pi-tuck 1.0.6 → 1.0.8

package/CHANGELOG.md

@@ -3,6 +3,27 @@
 All notable changes to pi-tuck. The format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and versions follow
 [Semantic Versioning](https://semver.org/).
 
+## [1.0.8] - 2026-11-01
+
+### Fixed
+
+- A fresh tool result too large for the room no longer refuses the run. The request carries the result's head and tail instead, with a
+  `tuck_recall` locator to the rest; a round of parallel results shares one clip budget. The clip ends with its run.
+- A prompt right after a cut is no longer refused when Pi has nothing to compact for it. When a run ends at or above the cut band, pi-tuck
+  cuts there itself, so the next prompt starts below the band. A run-end cut that cannot be planned is no fault.
+- Gates: on 29 replayed recordings, no task lost and no request refused, where 1.0.6 refused 8; live at a 32k window (60 tasks), no dead task
+  and no mid-run refusal, and 46 resolved, as 1.0.7 ([`benchmark/RESULTS-V108.md`](benchmark/RESULTS-V108.md)).
+
+## [1.0.7] - 2026-11-01
+
+### Changed
+
+- Semantic recall runs on Metal only, so only on Apple silicon. The CPU fallback is gone. Where the embedding server cannot start on Metal (a
+  VM, a Mac without a GPU), semantic recall goes off with "Semantic recall needs Metal; word recall still works", and word recall keeps
+  answering.
+- Off Apple silicon (Linux, Intel Macs), pi-tuck compacts and offers word recall only: `tuck_search` is no longer registered, `tuck_recall`'s
+  description no longer points to it, and nothing is downloaded. On Apple silicon both tools are as before.
+
 ## [1.0.6] - 2026-11-01
 
