pi-tuck 1.0.27 → 1.0.29

package/dist/src/compaction.js

@@ -1,9 +1,11 @@
 import { textOf } from "./tuck/core/content.js";
-import { requestReplyFloor, carriesPrompt, needsFullReplyReserve, thinkingOnlyLength, piContextSafetyMargin, loadPiRequestMath } from "./request-capacity.js";
+import { PendingCut, StartingPrompt, createRun } from "./run.js";
+import { requestReplyFloor, replyFit, carriesPrompt, thinkingOnlyLength, piContextSafetyMargin, loadPiRequestMath, seedContextWindow, WINDOW_RECEIPT } from "./request-capacity.js";
 import { BUILD_ID } from "./build-id.js";
 import { createSemanticRecall, budgetSemantic } from "./semantic-recall.js";
 import { DIAGNOSTIC_BUILD, IncidentRecorder, attachReceipt, permittedEntries, receiptId, findReceiptEntry } from "./diagnostics.js";
 import { createHash } from "node:crypto";
+import { readFileSync } from "node:fs";
 import { exportSource } from "./source-export.js";
 import { isDeepStrictEqual } from "node:util";
 import { assertNativeToolRounds, isDiscardedResponse } from "./protocol.js";
@@ -11,7 +13,7 @@ import { projectedMessages } from "./omissions.js";
 import { applyClips, clipBudgets, clipFor } from "./clip.js";
 import { DEFAULT_CUT_AT, bandOf, chooseCut, conversationTokens, gateCut, incomingEventTokens, incomingTokens, measurableConversationTokens, planningReserve, projectedConversationTokens, systemPart, validCutAt } from "./budget.js";
 import { getCurrentSystemMessage, isContextOverflow, normalizeContext } from "@earendil-works/pi-ai";
-import { calculateContextTokens, convertToLlm, estimateTokens, shouldCompact, SessionManager, SettingsManager } from "@earendil-works/pi-coding-agent";
+import { calculateContextTokens, convertToLlm, estimateTokens, shouldCompact, SettingsManager } from "@earendil-works/pi-coding-agent";
 import { Type } from "typebox";
 import { Check } from "typebox/value";
 import { MAX_RECALL_CHARACTERS, MAX_RECALL_ENTRY_ID_CHARACTERS, MAX_RECALL_QUERY_CHARACTERS } from "./recall.js";
@@ -19,7 +21,7 @@ import { tuck, tuckDraft, tuckObservedDraft, tuckRecall } from "./tuck.js";
 import { LOADED_VERSION, statusText } from "./status.js";
 import { ImageRecallInput, historyImage, historyAround } from "./history-image.js";
 import { eligibilityKey, eligibilityKeyMoved, memoizedEligibleSources } from "./eligibility-cache.js";
-import { applyHistoryTools, hasTuckCut, historyToolDeclarations, historyToolNames, stageHistoryTools } from "./history-tools.js";
+import { applyHistoryTools, historyToolDeclarations, historyToolNames, stageHistoryTools } from "./history-tools.js";
 const query = Type.String({ minLength: 1, maxLength: MAX_RECALL_QUERY_CHARACTERS });
 const entryId = Type.String({ minLength: 1, maxLength: MAX_RECALL_ENTRY_ID_CHARACTERS });
 const paging = {
@@ -43,7 +45,7 @@ const RecallInput = Type.Union([
 const SearchInput = Type.Object({ query, priorResults: Type.Optional(Type.Array(Type.Object({ sourceSha: Type.String({ minLength: 64, maxLength: 64 }), read: Type.Object({ entryId, offset: Type.Integer({ minimum: 0 }), limit: Type.Integer({ minimum: 0 }) }, { additionalProperties: false }) }, { additionalProperties: false }), { maxItems: 20 })) }, { additionalProperties: false });
 const reply = (value) => ({ content: [{ type: "text", text: JSON.stringify(value) }], details: {} });
 /** The compactor's verdict that this attempt cannot be made: the cut it needs cannot be made, or the request cannot fit. Like every failure but
- * a `CommitFault`, it ends with its attempt (`forgetFailure`), and the next attempt plans afresh from the session as it is. */
+ * a `CommitFault`, it ends with its attempt (`resetRun`), and the next attempt plans afresh from the session as it is. */
 class Refusal extends Error {
 }
 /** A cut this compactor supplied that Pi then failed to commit. Pi appends a cut to the session in memory before it writes the file, so the
@@ -122,11 +124,16 @@ export async function installCompaction(pi, options = {}) {
     // Semantic indexing outlives any one attempt, so it checks only that the host still grants access: a compactor failure, which ends with its
     // attempt, must not read as a revocation (that disables semantic recall and deletes its index for the rest of the session).
     // A prompt's cut reaches the requests at once but the session only at the end of the first turn: until then search sees the history as the model does.
-    const semanticProvider = (ctx) => () => memoizedEligibleSources(ctx, options.recallPolicy, hostAccess, promptCut ? promptCut.firstKeptEntryId || ctx.sessionManager.getBranch().findLast(e => e.type === "message" && e.message.role === "user")?.id : undefined);
+    const view = (ctx, threshold = false) => (threshold && run?.expired ? liveCut : run?.cut ?? liveCut).view(ctx);
+    const liveCut = new PendingCut();
+    const semanticProvider = (ctx) => () => {
+        const current = view(ctx);
+        return memoizedEligibleSources(ctx, options.recallPolicy, hostAccess, current.pending ? current.keptFromId : undefined);
+    };
     const recorder = new IncidentRecorder(options.diagnostics);
     let proposalId;
     const observe = (ctx) => recorder.measureInline(() => {
-        if (!active() || failure)
+        if (!active() || failure())
             return;
         if (!proposalId)
             return;
@@ -138,7 +145,7 @@ export async function installCompaction(pi, options = {}) {
         }
     });
     const captureDraft = (draft, ctx, reserve, reason, tokensBefore, retainCurrentInput, operatorManual, previousSummary, budget) => recorder.measureInline(() => {
-        const attached = attachReceipt(draft, reason, reserve, ctx.model?.contextWindow ?? 0, { responseReserveTokens: budget?.response, hostInputTokens: budget?.host, mandatoryInputTokens: budget?.mandatory, target: budget?.target, triggerMarginTokens: budget?.margin, ...(cutAt === 1 ? {} : { cutAt }), calibrationFactor: factor, calibrationWindow: [...ratios], calibrationIdentity: identity, activeInputCeilingTokens: lastCeiling });
+        const attached = attachReceipt(draft, reason, reserve, contextWindow(ctx), { responseReserveTokens: budget?.response, hostInputTokens: budget?.host, mandatoryInputTokens: budget?.mandatory, target: budget?.target, triggerMarginTokens: budget?.margin, ...(cutAt === 1 ? {} : { cutAt }), calibrationFactor: factor, calibrationWindow: [...ratios], calibrationIdentity: identity, learnedContextWindow, activeInputCeilingTokens: lastCeiling });
         proposalId = receiptId(attached);
         if (recorder.enabled) {
             try {
@@ -218,21 +225,26 @@ export async function installCompaction(pi, options = {}) {
             ctx.ui.notify(JSON.stringify({ ...semanticStatus(), ...(errors.length ? { errors } : {}) }), errors.length ? "warning" : "info");
         } });
     pi.registerCommand("tuck", { description: "pi-tuck's state in this session: version, cuts, cut point, search", handler: async (_args, ctx) => {
-            const { state, lastError } = semantic.status();
-            ctx.ui.notify(statusText({ version: LOADED_VERSION, active: active(), branch: ctx.sessionManager.getBranch(), cutAt: options.cutAt, search, semantic: { state, lastError } }), "info");
+            const state = semantic.status();
+            ctx.ui.notify(statusText({ version: LOADED_VERSION, active: active(), branch: ctx.sessionManager.getBranch(), cutAt: options.cutAt, search, semantic: state, pending: view(ctx).pending }), "info");
         } });
     // Pi's native start/settled events bracket the run and its post-turn cuts.
