queue, so their raw `ToolResultMessage` stays verbatim in future LLM context until a later read of the same path covers its delivered lines and supersedes it (below).
+A tool call is protected if its `toolName` is in `protectedTools`, its `args.path` (string) matches any glob in `protectedPaths`, or its result's recorded nested calls (`nestedCalls.calls`) include a name or path matching the same rules. This covers reads made inside codemode scripts and any other tool carrying `nestedCalls`, without a tool-name restriction. An incomplete nested-call record (`nestedCalls.complete === false`) protects the whole result unconditionally, even with both configuration lists empty. The recorder marks a record incomplete when arguments exceed 8 KiB per call or 32 KiB total, calls exceed 256, or a call is still running when the script ends; even a script that reads nothing protected can therefore stay verbatim. Nested call status does not affect matching.
+
+Protected calls are filtered out **at capture time** - they never enter the `pendingBatches` queue, summarizer, new index entries, or oversized spill, so their raw `ToolResultMessage` stays inline verbatim even above `spillThreshold`. Inside newly compressed chains their outputs relocate verbatim as `<protected-output>` without blocking compression. Only direct reads can be superseded when a later read of the same path covers their delivered lines and the cadence gate allows it (below); a protected scripted read stays verbatim and is not stubbed by a later read of the same path.
 
 **`protectedTools: string[]`** (default `[]`) - allowlist of tool names. Covers tools whose output is a small handle that must be reused byte-for-byte (e.g. a session-id) or planning tools like `todowrite` / `todoread`.
 
-**`protectedPaths: string[]`** (default `["**/skills/**/*.md", "**/gauntlet-overrides.md"]`) - glob list matched against `args.path`. Designed for skill files that carry multi-step workflow gates; summarizing them is categorically lossy. Non-string or missing `path` arguments never match. Set `[]` to disable. Edit with `/pruner protected-paths`.
+**`protectedPaths: string[]`** (default `["**/skills/**/*.md", "**/gauntlet-overrides.md"]`) - glob list matched against direct and recorded nested `args.path`. Designed for skill files that carry multi-step workflow gates; summarizing them is categorically lossy. Non-string or missing `path` arguments never match. Set `[]` to disable path matching only; nested tool-name matches and incomplete-record protection remain active. Edit with `/pruner protected-paths`.
 
 Glob contract: full-path match against the raw `args.path` string with `\` normalized to `/`. `*` and `?` match within a segment (no `/`); `**` crosses segments; `**/` also matches zero directories (so `**/SKILL.md` matches a bare relative `SKILL.md`). Case-sensitive. All other characters are regex-escaped literals.
 
-**Render-time re-check:** stub replacement runs in-flight on every turn (`pruneMessages`). If a tool call's persisted `args` now satisfy `isProtected` (e.g. a pattern was added mid-session), the stub is skipped and the raw result is left verbatim - this repairs already-summarized records in existing sessions with no schema change. Declared limitation: records inside already-compressed chains (`context-prune-chain` entries) are NOT repaired - their `protectedToolCallIds` set is fixed at compression time (forward-only). Dedup-alias edge: an alias resolving to an unprotected original stays stubbed.
+**Render-time re-check:** stub replacement runs in-flight on every turn (`pruneMessages`). If a tool call's persisted name and `args`, or its live result's `nestedCalls`, now satisfy `isProtected` (e.g. a pattern was added mid-session or a scripted read was summarized before nested-call protection), the stub is skipped and the raw result is left verbatim. The stored index entry stays but is not applied; this repairs already-summarized records in existing sessions with no schema change. Declared limitation: records inside already-compressed chains (`context-prune-chain` entries) are NOT repaired - their `protectedToolCallIds` set is fixed at compression time (forward-only). Dedup-alias edge: an alias resolving to an unprotected original stays stubbed unless its own live result carries protecting `nestedCalls`, and its own `args.path` is not re-checked.
 
 **Supersession (phase 1b, `src/supersede.ts`):** protected calls are never indexed, so content-hash dedup never sees them. A paired occurrence participates only when `isProtected(toolName, args)` is true and `typeof args.path === "string"`. Occurrences group by normalized `args.path` (backslash -> slash). An earlier occurrence is a supersession candidate only when **any later occurrence** of that path covers its delivered line range, not just when the last occurrence covers it. Different paths never interact; disjoint chunks stay verbatim.
 

package/README.md

@@ -172,7 +172,7 @@ Settings live under `contextPrune` in `<agent-dir>/settings.json` (`$PI_CODING_A
 | `autoBudgetThreshold` | `null` | Fraction (e.g. `0.8`) of the context window that force-flushes everything regardless of `pruneOn`; the trigger point is capped at 300k tokens |
 | `frontierGapThresholdTokens` | `null` | Opt-in absolute-token flush trigger: fires at `turn_end` once the un-pruned tail past the prune frontier reaches N tokens, regardless of window size; recommended starting value `80000` |
 | `maxImagesPerRequest` | `null` | Once a request carries more than N images, the oldest become a text note (in cache-friendly steps of half of N) so a long session stays under a provider's per-request image limit; applies even with pruning off. `null` = built-in limit for the model's API (Anthropic Messages: 100; others: no cap); a number overrides it for every API |
-| `protectedTools` / `protectedPaths` | `[]` / `["**/skills/**/*.md", "**/gauntlet-overrides.md"]` | Tool names / path globs that are never summarized; only the newest read per protected path stays verbatim (older reads of the same path are stubbed once the prompt cache is cold anyway) |
+| `protectedTools` / `protectedPaths` | `[]` / `["**/skills/**/*.md", "**/gauntlet-overrides.md"]` | Tool names / path globs that bypass summarization, including reads made inside codemode scripts through the result's recorded nested calls (`nestedCalls`). A protected scripted read stays verbatim and is not stubbed by a later read of the same path; only direct reads can supersede earlier reads when their delivered lines cover them and the cache-rewrite cadence allows it. An incomplete nested-call record (over 8 KiB of arguments per call, 32 KiB total, 256 calls, or a call still running when the script ends) keeps the whole result inline verbatim regardless of `protectedPaths`, even above `spillThreshold`. `protectedPaths: []` disables path matching only |
 | `spillThreshold` | `65536` | Chars above which a single oversized result spills straight to a sidecar file |
 
 The default also protects reads of [pi-gauntlet](https://github.com/jjuraszek/pi-gauntlet)'s per-repo `gauntlet-overrides.md` so the repo's harness contract stays available for gate decisions after pruning.
@@ -191,6 +191,8 @@ No committed roadmap beyond what's already tracked in [CHANGELOG.md](CHANGELOG.m
 
 See [CONTRIBUTING.md](CONTRIBUTING.md) - issues follow a Context / Problem / Idea / Acceptance Criteria template; PRs run the [pi-gauntlet](https://github.com/jjuraszek/pi-gauntlet) workflow (one-liners exempt from ceremony, never from keeping docs truthful).
 
