pi-tuck 1.0.25 → 1.0.27

package/CHANGELOG.md

@@ -3,6 +3,44 @@
 All notable changes to pi-tuck. The format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and versions follow
 [Semantic Versioning](https://semver.org/).
 
+## [1.0.27] - 2026-11-10
+
+### Fixed
+
+- **A run that a custom message started could lose that message after a cut in the middle of the run.** pi-tuck protected only a prompt the
+  user typed. A tool-loop cut in a run that an extension started with a custom message kept the message neither whole nor quoted, so later
+  requests lacked the instruction that started the run. Now such a message gets the same protection as a typed prompt: it is kept, or
+  quoted whole in the summary, and the guard checks it. Runs started by typed prompts are unchanged. A custom message with no text has
+  nothing to quote and stays unprotected, as before.
+
+### Added
+
+- A seeded lifecycle sequence test drives real Pi through orders of prompts, handled prompts, custom-message runs, tree moves, new
+  sessions, compactions and aborts. It checks invariants read from outputs only. It reproduces 1.0.23's stale-cut bug and found this one.
+
+### Release gates
+
+- **Shipped without a live gate, because its replay matches 1.0.26 exactly:** 13,946 requests, 0 different, 0 dead tasks, clips 17 → 17.
+  Strict stress: 0 findings. Tests (745) and CI. The packed tarball loaded in the real installed Pi.
+
+## [1.0.26] - 2026-11-10
+
+### Fixed
+
+- **1.0.25 failed to load in an installed Pi** ("Cannot find module '@earendil-works/pi-ai/utils/estimate'"). Pi's extension loader resolves
+  only a few pi-ai entry points for an installed package, and 1.0.25 imported another one by name.
+- **Since 1.0.23, the check of Pi's own reply cap never ran in an installed Pi**, for the same reason. It loaded only in tests and the eval
+  harness, where pi-ai resolves by name; the installed package silently fell back without it. The 4,096-token margin in the hard line held,
+  because it fell back to the same value.
+  - pi-tuck now loads Pi's reply clamp and estimator from the running Pi's own install. If it can't find them (a host embedding Pi), it
+    keeps the fallback as before.
+
+### Release gates
+
+- **New gate:** the packed tarball was loaded in the real installed Pi before publishing. It loaded, and Pi's clamp resolved from Pi's own
+  install.
+- Requests are unchanged from 1.0.25 wherever pi-ai resolves by name, which covers replay, stress and tests. Tests and CI pass.
+
 ## [1.0.25] - 2026-11-10
 
 ### Fixed

package/README.md

@@ -64,8 +64,8 @@ Then start a new Pi session. That is all. pi-tuck takes over Pi's compaction, bo
 
 - Needs Pi 1.2.0 or later (tested on 1.2.0 and 1.4.0), on macOS or Linux. On an older Pi, pi-tuck stays off, Pi's own compaction runs, and pi-tuck says so once. Full features on macOS with Apple silicon; elsewhere, compaction and word recall.
 - On macOS with Apple silicon, the first session also downloads a local search model in the background (about 390 MB, once), and says once when it is set up. Until it is ready, search works by keyword. See [Semantic search](#semantic-search).
-- Prefer GitHub? `pi install git:github.com/galyavin/pi-tuck@v1.0.24`.
-- To pin a version, add it: `pi install npm:pi-tuck@1.0.24`.
+- Prefer GitHub? `pi install git:github.com/galyavin/pi-tuck@v1.0.26`.
+- To pin a version, add it: `pi install npm:pi-tuck@1.0.26`.
 
 ## Uninstall
 
@@ -102,7 +102,7 @@ pi-tuck's tools appear only after its first cut. Before that there is nothing ou
 
 | Command | Does |
 |---|---|
-| `/tuck` | Says in words what pi-tuck is doing in this session: the version this session loaded (an open session keeps it until Pi restarts), how many cuts pi-tuck made and the last one's size before and after, whether the cut point adapts or is fixed by `cutAt`, and how search works here. It is for you; the model sees nothing new. |
+| `/tuck` | Says in words what pi-tuck is doing in this session: the version this session loaded (an open session keeps it until Pi restarts), how many cuts and retries pi-tuck made and the last cut's size before and after, whether the cut point adapts or is fixed by `cutAt`, and how search works here. It is for you; the model sees nothing new. |
 | `/tuck-semantic on\|off\|status` | Turns semantic search on or off for this session, or shows its state. |
 | `/tuck-incident on\|next\|off\|status` | Records this session's compaction decisions to a file you can attach to a bug report. |
 
@@ -131,6 +131,8 @@ Known limits today:
 - A host that patches a large section into the system prompt could get a refusal that a cut would have fit (1.0.0 to 1.0.16; fixed in 1.0.17). pi-tuck plans a prompt's cut when the prompt arrives, before other extensions change the system prompt. A host engine that adds a section of thousands of tokens for one turn could push that turn's first request over the room, and the final guard refused it. Now the guard plans the cut against the system prompt as finally sent, and refuses only if that cut does not fit either ([`CHANGELOG.md`](CHANGELOG.md) 1.0.17).
 - Semantic recall never started in `pi -p` (1.0.0 to 1.0.20; fixed in 1.0.21). pi-tuck skipped semantic recall whenever Pi ran with no UI, to keep a one-shot run from starting the first-time download, and that also skipped a runtime that was already installed. Jobs run with `pi -p` searched by keyword only, while `tuck_search` said semantic recall was being set up. RPC mode was not affected ([`CHANGELOG.md`](CHANGELOG.md) 1.0.21).
 - pi-tuck refused requests that fit the window, and could strand a session (1.0.0 to 1.0.21; fixed in 1.0.22). It refused at the room, the window less the full reply reserve, where native Pi still sends. With Pi's defaults and a large setup, a session could be refused at every prompt. The final refusal now sits at the window less a reply floor ([`CHANGELOG.md`](CHANGELOG.md) 1.0.22).
+- pi-tuck 1.0.25 failed to load in an installed Pi ("Cannot find module '@earendil-works/pi-ai/utils/estimate'"); fixed in 1.0.26, and 1.0.25 is deprecated. Since 1.0.23, the check of Pi's own reply cap also never ran in an installed Pi, for the same reason: Pi's extension loader resolves only a few pi-ai entry points for an installed package. It loaded only in tests and the eval harness, and the installed package fell back to the same 4,096-token margin without it. Fixed in 1.0.26, which was loaded in a real installed Pi before publishing ([`CHANGELOG.md`](CHANGELOG.md) 1.0.26).
+- A request above the room could be admitted and then refused, leaving the session stuck where native Pi would have sent (1.0.22 to 1.0.24; fixed in 1.0.25). pi-tuck checked its line in its own corrected token count, while Pi's reply cap uses Pi's own estimate, which is higher when the provider counts fewer tokens than pi-tuck's raw measure ([`CHANGELOG.md`](CHANGELOG.md) 1.0.25).
 - Near the 1.0.22 refusal line, replies were cut to a few hundred tokens (1.0.22; fixed in 1.0.23). 1.0.22 left only its reply floor and did not count Pi's 4,096-token margin on the reply cap ([`CHANGELOG.md`](CHANGELOG.md) 1.0.23).
 - Cost of the 1.0.22 change: between the room and the window, the reply reserve no longer cushions a wrong count. At a cold start an undercount can reach the provider. A provider that errors is caught and learned from; a server that truncates silently truncates, as it does for native Pi. With a setup above the room, cuts are forced and frequent, each freeing little, which beats a stranded session ([`CHANGELOG.md`](CHANGELOG.md) 1.0.22).
 - A prompt's cut could reach a run it was not planned for (fixed in 1.0.24). pi-tuck plans a prompt's cut when the prompt arrives. When another extension handled that prompt, no run started, and the plan waited for the next run. A run started by a custom message carried a cut sized for the prompt that never ran, deeper than needed. After a move in the session tree (`/tree`), the plan was applied on the new branch, where its kept entry was not present, so the request lost the custom message that started the run, even on a branch that needed no cut ([`CHANGELOG.md`](CHANGELOG.md) 1.0.24).
@@ -193,7 +195,9 @@ A bad file is reported at session start, and pi-tuck uses the defaults.
 