-    let admittedRun = false;
-    let runPrompt;
-    let runPromptMessageType = "user";
-    let thinkingRetryPending = false;
-    const protectedPrompt = (ctx) => runPrompt ? ctx.sessionManager.getBranch().findLast(entry => runPromptMessageType === "custom" ? entry.type === "custom_message" && textOf(entry.content) === runPrompt :
-        entry.type === "message" && entry.message.role === "user" && textOf(entry.message.content).includes(runPrompt))?.id : undefined;
+    let run;
+    // A native append may have mutated memory before its disk write failed. This session fault outlives the run.
+    let commitFault;
+    const failure = () => commitFault ?? run?.failure;
+    const protectedPrompt = (ctx) => run?.prompt?.id(ctx.sessionManager.getBranch());
+    const clips = () => run?.clips ?? emptyClips;
+    const emptyClips = new Map();
+    const resetRun = () => { run = undefined; pending = undefined; };
     const promptRefusal = () => new Refusal("Prompt check failed: the whole starting prompt cannot fit after cutting to the band and room, shrinking the summary and clipping fresh results. Shorten the prompt or choose a model with a larger context window, then retry");
     let estimatedTokens = 0;
     // One serial request, one accounting identity; observations never certify new content. A new identity (the first request after a session
     // start, or a model switch) starts with the window its branch's newest receipt recorded for that identity, else that receipt's factor, else the model's measured undercount or 1 (`seedWindow`).
     let identity = "", factor = 1, ratios = [];
+    let learnedContextWindow;
+    const serverClipped = new WeakSet();
+    let windowObservation;
     let lastCeiling = null;
     let pending;
     const identityFor = (ctx) => {
@@ -241,10 +253,27 @@ export async function installCompaction(pi, options = {}) {
             identity = key;
             ratios = seedWindow(ctx.sessionManager.getBranch(), key);
             factor = Math.max(1, ...ratios);
+            learnedContextWindow = seedContextWindow(ctx.sessionManager.getBranch(), key);
             pending = undefined;
         }
         return key;
     };
+    const contextWindow = (ctx) => {
+        identityFor(ctx);
+        return Math.min(ctx.model?.contextWindow ?? 0, learnedContextWindow ?? Infinity);
+    };
+    // This is the cap in Pi's built provider payload, including its context clamp and thinking adjustments.
+    // An API with no explicit cap supplies no clipping evidence; never substitute the catalogue maximum.
+    pi.on("before_provider_request", event => {
+        if (!pending || !event.payload || typeof event.payload !== "object")
+            return;
+        const payload = event.payload;
+        // Read at reply time so later in-place payload edits are included too.
+        pending.requestedMaxTokens = () => {
+            const cap = payload.max_tokens ?? payload.max_completion_tokens ?? payload.max_output_tokens;
+            return typeof cap === "number" && Number.isSafeInteger(cap) && cap > 0 ? cap : undefined;
+        };
+    });
     // The factor is max(1, the last CALIBRATION_WINDOW paired ratios, overflow bounds and seed): it rises at once and a stale high ratio ages out.
     const learn = (value) => { ratios.push(value); if (ratios.length > CALIBRATION_WINDOW)
         ratios.shift(); factor = Math.max(1, ...ratios); };
@@ -256,6 +285,7 @@ export async function installCompaction(pi, options = {}) {
     // The cut planner's raw reserve for the target limit, on the same factor as every other consumer.
     const planReserve = (target, room, band, mandatory, ctx) => {
         identityFor(ctx);
+        // The compiler subtracts this reserve from the catalogue window. Targets already use the learned window.
         return planningReserve(ctx.model?.contextWindow ?? 0, target === "band" ? band : room, factor, mandatory);
     };
     pi.on("message_end", (event, ctx) => {
@@ -274,7 +304,7 @@ export async function installCompaction(pi, options = {}) {
         pending = undefined;
         const key = identityFor(ctx), message = event.message;
         const overflow = message.stopReason === "error" && isContextOverflow(message);
-        if (!paired || !key || paired.identity !== key || !active() || failure || ctx.signal?.aborted || (message.errorMessage && !overflow) ||
+        if (!paired || !key || paired.identity !== key || !active() || failure() || ctx.signal?.aborted || (message.errorMessage && !overflow) ||
             message.provider !== ctx.model?.provider || message.model !== ctx.model.id || message.api !== ctx.model.api ||
             (!overflow && !["stop", "toolUse", "length"].includes(message.stopReason)) ||
             !isDeepStrictEqual(convertToLlm(paired.messages), paired.snapshot))
@@ -284,9 +314,9 @@ export async function installCompaction(pi, options = {}) {
         // Either way the operator hears it from pi-tuck. The estimate is what admitted the request, and a turn that ended in the provider's error
         // with no word from pi-tuck read as a hang: every other refusal says why, and this is the path that skipped it.
         if (overflow) {
-            const bound = (ctx.model.contextWindow + 1) / paired.tokens;
+            const window = contextWindow(ctx), bound = (window + 1) / paired.tokens;
             const learned = bound <= CALIBRATION_CEILING;
-            ctx.ui.notify(overflowNotice(ctx.model.contextWindow, bound, learned), "warning");
+            ctx.ui.notify(overflowNotice(window, bound, learned), "warning");
             if (learned)
                 learn(bound);
             return;
@@ -298,14 +328,52 @@ export async function installCompaction(pi, options = {}) {
         if (!counts.every(n => Number.isSafeInteger(n) && n >= 0))
             return;
         const input = counts.reduce((a, b) => a + b, 0), ratio = input / paired.tokens;
+        const output = usage.output, bound = usage.input + usage.cacheRead + output, requested = paired.requestedMaxTokens?.();
+        if (message.stopReason === "length" && requested !== undefined &&
+            Number.isSafeInteger(output) && output >= 0 && output < requested &&
+            Number.isSafeInteger(bound) && bound > 0 && bound <= ctx.model.contextWindow) {
+            learnedContextWindow = Math.min(learnedContextWindow ?? Infinity, bound);
+            serverClipped.add(message);
+            windowObservation = { message, identity: key, window: learnedContextWindow };
+        }
         // A request that was answered cannot have held more than the model's window, so a report above it describes something that never happened.
         // Learning from one sets the factor for the requests after it: a 60,000-token cache read reported in a 32,768-token window made a
         // 6,000-token prompt refuse. The overflow branch above learns from a refusal, where the count is a lower bound, and the ceiling is unchanged.
         if (input > 0 && input <= ctx.model.contextWindow && Number.isSafeInteger(input) && Number.isFinite(ratio))
             learn(ratio);
     });
-    pi.on("agent_start", () => { admittedRun = true; thinkingRetryPending = false; pending = undefined; phase = "idle"; });
-    pi.on("agent_settled", () => { admittedRun = false; runPrompt = undefined; thinkingRetryPending = false; pending = undefined; phase = "idle"; forgetFailure(); clips.clear(); promptCut = undefined; });
+    pi.on("turn_end", event => {
+        if (windowObservation?.message !== event.message)
+            return;
+        const observation = windowObservation;
+        windowObservation = undefined;
+        pi.appendEntry(WINDOW_RECEIPT, { calibrationIdentity: observation.identity, learnedContextWindow: observation.window,
+            serverClippedReplyId: event.messageEntryId });
+    });
+    // The operator's length-stop notice is decided at settle and is not attempt state: a run reset before then (a tree move inside another
+    // extension's agent_settled, a failure) must not erase it. Only the final assistant reply decides it; a successful retry clears it.