+For paid synthetic context-quality checks and retained behavioral baselines, see the [behavioral eval guide](eval/README.md).
+
 ## Support
 
 If this saves you tokens, [buy me a coffee](https://buymeacoffee.com/jjurasszek).

package/index.ts

@@ -13,6 +13,7 @@
  * Usage:  pi -e .
  */
 
+import type { NestedToolCalls } from "@earendil-works/pi-ai";
 import type { ExtensionAPI, SessionEntry } from "@earendil-works/pi-coding-agent";
 import { loadConfig } from "./src/config.js";
 import { capImages, imageLimitFor } from "./src/image-cap.js";
@@ -62,7 +63,7 @@ export default function (pi: ExtensionAPI) {
     value: { ...DEFAULT_CONFIG },
   };
 
-  const protectionPredicate = (name: string, args: unknown) => isProtected(name, args, currentConfig.value);
+  const protectionPredicate = (name: string, args: unknown, nested?: NestedToolCalls) => isProtected(name, args, currentConfig.value, nested);
 
   // Shared indexer — rebuilt from session on every session_start / session_tree
   const indexer = new ToolCallIndexer();
@@ -926,7 +927,7 @@ export default function (pi: ExtensionAPI) {
       // CapturedBatch is pruned, which is exactly what we want.
       const filtered = {
         ...capturedBatch,
-        toolCalls: capturedBatch.toolCalls.filter((tc) => !isProtected(tc.toolName, tc.args, currentConfig.value)),
+        toolCalls: capturedBatch.toolCalls.filter((tc) => !protectionPredicate(tc.toolName, tc.args, tc.nestedCalls)),
       };
 
       // Eager spill: offload oversized single results to sidecar files before they

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-condense",
-  "version": "2.13.0",
+  "version": "2.14.0",
   "description": "Pi coding-agent extension that summarizes completed tool-call batches, replaces raw outputs with short stubs, compresses closed tool-call chains, and recovers any original on demand via context_tree_query.",
   "author": "Jacek Juraszek",
   "license": "MIT",
@@ -38,7 +38,10 @@
   ],
   "scripts": {
     "check:agents-core": "node scripts/check-agents-core.mjs",
-    "test": "bun test src/"
+    "test": "bun test src/",
+    "eval": "bun eval/run.ts",
+    "eval:replay": "bun eval/replay/run.ts",
+    "test:eval": "bun test eval/"
   },
   "pi": {
     "extensions": [
@@ -57,9 +60,9 @@
     "@sinclair/typebox": "*"
   },
   "devDependencies": {
-    "@earendil-works/pi-ai": "^1.3.0",
-    "@earendil-works/pi-coding-agent": "^1.3.0",
-    "@earendil-works/pi-tui": "^1.3.0",
+    "@earendil-works/pi-ai": "^1.5.0",
+    "@earendil-works/pi-coding-agent": "^1.5.0",
+    "@earendil-works/pi-tui": "^1.5.0",
     "@sinclair/typebox": "^0.34.52"
   }
 }

package/src/batch-capture.test.ts

@@ -11,6 +11,26 @@ import {
 } from "./batch-capture.js";
 import type { CapturedBatch, CapturedToolCall } from "./types.js";
 import { ToolCallIndexer } from "./indexer.js";
+import { isProtected } from "./protected.js";
+import { DEFAULT_CONFIG } from "./types.js";
+
+test("nested protection uses each turn's first paired result and preserves capture metadata", () => {
+  const nestedCalls = { complete: true, calls: [{ id: "nested", name: "read", arguments: { path: "skills/x/SKILL.md" }, status: "ok" as const }] };
+  const assistant = { role: "assistant", content: [{ type: "toolCall", id: "same", name: "codemode", arguments: { code: "read()" } }] };
+  const result = (timestamp: number, nested?: typeof nestedCalls) => ({ role: "toolResult", toolCallId: "same", toolName: "codemode", timestamp, content: [{ type: "text", text: "body" }], ...(nested ? { nestedCalls: nested } : {}) });
+  const protectedResult = result(1, nestedCalls);
+  const plainResult = result(2);
+  const captured = captureBatch(assistant, [protectedResult, plainResult], 0, 0);
+  expect(captured.toolCalls[0].nestedCalls).toBe(nestedCalls);
+  expect(captureBatch(assistant, [plainResult], 1, 0).toolCalls[0]).not.toHaveProperty("nestedCalls");
+  expect(serializeBatchForSummarizer(captured)).not.toContain("nestedCalls");
+  const branch = [assistant, protectedResult, plainResult, assistant, plainResult].map(message => ({ type: "message", message }));
+  const batches = captureUnindexedBatchesFromSession(branch, { isSummarized: () => false },
+    (name, args, nested) => isProtected(name, args, DEFAULT_CONFIG, nested));
+  expect(batches).toHaveLength(1);
+  expect(batches[0].turnIndex).toBe(1);
+  expect(batches[0].toolCalls[0].resultTimestamp).toBe(2);
+});
 
 function toolCall(overrides: Partial<CapturedToolCall> = {}): CapturedToolCall {
   return {

package/src/batch-capture.ts

@@ -1,4 +1,5 @@
 import { createHash } from "node:crypto";
+import type { NestedToolCalls } from "@earendil-works/pi-ai";
 import type { SessionEntry } from "@earendil-works/pi-coding-agent";
 import type { CapturedBatch, CapturedToolCall, BatchingMode } from "./types.js";
 import { occKey, resultTimestampOf } from "./occurrence-key.js";
@@ -111,6 +112,7 @@ export function captureBatch(
         resultText,
         isError,
         ...(resultTimestamp !== undefined ? { resultTimestamp } : {}),
+        ...(match?.nestedCalls !== undefined ? { nestedCalls: match.nestedCalls } : {}),
       } satisfies CapturedToolCall;
     });
 
@@ -128,7 +130,7 @@ export function captureBatch(
 export function captureUnindexedBatchesFromSession(
   branch: any[],
   indexer: { isSummarized(id: string): boolean },
-  exclude: (toolName: string, args: unknown) => boolean = () => false
+  exclude: (toolName: string, args: unknown, nested?: NestedToolCalls) => boolean = () => false
 ): CapturedBatch[] {
   // Keep the SessionEntry wrapper alongside each projected message so the
   // entry's own timestamp remains available as the preferred source below
@@ -191,7 +193,7 @@ export function captureUnindexedBatchesFromSession(
       const result = turnResults.get(id);
       if (!result) return false;
       if (indexer.isSummarized(occKey(id, resultTimestampOf(result.timestamp)))) return false;
-      if (exclude(tc.name, tc.input ?? tc.arguments)) return false;
+      if (exclude(tc.name, tc.input ?? tc.arguments, result.nestedCalls)) return false;
       return true;
     });
 