 pi-tuck keeps room for the model's reply. Since 1.0.20 that room is Pi's `compaction.reserveTokens` (default 16,384), the same as native Pi. It rises to the model's `maxTokens` for the rest of the branch only after a reply on that branch did not fit: a reply that stopped for length, or a request refused as a context overflow. A transient error such as a 503 keeps the native room. This is read from the current branch at each decision, so resume, fork and `/tree` follow the branch, and a new session starts at `reserveTokens` again. A host that passes its own reserve keeps its own. Before 1.0.20, pi-tuck always reserved the larger of the two, so with a large `maxTokens` it cut earlier than native Pi.
 
-Since 1.0.22, pi-tuck refuses a request only past a line near the window. Pi sets each request's reply cap to the window less its own estimate of the request less a 4,096-token safety margin, and since 1.0.23 pi-tuck reads that margin from Pi. A request above the room goes out only if Pi's own cap still leaves the reply floor. The floor is the larger of the biggest reply seen on the branch and 3,584 tokens, capped at the model's own reply cap. After a reply that stopped for length or was refused as a context overflow, the floor is the reserve. The line never sits below the room, where 1.0.21 also sends. Before it refuses, pi-tuck cuts to the band, cuts to the room, makes a smaller summary and clips a fresh tool result, in that order. A run's request always carries the whole prompt that started the run: if it cannot fit after every reduction, pi-tuck stops the run with a notice saying to shorten the prompt or use a larger window. Each refusal, and each request sent above the room, leaves one `pi-tuck-capacity` entry in the session; it is never sent to the model, and never appears in summaries or recall.
+Since 1.0.22, pi-tuck refuses a request only past a line near the window. Pi sets each request's reply cap to the window less its own estimate of the request less a 4,096-token safety margin, and since 1.0.26 pi-tuck loads Pi's own reply clamp and estimator from the running Pi's install (a host that embeds Pi falls back to the same 4,096-token margin). Since 1.0.25, each point that sends a request above the room checks Pi's own cap on the request it would send. When that leaves less than the reply floor, pi-tuck cuts deeper, with up to three re-plans and then the deepest cut that still carries the whole prompt, and refuses only if that leaves less than the floor too. The floor is the larger of the biggest reply seen on the branch and 3,584 tokens, capped at the model's own reply cap. After a reply that stopped for length or was refused as a context overflow, the floor is the reserve. The line never sits below the room, where 1.0.21 also sends. Before it refuses, pi-tuck cuts to the band, cuts to the room, makes a smaller summary and clips a fresh tool result, in that order. A run's request always carries the whole prompt that started the run: if it cannot fit after every reduction, pi-tuck stops the run with a notice saying to shorten the prompt or use a larger window. Each refusal, and each request sent above the room, leaves one `pi-tuck-capacity` entry in the session; it is never sent to the model, and never appears in summaries or recall.
+
+Since 1.0.25, after a reply that stops for length with thinking only, pi-tuck retries the turn once, leaving the stopped reply out of the request. It uses the deepest cut that still carries the whole prompt when that gives the reply more room, and otherwise retries uncut. A retried reply that stops again ends the run. When a run ends on a reply cut at the output limit, pi-tuck says so ("the last reply stopped at the model's output limit and may be cut off"): in the interface, or on stderr when there is no UI. The notice never enters the model's context.
 
 pi-tuck estimates the request's size, and it scales that estimate by the worst gap it has seen between its count and the provider's. In a small window, an upstream that spends far more context on tool schemas (some OpenRouter upstreams do) can leave too little room. If a small window refuses, use a larger window, or pin one upstream as below.
 

package/dist/src/build-id.d.ts

@@ -1 +1 @@
-export declare const BUILD_ID = "48d3f777f203edb56b29154215540eb8245182237d18cdc50c6cbe704ea28e7e";
+export declare const BUILD_ID = "480a4cbd70d99cf72adcc93f282c17434d1997e54d3f38fe2f26b3c642f50b2f";

package/dist/src/build-id.js

@@ -1 +1 @@
-export const BUILD_ID = "48d3f777f203edb56b29154215540eb8245182237d18cdc50c6cbe704ea28e7e";
+export const BUILD_ID = "480a4cbd70d99cf72adcc93f282c17434d1997e54d3f38fe2f26b3c642f50b2f";