+    let lengthStop = false;
+    pi.on("agent_start", () => { run ??= createRun("admitted"); run.phase = "admitted"; run.thinkingRetryPending = false; lengthStop = false; pending = undefined; });
+    pi.on("message_end", event => { if (event.message.role === "assistant")
+        lengthStop = event.message.stopReason === "length"; });
+    pi.on("agent_settled", (_event, ctx) => {
+        try {
+            if (!lengthStop || !active())
+                return;
+            lengthStop = false;
+            const message = "pi-tuck: the last reply stopped at the model's output limit and may be cut off. Ask the agent to continue.";
+            try {
+                if (ctx.hasUI === false)
+                    process.stderr.write(message + "\n");
+                else
+                    ctx.ui.notify(message, "warning");
+            }
+            catch { /* ended */ }
+        }
+        finally {
+            resetRun();
+        }
+    });
     const active = () => options.active?.() ?? true;
     const settingsFor = () => options.settings ?? SettingsManager.inMemory(pi.getSettings());
     // The one reserve decision; every consumer takes its room from limits. Standalone starts at Pi's native cut point. Once a reply did
@@ -318,7 +386,7 @@ export async function installCompaction(pi, options = {}) {
         const budget = host ?? { response: settingsFor().getCompactionSettings(ctx.model).reserveTokens };
         if (!Number.isSafeInteger(budget.response) || budget.response < 0)
             throw new Error("Invalid host request reserve");
-        const floor = host ? host.responseExact !== true : ctx.sessionManager.getBranch().some(entry => entry.type === "message" && needsFullReplyReserve(entry.message));
+        const floor = host ? host.responseExact !== true : replyFit(ctx.sessionManager.getBranch()).failed;
         return { response: floor ? Math.max(budget.response, ctx.model?.maxTokens ?? 0) : budget.response };
     };
     const inputRoom = (response, ctx) => {
@@ -327,27 +395,27 @@ export async function installCompaction(pi, options = {}) {
         lastCeiling = ceiling ?? null;
         if (ceiling !== undefined && (!Number.isSafeInteger(ceiling) || ceiling <= 0))
             throw new Error("Invalid active-input token ceiling");
-        return Math.min((ctx.model?.contextWindow ?? 0) - response, ceiling ?? Infinity);
+        return Math.min(contextWindow(ctx) - response, ceiling ?? Infinity);
     };
     // Room still owns every existing cut/clip attempt. Only final capacity admission uses the hard line.
     const limits = (ctx) => {
         const { response } = requestReserve(ctx), room = inputRoom(response, ctx);
         const floor = options.requestReserve ? response : requestReplyFloor(ctx.sessionManager.getBranch(), response, ctx.model?.maxTokens);
-        const hardLine = Math.min(Math.max(room, (ctx.model?.contextWindow ?? 0) - piMargin - floor), lastCeiling ?? Infinity);
+        const hardLine = Math.min(Math.max(room, contextWindow(ctx) - piMargin - floor), lastCeiling ?? Infinity);
         return { response, room, hardLine, replyFloor: floor };
     };
-    const decisionBand = (ctx, room, system) => {
-        const last = ctx.sessionManager.getBranch().findLast(entry => entry.type === "compaction");
+    const decisionBand = (ctx, room, system, current = view(ctx)) => {
+        const last = current.session.getBranch().findLast(entry => entry.type === "compaction");
         const after = last?.type === "compaction" ? last.details?.tokensAfter : undefined;
         return bandOf(room, cutAt, options.cutAt === undefined && typeof after === "number" && Number.isFinite(after) && after >= 0
             ? { system, tokensAfter: after, factor } : undefined);
     };
     const fits = (tokens, limit, ctx) => corrected(tokens, ctx) < limit;
     // The saved conversation and a cut's quantities are counted by the one function the guard counts with (strict, as the context hook is).
-    const measureFor = (ctx) => (messages) => projectedConversationTokens(applyClips(messages, clips), ctx, options.recallPolicy);
+    const measureFor = (ctx) => (messages) => projectedConversationTokens(applyClips(messages, clips()), ctx, options.recallPolicy);
     // The planner counts with the same function, except that it does not fail on a summary in another format: a cut can replace one
     // (an operator's /compact repairs a session whose saved summary is foreign). Identical to the strict one for this compactor's summaries.
-    const plannerMeasureFor = (ctx) => Object.assign((messages) => measurableConversationTokens(applyClips(messages, clips), ctx, options.recallPolicy), { messageTokens: (message) => conversationTokens(applyClips([message], clips)) });
+    const plannerMeasureFor = (ctx) => Object.assign((messages) => measurableConversationTokens(applyClips(messages, clips()), ctx, options.recallPolicy), { messageTokens: (message) => conversationTokens(applyClips([message], clips())) });
     const hostMessages = (ctx) => options.hostMessages?.(ctx) ?? [];
     const toolShapes = (names) => {
         const selected = new Set(names);
@@ -366,7 +434,7 @@ export async function installCompaction(pi, options = {}) {
     // whereas our hard line is in corrected units; fitting that line alone need not leave the branch's reply floor.
     const requestClamp = (messages, ctx) => {
         const context = normalizeContext({ messages: convertToLlm(messages) });
-        const cap = piClamp?.(ctx.model, context, ctx.model.maxTokens);
+        const cap = piClamp?.({ ...ctx.model, contextWindow: contextWindow(ctx) }, context, ctx.model.maxTokens);
         return { cap, leavesFloor: cap === undefined || cap >= limits(ctx).replyFloor,
             estimate: piMath ? piMath.estimateContextTokens(context).tokens : 0 };
     };
@@ -375,19 +443,19 @@ export async function installCompaction(pi, options = {}) {
         const saved = messages.some(message => message.role === "system") ? messages :
             [{ role: "system", content: prompt, toolsAdded: shapes, timestamp: 0 }, ...messages];
         const declared = enabled ? historyToolDeclarations(saved, shapes, true) : saved;
-        return applyClips([...host, ...(enabled ? projectedMessages(declared, ctx, options.recallPolicy) : declared), ...incoming], clips);
+        return applyClips([...host, ...(enabled ? projectedMessages(declared, ctx, options.recallPolicy) : declared), ...incoming], clips());
     };
     const clampAboveRoom = (decision, ctx, room, target, total, project, replan, deepest) => {
         if (options.requestReserve || !piClamp)
             return decision;
         const lastAttempt = () => {
-            const previousClips = new Map(clips);
+            const previousClips = new Map(clips());
             const candidate = deepest();
             if (candidate.kind === "cut" && fits(total(candidate), limits(ctx).hardLine, ctx) && requestClamp(project(candidate), ctx).leavesFloor)
                 return candidate;
-            clips.clear();
+            clips().clear();
             for (const [id, clip] of previousClips)
-                clips.set(id, clip);
+                clips().set(id, clip);
             return { kind: "fault", capacity: true, message: clampMessage };
         };
         for (let retry = 0;; retry++) {
@@ -402,7 +470,7 @@ export async function installCompaction(pi, options = {}) {
                 return lastAttempt();
             // Shrink in the planner's units by Pi's measured shortfall, at most three times. Once we reach the original room,
             // use its existing band/room policy; admission below the room is deliberately unchanged.