package/src/chain-detector.test.ts

@@ -1,5 +1,21 @@
 import { describe, expect, test } from "bun:test";
 import { detectChains, isChainAnchorCustom, withClosingMessage } from "./chain-detector.js";
+import { isProtected } from "./protected.js";
+import { DEFAULT_CONFIG } from "./types.js";
+
+test("nested protected reads join a closed chain's protected ids", () => {
+  const messages = [
+    userMsg(1),
+    { role: "assistant", timestamp: 2, content: [{ type: "toolCall", id: "script", name: "codemode", arguments: {} }] },
+    { role: "toolResult", timestamp: 3, toolCallId: "script", toolName: "codemode", nestedCalls: {
+      complete: true, calls: [{ id: "read", name: "read", arguments: { path: "skills/x/SKILL.md" }, status: "ok" }],
+    } },
+    { role: "assistant", timestamp: 4, content: [{ type: "text", text: "done" }] },
+  ];
+  const [chain] = detectChains(messages, (name, args, nested) => isProtected(name, args, DEFAULT_CONFIG, nested));
+  expect(chain.protectedToolCallIds).toEqual(["script"]);
+  expect(chain.finalAssistantTimestamp).toBe(4);
+});
 
 const custom = (customType: string, timestamp: number) => ({ role: "custom", customType, timestamp });
 

package/src/chain-detector.ts

@@ -1,3 +1,4 @@
+import type { NestedToolCalls } from "@earendil-works/pi-ai";
 import { occKey, resultTimestampOf } from "./occurrence-key.js";
 import type { ChainRange } from "./types.js";
 
@@ -45,12 +46,12 @@ type State = "idle" | "inChain";
  * NOTE: Message identity uses `timestamp` (for user / final text-only assistant) and
  * `toolCallId` sets (for middle tool-using turns). AgentMessage has no `.id` field.
  *
- * @param isProtected  Predicate over (toolName, args); matching calls are never pruned
+ * @param isProtected  Predicate over (toolName, args, nestedCalls); matching calls are never pruned
  *                     and their outputs are relocated verbatim into compressed chains.
  */
 export function detectChains(
   messages: any[],
-  isProtected: (toolName: string, args: unknown) => boolean = () => false,
+  isProtected: (toolName: string, args: unknown, nested?: NestedToolCalls) => boolean = () => false,
 ): ChainRange[] {
   const ranges: ChainRange[] = [];
   let state: State = "idle";
@@ -108,9 +109,8 @@ export function detectChains(
       if (msg.toolCallId) {
         middleIds.add(msg.toolCallId);
         middleKeys.add(occKey(msg.toolCallId, resultTimestampOf(msg.timestamp)));
-        // toolResult fallback — results carry no args; name-only by design,
-        // the assistant block always precedes its result so no protection is lost
-        if (isProtected(msg.toolName, undefined)) protectedIds.add(msg.toolCallId);
+        // Outer args live on the assistant block; nested calls live on the result.
+        if (isProtected(msg.toolName, undefined, msg.nestedCalls)) protectedIds.add(msg.toolCallId);
       }
       continue;
     }

package/src/commands.test.ts

@@ -1,5 +1,5 @@
 import { describe, it, expect, mock } from "bun:test";
-import { mkdtempSync } from "node:fs";
+import { mkdtempSync, writeFileSync, rmSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 
@@ -9,7 +9,7 @@ import { join } from "node:path";
 process.env.PI_CODING_AGENT_DIR = mkdtempSync(join(tmpdir(), "pi-condense-commands-test-"));
 
 import { pruneStatusText, setPruneStatusWidget, registerCommands } from "./commands.js";
-import { settingsPath } from "./config.js";
+import { settingsPath, loadConfig } from "./config.js";
 import type { ContextPruneConfig, ContextMetricsSnapshot, SummarizerStats } from "./types.js";
 import { DEFAULT_CONFIG } from "./types.js";
 import { Container, SettingsList } from "@earendil-works/pi-tui";
@@ -97,13 +97,14 @@ function setupPrunerCommand(overrides: {
   };
 }
 
-describe("/pruner settings argument purge", () => {
+describe("/pruner settings descriptions", () => {
   initTheme("dark");
 
   it.each([
     ["purgeErrorsEnabled", "Argument purge", "Shrink long strings in summarized calls when their results are stubbed in the same render, and in errored calls after the error cooldown, keeping argument shape."],
     ["purgeErrorsCooldown", "Error purge cooldown (turns)", "Wait this many turns after a tool error before purging its argument body."],
     ["purgeErrorsMinArgChars", "Argument purge min arg chars", "Only purge summarized or errored argument bodies at least this many chars."],
+    ["protectedPaths", "Protected paths", "reads made inside codemode scripts"],
   ])("describes %s through the settings overlay", async (id, label, description) => {
     const harness = setupPrunerCommand({ save: async () => {} });
     await harness.run("settings");
@@ -114,6 +115,11 @@ describe("/pruner settings argument purge", () => {
     expect(rendered).toContain(label);
     expect(rendered).toContain(description);
     if (id === "purgeErrorsCooldown") expect(rendered).not.toContain("same render");
+    if (id === "protectedPaths") {
+      expect(rendered).toContain("nestedCalls");
+      expect(rendered).toContain("incomplete nested-call record is kept verbatim regardless of this setting");
+      expect(rendered).toContain("Set to 'none' to disable path matching only");
+    }
   });
 
   it("persists the shared disabled toggle and minimum using only existing purgeErrors fields", async () => {
@@ -148,6 +154,23 @@ describe("/pruner now (empty capture)", () => {
 });
 
 describe("/pruner status context block", () => {
+  it("reports the resolved 45s idle default when the setting is absent", async () => {
+    const scratchDir = mkdtempSync(join(tmpdir(), "pi-condense-idle-status-"));
+    const previousAgentDir = process.env.PI_CODING_AGENT_DIR;
+    try {
+      process.env.PI_CODING_AGENT_DIR = scratchDir;
+      writeFileSync(settingsPath(), JSON.stringify({ contextPrune: { enabled: true } }));
+      const harness = setupPrunerCommand();
+      harness.currentConfig.value = await loadConfig();
+      await harness.run("status");
+      expect(harness.notifications[0]?.message).toContain("idle to:  45s");
+    } finally {
+      if (previousAgentDir === undefined) delete process.env.PI_CODING_AGENT_DIR;
+      else process.env.PI_CODING_AGENT_DIR = previousAgentDir;
+      rmSync(scratchDir, { recursive: true, force: true });
+    }
+  });
+
   const metrics: ContextMetricsSnapshot = {
     openCycleThinkingTokens: 12000,
     largestChainSharePct: 62,

package/src/commands.ts

@@ -256,7 +256,7 @@ function protectedToolsDescription(config: ContextPruneConfig): string {
 }
 
 function protectedPathsDescription(config: ContextPruneConfig): string {
-  return `Glob patterns matched against a tool call's \`args.path\`; matching outputs are NEVER pruned. Currently: ${protectedToolsDisplay(config.protectedPaths)}. Edit via \`/pruner protected-paths\` (interactive) or \`/pruner protected-paths <comma-separated globs>\`. Set to 'none' to disable (kill switch). Default protects skill files and per-repo gauntlet overrides: **/skills/**/*.md, **/gauntlet-overrides.md`;
+  return `Glob patterns match a tool call's \`args.path\` and reads recorded in a result's \`nestedCalls\`, including reads made inside codemode scripts. Matching outputs bypass summarization. An incomplete nested-call record is kept verbatim regardless of this setting. Set to 'none' to disable path matching only. Currently: ${protectedToolsDisplay(config.protectedPaths)}. Edit via \`/pruner protected-paths\` (interactive) or \`/pruner protected-paths <comma-separated globs>\`. Default protects skill files and per-repo gauntlet overrides: **/skills/**/*.md, **/gauntlet-overrides.md`;
 }
 
 const HELP_TEXT = `pruner — automatically summarizes tool-call outputs to keep context lean.