package/dist/src/compaction.js

@@ -1,5 +1,5 @@
 import { textOf } from "./tuck/core/content.js";
-import { requestReplyFloor, carriesPrompt, needsFullReplyReserve, thinkingOnlyLength, piContextSafetyMargin } from "./request-capacity.js";
+import { requestReplyFloor, carriesPrompt, needsFullReplyReserve, thinkingOnlyLength, piContextSafetyMargin, loadPiRequestMath } from "./request-capacity.js";
 import { BUILD_ID } from "./build-id.js";
 import { createSemanticRecall, budgetSemantic } from "./semantic-recall.js";
 import { DIAGNOSTIC_BUILD, IncidentRecorder, attachReceipt, permittedEntries, receiptId, findReceiptEntry } from "./diagnostics.js";
@@ -11,7 +11,6 @@ import { projectedMessages } from "./omissions.js";
 import { applyClips, clipBudgets, clipFor } from "./clip.js";
 import { DEFAULT_CUT_AT, bandOf, chooseCut, conversationTokens, gateCut, incomingEventTokens, incomingTokens, measurableConversationTokens, planningReserve, projectedConversationTokens, systemPart, validCutAt } from "./budget.js";
 import { getCurrentSystemMessage, isContextOverflow, normalizeContext } from "@earendil-works/pi-ai";
-import { estimateContextTokens } from "@earendil-works/pi-ai/utils/estimate";
 import { calculateContextTokens, convertToLlm, estimateTokens, shouldCompact, SessionManager, SettingsManager } from "@earendil-works/pi-coding-agent";
 import { Type } from "typebox";
 import { Check } from "typebox/value";
@@ -105,9 +104,9 @@ export function seedWindow(branch, key) {
     return initialWindow(key);
 }
 export async function installCompaction(pi, options = {}) {
-    const piMargin = options.requestReserve ? 0 : await piContextSafetyMargin();
-    const piClamp = await import('@earendil-works/pi-ai/api/simple-options')
-        .then(module => module.clampMaxTokensToContext).catch(() => undefined);
+    const piMath = await loadPiRequestMath();
+    const piMargin = options.requestReserve ? 0 : await piContextSafetyMargin(piMath);
+    const piClamp = piMath?.clampMaxTokensToContext;
     const cutAt = options.cutAt ?? DEFAULT_CUT_AT;
     if (!validCutAt(cutAt))
         throw new Error("Invalid cut point: cutAt must be a number above 0 and at most 1");
@@ -225,8 +224,10 @@ export async function installCompaction(pi, options = {}) {
     // Pi's native start/settled events bracket the run and its post-turn cuts.
     let admittedRun = false;
     let runPrompt;
+    let runPromptMessageType = "user";
     let thinkingRetryPending = false;
-    const protectedPrompt = (ctx) => runPrompt ? ctx.sessionManager.getBranch().findLast(entry => entry.type === "message" && entry.message.role === "user" && textOf(entry.message.content).includes(runPrompt))?.id : undefined;
+    const protectedPrompt = (ctx) => runPrompt ? ctx.sessionManager.getBranch().findLast(entry => runPromptMessageType === "custom" ? entry.type === "custom_message" && textOf(entry.content) === runPrompt :
+        entry.type === "message" && entry.message.role === "user" && textOf(entry.message.content).includes(runPrompt))?.id : undefined;
     const promptRefusal = () => new Refusal("Prompt check failed: the whole starting prompt cannot fit after cutting to the band and room, shrinking the summary and clipping fresh results. Shorten the prompt or choose a model with a larger context window, then retry");
     let estimatedTokens = 0;
     // One serial request, one accounting identity; observations never certify new content. A new identity (the first request after a session
@@ -367,7 +368,7 @@ export async function installCompaction(pi, options = {}) {
         const context = normalizeContext({ messages: convertToLlm(messages) });
         const cap = piClamp?.(ctx.model, context, ctx.model.maxTokens);
         return { cap, leavesFloor: cap === undefined || cap >= limits(ctx).replyFloor,
-            estimate: estimateContextTokens(context).tokens };
+            estimate: piMath ? piMath.estimateContextTokens(context).tokens : 0 };
     };
     const projectedRequest = (messages, ctx, host, incoming, prompt, tools, cut) => {
         const enabled = cut || historyToolsEnabled(ctx), shapes = toolShapes(historyToolNames(pi, tools, enabled));
@@ -793,7 +794,9 @@ export async function installCompaction(pi, options = {}) {
         // input, so no run started for it): plan afresh.
         const prompted = phase === "decided" && event.messageType !== "custom";
         phase = "starting";
-        runPrompt = event.messageType === "custom" ? undefined : event.prompt;
+        runPromptMessageType = event.messageType;
+        // Image-only and empty custom messages have no starting text to quote.
+        runPrompt = event.messageType === "custom" ? textOf(event.message.content) || undefined : event.prompt;
         try {
             syncHistoryTools(ctx);
             if (prompted)
@@ -1039,7 +1042,7 @@ export async function installCompaction(pi, options = {}) {
         if (decision.kind !== "cut")
             throw new CapacityError(clampMessage);
         const messages = projectedRequest(decision.plan.messages, view, hostInput, event.context.pendingMessages, ctx.getSystemPrompt(), pi.getActiveTools(), true);
-        if (runPrompt !== undefined && !carriesPrompt(messages, runPrompt))
+        if (runPrompt !== undefined && !carriesPrompt(messages, runPrompt, runPromptMessageType))
             throw promptRefusal();
         const system = requestSystemPart(ctx.getSystemPrompt(), pi.getActiveTools(), messages, ctx.getSystemPrompt());
         const tokens = system + conversationTokens(messages), check = requestClamp(messages, view);
@@ -1174,7 +1177,7 @@ export async function installCompaction(pi, options = {}) {
             observeBudget(tokens, ctx);
             estimatedTokens = corrected(tokens, ctx);
             const { room, hardLine } = limits(ctx);
-            if (runPrompt !== undefined && !carriesPrompt(messages, runPrompt))
+            if (runPrompt !== undefined && !carriesPrompt(messages, runPrompt, runPromptMessageType))
                 throw new Refusal("Prompt check failed: the request is missing the whole text of the prompt that started this run. Shorten the prompt or choose a model with a larger context window, then retry");
             if (!fits(tokens, hardLine, ctx))
                 throw new CapacityError("Complete Pi context and response reserve exceed the estimated request budget");

package/dist/src/diagnostics.d.ts

@@ -1,6 +1,6 @@
 import { type RecallPolicy } from './recall.js';
 import type { SessionEntry } from '@earendil-works/pi-coding-agent';
-export declare const DIAGNOSTIC_BUILD = "48d3f777f203edb56b29154215540eb8245182237d18cdc50c6cbe704ea28e7e";
+export declare const DIAGNOSTIC_BUILD = "480a4cbd70d99cf72adcc93f282c17434d1997e54d3f38fe2f26b3c642f50b2f";
 export interface Receipt {
     id: string;
     build: string;