-            target = Math.max(room, Math.floor(target * (ctx.model.contextWindow - piMargin - limits(ctx).replyFloor) / check.estimate));
+            target = Math.max(room, Math.floor(target * (contextWindow(ctx) - piMargin - limits(ctx).replyFloor) / check.estimate));
             decision = replan(target);
             if (decision.kind === "defer" || decision.kind === "fault")
                 return lastAttempt();
@@ -412,18 +480,6 @@ export async function installCompaction(pi, options = {}) {
     const isNoWork = (message) => ["Already compacted", "Nothing to compact (session too small)"].includes(message?.replace(/^Compaction failed: /, "") ?? "");
     // A missing model is configuration, not capacity.
     const missingModel = () => new Error("No context model for the request budget");
-    let promptCut;
-    // Where the branch ended when the prompt's cut was planned: the prompt is the entry Pi appends there. A cut that keeps nothing of the conversation
-    // before it names no entry to keep from, and read as it stands that drops the prompt too, so the model never sees it.
-    let promptCutAt = 0;
-    const keptFrom = (cut, ctx) => cut.firstKeptEntryId ||
-        ctx.sessionManager.getBranch().slice(promptCutAt).find(entry => entry.type !== "custom" || entry.customType !== "pi-tuck-capacity")?.id || "";
-    let failure;
-    let refusalReceipted = false;
-    let pendingBoundaryCommit = false;
-    // Fresh tool results the room cannot hold, by call id: each request of the run carries the clip in their place; the session keeps them
-    // whole. A clip ends with its run like any failure would: the next run plans from the session as it is, where the result is no longer fresh.
-    const clips = new Map();
     const receipt = (kind, reason, ctx) => {
         let room = null, hardLine = null;
         try {
@@ -436,51 +492,43 @@ export async function installCompaction(pi, options = {}) {
         recorder.stop("native-attempt-failed");
         // Every refusal says why, once per attempt: a capacity error with what the user can change, a cut Pi failed to commit with what that
         // means for the session, anything else as it is (an attempt that ended with no word looked like a hang).
-        const notify = !failure;
-        // A CommitFault stays whatever fails after it.
-        if (!(failure instanceof CommitFault))
-            failure = error instanceof Error ? error : new Error(String(error));
-        pendingBoundaryCommit = false;
-        pending = undefined;
-        promptCut = undefined;
+        const previous = failure(), notify = !previous;
+        const fault = previous instanceof CommitFault ? previous : error instanceof Error ? error : new Error(String(error));
+        const receipted = run?.refusalReceipted;
+        resetRun();
+        // Keep only a terminal attempt record until Pi settles: its fresh abort controller must still see the refusal.
+        run = createRun("failed");
+        run.failure = fault;
+        run.refusalReceipted = true;
+        if (fault instanceof CommitFault)
+            commitFault = fault;
         try {
-            if (!refusalReceipted) {
-                refusalReceipted = true;
-                receipt("refusal", failure.message, ctx);
-            }
+            if (!receipted)
+                receipt("refusal", fault.message, ctx);
             options.fail?.(error);
         }
         finally {
             try {
                 if (notify)
-                    ctx.ui.notify(failure instanceof CapacityError ? refusalNotice(failure.message, factor) : failure instanceof CommitFault
-                        ? `pi-tuck: ${failure.message}; the session holds a cut its file may lack, so start a new session.`
-                        : `pi-tuck could not plan this request (${failure.message}); the next prompt is planned afresh.`, "error");
+                    ctx.ui.notify(fault instanceof CapacityError ? refusalNotice(fault.message, factor) : fault instanceof CommitFault
+                        ? `pi-tuck: ${fault.message}; the session holds a cut its file may lack, so start a new session.`
+                        : `pi-tuck could not plan this request (${fault.message}); the next prompt is planned afresh.`, "error");
             }
             finally {
                 ctx.abort();
             }
         }
     };
-    // The one place a failure is dropped: when its attempt has settled, when a prompt arrives, and when the operator asks for a cut. A run that no
-    // input started (a custom message) has only the first of these. No failure but a CommitFault outlives its attempt.
-    const forgetFailure = () => { refusalReceipted = false; if (!(failure instanceof CommitFault))
-        failure = undefined; };
     const access = () => {
-        if (failure)
-            throw failure;
+        if (failure())
+            throw failure();
         hostAccess();
     };
-    // Abort alone is insufficient: Pi starts a fresh abort controller after
-    // before_agent_start. Keep this attempt blocked, then recheck on new idle input.
-    // "decided": `input` has decided for the run it starts, so that run's before_agent_start does not decide again. "starting": a run is
-    // between before_agent_start and agent_start, where Pi 1.1 still reports idle but a message joins that run.
-    let phase = "idle";
     pi.on("input", async (event, ctx) => {
-        if (!ctx.isIdle() || phase === "starting")
-            return; // a steering or follow-up message joins the running request
-        forgetFailure();
-        phase = "decided";
+        if (!ctx.isIdle() || run?.phase === "starting")
+            return; // steering joins the existing run
+        run = createRun("decided");
+        const decision = run;
         try {
             syncHistoryTools(ctx);
             await preflight(ctx, incomingTokens(event.text, event.images), [{ role: "user", content: [{ type: "text", text: event.text }, ...(event.images ?? [])], timestamp: 0 }], ctx.getSystemPrompt(), pi.getActiveTools());
@@ -489,6 +537,10 @@ export async function installCompaction(pi, options = {}) {
         catch (error) {
             fail(error, ctx);
         }
+        // Pi normally reaches its pre-run threshold check within microtasks. Auth I/O or a later extension's input I/O can make a
+        // real prompt expire too; safely fall back to carrying its cut in the request and saving it at the first boundary.
+        setImmediate(() => { if (run === decision && !decision.claimed)
+            decision.expired = true; });
     });
     pi.registerTool({
         name: "tuck_recall", label: "pi-tuck history", parameters: RecallInput,
@@ -566,28 +618,30 @@ export async function installCompaction(pi, options = {}) {
             }
             // Pi checks its own threshold after a prompt's input and before the run starts: the prompt's cut, planned with the prompt counted,
             // is the answer, and it is saved before the first request.
-            if (promptCut && !admittedRun && event.reason === "threshold") {
-                access();
-                const { type: _, ...compaction } = promptCut;
-                promptCut = undefined;
-                return { compaction };
+            if (run?.phase === "decided" && !run.expired && event.reason === "threshold") {
+                run.claimed = true;
+                if (view(ctx).pending) {
+                    access();
+                    const current = view(ctx), { type: _, ...compaction } = run.cut.take();
+                    return { compaction: { ...compaction, firstKeptEntryId: current.keptFromId } };
+                }
             }
             const operatorManual = event.reason === "manual";
-            if (operatorManual && !admittedRun)
-                forgetFailure();
+            if (operatorManual && run?.phase !== "admitted")
+                resetRun();
             access();
             // pi-tuck's summary is built from the session itself, so text after /compact cannot steer it. The operator asked for a cut: make the one
             // plain /compact makes and say the text was not used, rather than cancel (which Pi shows as an error, with no cut).
             if (event.customInstructions?.trim())
                 ctx.ui.notify("pi-tuck: /compact ignores the text after it, since pi-tuck builds its summary from the session itself. Cutting as plain /compact does.", "info");
             const { response, room } = limits(ctx);
-            const retain = operatorManual || admittedRun;
+            const retain = operatorManual || run?.phase === "admitted";
             // A cut Pi asks for (an operator's /compact, Pi's threshold or overflow recovery) charges what the request must carry whatever is
             // cut: the system part and the host input. A prompt's cut is pi-tuck's own and never comes here.
             const saved = ctx.sessionManager.buildSessionProjection().messages;
             const hostInput = hostMessages(ctx), host = conversationTokens(hostInput);
             const system = requestSystemPart(ctx.getSystemPrompt(), pi.getActiveTools(), saved, ctx.getSystemPrompt());
-            const mandatory = system + host, band = decisionBand(ctx, room, system);
+            const mandatory = system + host, band = decisionBand(ctx, room, system, view(ctx, event.reason === "threshold"));
             const before = plannerMeasureFor(ctx)(saved);
             observeBudget(before + mandatory, ctx);
             // Pi's own usage threshold (reason "threshold") counts the last reply's output tokens, reasoning included, plus the messages after
@@ -610,9 +664,9 @@ export async function installCompaction(pi, options = {}) {
                     const reserve = planReserve(target, targetRoom, targetBand, mandatory, ctx);
                     // Every cut asked while no run is admitted (an operator's cut) is planned for a run that has not begun: the session has moved on
                     // from any run that ended. A retry is inside its run.