package/src/config.test.ts

@@ -99,8 +99,15 @@ describe("loadConfig summarizer timeout normalization", () => {
   it("defaults both timeouts when absent", async () => {
     await writeContextPrune({});
     const config = await loadConfig();
-    expect(config.summarizerIdleTimeoutMs).toBe(DEFAULT_CONFIG.summarizerIdleTimeoutMs);
+    expect(config.summarizerIdleTimeoutMs).toBe(45000);
     expect(config.summarizerMaxTimeoutMs).toBe(DEFAULT_CONFIG.summarizerMaxTimeoutMs);
+    expect(config.summarizerMaxTimeoutMs).toBe(180000);
+  });
+
+  it("preserves an explicit legacy 20s idle timeout", async () => {
+    await writeContextPrune({ summarizerIdleTimeoutMs: 20000 });
+    const config = await loadConfig();
+    expect(config.summarizerIdleTimeoutMs).toBe(20000);
   });
 
   it("preserves explicit 0 (disabled) for both", async () => {

package/src/context-metrics.test.ts

@@ -1,6 +1,16 @@
 import { describe, expect, test } from "bun:test";
 import { computeContextMetrics } from "./context-metrics.js";
-import type { PruneFrontier } from "./types.js";
+import { DEFAULT_CONFIG, type PruneFrontier } from "./types.js";
+import { isProtected } from "./protected.js";
+
+test("frontier gap excludes a result with a protected nested read", () => {
+  const messages = [userMsg(1), assistantWithTools(2, ["script"]), {
+    ...toolResult(3, "script", "codemode"),
+    nestedCalls: { complete: true, calls: [{ id: "nested", name: "read", arguments: { path: "skills/x/SKILL.md" }, status: "ok" }] },
+  }];
+  expect(computeContextMetrics(messages, null, () => false,
+    (name, args, nested) => isProtected(name, args, DEFAULT_CONFIG, nested)).frontierGapTokens).toBe(0);
+});
 
 // ── Minimal message factories (mirrors src/chain-detector.test.ts style) ───
 

package/src/context-metrics.ts

@@ -1,3 +1,4 @@
+import type { NestedToolCalls } from "@earendil-works/pi-ai";
 import { detectChains, isChainAnchorCustom } from "./chain-detector.js";
 import { occKey, resultTimestampOf } from "./occurrence-key.js";
 import type { ContextMetricsSnapshot, PruneFrontier } from "./types.js";
@@ -49,7 +50,7 @@ export function computeContextMetrics(
   branch: any[],
   frontier: PruneFrontier | null,
   isSummarized: (occurrenceKey: string) => boolean,
-  isProtected: (toolName: string, args: unknown) => boolean,
+  isProtected: (toolName: string, args: unknown, nested?: NestedToolCalls) => boolean,
 ): ContextMetricsSnapshot {
   if (branch.length === 0) {
     return { openCycleThinkingTokens: 0, largestChainSharePct: 0, frontierGapTokens: 0 };
@@ -156,7 +157,7 @@ export function computeContextMetrics(
     const key = occKey(m.toolCallId, resultTimestampOf(m.timestamp));
     if (isSummarized(key)) continue;
     const args = findArgsForToolCallId(branch, i, m.toolCallId);
-    if (isProtected(m.toolName, args)) continue;
+    if (isProtected(m.toolName, args, m.nestedCalls)) continue;
     frontierGapTokens += tokensOf(m);
   }
 

package/src/protected.test.ts

@@ -1,4 +1,5 @@
 import { describe, expect, test } from "bun:test";
+import type { NestedToolCalls } from "@earendil-works/pi-ai";
 import { globToRegExp, isProtected, normalizePath } from "./protected.js";
 import { DEFAULT_CONFIG } from "./types.js";
 
@@ -67,6 +68,46 @@ describe("isProtected", () => {
     expect(isProtected("read", { path: "/h/src/app.ts" }, cfg)).toBe(false);
   });
 
+  test.each(["ok", "error"] as const)("protects nested skill reads with status %s", (status) => {
+    expect(isProtected("codemode", { code: "console.log(await tools.read({ path: 'skills/x/SKILL.md' }))" }, cfg, {
+      complete: true,
+      calls: [{ id: "nested-read", name: "read", arguments: { path: "skills/x/SKILL.md" }, status }],
+    })).toBe(true);
+  });
+
+  test.each([undefined, {}, { path: "source.ts" }])("protects nested tool names with arguments %j and path matching disabled", (args) => {
+    for (const outerName of ["codemode", "another-script-tool"]) {
+      expect(isProtected(outerName, {}, { protectedTools: ["todowrite"], protectedPaths: [] }, {
+        complete: true, calls: [{ id: "nested", name: "todowrite", arguments: args, status: "ok" }],
+      })).toBe(true);
+    }
+  });
+
+  test.each([
+    { complete: false, calls: [] },
+    { complete: false, calls: [{ id: "write", name: "write", arguments: { path: "source.ts" }, status: "ok" }] },
+    { complete: false, calls: [{ id: "read", name: "read", argumentsBytes: 8193, status: "ok" }] },
+    { complete: false, calls: [{ id: "read", name: "read", arguments: { path: "source.ts" }, status: "unfinished" }] },
+  ] satisfies NestedToolCalls[])("protects incomplete records %j even with empty configuration", (nested) => {
+    for (const config of [cfg, { protectedTools: [], protectedPaths: [] }]) {
+      expect(isProtected("codemode", {}, config, nested)).toBe(true);
+    }
+  });
+
+  test.each([
+    undefined,
+    { complete: true, calls: [] },
+    { complete: true, calls: [{ id: "read", name: "read", arguments: { path: "source.ts" }, status: "ok" }] },
+    { complete: true, calls: [{ id: "read", name: "read", arguments: { path: 42 }, status: "ok" }] },
+    "malformed",
+    { complete: false, calls: {} },
+  ])("keeps unmatched or malformed nested records %j prunable without changing direct protection", (nested) => {
+    const record = nested as NestedToolCalls | undefined;
+    expect(isProtected("codemode", { code: "tools.read({path: 'skills/x/SKILL.md'})" }, cfg, record)).toBe(false);
+    expect(isProtected("todowrite", {}, cfg, record)).toBe(true);
+    expect(isProtected("read", { path: "skills/x/SKILL.md" }, cfg, record)).toBe(true);
+  });
+
   test("backslashes normalized to forward slashes", () => {
     expect(isProtected("read", { path: "h\\skills\\x\\SKILL.md" }, cfg)).toBe(true);
   });

package/src/protected.ts

@@ -1,3 +1,5 @@
+import type { NestedToolCalls } from "@earendil-works/pi-ai";
+
 /** Structural pick of ContextPruneConfig — keeps this module dependency-free. */
 export interface ProtectionConfig {
   protectedTools: readonly string[];
@@ -46,7 +48,7 @@ export function normalizePath(path: string): string {
   return path.replace(/\\/g, "/");
 }
 