package/dist/src/request-capacity.d.ts

@@ -1,9 +1,21 @@
 import type { SessionEntry } from '@earendil-works/pi-coding-agent';
 import type { AgentMessage, Messages } from './budget.js';
+type SimpleOptions = typeof import('@earendil-works/pi-ai/api/simple-options');
+type Estimate = typeof import('@earendil-works/pi-ai/utils/estimate');
+export type PiRequestMath = {
+    clampMaxTokensToContext: SimpleOptions['clampMaxTokensToContext'];
+    estimateContextTokens: Estimate['estimateContextTokens'];
+};
+/** Pi's own request arithmetic: its reply clamp and the estimator behind it, as the running Pi has them.
+ * An installed extension cannot import these subpaths by name: Pi's extension loader aliases only pi-ai's root, compat, models, oauth and
+ * providers/all, and an installed package has no node_modules of its own. So resolve them first by name (tests, the eval harness, a dev
+ * checkout), then from the running Pi's own install, beside its executable. If neither works (an SDK host), there is none, and callers
+ * keep their fallbacks. */
+export declare function loadPiRequestMath(): Promise<PiRequestMath | undefined>;
 /** Read Pi's private safety allowance through its public clamp, rather than copying it.
- * Older/unavailable subpaths fall back to Pi 1.2–1.5's documented 4,096-token allowance.
+ * Without Pi's request arithmetic, fall back to Pi 1.2–1.5's documented 4,096-token allowance.
  */
-export declare function piContextSafetyMargin(): Promise<number>;
+export declare function piContextSafetyMargin(math?: PiRequestMath): Promise<number>;
 /** The smallest reply room a request above the room must leave after Pi's own clamp: above the user's p99 reply (3,270 tokens). */
 export declare const REPLY_FLOOR_MIN = 3584;
 /** A spent thinking budget that produced neither a visible answer nor work. Empty/text/tool replies keep the existing length recovery. */
@@ -14,5 +26,6 @@ export declare const needsFullReplyReserve: (message: AgentMessage) => boolean;
 export declare function branchReplyFloor(branch: readonly SessionEntry[], reserve: number): number;
 /** Admission never promises more output than a model with a positive reply cap can produce. */
 export declare function requestReplyFloor(branch: readonly SessionEntry[], reserve: number, maxTokens?: number): number;
-/** Check decoded text, including a whole verbatim user quote in our summary; never JSON-escaped substring matching. */
-export declare function carriesPrompt(messages: Messages, prompt: string): boolean;
+/** Check decoded starting text, native or quoted whole with its original role; never JSON-escaped substring matching. */
+export declare function carriesPrompt(messages: Messages, prompt: string, role?: 'user' | 'custom'): boolean;
+export {};

package/dist/src/request-capacity.js

@@ -1,13 +1,51 @@
 import { isContextOverflow, normalizeContext } from '@earendil-works/pi-ai';
 import { parseRecords, splitSummary } from './tuck/core/transcript.js';
+/** Pi's own request arithmetic: its reply clamp and the estimator behind it, as the running Pi has them.
+ * An installed extension cannot import these subpaths by name: Pi's extension loader aliases only pi-ai's root, compat, models, oauth and
+ * providers/all, and an installed package has no node_modules of its own. So resolve them first by name (tests, the eval harness, a dev
+ * checkout), then from the running Pi's own install, beside its executable. If neither works (an SDK host), there is none, and callers
+ * keep their fallbacks. */
+export async function loadPiRequestMath() {
+    try {
+        const [simple, estimate] = await Promise.all([import('@earendil-works/pi-ai/api/simple-options'), import('@earendil-works/pi-ai/utils/estimate')]);
+        return { clampMaxTokensToContext: simple.clampMaxTokensToContext, estimateContextTokens: estimate.estimateContextTokens };
+    }
+    catch { /* not resolvable by name: an installed extension */ }
+    try {
+        // pi-ai's exports map these subpaths for `import` only (./api/* -> ./dist/api/*.js), so find the package beside Pi's executable and
+        // import the files that map names.
+        const [{ existsSync, realpathSync }, { dirname, join }, { pathToFileURL }] = await Promise.all([import('node:fs'), import('node:path'), import('node:url')]);
+        const entry = process.argv[1];
+        if (!entry)
+            return undefined;
+        let dir = dirname(realpathSync(entry)), root;
+        for (let up = 0; up < 12 && !root; up++, dir = dirname(dir)) {
+            const candidate = join(dir, 'node_modules', '@earendil-works', 'pi-ai');
+            if (existsSync(join(candidate, 'dist', 'api', 'simple-options.js')))
+                root = candidate;
+            if (dirname(dir) === dir)
+                break;
+        }
+        if (!root)
+            return undefined;
+        const [simple, estimate] = await Promise.all([
+            import(pathToFileURL(join(root, 'dist', 'api', 'simple-options.js')).href),
+            import(pathToFileURL(join(root, 'dist', 'utils', 'estimate.js')).href)
+        ]);
+        if (typeof simple.clampMaxTokensToContext !== 'function' || typeof estimate.estimateContextTokens !== 'function')
+            return undefined;
+        return { clampMaxTokensToContext: simple.clampMaxTokensToContext, estimateContextTokens: estimate.estimateContextTokens };
+    }
+    catch {
+        return undefined;
+    }
+}
 /** Read Pi's private safety allowance through its public clamp, rather than copying it.
- * Older/unavailable subpaths fall back to Pi 1.2–1.5's documented 4,096-token allowance.
+ * Without Pi's request arithmetic, fall back to Pi 1.2–1.5's documented 4,096-token allowance.
  */
-export async function piContextSafetyMargin() {
+export async function piContextSafetyMargin(math) {
     try {
-        const [{ clampMaxTokensToContext }, { estimateContextTokens }] = await Promise.all([
-            import('@earendil-works/pi-ai/api/simple-options'), import('@earendil-works/pi-ai/utils/estimate'),
-        ]);
+        const { clampMaxTokensToContext, estimateContextTokens } = math ?? await loadPiRequestMath() ?? (() => { throw new Error('No Pi request math'); })();
         const window = 1_000_000, context = normalizeContext({ messages: [] });
         const margin = window - estimateContextTokens(context).tokens - clampMaxTokensToContext({ contextWindow: window, maxTokens: window }, context, window);
         if (!Number.isSafeInteger(margin) || margin < 0 || margin >= window)
@@ -49,18 +87,18 @@ export function requestReplyFloor(branch, reserve, maxTokens) {
     const floor = branchReplyFloor(branch, reserve);
     return maxTokens !== undefined && maxTokens > 0 ? Math.min(floor, maxTokens) : floor;
 }
-/** Check decoded text, including a whole verbatim user quote in our summary; never JSON-escaped substring matching. */
-export function carriesPrompt(messages, prompt) {
+/** Check decoded starting text, native or quoted whole with its original role; never JSON-escaped substring matching. */
+export function carriesPrompt(messages, prompt, role = 'user') {
     if (!prompt.length)
         return true;
     return messages.some(message => {
-        if (message.role === 'user') {
+        if (message.role === role) {
             const text = typeof message.content === 'string' ? message.content : message.content.flatMap(block => block.type === 'text' ? [block.text] : []).join('\n');
             return text.includes(prompt);
         }
         if (message.role !== 'compactionSummary')
             return false;
         const split = splitSummary(message.summary);
-        return split !== null && split !== undefined && parseRecords(split.body, split.version).some(record => record.kind === 'excerpt' && record.role === 'user' && record.text.includes(prompt));
+        return split !== null && split !== undefined && parseRecords(split.body, split.version).some(record => record.kind === 'excerpt' && record.role === role && record.text.includes(prompt));
     });
 }