-                    const draft = tuckDraft(tuck, event, ctx, reserve, plannerMeasureFor(ctx), options.recallPolicy, retain, operatorManual, operatorManual || !admittedRun, admittedRun ? protectedPrompt(ctx) : undefined);
+                    const draft = tuckDraft(tuck, event, ctx, reserve, plannerMeasureFor(ctx), options.recallPolicy, retain, operatorManual, operatorManual || run?.phase !== "admitted", run?.phase === "admitted" ? protectedPrompt(ctx) : undefined);
                     return draft.compaction ? { draft: true, after: draft.after, mode: draft.mode, compaction: draft.compaction, reserve,
-                        messages: previewCut(ctx, { type: "compaction", ...draft.compaction, tokensBefore: before }).buildSessionProjection().messages }
+                        messages: plannedView(ctx, { type: "compaction", ...draft.compaction, tokensBefore: before }).session.buildSessionProjection().messages }
                         : { draft: false, capacityRejected: Boolean(draft.capacityRejected), reason: draft.unavailable };
                 },
             });
@@ -621,7 +675,7 @@ export async function installCompaction(pi, options = {}) {
             const { hardLine } = limits(ctx);
             if (!operatorManual && hardLine > room && decision.kind === "fault") {
                 decision = fits(before + mandatory, hardLine, ctx) ? { kind: "none" } : decide(hardLine, hardLine);
-                decision = clampAboveRoom(decision, ctx, room, hardLine, candidate => (candidate.kind === "cut" ? candidate.plan.after : before) + mandatory, candidate => projectedRequest(candidate.kind === "cut" ? candidate.plan.messages : saved, ctx, hostInput, [], ctx.getSystemPrompt(), pi.getActiveTools(), candidate.kind === "cut"), target => target <= room ? decide() : decide(target, target), () => deepestDecision(ctx, operatorManual || !admittedRun, retain));
+                decision = clampAboveRoom(decision, ctx, room, hardLine, candidate => (candidate.kind === "cut" ? candidate.plan.after : before) + mandatory, candidate => projectedRequest(candidate.kind === "cut" ? candidate.plan.messages : saved, ctx, hostInput, [], ctx.getSystemPrompt(), pi.getActiveTools(), candidate.kind === "cut"), target => target <= room ? decide() : decide(target, target), () => deepestDecision(ctx, operatorManual || run?.phase !== "admitted", retain));
             }
             if (decision.kind === "cut") {
                 return { compaction: captureDraft(decision.plan.compaction, ctx, decision.plan.reserve, event.reason, event.preparation.tokensBefore, retain, operatorManual, event.preparation.previousSummary, { response, host, mandatory, target: decision.target, margin: room - band }) };
@@ -647,49 +701,23 @@ export async function installCompaction(pi, options = {}) {
         }
     });
     pi.on("session_before_tree", (event) => event.preparation.userWantsSummary ? { cancel: true } : undefined);
-    pi.on("session_start", () => { clips.clear(); promptCut = undefined; recorder.stop("session-transition"); proposalId = undefined; failure = undefined; refusalReceipted = false; admittedRun = false; runPrompt = undefined; estimatedTokens = 0; pendingBoundaryCommit = false; identity = ""; factor = 1; pending = undefined; phase = "idle"; });
-    const historyToolsEnabled = (ctx) => Boolean(promptCut) || hasTuckCut(ctx.sessionManager.getBranch());
+    pi.on("session_start", () => { resetRun(); recorder.stop("session-transition"); proposalId = undefined; commitFault = undefined; estimatedTokens = 0; identity = ""; factor = 1; learnedContextWindow = undefined; windowObservation = undefined; });
+    const historyToolsEnabled = (ctx) => view(ctx).hasTuckCut;
     const syncHistoryTools = (ctx) => { if (active())
         applyHistoryTools(pi, historyToolsEnabled(ctx)); };
     pi.on("session_start", (_event, ctx) => syncHistoryTools(ctx));
     // A plan decided on `input` is for the branch it was decided on: moving in the tree leaves it planned for another branch, whose kept entry
     // may not be on this one.
-    pi.on("session_tree", (_event, ctx) => { promptCut = undefined; phase = "idle"; syncHistoryTools(ctx); });
-    pi.on("session_compact", (_event, ctx) => { if (!admittedRun)
+    pi.on("session_tree", (_event, ctx) => { resetRun(); windowObservation = undefined; learnedContextWindow = seedContextWindow(ctx.sessionManager.getBranch(), identityFor(ctx)); syncHistoryTools(ctx); });
+    pi.on("session_compact", (_event, ctx) => { if (run?.phase !== "admitted")
         syncHistoryTools(ctx); });
     pi.on("turn_start", (_event, ctx) => syncHistoryTools(ctx));
     pi.on("agent_settled", (_event, ctx) => syncHistoryTools(ctx));
-    // A reply that stopped at the output limit may be cut off, and Pi says nothing. Tell the operator once per run, on the operator's side only:
-    // the notice never enters the model's context. Decided at the end of the run, so a later reply in the same run (a retry or a continuation)
-    // that ends normally clears it.
-    let lengthStop = false;
-    pi.on("agent_start", () => { lengthStop = false; });
-    pi.on("message_end", event => { if (event.message.role === "assistant")
-        lengthStop = event.message.stopReason === "length"; });
-    pi.on("agent_settled", (_event, ctx) => {
-        if (!lengthStop || !active())
-            return;
-        lengthStop = false;
-        const message = "pi-tuck: the last reply stopped at the model's output limit and may be cut off. Ask the agent to continue.";
-        try {
-            if (ctx.hasUI === false)
-                process.stderr.write(message + "\n");
-            else
-                ctx.ui.notify(message, "warning");
-        }
-        catch { /* ended */ } // with no UI (pi -p), stderr is the operator's
-    });
-    // The session as it will be once a cut that is not saved yet is saved, and its conversation as the next request carries it.