-export function isProtected(toolName: string, args: unknown, config: ProtectionConfig): boolean {
+function matches(toolName: string, args: unknown, config: ProtectionConfig): boolean {
   if (config.protectedTools.includes(toolName)) return true;
   if (config.protectedPaths.length === 0) return false;
   const path = (args as Record<string, unknown> | null | undefined)?.path;
@@ -54,3 +56,10 @@ export function isProtected(toolName: string, args: unknown, config: ProtectionC
   const normalized = normalizePath(path);
   return config.protectedPaths.some((p) => globToRegExp(p).test(normalized));
 }
+
+export function isProtected(toolName: string, args: unknown, config: ProtectionConfig, nested?: NestedToolCalls): boolean {
+  if (matches(toolName, args, config)) return true;
+  if (!nested || typeof nested !== "object" || !Array.isArray(nested.calls)) return false;
+  if (nested.complete === false) return true;
+  return nested.calls.some((call) => matches(call?.name, call?.arguments, config));
+}

package/src/pruner.test.ts

@@ -599,6 +599,27 @@ describe("render-time protection re-check", () => {
     expect(messages[1].content[0].text).toBe("FULL SKILL BODY");
   });
 
+  it("repairs an indexed script result from nested metadata with byte-identical repeat renders", () => {
+    const record = { toolCallId: "script", toolName: "codemode", args: { code: "read()" }, resultText: "FULL SKILL BODY", isError: false, turnIndex: 0, timestamp: 10 };
+    const oldIndexer = makeMockIndexer({
+      summarized: new Set(["script"]), shortRefs: new Map([["script", "t1"]]), records: new Map([["script", record]]),
+    });
+    const raw = [
+      { ...skillAsst, content: [{ type: "toolCall", id: "script", name: "codemode", arguments: record.args }] },
+      { ...skillMsg, toolCallId: "script", toolName: "codemode", nestedCalls: {
+        complete: true, calls: [{ id: "nested", name: "read", arguments: { path: "skills/x/SKILL.md" }, status: "ok" }],
+      } },
+    ];
+    const before = JSON.stringify(raw);
+    const render = () => pruneMessages(raw, oldIndexer as any, undefined, undefined,
+      { protectedTools: [], protectedPaths: ["**/skills/**/*.md"] });
+    const first = render();
+    expect(first.pruned).toBe(false);
+    expect(JSON.stringify(first.messages)).toBe(before);
+    expect(JSON.stringify(render().messages)).toBe(JSON.stringify(first.messages));
+    expect(oldIndexer.getRecord("script")).toBe(record);
+  });
+
   it("still stubs when no protection config is passed", () => {
     const { messages, pruned } = pruneMessages([skillAsst, skillMsg], indexer as any);
     expect(pruned).toBe(true);

package/src/pruner.ts

@@ -116,7 +116,7 @@ export function pruneMessages(
     // session JSONL, so skipping the stub restores it verbatim.
     // Dedup aliases resolve to the original record, so an alias whose own
     // path is protected but whose original isn't stays stubbed (edge case).
-    if (protection && record && isProtected(record.toolName, record.args, protection)) {
+    if (protection && record && isProtected(record.toolName, record.args, protection, msg.nestedCalls)) {
       return msg;
     }
     if (inGrace.has(key)) {

package/src/reload-rearm.integration.test.ts

@@ -3,6 +3,7 @@ import { mkdtempSync, readFileSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { supersededStub } from "./supersede.js";
+import { DEFAULT_CONFIG } from "./types.js";
 
 // This must run before any module that transitively reads PI_CODING_AGENT_DIR
 // (src/config.ts's getAgentDir()) is imported/executed.
@@ -323,6 +324,47 @@ async function boot(options?: Parameters<typeof bootExtension>[0]) {
   return harness;
 }
 
+describe("nested protection capture", () => {
+  it.each([
+    { mode: "live", incomplete: false },
+    { mode: "rescan", incomplete: false },
+    { mode: "live", incomplete: true },
+    { mode: "rescan", incomplete: true },
+  ])("%j excludes protected script output from summarizer and index", async ({ mode, incomplete }) => {
+    const branch: any[] = [];
+    const { handlers, ctx, appended } = await boot({ branch, ...(incomplete ? { protectedPaths: [] } : {}) });
+    await handlers.get("session_start")!({}, ctx);
+    const message = { role: "assistant", content: [
+      { type: "toolCall", id: "script", name: "codemode", arguments: { code: "read()" } },
+      { type: "toolCall", id: "control", name: "read", arguments: { path: "source.ts" } },
+    ] };
+    const toolResults = [
+      { role: "toolResult", toolCallId: "script", toolName: "codemode", timestamp: 10, content: [{ type: "text", text: "PROTECTED-SCRIPT-BODY".repeat(incomplete ? Math.ceil(DEFAULT_CONFIG.spillThreshold / "PROTECTED-SCRIPT-BODY".length) + 1 : 200) }], nestedCalls: {
+        complete: !incomplete, calls: incomplete ? [] : [{ id: "nested", name: "read", arguments: { path: "skills/x/SKILL.md" }, status: "ok" }],
+      } },
+      { role: "toolResult", toolCallId: "control", toolName: "read", timestamp: 11, content: [{ type: "text", text: "UNPROTECTED-CONTROL".repeat(200) }] },
+    ];
+    branch.push(...[message, ...toolResults].map(message => ({ type: "message", message })));
+    ctx.getContextUsage = () => ({ tokens: 10, contextWindow: 1000000 });
+    const inputs: string[] = [];
+    const previousStream = streamImpl;
+    streamImpl = (_model, input) => { inputs.push(JSON.stringify(input)); return okStream(); };
+    try {
+      await handlers.get("turn_end")!({ message, toolResults, turnIndex: 0 }, ctx);
+      if (mode === "live") ctx.sessionManager.getBranch = () => { throw new Error("force pending live batch"); };
+      await handlers.get("message_end")!({ message: { role: "assistant", content: [{ type: "text", text: "done" }] } }, ctx);
+      expect(inputs).toHaveLength(1);
+      expect(inputs[0]).toContain("UNPROTECTED-CONTROL");
+      expect(inputs[0]).not.toContain("PROTECTED-SCRIPT-BODY");
+      const indexed = appended.filter(entry => entry.type === "context-prune-index")
+        .flatMap(entry => (entry.data as any).toolCalls.map((call: any) => call.toolCallId));
+      expect(indexed).toEqual(["control"]);
+    } finally {
+      streamImpl = previousStream;
+    }
+  });
+});
+
 describe("reload rearm (issue #6)", () => {
   it("hides the startup widget when the prune status line is disabled", async () => {
     const { handlers, ctx, widgets } = await boot({ showPruneStatusLine: false });