package/dist/src/tuck.js

@@ -116,7 +116,8 @@ export function tuckObservedDraft(tuck, input, ctx, reserveTokens, measure, poli
     const userContent = current?.type === "message" && current.message.role === "user" ? current.message.content : undefined;
     const textOnly = isTextOnly(userContent);
     // Steering can become the latest user source while the run still owns its original prompt.
-    const startingPosition = entries.findIndex(entry => entry.id === input.protectedPromptEntryId && entry.type === "message" && entry.message.role === "user");
+    const startingPosition = entries.findIndex(entry => entry.id === input.protectedPromptEntryId &&
+        (entry.type === "custom_message" || entry.type === "message" && entry.message.role === "user"));
     const starting = entries[startingPosition];
     // Anchor the actual first source only; a native omission never promotes a later prompt.
     const firstUser = branch.find(entry => entry.type === "message" && entry.message.role === "user");
@@ -256,10 +257,12 @@ export function tuckObservedDraft(tuck, input, ctx, reserveTokens, measure, poli
             if (cached)
                 return cached;
             const index = indices.get(entry.id);
-            const text = entry.type === "message" && entry.message.role === "user" ? textOf(entry.message.content) : "";
+            const text = entry.type === "custom_message" ? textOf(entry.content) : entry.type === "message" && entry.message.role === "user" ? textOf(entry.message.content) : "";
             const sourceTimes = index === undefined ? undefined : [{ sourceIndex: index, ...resolveSourceTime(entry) }];
-            const records = index === undefined ? [] : take === Infinity
-                ? [{ kind: "excerpt", role: "user", sourceIndex: index, text, sourceTimes }]
+            // Custom entries have a native identity but no global message index.
+            const records = index === undefined && entry.type !== "custom_message" ? [] : take === Infinity
+                ? [{ kind: "excerpt", role: entry.type === "custom_message" ? "custom" : "user", ...(index === undefined ? {} : { sourceIndex: index }), text, sourceTimes,
+                        ...(entry.type === "custom_message" ? { sourceEntryId: entry.id } : {}) }]
                 : userPrefixRecords({ kind: "user", text, originalText: text, startsSource: true, sourceIndex: index }, undefined, take).map(record => ({ ...record, sourceTimes }));
             cached = { records, cost: lineCost(records), whole: take >= text.length };
             quoteCache.set(key, cached);
@@ -399,21 +402,24 @@ export function tuckObservedDraft(tuck, input, ctx, reserveTokens, measure, poli
             if (row.message.role === "user" && Array.isArray(row.message.content))
                 imageLabels.set(row.index, new Set(row.message.content.flatMap(part => part.type === "image" ? [`[image: ${part.mimeType}]`] : [])));
         const compiledBoundary = boundary;
+        // A protected custom prompt uses its native entry ID in the same anchoring/movement path as indexed user prompts.
+        const sourceKey = (record) => starting?.type === "custom_message" && record.sourceEntryId === starting.id ? starting.id : record.sourceIndex;
         const assemble = (compiled, at = compiledBoundary) => {
             const split = compiled ? splitSummary(compiled) : undefined;
             if (compiled && !split)
                 throw new Error("pi-tuck returned an invalid summary");
             const inputRecords = split ? parseRecords(split.body, split.version) : protectedView.omissions;
-            const expanded = new Set(protectedView.kept.filter(record => record.kind === "excerpt" && inputRecords.some(row => row.kind === "excerpt" && row.role === "user" && row.sourceIndex === record.sourceIndex && row.text.startsWith(record.text) && row.text.length >= record.text.length)).map(record => record.sourceIndex));
-            const anchored = new Set(protectedView.kept.map(record => record.sourceIndex));
-            const moved = new Set(rows.filter(row => row.position >= at && row.position < compiledBoundary).map(row => row.index));
+            const expanded = new Set(protectedView.kept.filter(record => record.kind === "excerpt" && inputRecords.some(row => row.kind === "excerpt" && row.role === record.role && sourceKey(row) === sourceKey(record) && row.text.startsWith(record.text) && row.text.length >= record.text.length)).map(sourceKey));
+            const anchored = new Set(protectedView.kept.map(sourceKey));
+            const moved = new Set(rows.filter(row => row.position >= at && row.position < compiledBoundary).map(row => starting?.type === "custom_message" && row.id === starting.id ? row.id : row.index));
             const records = [...inputRecords.filter(record => {
-                    if (record.sourceIndex !== undefined && moved.has(record.sourceIndex))
+                    const key = sourceKey(record);
+                    if (key !== undefined && moved.has(key))
                         return false;
                     if (record.kind === "excerpt" && record.role === "user" && imageLabels.get(record.sourceIndex)?.has(record.text))
                         return true;
-                    return record.role !== "user" || record.sourceIndex === undefined || !anchored.has(record.sourceIndex) || expanded.has(record.sourceIndex);
-                }), ...protectedView.kept.filter(record => !expanded.has(record.sourceIndex) && !moved.has(record.sourceIndex))];
+                    return record.role !== "user" && record.role !== "custom" || key === undefined || !anchored.has(key) || expanded.has(key);
+                }), ...protectedView.kept.filter(record => !expanded.has(sourceKey(record)) && !moved.has(sourceKey(record)))];
             // Mixed user turns keep their text opening, while their image
             // metadata remains in the ordinary lower-ranked dialogue lane.
             const wholeUser = new Set(records.filter(record => record.kind === "excerpt" && record.role === "user" && record.text === userTexts.get(record.sourceIndex)).map(record => record.sourceIndex));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-tuck",
-  "version": "1.0.25",
+  "version": "1.0.27",
   "description": "Deterministic compaction for Pi with no model call, plus exact recall of earlier history. Search by meaning on Apple silicon.",
   "keywords": [
     "pi-package",