-    const previewCut = (ctx, cut) => {
-        const header = ctx.sessionManager.getHeader();
-        if (!header)
-            throw new Error("Missing native session header for the prompt's cut");
-        const preview = SessionManager.inMemory(ctx.cwd, undefined, [header, ...ctx.sessionManager.getBranch()]);
-        preview.appendCompaction(cut.summary, cut.firstKeptEntryId, 0, cut.details, true);
-        return preview;
+    const plannedView = (ctx, cut) => {
+        const pending = new PendingCut();
+        pending.plan(cut, ctx.sessionManager.getBranch().length);
+        return pending.view(ctx);
     };
-    const cutSession = (ctx, cut) => previewCut(ctx, { ...cut, firstKeptEntryId: keptFrom(cut, ctx) });
-    const withCut = (ctx, cut) => cutSession(ctx, cut).buildSessionProjection().messages;
     // The shared final planner: preserve the compiler's prompt/protocol floor and spend nothing on optional history. Fresh text results
     // get the smallest existing head/tail + recall-locator representation; their originals remain in the session, as for ordinary clips.
     const deepestDecision = (ctx, newPrompt, retain) => {
@@ -712,7 +740,7 @@ export async function installCompaction(pi, options = {}) {
                         low = middle + 1;
                 }
                 for (const clip of clipFor([result], entryIdOf, low))
-                    clips.set(clip.toolCallId, clip);
+                    clips().set(clip.toolCallId, clip);
             }
         }
         const before = measureFor(ctx)(saved);
@@ -721,7 +749,7 @@ export async function installCompaction(pi, options = {}) {
             protectedPromptEntryId: newPrompt ? undefined : protectedPrompt(ctx), deepest: true }, ctx, 0, plannerMeasureFor(ctx), options.recallPolicy, retain);
         if (!draft.compaction)
             return { kind: "fault", capacity: Boolean(draft.capacityRejected), message: draft.unavailable };
-        const messages = previewCut(ctx, { type: "compaction", ...draft.compaction }).buildSessionProjection().messages;
+        const messages = plannedView(ctx, { type: "compaction", ...draft.compaction }).session.buildSessionProjection().messages;
         assertNativeToolRounds(messages);
         return { kind: "cut", target: "room", plan: { draft: true, after: measureFor(ctx)(messages), mode: draft.mode,
                 compaction: draft.compaction, reserve: 0, messages } };
@@ -731,8 +759,8 @@ export async function installCompaction(pi, options = {}) {
     // keepRecentTokens, and where those are the whole conversation it has nothing to cut, so every later prompt was refused for good (t06 at
     // Pi's defaults on a 32k window). Each request of the run carries the cut, and the run's first boundary saves it.
     const preflight = (ctx, incomingPart, incomingMessages, observedPrompt, tools, hostSnapshot) => {
-        promptCut = undefined;
-        promptCutAt = ctx.sessionManager.getBranch().length;
+        run.cut.clear();
+        const branchLength = ctx.sessionManager.getBranch().length;
         if (!active())
             return;
         access();
@@ -767,7 +795,9 @@ export async function installCompaction(pi, options = {}) {
                 const draft = tuckObservedDraft(tuck, { branchEntries: ctx.sessionManager.getBranch(), tokensBefore: before, previousSummary, newPrompt: true, reRenderSummary: !opportunistic }, ctx, reserve, plannerMeasureFor(ctx), options.recallPolicy, false);
                 if (!draft.compaction)
                     return { draft: false, capacityRejected: Boolean(draft.capacityRejected), reason: draft.unavailable };
-                const messages = withCut(ctx, { type: "compaction", ...draft.compaction, tokensBefore: before });
+                const candidate = new PendingCut();
+                candidate.plan({ type: "compaction", ...draft.compaction, tokensBefore: before }, branchLength);
+                const messages = candidate.view(ctx).session.buildSessionProjection().messages;
                 assertNativeToolRounds(messages);
                 return { draft: true, after: measure(messages), mode: draft.mode, compaction: draft.compaction, reserve, messages };
             },
@@ -787,16 +817,19 @@ export async function installCompaction(pi, options = {}) {
         if (decision.kind === "fault")
             throw new (decision.capacity ? CapacityError : Refusal)(decision.message);
         const compaction = captureDraft(decision.plan.compaction, ctx, decision.plan.reserve, "prompt", before, false, false, previousSummary, { response, host, mandatory, target: decision.target, margin: room - band });
-        promptCut = { type: "compaction", summary: compaction.summary, firstKeptEntryId: compaction.firstKeptEntryId, tokensBefore: before, details: compaction.details };
+        run.cut.plan({ type: "compaction", summary: compaction.summary, firstKeptEntryId: compaction.firstKeptEntryId, tokensBefore: before, details: compaction.details }, branchLength);
     };
     pi.on("before_agent_start", async (event, ctx) => {
         // A decided plan is for the prompt `input` saw. A run that a custom message starts is not that run (another extension handled the
         // input, so no run started for it): plan afresh.
-        const prompted = phase === "decided" && event.messageType !== "custom";
-        phase = "starting";
-        runPromptMessageType = event.messageType;
-        // Image-only and empty custom messages have no starting text to quote.
-        runPrompt = event.messageType === "custom" ? textOf(event.message.content) || undefined : event.prompt;
+        const prompted = run?.phase === "decided" && event.messageType !== "custom";
+        if (!prompted && run?.phase !== "failed")
+            run = createRun("starting");
+        run ??= createRun("starting");
+        run.claimed = true;
+        run.phase = "starting";
+        const prompt = event.messageType === "custom" ? textOf(event.message.content) : event.prompt;
+        run.prompt = prompt ? new StartingPrompt(prompt, ctx.sessionManager.getBranch().length, event.messageType) : undefined;
         try {
             syncHistoryTools(ctx);
             if (prompted)
@@ -821,7 +854,7 @@ export async function installCompaction(pi, options = {}) {
     // handlers have run. Pi's prepareRequest has not yet snapshotted executable tools. A first cut discovered in context_with_system
     // would be too late for that snapshot, even if its declarations were repaired there, so make the late prompt decision here.
     pi.on("message_end", (event, ctx) => {
-        if (event.message.role !== "user" || !active() || !admittedRun || promptCut)
+        if (event.message.role !== "user" || !active() || run?.phase !== "admitted" || view(ctx).pending)
             return;
         try {
             access();
@@ -876,7 +909,7 @@ export async function installCompaction(pi, options = {}) {
             if (forecast !== saved) {
                 const head = getCurrentSystemMessage(convertToLlm(forecast));
                 const native = (head ? estimateTokens(head) : 0) + saved.reduce((sum, message) => sum + (message.role === "system" ? 0 : estimateTokens(message)), 0);
-                if (shouldCompact(native, ctx.model.contextWindow, settingsFor().getCompactionSettings(ctx.model)))
+                if (shouldCompact(native, contextWindow(ctx), settingsFor().getCompactionSettings(ctx.model)))
                     densityTokens = native;
             }
         }
@@ -914,12 +947,7 @@ export async function installCompaction(pi, options = {}) {
                         }
                         return { draft: false, capacityRejected: Boolean(draft.capacityRejected), reason: draft.unavailable };
                     }
-                    const header = ctx.sessionManager.getHeader();
-                    if (!header)
-                        throw new Error("Missing native session header at tool-loop boundary");
-                    const preview = SessionManager.inMemory(ctx.cwd, undefined, [header, ...ctx.sessionManager.getBranch()]);
-                    preview.appendCompaction(draft.compaction.summary, draft.compaction.firstKeptEntryId, before, draft.compaction.details, true);
-                    const messages = preview.buildSessionProjection().messages;
+                    const messages = plannedView(ctx, { type: "compaction", ...draft.compaction, tokensBefore: before }).session.buildSessionProjection().messages;
                     assertNativeToolRounds(messages);
                     previews.push(messages);
                     return { draft: true, after: measure(messages), mode: draft.mode, compaction: draft.compaction, reserve, messages };
@@ -944,11 +972,11 @@ export async function installCompaction(pi, options = {}) {
                 if (!round.length)
                     continue;
                 for (const clip of round)
-                    clips.set(clip.toolCallId, clip);
+                    run.clips.set(clip.toolCallId, clip);
                 const clippedDecision = decide(clipRoom, targetBand, required);
                 if (clippedDecision.kind === "fault")
                     for (const clip of round)
-                        clips.delete(clip.toolCallId);
+                        run.clips.delete(clip.toolCallId);
                 else {
                     decision = clippedDecision;
                     break;
@@ -985,56 +1013,57 @@ export async function installCompaction(pi, options = {}) {
         return { entries: [{ type: "compaction", summary: compaction.summary,
                     firstKeptEntryId: compaction.firstKeptEntryId, details: compaction.details }] };
     };
+    const markBoundary = (entries) => {
+        if (!run)
+            return;
+        run.pendingBoundaryReceipts = entries.flatMap(entry => entry.type === "compaction" ? receiptId(entry) ?? [] : []);
+        run.pendingBoundaryCommit = run.pendingBoundaryReceipts.length > 0;
+    };
+    const boundarySaved = (ctx) => {
+        const wanted = run?.pendingBoundaryReceipts ?? [];
+        const file = ctx.sessionManager.getSessionFile();
+        // appendCompaction mutates memory before writing. On an error boundary, only the persisted entries prove a file-backed cut saved.