package/src/summarizer-wiring.test.ts

@@ -4,7 +4,7 @@ let streamImpl: (model: any, input?: any, opts?: any) => any = () => {
 };
 const { summarizeBatch, summarizeRange } = await import("./summarizer.js");
 const { FallbackController } = await import("./summarizer-fallback.js");
-const { DEFAULT_CONFIG } = await import("./types.js");
+const { DEFAULT_CONFIG, SUMMARIZER_IDLE_TIMEOUT_PRESETS } = await import("./types.js");
 
 const PRIMARY = { id: "primary-model", provider: "provider-a", name: "Primary", api: "openai-responses" };
 const SESSION = { id: "session-model", provider: "provider-b", name: "Session", api: "openai-responses" };
@@ -161,6 +161,7 @@ describe("virtual models through the registry", () => {
       expect(result?.summaryText).toBe("- routed summary");
       expect(controller.inFallback).toBe(true);
       expect(seen[1]).toBe(VIRTUAL);
+      expect(notes[0]).toEqual({ msg: "pi-condense: summarizer model Primary failing (down), using session model Auto until it recovers", level: "warning" });
       expect(notes.filter(n => n.level === "warning")).toHaveLength(1);
       expect(notes.filter(n => n.level === "error")).toHaveLength(0);
     });
@@ -300,6 +301,7 @@ describe("runSummarization wiring — both-down + deferred warning", () => {
     const r2 = await summarizeBatch(makeBatch(), distinctConfig, ctx, { controller });
     expect(r2?.summaryText).toBe("- rescued");
     expect(notes.filter((n) => n.level === "warning")).toHaveLength(1);
+    expect(notes[0].msg).toBe("pi-condense: summarizer model Primary failing, using session model Session until it recovers");
   });
 });
 
@@ -319,6 +321,7 @@ describe("runSummarization wiring — abort", () => {
 
 describe("runSummarization wiring — timeouts", () => {
   for (const [kind, idleMs, maxMs, message] of [
+    // Millisecond-scale overrides exercise timer behavior, not the default.
     ["idle", 20, 0, /stalled/],
     ["ceiling", 0, 20, /ceiling/],
   ] as const) {
@@ -379,7 +382,7 @@ describe("runSummarization wiring — timeouts", () => {
     const r = await summarizeBatch(makeBatch(), cfg, ctx, { controller });
     expect(r?.summaryText).toBe("- rescued");
     expect(controller.inFallback).toBe(true);
-    expect(notes.filter((n) => n.level === "warning")).toHaveLength(1); // generic "enter" fallback warning
+    expect(notes.filter((n) => n.level === "warning")).toHaveLength(1);
     expect(notes.filter((n) => n.level === "error")).toHaveLength(0);
   });
 