package/src/build-id.ts

@@ -1 +1 @@
-export const BUILD_ID = "48d3f777f203edb56b29154215540eb8245182237d18cdc50c6cbe704ea28e7e";
+export const BUILD_ID = "480a4cbd70d99cf72adcc93f282c17434d1997e54d3f38fe2f26b3c642f50b2f";

package/src/compaction.ts

@@ -1,5 +1,5 @@
 import { textOf } from "./tuck/core/content.js";
-import { requestReplyFloor, carriesPrompt, needsFullReplyReserve, thinkingOnlyLength, piContextSafetyMargin } from "./request-capacity.js";
+import { requestReplyFloor, carriesPrompt, needsFullReplyReserve, thinkingOnlyLength, piContextSafetyMargin, loadPiRequestMath } from "./request-capacity.js";
 import { BUILD_ID } from "./build-id.js";
 import { createSemanticRecall, budgetSemantic, type SemanticRecallController } from "./semantic-recall";
 import { DIAGNOSTIC_BUILD, IncidentRecorder, attachReceipt, permittedEntries, receiptId, findReceiptEntry, type Receipt, type RecorderOptions } from "./diagnostics.js";
@@ -12,7 +12,6 @@ import { applyClips, clipBudgets, clipFor, type Clip } from "./clip.js";
 import { DEFAULT_CUT_AT, bandOf, chooseCut, conversationTokens, gateCut, incomingEventTokens, incomingTokens, measurableConversationTokens, planningReserve, projectedConversationTokens, systemPart, validCutAt,
     type AgentMessage, type Decision, type Messages, type Plan, type Target } from "./budget.js";
 import { getCurrentSystemMessage, isContextOverflow, normalizeContext, type ImageContent, type ToolResultMessage } from "@earendil-works/pi-ai";
-import { estimateContextTokens } from "@earendil-works/pi-ai/utils/estimate";
 import { calculateContextTokens, convertToLlm, estimateTokens, shouldCompact, SessionManager, SettingsManager, type ExtensionAPI, type ExtensionContext, type SessionEntry, type SessionBoundaryDraft, type TurnEndEvent } from "@earendil-works/pi-coding-agent";
 import { Type } from "typebox";
 import { Check } from "typebox/value";
@@ -135,9 +134,9 @@ export interface CompactionOptions {
 }
 
 export async function installCompaction(pi: ExtensionAPI, options: CompactionOptions = {}) {
-    const piMargin = options.requestReserve ? 0 : await piContextSafetyMargin();
-    const piClamp = await import('@earendil-works/pi-ai/api/simple-options')
-        .then(module => module.clampMaxTokensToContext).catch(() => undefined);
+    const piMath = await loadPiRequestMath();
+    const piMargin = options.requestReserve ? 0 : await piContextSafetyMargin(piMath);
+    const piClamp = piMath?.clampMaxTokensToContext;
     const cutAt = options.cutAt ?? DEFAULT_CUT_AT;
     if (!validCutAt(cutAt)) throw new Error("Invalid cut point: cutAt must be a number above 0 and at most 1");
     const semantic = options.semanticRecall ?? createSemanticRecall(), search = options.search ?? true;
@@ -221,8 +220,10 @@ export async function installCompaction(pi: ExtensionAPI, options: CompactionOpt
     // Pi's native start/settled events bracket the run and its post-turn cuts.
     let admittedRun = false;
     let runPrompt: string | undefined;
+    let runPromptMessageType: "user" | "custom" = "user";
     let thinkingRetryPending = false;
     const protectedPrompt = (ctx: ExtensionContext) => runPrompt ? ctx.sessionManager.getBranch().findLast(entry =>
+        runPromptMessageType === "custom" ? entry.type === "custom_message" && textOf(entry.content) === runPrompt :
         entry.type === "message" && entry.message.role === "user" && textOf(entry.message.content).includes(runPrompt!))?.id : undefined;
     const promptRefusal = () => new Refusal("Prompt check failed: the whole starting prompt cannot fit after cutting to the band and room, shrinking the summary and clipping fresh results. Shorten the prompt or choose a model with a larger context window, then retry");
     let estimatedTokens = 0;
@@ -350,7 +351,7 @@ export async function installCompaction(pi: ExtensionAPI, options: CompactionOpt
         const context = normalizeContext({ messages: convertToLlm(messages) });
         const cap = piClamp?.(ctx.model!, context, ctx.model!.maxTokens);
         return { cap, leavesFloor: cap === undefined || cap >= limits(ctx).replyFloor,
-            estimate: estimateContextTokens(context).tokens };
+            estimate: piMath ? piMath.estimateContextTokens(context).tokens : 0 };
     };
     const projectedRequest = (messages: Messages, ctx: ExtensionContext, host: Messages, incoming: Messages, prompt: string, tools: readonly string[], cut: boolean) => {
         const enabled = cut || historyToolsEnabled(ctx), shapes = toolShapes(historyToolNames(pi, tools, enabled));
@@ -700,7 +701,9 @@ export async function installCompaction(pi: ExtensionAPI, options: CompactionOpt
         // input, so no run started for it): plan afresh.
         const prompted = phase === "decided" && event.messageType !== "custom";
         phase = "starting";
-        runPrompt = event.messageType === "custom" ? undefined : event.prompt;
+        runPromptMessageType = event.messageType;
+        // Image-only and empty custom messages have no starting text to quote.
+        runPrompt = event.messageType === "custom" ? textOf(event.message.content) || undefined : event.prompt;
         try {
             syncHistoryTools(ctx);
             if (prompted) access(); // decided on input; a failure latched there still stops the run
@@ -916,7 +919,7 @@ export async function installCompaction(pi: ExtensionAPI, options: CompactionOpt
         }
         if (decision.kind !== "cut") throw new CapacityError(clampMessage);
         const messages = projectedRequest(decision.plan.messages, view, hostInput, event.context.pendingMessages, ctx.getSystemPrompt(), pi.getActiveTools(), true);
-        if (runPrompt !== undefined && !carriesPrompt(messages, runPrompt)) throw promptRefusal();
+        if (runPrompt !== undefined && !carriesPrompt(messages, runPrompt, runPromptMessageType)) throw promptRefusal();
         const system = requestSystemPart(ctx.getSystemPrompt(), pi.getActiveTools(), messages, ctx.getSystemPrompt());
         const tokens = system + conversationTokens(messages), check = requestClamp(messages, view);
         const { response, room, hardLine } = limits(view);
@@ -1020,7 +1023,7 @@ export async function installCompaction(pi: ExtensionAPI, options: CompactionOpt
             observeBudget(tokens, ctx);
             estimatedTokens = corrected(tokens, ctx);
             const { room, hardLine } = limits(ctx);
-            if (runPrompt !== undefined && !carriesPrompt(messages, runPrompt))
+            if (runPrompt !== undefined && !carriesPrompt(messages, runPrompt, runPromptMessageType))
                 throw new Refusal("Prompt check failed: the request is missing the whole text of the prompt that started this run. Shorten the prompt or choose a model with a larger context window, then retry");
 			if (!fits(tokens, hardLine, ctx))
 				throw new CapacityError("Complete Pi context and response reserve exceed the estimated request budget");