 ### Changed

package/README.md

@@ -1,6 +1,6 @@
 # pi-tuck
 
-**Compaction for [Pi](https://pi.dev) with no model call, and a history the agent can search by keyword or by meaning, all on your machine.** In our live run, a cut took a median 0.09 s. It costs no tokens. The same session always gives the same summary. And nothing is lost: the agent can read back anything earlier, word for word, and on Apple silicon it can find it by meaning.
+**Compaction for [Pi](https://pi.dev) with no model call, and a history the agent can search by keyword, and on Apple silicon by meaning, all on your machine.** In our live run, a cut took a median 0.09 s. It costs no tokens. The same session always gives the same summary. And nothing is lost: the agent can read back anything earlier, word for word, and on Apple silicon it can find it by meaning.
 
 ```sh
 pi install npm:pi-tuck
@@ -17,14 +17,13 @@ Pi's built-in compaction asks a model to write a summary. pi-tuck builds the sum
 | Context carried after a cut | 29,200 tokens | 27,800 tokens (about the same) |
 | Same session, same summary | Not guaranteed, since a model writes it | Yes |
 | Can the agent get dropped detail back | No recall tool in Pi 1.4.0. The full history stays in the session file, but the agent has no tool made to search it | Yes. `tuck_recall` reads any original exactly |
-| Search history by meaning | No | Yes, with `tuck_search`, on macOS with Apple silicon. It runs locally, and no text leaves your machine. Elsewhere it searches by keyword |
+| Search history by meaning | No | Yes, with `tuck_search`, on macOS with Apple silicon. It runs locally on your Mac's GPU, and no text leaves your machine. Elsewhere there is no `tuck_search`, and `tuck_recall` searches by keyword |
 | Can the summary invent history | It can, since a model writes it | No, it holds only recorded text |
 | What the summary leaves out | Whatever the model dropped | Tool output only; the agent reads it back exactly |
 | Billed input at the default 60% cut point (simulated) | Not measured | 10–18% less than pi-tuck cutting at the full room. This is not a comparison with the built-in |
-| Answer quality against Pi's own compaction on a local model (`mac-studio/main`) | | **Being measured. Not claimed yet.** |
-| Answer quality against Pi's compaction prompts on a frontier model | | **Untested.** |
+| Tasks resolved at a 32k window (150 SWE-bench Verified tasks, one model, pi-tuck 1.0.5) | 94 of 150 | 120 of 150 (+17.3 points, 95% lower bound +10.7). Limits below the table |
 
-The time and context rows are live runs with a 131k window: 27 cuts per arm over 5 chains, interim. Every number comes from a file in this repository. Conditions, sample sizes and links are in [Benchmarks](#benchmarks). The last row is the one that matters most, and it is not finished: see [What is proven, and what is not](#what-is-proven-and-what-is-not).
+The time and context rows are live runs with a 131k window: 27 cuts per arm over 5 chains, interim. The 32k row is one model, one window and five chains. Observation masking, a third approach, resolved 117 of the same 150 tasks (pi-tuck +2.0 points, lower bound −2.7: no difference shown). In the 32k run only pi-tuck was held to the 16,384-token room: Pi's built-in compaction sent a request over it in 97 of 150 tasks. Every number comes from a file in this repository. Conditions, sample sizes and the full limits are in [Benchmarks](#benchmarks).
 
 ## Ask your history
 
@@ -46,7 +45,7 @@ It gets back the original passage, with a pointer such as `#212`. It reads the w
 
 That is `tuck_recall`. The agent answers from the original text, not from a model's memory of it.
 
-*This example is an illustration. It is not a recorded session.* The call shapes are real. **Semantic search has no measured quality numbers yet.** A test of it is pre-registered in [`benchmark/PREREG-RECALL.md`](benchmark/PREREG-RECALL.md); it has no result yet. The benchmarks below measure cut time, cost and answer retention after cuts, not how well `tuck_search` finds a passage. It runs only on macOS with Apple silicon. Elsewhere, `tuck_search` uses keywords, and the example above would not find its match.
+*This example is an illustration. It is not a recorded session.* The call shapes are real. **Semantic search has no measured quality numbers yet.** A test of it is pre-registered in [`benchmark/PREREG-RECALL.md`](benchmark/PREREG-RECALL.md); it has no result yet. The benchmarks below measure cut time, cost and answer retention after cuts, not how well `tuck_search` finds a passage. `tuck_search` exists only on macOS with Apple silicon. Elsewhere the agent has `tuck_recall` and its keyword search, and the example above would not find its match.
 
 ## Install
 
@@ -56,10 +55,10 @@ pi install npm:pi-tuck
 
 Then start a new Pi session. That is all. pi-tuck takes over Pi's compaction, both automatic and `/compact`. You change no setting.
 
-- Needs Pi 1.1 or later (tested on 1.1.0 and 1.4.0), on macOS or Linux.
+- Needs Pi 1.1 or later (tested on 1.1.0 and 1.4.0), on macOS or Linux. Full features on macOS with Apple silicon; elsewhere, compaction and word recall.
 - On macOS with Apple silicon, the first session also downloads a local search model in the background (about 390 MB, once). Until it is ready, search works by keyword. See [Semantic search](#semantic-search).
-- Prefer GitHub? `pi install git:github.com/galyavin/pi-tuck@v1.0.6`.
-- To pin a version, add it: `pi install npm:pi-tuck@1.0.6`.
+- Prefer GitHub? `pi install git:github.com/galyavin/pi-tuck@v1.0.7`.
+- To pin a version, add it: `pi install npm:pi-tuck@1.0.7`.
 
 ## How it works
 
@@ -77,9 +76,9 @@ The summary is plain text, one line per record, such as `#12 user @2026-10-30T14
 The agent gets two tools to get anything back:
 
 - **`tuck_recall`** finds earlier text by keyword. It reads any original message or tool result exactly, by the index shown in a summary. It can also write an original out to a file.
-- **`tuck_search`** finds earlier history related to a question, even when the wording differs. It combines keyword hits with local semantic search and returns the original text with pointers for `tuck_recall`.
+- **`tuck_search`** (macOS with Apple silicon only) finds earlier history related to a question, even when the wording differs. It combines keyword hits with local semantic search and returns the original text with pointers for `tuck_recall`.
 