+        const entries = file ? readFileSync(file, "utf8").split("\n").filter(Boolean).map(line => JSON.parse(line)) : ctx.sessionManager.getBranch();
+        const saved = new Set(entries.flatMap(entry => entry.type === "compaction" ? receiptId(entry) ?? [] : []));
+        return wanted.every(id => saved.has(id));
+    };
     const atBoundary = (event, ctx, reason, decide) => {
-        if (!promptCut)
+        const current = view(ctx);
+        if (!current.pending)
             return decide ? boundaryCut(event, ctx, reason) : undefined;
-        const entry = promptCut;
-        promptCut = undefined;
-        const preview = cutSession(ctx, entry), view = Object.create(ctx, { sessionManager: { value: preview } });
+        const entry = run.cut.take();
+        const preview = current.session, context = Object.create(ctx, { sessionManager: { value: preview } });
         const more = decide && !event.entries.length
-            ? boundaryCut({ ...event, context: { ...event.context, contextMessages: preview.buildSessionProjection().messages } }, view, reason) : undefined;
+            ? boundaryCut({ ...event, context: { ...event.context, contextMessages: preview.buildSessionProjection().messages } }, context, reason) : undefined;
         const { tokensBefore: _, ...cut } = entry;
-        const saved = { ...cut, firstKeptEntryId: keptFrom(entry, ctx) };
+        const saved = { ...cut, firstKeptEntryId: current.keptFromId };
         // As for a cut Pi makes (session_compact): the history the cut leaves behind is indexed, once Pi has committed the entries.
         setImmediate(() => { semantic.indexAtCut(semanticProvider(ctx)); });
         return { entries: [...event.entries, saved, ...(more?.entries ?? [])] };
     };
-    const retryThinking = (event, ctx) => {
+    const retryLength = (event, ctx) => {
         // Pi's supported boundary drafts commit before finishTurn honors `continue`. Omitting the selected failed response also prevents
         // Pi's later native length recovery from retrying it independently. The stored message and its output usage stay on the branch.
         const entries = [...(atBoundary(event, ctx, "run-end", false)?.entries ?? event.entries),
             { type: "context_edit", targetId: event.messageEntryId, replacement: null }];
-        if (thinkingRetryPending)
+        if (run.thinkingRetryPending)
             return { entries, continue: false };
-        const header = ctx.sessionManager.getHeader();
-        if (!header)
-            throw new Error("Missing native session header for the thinking-only retry");
-        const preview = SessionManager.inMemory(ctx.cwd, undefined, [header, ...ctx.sessionManager.getBranch()]);
-        for (const entry of entries) {
-            if (entry.type === "context_edit")
-                preview.appendContextEdit(entry.targetId, entry.replacement);
-            else if (entry.type === "compaction")
-                preview.appendCompaction(entry.summary, entry.firstKeptEntryId, 0, entry.details, true, entry.usage);
-            else if (entry.type === "custom")
-                preview.appendCustomEntry(entry.customType, entry.data);
-            else
-                preview.appendCustomMessageEntry(entry.customType, entry.content, entry.display, entry.details);
-        }
+        const preview = liveCut.view(ctx, entries).session;
         const view = Object.create(ctx, { sessionManager: { value: preview } });
         const hostInput = hostMessages(ctx), host = conversationTokens(hostInput);
         // The deepest cut only when it buys reply room: where Pi's cap on the request as it stands (the stopped reply left out) is already
         // as large as the deepest cut's, the turn is retried uncut, and no history is given up for nothing.
         const asIs = projectedRequest(preview.buildSessionProjection().messages, view, hostInput, event.context.pendingMessages, ctx.getSystemPrompt(), pi.getActiveTools(), false);
         const asIsCheck = requestClamp(asIs, view);
-        const previousClips = new Map(clips);
+        const previousClips = new Map(clips());
         const decision = deepestDecision(view, false, true);
-        if (decision.kind === "cut" && asIsCheck.cap !== undefined && asIsCheck.leavesFloor &&
+        if (!serverClipped.has(event.message) && decision.kind === "cut" && asIsCheck.cap !== undefined && asIsCheck.leavesFloor &&
             requestClamp(projectedRequest(decision.plan.messages, view, hostInput, event.context.pendingMessages, ctx.getSystemPrompt(), pi.getActiveTools(), true), view).cap <= asIsCheck.cap) {
-            clips.clear();
+            clips().clear();
             for (const [id, clip] of previousClips)
-                clips.set(id, clip);
+                clips().set(id, clip);
             const { room, hardLine } = limits(view);
-            thinkingRetryPending = true;
+            run.thinkingRetryPending = true;
             return { entries: [...entries, { type: "custom", customType: "pi-tuck-capacity", data: { kind: "retry", stoppedReplyEntryId: event.messageEntryId,
                             stoppedOutputTokens: event.message.role === "assistant" ? event.message.usage?.output ?? 0 : 0, cut: false,
                             piEstimateTokens: asIsCheck.estimate, piCap: asIsCheck.cap, room, hardLine, buildId: BUILD_ID } }], continue: true };
@@ -1042,35 +1071,39 @@ export async function installCompaction(pi, options = {}) {
         if (decision.kind !== "cut")
             throw new CapacityError(clampMessage);
         const messages = projectedRequest(decision.plan.messages, view, hostInput, event.context.pendingMessages, ctx.getSystemPrompt(), pi.getActiveTools(), true);
-        if (runPrompt !== undefined && !carriesPrompt(messages, runPrompt, runPromptMessageType))
+        if (run?.prompt && !carriesPrompt(messages, run.prompt.text(ctx.sessionManager.getBranch()), run.prompt.role))
             throw promptRefusal();
         const system = requestSystemPart(ctx.getSystemPrompt(), pi.getActiveTools(), messages, ctx.getSystemPrompt());
         const tokens = system + conversationTokens(messages), check = requestClamp(messages, view);
         const { response, room, hardLine } = limits(view);
-        if (!fits(tokens, hardLine, view) || check.cap === undefined || !check.leavesFloor)
+        // A learned server boundary uses the same admission rule as the guard: below the room the whole reserve fits in provider units.
+        // Keep the thinking-only rule's unconditional native-clamp floor unchanged.