package/src/request-capacity.ts

@@ -3,14 +3,47 @@ import type { SessionEntry } from '@earendil-works/pi-coding-agent';
 import type { AgentMessage, Messages } from './budget.js';
 import { parseRecords, splitSummary } from './tuck/core/transcript.js';
 
+type SimpleOptions = typeof import('@earendil-works/pi-ai/api/simple-options');
+type Estimate = typeof import('@earendil-works/pi-ai/utils/estimate');
+export type PiRequestMath = { clampMaxTokensToContext: SimpleOptions['clampMaxTokensToContext']; estimateContextTokens: Estimate['estimateContextTokens'] };
+
+/** Pi's own request arithmetic: its reply clamp and the estimator behind it, as the running Pi has them.
+ * An installed extension cannot import these subpaths by name: Pi's extension loader aliases only pi-ai's root, compat, models, oauth and
+ * providers/all, and an installed package has no node_modules of its own. So resolve them first by name (tests, the eval harness, a dev
+ * checkout), then from the running Pi's own install, beside its executable. If neither works (an SDK host), there is none, and callers
+ * keep their fallbacks. */
+export async function loadPiRequestMath(): Promise<PiRequestMath | undefined> {
+    try {
+        const [simple, estimate] = await Promise.all([import('@earendil-works/pi-ai/api/simple-options'), import('@earendil-works/pi-ai/utils/estimate')]);
+        return { clampMaxTokensToContext: simple.clampMaxTokensToContext, estimateContextTokens: estimate.estimateContextTokens };
+    } catch { /* not resolvable by name: an installed extension */ }
+    try {
+        // pi-ai's exports map these subpaths for `import` only (./api/* -> ./dist/api/*.js), so find the package beside Pi's executable and
+        // import the files that map names.
+        const [{ existsSync, realpathSync }, { dirname, join }, { pathToFileURL }] = await Promise.all([import('node:fs'), import('node:path'), import('node:url')]);
+        const entry = process.argv[1];
+        if (!entry) return undefined;
+        let dir = dirname(realpathSync(entry)), root: string | undefined;
+        for (let up = 0; up < 12 && !root; up++, dir = dirname(dir)) {
+            const candidate = join(dir, 'node_modules', '@earendil-works', 'pi-ai');
+            if (existsSync(join(candidate, 'dist', 'api', 'simple-options.js'))) root = candidate;
+            if (dirname(dir) === dir) break;
+        }
+        if (!root) return undefined;
+        const [simple, estimate] = await Promise.all([
+            import(pathToFileURL(join(root, 'dist', 'api', 'simple-options.js')).href) as Promise<SimpleOptions>,
+            import(pathToFileURL(join(root, 'dist', 'utils', 'estimate.js')).href) as Promise<Estimate>]);
+        if (typeof simple.clampMaxTokensToContext !== 'function' || typeof estimate.estimateContextTokens !== 'function') return undefined;
+        return { clampMaxTokensToContext: simple.clampMaxTokensToContext, estimateContextTokens: estimate.estimateContextTokens };
+    } catch { return undefined; }
+}
+
 /** Read Pi's private safety allowance through its public clamp, rather than copying it.
- * Older/unavailable subpaths fall back to Pi 1.2–1.5's documented 4,096-token allowance.
+ * Without Pi's request arithmetic, fall back to Pi 1.2–1.5's documented 4,096-token allowance.
  */
-export async function piContextSafetyMargin(): Promise<number> {
+export async function piContextSafetyMargin(math?: PiRequestMath): Promise<number> {
     try {
-        const [{ clampMaxTokensToContext }, { estimateContextTokens }] = await Promise.all([
-            import('@earendil-works/pi-ai/api/simple-options'), import('@earendil-works/pi-ai/utils/estimate'),
-        ]);
+        const { clampMaxTokensToContext, estimateContextTokens } = math ?? await loadPiRequestMath() ?? (() => { throw new Error('No Pi request math'); })();
         const window = 1_000_000, context = normalizeContext({ messages: [] });
         const margin = window - estimateContextTokens(context).tokens - clampMaxTokensToContext({ contextWindow: window, maxTokens: window } as never, context, window);
         if (!Number.isSafeInteger(margin) || margin < 0 || margin >= window) throw new Error('Invalid Pi context margin');
@@ -51,17 +84,17 @@ export function requestReplyFloor(branch: readonly SessionEntry[], reserve: numb
     return maxTokens !== undefined && maxTokens > 0 ? Math.min(floor, maxTokens) : floor;
 }
 