@@ -430,3 +433,235 @@ describe("runSummarization wiring — idle reset keeps a flowing stream alive",
     expect(notes.filter((n) => n.level === "warning")).toHaveLength(0);
   });
 });
+
+async function withTimerClock(
+  run: (clock: { advance(ms: number): Promise<void>; now(): number }) => Promise<void>,
+) {
+  const realSetTimeout = globalThis.setTimeout;
+  const realClearTimeout = globalThis.clearTimeout;
+  const timers = new Map<number, { at: number; fire(): void }>();
+  let now = 0;
+  let nextId = 0;
+  const drain = () => new Promise<void>((resolve) => realSetTimeout(resolve, 0));
+  globalThis.setTimeout = ((callback: (...args: any[]) => void, delay = 0, ...args: any[]) => {
+    const id = ++nextId;
+    timers.set(id, { at: now + Number(delay), fire: () => callback(...args) });
+    return id;
+  }) as unknown as typeof globalThis.setTimeout;
+  globalThis.clearTimeout = ((id: any) => { timers.delete(Number(id)); }) as unknown as typeof globalThis.clearTimeout;
+  try {
+    await run({
+      now: () => now,
+      async advance(ms) {
+        await drain();
+        const end = now + ms;
+        while (true) {
+          const next = [...timers.entries()]
+            .filter(([, timer]) => timer.at <= end)
+            .sort((a, b) => a[1].at - b[1].at || a[0] - b[0])[0];
+          if (!next) break;
+          now = next[1].at;
+          timers.delete(next[0]);
+          next[1].fire();
+          await drain();
+        }
+        now = end;
+        await drain();
+      },
+    });
+  } finally {
+    globalThis.setTimeout = realSetTimeout;
+    globalThis.clearTimeout = realClearTimeout;
+    timers.clear();
+  }
+}
+
+const genericEnter = "pi-condense: summarizer model Primary failing, using session model Session until it recovers";
+
+describe("immediate fallback reasons", () => {
+  it("marks only the 45s preset as default", () => {
+    expect(DEFAULT_CONFIG.summarizerIdleTimeoutMs).toBe(45000);
+    expect(SUMMARIZER_IDLE_TIMEOUT_PRESETS.filter(p => p.label.includes("(default)")))
+      .toEqual([{ value: "45000", label: "45s (default)" }]);
+  });
+
+  for (const raw of [
+    { summarizerModel: "provider-a/primary-model" },
+    { summarizerModel: "provider-a/primary-model", summarizerIdleTimeoutMs: 20000 },
+  ]) {
+    it(`delayed first event with ${raw.summarizerIdleTimeoutMs ?? "resolved default"}`, async () => {
+      await withTimerClock(async clock => {
+        const config = { ...DEFAULT_CONFIG, ...raw };
+        const notes: Note[] = [];
+        const attempts: any[] = [];
+        let primarySignal: AbortSignal;
+        streamImpl = (model, _input, opts) => {
+          attempts.push(model);
+          if (model === PRIMARY) {
+            primarySignal = opts.signal;
+            return drippingStream(opts, "- primary summary", 1, 25000);
+          }
+          return okStream("- rescued");
+        };
+        const controller = new FallbackController(clock.now);
+        let settled = false;
+        const pending = summarizeBatch(makeBatch(), config, makeCtx(notes), { controller });
+        void pending.then(() => { settled = true; });
+        await clock.advance(19999);
+        expect(settled).toBe(false);
+        await clock.advance(1);
+        if (raw.summarizerIdleTimeoutMs === 20000) {
+          expect(primarySignal!.aborted).toBe(true);
+          expect((await pending)?.summaryText).toBe("- rescued");
+          expect(attempts).toEqual([PRIMARY, SESSION]);
+          expect(notes).toEqual([{ msg: genericEnter.replace("failing,", "failing (stalled (no output for 20s)),"), level: "warning" }]);
+        } else {
+          expect(config.summarizerIdleTimeoutMs).toBe(45000);
+          expect(settled).toBe(false);
+          expect(primarySignal!.aborted).toBe(false);
+          await clock.advance(5000);
+          expect((await pending)?.summaryText).toBe("- primary summary");
+          expect(attempts).toEqual([PRIMARY]);
+          expect(controller.inFallback).toBe(false);
+          expect(notes).toEqual([]);
+        }
+      });
+    });
+  }
+
+  for (const kind of ["idle", "ceiling"] as const) {
+    it(`${kind} rescue carries the prefix-free reason`, async () => {
+      await withTimerClock(async clock => {
+        const notes: Note[] = [];
+        streamImpl = (model, _input, opts) => {
+          if (model === SESSION) return okStream("- rescued");
+          if (kind === "ceiling") return hangingStream(opts);
+          const drip = drippingStream(opts, "- partial", 1, 1000);
+          const hang = hangingStream(opts);
+          return {
+            async *[Symbol.asyncIterator]() { yield* drip; yield* hang; },
+            result: () => hang.result(),
+          };
+        };
+        let settled = false;
+        const pending = summarizeBatch(makeBatch(), {
+          ...distinctConfig, summarizerIdleTimeoutMs: kind === "idle" ? 45000 : 0,
+          summarizerMaxTimeoutMs: 180000,
+        }, makeCtx(notes), { controller: new FallbackController(clock.now) });
+        void pending.then(() => { settled = true; });
+        await clock.advance(kind === "idle" ? 45000 : 179999);
+        expect(settled).toBe(false);
+        await clock.advance(kind === "idle" ? 1000 : 1);
+        expect((await pending)?.summaryText).toBe("- rescued");
+        const reason = kind === "idle" ? "stalled (no output for 45s)" : "exceeded 180s ceiling";
+        expect(notes).toEqual([{ msg: genericEnter.replace("failing,", `failing (${reason}),`), level: "warning" }]);
+        if (kind === "idle") expect(notes[0].msg).toMatch(/summarizer model .* failing \(stalled \(no output for \d+s\)\), using session model/);
+      });
+    });
+  }
+
+  for (const path of ["response", "throw"] as const) {
+    for (const [name, message] of [
+      ["non-empty", "boom"],
+      ["multiline", "  long provider message\n" + "detail ".repeat(60) + "\n  "],
+      ["empty", ""],
+    ]) {
+      it(`${path} preserves ${name} message verbatim`, async () => {
+        streamImpl = model => {
+          if (model === SESSION) return okStream("- rescued");
+          if (path === "throw") throw new Error(message);
+          return errStream(message);
+        };
+        const notes: Note[] = [];
+        const result = await summarizeBatch(makeBatch(), distinctConfig, makeCtx(notes), { controller: new FallbackController() });
+        expect(result?.summaryText).toBe("- rescued");
+        expect(notes).toEqual([{ msg: message ? genericEnter.replace("failing,", `failing (${message}),`) : genericEnter, level: "warning" }]);
+      });
+    }
+  }
+});
+
+describe("terminal timeout labels", () => {
+  for (const kind of ["idle", "ceiling"] as const) {
+    for (const mode of ["legacy", "fallback-only", "both-down", "unusable-retry"] as const) {
+      it(`${kind}: ${mode} labels the selected outcome`, async () => {
+        await withTimerClock(async clock => {
+          const notes: Note[] = [];
+          streamImpl = (model, _input, opts) => mode === "unusable-retry" && model === SESSION
+            ? okStream(" ") : hangingStream(opts);
+          const controller = new FallbackController(clock.now);
+          if (mode === "fallback-only") controller.onBothDown();
+          const pending = summarizeBatch(makeBatch(), {
+            ...distinctConfig,
+            summarizerModel: mode === "legacy" ? "default" : distinctConfig.summarizerModel,
+            summarizerIdleTimeoutMs: kind === "idle" ? 20 : 0,
+            summarizerMaxTimeoutMs: kind === "ceiling" ? 20 : 0,
+          }, makeCtx(notes), mode === "legacy" ? {} : { controller });
+          await clock.advance(40);
+          expect(await pending).toBeNull();
+          const label = mode === "unusable-retry" ? "Primary" : "Session";
+          const reason = kind === "idle" ? "stalled (no output for 0s)" : "exceeded 0s ceiling";
+          expect(notes).toEqual([{ msg: `pi-condense: summarizer ${label} ${reason}; summarizer call abandoned`, level: "warning" }]);
+        });
+      });
+    }
+  }
+
+  it("session-only auth failure after transient primary keeps its error text", async () => {
+    streamImpl = () => errStream("down");
+    const notes: Note[] = [];
+    const ctx = makeCtx(notes);
+    ctx.modelRegistry.getApiKeyAndHeaders = async (model: any) => model === PRIMARY
+      ? { ok: true, apiKey: "k", headers: {} } : { ok: false, error: "session key missing" };
+    expect(await summarizeBatch(makeBatch(), distinctConfig, ctx, { controller: new FallbackController() })).toBeNull();
+    expect(notes).toEqual([{ msg: "pruner: summarization failed: session key missing", level: "error" }]);
+  });
+});
+
+describe("deferred entry and probe notices", () => {
+  for (const initial of ["both-down", "rescued"] as const) {
+    it(`${initial}: failed probe rescue then recovery`, async () => {
+      let now = 0;
+      const controller = new FallbackController(() => now);
+      const notes: Note[] = [];
+      const ctx = makeCtx(notes);
+      streamImpl = model => model === PRIMARY || initial === "both-down" ? errStream("down") : okStream("- ok");
+      await summarizeBatch(makeBatch(), distinctConfig, ctx, { controller });
+      notes.length = 0;
+      now += 600001;
+      streamImpl = model => model === PRIMARY ? errStream("probe failed") : okStream("- rescued");
+      expect((await summarizeBatch(makeBatch(), distinctConfig, ctx, { controller }))?.summaryText).toBe("- rescued");
+      expect(notes).toEqual(initial === "both-down" ? [{ msg: genericEnter, level: "warning" }] : []);
+      notes.length = 0;
+      now += 600001;
+      streamImpl = () => okStream("- recovered");
+      await summarizeBatch(makeBatch(), distinctConfig, ctx, { controller });
+      expect(notes).toEqual([{ msg: "pi-condense: summarizer model Primary recovered", level: "info" }]);
+    });
+  }
+
+  it("blank primary never retries or enters fallback", async () => {
+    const attempts: any[] = [];
+    streamImpl = model => { attempts.push(model); return okStream(" "); };
+    const controller = new FallbackController();
+    const notes: Note[] = [];
+    expect(await summarizeBatch(makeBatch(), distinctConfig, makeCtx(notes), { controller })).toBeNull();
+    expect(attempts).toEqual([PRIMARY]);
+    expect(controller.inFallback).toBe(false);
+    expect(notes).toEqual([]);
+  });
+
+  it("abort during pending stream rejects without notices", async () => {
+    await withTimerClock(async clock => {
+      streamImpl = (_model, _input, opts) => hangingStream(opts);
+      const notes: Note[] = [];
+      const ac = new AbortController();
+      const pending = summarizeBatch(makeBatch(), distinctConfig, makeCtx(notes), { controller: new FallbackController(clock.now), signal: ac.signal });
+      const rejected = pending.then(() => null, error => error);
+      await clock.advance(1);
+      ac.abort();
+      expect(await rejected).toBeInstanceOf(Error);
+      expect(notes).toEqual([]);
+    });
+  });
+});

package/src/summarizer.ts

@@ -11,7 +11,7 @@ import type {
 import { serializeBatchForSummarizer } from "./batch-capture.js";
 import { FallbackController, type FallbackTransition } from "./summarizer-fallback.js";
 