+        const needsClampFloor = !serverClipped.has(event.message) || corrected(tokens, view) > room;
+        if (!fits(tokens, hardLine, view) || check.cap === undefined || needsClampFloor && !check.leavesFloor)
             throw new CapacityError(clampMessage);
         const compaction = captureDraft(decision.plan.compaction, view, decision.plan.reserve, "length-retry", tokens, true, false, undefined, { response, host, mandatory: system + host + conversationTokens(event.context.pendingMessages), target: decision.target, margin: room - decisionBand(view, room, system) });
-        thinkingRetryPending = true;
-        pendingBoundaryCommit = true;
-        return { entries: [...entries, { type: "compaction", summary: compaction.summary, firstKeptEntryId: compaction.firstKeptEntryId || null, details: compaction.details },
-                { type: "custom", customType: "pi-tuck-capacity", data: { kind: "retry", stoppedReplyEntryId: event.messageEntryId,
-                        stoppedOutputTokens: event.message.role === "assistant" ? event.message.usage?.output ?? 0 : 0, cut: true,
-                        estimatedTokens: corrected(tokens, view), piEstimateTokens: check.estimate, piCap: check.cap, room, hardLine, buildId: BUILD_ID } }], continue: true };
+        run.thinkingRetryPending = true;
+        const drafts = [...entries, { type: "compaction", summary: compaction.summary, firstKeptEntryId: compaction.firstKeptEntryId || null, details: compaction.details },
+            { type: "custom", customType: "pi-tuck-capacity", data: { kind: "retry", stoppedReplyEntryId: event.messageEntryId,
+                    stoppedOutputTokens: event.message.role === "assistant" ? event.message.usage?.output ?? 0 : 0, cut: true,
+                    estimatedTokens: corrected(tokens, view), piEstimateTokens: check.estimate, piCap: check.cap, room, hardLine, buildId: BUILD_ID } }];
+        markBoundary(drafts);
+        return { entries: drafts, continue: true };
     };
     pi.on("turn_end", (event, ctx) => {
         try {
-            if (!active() || !admittedRun)
+            if (!active() || run?.phase !== "admitted")
                 return;
-            if (thinkingOnlyLength(event.message) && !failure && !ctx.signal?.aborted && settingsFor().getCompactionSettings(ctx.model).enabled)
-                return retryThinking(event, ctx);
-            thinkingRetryPending = false;
+            if ((thinkingOnlyLength(event.message) || serverClipped.has(event.message)) && !failure() && !ctx.signal?.aborted && settingsFor().getCompactionSettings(ctx.model).enabled)
+                return retryLength(event, ctx);
+            run.thinkingRetryPending = false;
             const decide = event.outcome === "completed" && !ctx.signal?.aborted && event.context.canContinue && event.toolResults.length > 0 &&
                 settingsFor().getCompactionSettings(ctx.model).enabled;
-            if (!promptCut && !decide)
+            if (!view(ctx).pending && !decide)
                 return;
             const result = atBoundary(event, ctx, "tool-loop", decide);
             if (result) {
-                pendingBoundaryCommit = true;
+                markBoundary(result.entries);
             }
             return result;
         }
@@ -1091,23 +1124,24 @@ export async function installCompaction(pi, options = {}) {
     // A request of a run whose prompt's cut is not saved yet: the saved conversation in it, which other handlers may surround, is replaced by
     // the conversation with the cut applied. Pi sends the saved system message apart from the request's messages, so neither side carries it
     // here. A request that does not carry the saved conversation as it stands cannot take the cut.
-    const cutRequest = (messages, ctx, cut) => {
+    const cutRequest = (messages, ctx) => {
         const conversation = (all) => all.filter(message => message.role !== "system");
         const saved = conversation(ctx.sessionManager.buildSessionProjection().messages);
         for (let at = 0; at + saved.length <= messages.length; at++)
             if (saved.every((message, i) => isDeepStrictEqual(messages[at + i], message)))
-                return [...messages.slice(0, at), ...conversation(withCut(ctx, cut)), ...messages.slice(at + saved.length)];
+                return [...messages.slice(0, at), ...conversation(view(ctx).session.buildSessionProjection().messages), ...messages.slice(at + saved.length)];
         throw new Error("The prompt's cut cannot be applied: the request does not carry the saved conversation");
     };
     pi.on("context", (event, ctx) => {
         try {
             if (!active())
                 return;
+            run?.prompt?.id(ctx.sessionManager.getBranch());
             // Before a cut, Pi owns the whole request, including its object identities and system-message serialization.
             if (!historyToolsEnabled(ctx))
-                return clips.size ? { messages: applyClips(event.messages, clips) } : undefined;
+                return clips().size ? { messages: applyClips(event.messages, clips()) } : undefined;
             access();
-            return { messages: applyClips(projectedMessages(promptCut ? cutRequest(event.messages, ctx, promptCut) : event.messages, ctx, options.recallPolicy), clips) };
+            return { messages: applyClips(projectedMessages(view(ctx).pending ? cutRequest(event.messages, ctx) : event.messages, ctx, options.recallPolicy), clips()) };
         }
         catch (error) {
             try {
@@ -1138,17 +1172,27 @@ export async function installCompaction(pi, options = {}) {
             fail(new (event.fromExtension ? CommitFault : Error)(event.errorMessage ?? "Compaction failed"), ctx);
     });
     pi.on("agent_before_settle", (event, ctx) => {
-        if (pendingBoundaryCommit) {
-            if (event.outcome === "error")
-                return void fail(new CommitFault("Native tool-loop boundary draft remained unconfirmed at error settlement"), ctx);
-            pendingBoundaryCommit = false;
+        if (run?.pendingBoundaryCommit) {
+            if (event.outcome === "error") {
+                try {
+                    if (!boundarySaved(ctx))
+                        throw new Error("Boundary receipt absent from the session file");
+                }
+                catch {
+                    return void fail(new CommitFault("Native tool-loop boundary cut was not saved in the session file"), ctx);
+                }
+            }
+            if (run) {
+                run.pendingBoundaryCommit = false;
+                run.pendingBoundaryReceipts = [];
+            }
         }
         // Pi commits these entries before the run settles.
         try {
-            if (!active() || !admittedRun || failure || !settingsFor().getCompactionSettings(ctx.model).enabled)
+            if (!active() || run?.phase !== "admitted" || failure() || !settingsFor().getCompactionSettings(ctx.model).enabled)
                 return;
             const decide = event.outcome === "completed" && !ctx.signal?.aborted;
-            if (promptCut ? event.outcome === "error" : !decide)
+            if (view(ctx).pending ? event.outcome === "error" : !decide)
                 return;
             return atBoundary(event, ctx, "run-end", decide);
         }
@@ -1158,7 +1202,10 @@ export async function installCompaction(pi, options = {}) {
     });
     pi.on("context_with_system", (event, ctx) => {
         // Reaching the next request boundary proves native commit returned, not durable storage.
-        pendingBoundaryCommit = false;
+        if (run) {
+            run.pendingBoundaryCommit = false;
+            run.pendingBoundaryReceipts = [];
+        }
         pending = undefined;
         try {
             if (!active())
@@ -1177,7 +1224,7 @@ export async function installCompaction(pi, options = {}) {
             observeBudget(tokens, ctx);
             estimatedTokens = corrected(tokens, ctx);
             const { room, hardLine } = limits(ctx);
-            if (runPrompt !== undefined && !carriesPrompt(messages, runPrompt, runPromptMessageType))
+            if (run?.prompt && !carriesPrompt(messages, run.prompt.text(ctx.sessionManager.getBranch()), run.prompt.role))
                 throw new Refusal("Prompt check failed: the request is missing the whole text of the prompt that started this run. Shorten the prompt or choose a model with a larger context window, then retry");
             if (!fits(tokens, hardLine, ctx))
                 throw new CapacityError("Complete Pi context and response reserve exceed the estimated request budget");