-/** Check decoded text, including a whole verbatim user quote in our summary; never JSON-escaped substring matching. */
-export function carriesPrompt(messages: Messages, prompt: string): boolean {
+/** Check decoded starting text, native or quoted whole with its original role; never JSON-escaped substring matching. */
+export function carriesPrompt(messages: Messages, prompt: string, role: 'user' | 'custom' = 'user'): boolean {
     if (!prompt.length) return true;
     return messages.some(message => {
-        if (message.role === 'user') {
+        if (message.role === role) {
             const text = typeof message.content === 'string' ? message.content : message.content.flatMap(block => block.type === 'text' ? [block.text] : []).join('\n');
             return text.includes(prompt);
         }
         if (message.role !== 'compactionSummary') return false;
         const split = splitSummary(message.summary);
         return split !== null && split !== undefined && parseRecords(split.body, split.version).some(record =>
-            record.kind === 'excerpt' && record.role === 'user' && record.text.includes(prompt));
+            record.kind === 'excerpt' && record.role === role && record.text.includes(prompt));
     });
 }

package/src/tuck.ts

@@ -144,7 +144,8 @@ export function tuckObservedDraft(tuck: Tuck, input: { branchEntries: SessionEnt
     const userContent = current?.type === "message" && current.message.role === "user" ? current.message.content : undefined;
     const textOnly = isTextOnly(userContent);
     // Steering can become the latest user source while the run still owns its original prompt.
-    const startingPosition = entries.findIndex(entry => entry.id === input.protectedPromptEntryId && entry.type === "message" && entry.message.role === "user");
+    const startingPosition = entries.findIndex(entry => entry.id === input.protectedPromptEntryId &&
+        (entry.type === "custom_message" || entry.type === "message" && entry.message.role === "user"));
     const starting = entries[startingPosition];
     // Anchor the actual first source only; a native omission never promotes a later prompt.
     const firstUser = branch.find(entry => entry.type === "message" && entry.message.role === "user");
@@ -265,10 +266,12 @@ export function tuckObservedDraft(tuck: Tuck, input: { branchEntries: SessionEnt
             let cached = quoteCache.get(key);
             if (cached) return cached;
             const index = indices.get(entry.id);
-            const text = entry.type === "message" && entry.message.role === "user" ? textOf(entry.message.content) : "";
+            const text = entry.type === "custom_message" ? textOf(entry.content) : entry.type === "message" && entry.message.role === "user" ? textOf(entry.message.content) : "";
             const sourceTimes = index === undefined ? undefined : [{ sourceIndex: index, ...resolveSourceTime(entry) }];
-            const records: TranscriptRecord[] = index === undefined ? [] : take === Infinity
-                ? [{ kind: "excerpt", role: "user", sourceIndex: index, text, sourceTimes }]
+            // Custom entries have a native identity but no global message index.
+            const records: TranscriptRecord[] = index === undefined && entry.type !== "custom_message" ? [] : take === Infinity
+                ? [{ kind: "excerpt", role: entry.type === "custom_message" ? "custom" : "user", ...(index === undefined ? {} : { sourceIndex: index }), text, sourceTimes,
+                    ...(entry.type === "custom_message" ? { sourceEntryId: entry.id } : {}) }]
                 : userPrefixRecords({ kind: "user", text, originalText: text, startsSource: true, sourceIndex: index }, undefined, take).map(record => ({ ...record, sourceTimes }));
             cached = { records, cost: lineCost(records), whole: take >= text.length };
             quoteCache.set(key, cached);
@@ -383,19 +386,23 @@ export function tuckObservedDraft(tuck: Tuck, input: { branchEntries: SessionEnt
         for (const row of sourceRows) if (row.message.role === "user" && Array.isArray(row.message.content))
             imageLabels.set(row.index, new Set(row.message.content.flatMap(part => part.type === "image" ? [`[image: ${part.mimeType}]`] : [])));
         const compiledBoundary = boundary;
+        // A protected custom prompt uses its native entry ID in the same anchoring/movement path as indexed user prompts.
+        const sourceKey = (record: TranscriptRecord) => starting?.type === "custom_message" && record.sourceEntryId === starting.id ? starting.id : record.sourceIndex;
         const assemble = (compiled: string, at = compiledBoundary) => {
             const split = compiled ? splitSummary(compiled) : undefined;
             if (compiled && !split) throw new Error("pi-tuck returned an invalid summary");
             const inputRecords = split ? parseRecords(split.body, split.version) : protectedView.omissions;
             const expanded = new Set(protectedView.kept.filter(record => record.kind === "excerpt" && inputRecords.some(row =>
-                row.kind === "excerpt" && row.role === "user" && row.sourceIndex === record.sourceIndex && row.text.startsWith(record.text!) && row.text.length >= record.text!.length)).map(record => record.sourceIndex));
-            const anchored = new Set(protectedView.kept.map(record => record.sourceIndex));
-            const moved = new Set(rows.filter(row => row.position >= at && row.position < compiledBoundary).map(row => row.index));
+                row.kind === "excerpt" && row.role === record.role && sourceKey(row) === sourceKey(record) && row.text.startsWith(record.text!) && row.text.length >= record.text!.length)).map(sourceKey));
+            const anchored = new Set(protectedView.kept.map(sourceKey));
+            const moved = new Set(rows.filter(row => row.position >= at && row.position < compiledBoundary).map(row =>
+                starting?.type === "custom_message" && row.id === starting.id ? row.id : row.index));
             const records = [...inputRecords.filter(record => {
-                if (record.sourceIndex !== undefined && moved.has(record.sourceIndex)) return false;
+                const key = sourceKey(record);
+                if (key !== undefined && moved.has(key)) return false;
                 if (record.kind === "excerpt" && record.role === "user" && imageLabels.get(record.sourceIndex)?.has(record.text)) return true;
-                return record.role !== "user" || record.sourceIndex === undefined || !anchored.has(record.sourceIndex) || expanded.has(record.sourceIndex);
-            }), ...protectedView.kept.filter(record => !expanded.has(record.sourceIndex) && !moved.has(record.sourceIndex))];
+                return record.role !== "user" && record.role !== "custom" || key === undefined || !anchored.has(key) || expanded.has(key);
+            }), ...protectedView.kept.filter(record => !expanded.has(sourceKey(record)) && !moved.has(sourceKey(record)))];
             // Mixed user turns keep their text opening, while their image
             // metadata remains in the ordinary lower-ranked dialogue lane.
             const wholeUser = new Set(records.filter(record => record.kind === "excerpt" && record.role === "user" && record.text === userTexts.get(record.sourceIndex)).map(record => record.sourceIndex));