-const SYSTEM_PROMPT = `You are summarizing a batch of tool calls made by an AI coding assistant.
+export const SYSTEM_PROMPT = `You are summarizing a batch of tool calls made by an AI coding assistant.
 For each tool call provide:
 - Tool name and a one-sentence description of what it did
 - Key outcome, plus any file paths, identifiers, signatures, or error strings copied verbatim - never reword these
@@ -153,8 +153,8 @@ async function runOnce(
   };
   const timeoutMessage = () =>
     timeoutKind === "ceiling"
-      ? `summarizer ${modelLabel(model)} exceeded ${Math.round(maxMs / 1000)}s ceiling`
-      : `summarizer ${modelLabel(model)} stalled (no output for ${Math.round(idleMs / 1000)}s)`;
+      ? `exceeded ${Math.round(maxMs / 1000)}s ceiling`
+      : `stalled (no output for ${Math.round(idleMs / 1000)}s)`;
 
   try {
     // Preserve auth classification for physical models without pre-checking
@@ -273,7 +273,7 @@ async function runOnce(
  * session model, and the controller stays sticky in fallback until a
  * per-cooldown probe of the primary succeeds.
  */
-async function runSummarization(
+export async function runSummarization(
   userMessage: string,
   config: ContextPruneConfig,
   ctx: ExtensionContext,
@@ -286,10 +286,10 @@ async function runSummarization(
   const controller = options.controller;
   const sessionModel = ctx.model;
 
-  const notifyFailure = (o: { message: string; timedOut?: boolean }) =>
+  const notifyFailure = (model: any, o: { message: string; timedOut?: boolean }) =>
     ctx.ui.notify(
       o.timedOut
-        ? `pi-condense: ${o.message}; summarizer call abandoned`
+        ? `pi-condense: summarizer ${modelLabel(model)} ${o.message}; summarizer call abandoned`
         : `pruner: summarization failed: ${o.message}`,
       o.timedOut ? "warning" : "error",
     );
@@ -302,17 +302,18 @@ async function runSummarization(
         return r.result;
       case "auth":
       case "transient":
-        notifyFailure(r);
+        notifyFailure(primary, r);
         return null;
       case "unusable":
         return null;
     }
   }
 
-  const emit = (t: FallbackTransition) => {
+  const emit = (t: FallbackTransition, reason?: string) => {
     if (t === "enter") {
+      const failureReason = typeof reason === "string" && reason.length > 0 ? ` (${reason})` : "";
       ctx.ui.notify(
-        `pi-condense: summarizer model ${modelLabel(primary)} failing, using session model ${modelLabel(sessionModel)} until it recovers`,
+        `pi-condense: summarizer model ${modelLabel(primary)} failing${failureReason}, using session model ${modelLabel(sessionModel)} until it recovers`,
         "warning"
       );
     } else if (t === "recover") {
@@ -330,24 +331,29 @@ async function runSummarization(
       else emit(controller.onFallbackSuccess());
       return r.result;
     case "auth":
-      notifyFailure(r); // auth never trips the controller
+      notifyFailure(model, r); // auth never trips the controller
       return null;
     case "unusable":
       return null; // probe unusable => stay (no state change)
     case "transient": {
       if (decision.target === "fallback") {
         controller.onFallbackOnlyFail();
-        notifyFailure(r);
+        notifyFailure(model, r);
         return null;
       }
       // target was primary (initial detection or probe): retry once on the session model.
       const r2 = await runOnce(sessionModel, userMessage, config, ctx, options);
       if (r2.kind === "ok") {
-        emit(controller.onPrimaryFailFallbackOk(decision.wasProbe));
+        const wasInFallback = controller.inFallback;
+        emit(controller.onPrimaryFailFallbackOk(decision.wasProbe), wasInFallback ? undefined : r.message);
         return r2.result; // suppress the legacy error notify — fallback rescued the call
       }
       controller.onBothDown();
-      notifyFailure(r2.kind === "transient" || r2.kind === "auth" ? r2 : r);
+      if (r2.kind === "transient" || r2.kind === "auth") {
+        notifyFailure(sessionModel, r2);
+      } else {
+        notifyFailure(model, r);
+      }
       return null;
     }
   }

package/src/types.ts

@@ -1,3 +1,5 @@
+import type { NestedToolCalls } from "@earendil-works/pi-ai";
+
 /**
  * Shared types for the context-prune extension.
  *
@@ -219,8 +221,8 @@ export const RECOVERY_GRACE_PRESETS: { value: string; label: string }[] = [
 export const SUMMARIZER_IDLE_TIMEOUT_PRESETS: { value: string; label: string }[] = [
   { value: "0", label: "0 (disabled)" },
   { value: "10000", label: "10s" },
-  { value: "20000", label: "20s (default)" },
-  { value: "45000", label: "45s" },
+  { value: "20000", label: "20s" },
+  { value: "45000", label: "45s (default)" },
   { value: "90000", label: "90s" },
 ];
 
@@ -321,7 +323,7 @@ export interface ContextPruneConfig {
    * Reset on every received stream event; armed before the first event so it
    * also bounds time-to-first-token. If no event arrives within this window
    * the call is aborted and classified transient (feeds the outage-fallback
-   * retry). 0 disables the idle timer. Default 20000.
+   * retry). 0 disables the idle timer. Default 45000.
    */
   summarizerIdleTimeoutMs: number;
   /**
@@ -569,7 +571,7 @@ export const DEFAULT_CONFIG: ContextPruneConfig = {
   quietOversizedSkips: false,
   minBatchChars: 2000,
   recoveryGraceTurns: 3,
-  summarizerIdleTimeoutMs: 20000,
+  summarizerIdleTimeoutMs: 45000,
   summarizerMaxTimeoutMs: 180000,
   protectedTools: [],
   protectedPaths: ["**/skills/**/*.md", "**/gauntlet-overrides.md"],
@@ -597,6 +599,7 @@ export const DEFAULT_CONFIG: ContextPruneConfig = {
 
 /** A single tool call + its result as captured from turn_end */
 export interface CapturedToolCall {
+  nestedCalls?: NestedToolCalls;
   toolCallId: string;
   toolName: string;
   args: Record<string, unknown>;