-Both tools cost about 1,050 tokens of tool description per request.
+On Apple silicon, both tools cost about 1,050 tokens of tool description per request. Elsewhere only `tuck_recall` is offered.
 
 | Command | Does |
 |---|---|
@@ -90,15 +89,15 @@ Both tools cost about 1,050 tokens of tool description per request.
 
 ## What is proven, and what is not
 
-**Measured so far:** in the live run, a pi-tuck cut took a median 0.09 s, where Pi's built-in compaction with a local model writing the summary took a median 269 s. A cut calls no model, so it costs no tokens. After a cut, pi-tuck carried about as many tokens as the built-in did, not fewer. In simulation, cutting at 60% of the room instead of 100% saved billed input for pi-tuck itself, and answers held in replay.
+**Measured so far.** In the live run at a 131k window, a pi-tuck cut took a median 0.09 s, where Pi's built-in compaction with a local model writing the summary took a median 269 s. A cut calls no model, so it costs no tokens. After a cut, pi-tuck carried about as many tokens as the built-in did, not fewer. In simulation, cutting at 60% of the room instead of 100% saved billed input for pi-tuck itself, and answers held in replay. At a 32k window, in one suite of 150 SWE-bench Verified tasks with one model, pi-tuck 1.0.5 resolved 120 tasks and Pi's built-in compaction 94 (+17.3 points, 95% lower bound +10.7). Observation masking resolved 117 (pi-tuck +2.0 points, lower bound −2.7: no difference shown). The limits of that result are in [Benchmarks](#benchmarks).
 
-**Not proven yet: that the summary is as good as a model-written one.** The claim is that pi-tuck compacts as well as an LLM compactor, in far less time and at no cost. The comparator is Pi's own summarize prompts, run on a local model (`mac-studio/main`). The frontier comparison is untested: the model first named for it (`openai/gpt-6-astra`) was retired on 2026-10-31, and its recordings are a labelled partial view that feeds no test. A replacement, GPT-6.1 Terra, is pre-registered in [`benchmark/PREREG-TERRA.md`](benchmark/PREREG-TERRA.md). See [`benchmark/PINS.md`](benchmark/PINS.md). That claim has a pre-registered test. The test is running now. It was written down before any result came in, and a failed test will be reported as failed. When the result is final, it goes in [`benchmark/`](benchmark) and in this README. Until then, this README does not claim that pi-tuck is as good as, or better than, any LLM compactor.
+**Not claimed.** This README does not say that pi-tuck is as good as, or better than, Pi's built-in compaction at a 128k window or in any other setting than the one above. The tests were pre-registered before any result came in. The plans, and every result, including those that did not favour pi-tuck, are in [`benchmark/`](benchmark).
 
-The test has three parts:
+The pre-registered plan has three parts:
 
 1. **A live run** at a 128k window on a local model, with pi-tuck 1.0.1. Ten chains of 30 SWE-bench Verified tasks per arm, with Pi's built-in compaction in one arm and pi-tuck in the other. Official grading.
-2. **A paired replay with probe questions.** The same cuts, made by pi-tuck and by Pi's summarize prompts on the local model, then questions about facts that fell before the cut. Pre-registered rule: the claim holds only if pi-tuck is no more than 3 points worse than the better compactor, with a 95% bound. The comparators are named above and in `benchmark/`.
-3. **A 32k suite**, where tasks are bigger than the room, so cuts must summarise work in progress.
+2. **A paired replay with probe questions.** The same cuts, made by pi-tuck and by Pi's summarize prompts, then questions about facts that fell before the cut. Pre-registered rule: the claim holds only if pi-tuck is no more than 3 points worse than the better compactor, with a 95% bound. The comparators are named in [`benchmark/PINS.md`](benchmark/PINS.md).
+3. **A 32k suite**, where tasks are bigger than the room, so cuts must summarise work in progress. Its result is the 32k row above.
 
 The plan: [`benchmark/PREREG.md`](benchmark/PREREG.md), [`benchmark/PREREG-32K.md`](benchmark/PREREG-32K.md), [`benchmark/PREREG-TERRA.md`](benchmark/PREREG-TERRA.md), and every change after the freeze in [`benchmark/DEVIATIONS.md`](benchmark/DEVIATIONS.md).
 
@@ -106,7 +105,7 @@ Known limits today:
 
 - pi-tuck's summary does not explain why things happened. It holds the words that were said, not a model's reading of them. The agent must look things up. Each look-up costs a tool call.
 - Small windows: an upstream that spends far more context on tool schemas than others (some OpenRouter upstreams do) can leave a small input room too little space, and pi-tuck then refuses to cut rather than overflow. This is what made 1.0.1 refuse at a 32k window with Pi's default 16,384 reserve. Since 1.0.4 the notice says when the provider is counting far above pi-tuck's estimate. In 1.0.4, after an oversize tool result or a "Nothing to compact" error from Pi, a session could keep refusing later prompts. 1.0.5 fixes both. Pin a different upstream, lower the reserve, or use a larger window; see [Small windows](#small-windows).
-- Semantic search runs only on macOS with Apple silicon.
+- Semantic search (`tuck_search`) needs a Mac with Metal (Apple silicon). Elsewhere, compaction and `tuck_recall`'s word search work, there is no `tuck_search`, and nothing is downloaded.
 
 ## Benchmarks
 
@@ -114,6 +113,7 @@ Each row says what was measured, under which conditions, and where the data is.
 
 | What | Result | Conditions | Source |
 |---|---|---|---|
+| Tasks resolved, 32k window | Pi's built-in compaction 94 of 150; pi-tuck 120 of 150 (+17.3 points, 95% lower bound +10.7); observation masking 117 of 150 (pi-tuck +2.0, lower bound −2.7: no difference shown). Turns per task: 9.4 (built-in), 24.0 (pi-tuck), 11.9 (masking). Tokens per session: 6.10 M, 6.39 M, 7.02 M. Spend per arm for the five sessions: $0.87, $0.55, $0.94 | pi-tuck 1.0.5 (commit `aa30824`, the 1.0.5 code; 1.0.6 and 1.0.7 are not measured). DeepSeek V4.1 Flash pinned to one upstream, window 32,768, reserve 16,384, 5 chains of 30 SWE-bench Verified tasks, paired by task, one-sided bootstrap over tasks. **Limits:** only pi-tuck is held to the 16,384-token room (the built-in sent a request over it in 97 of 150 tasks, masking in 73, so the window is nominal for them). The difference by chain is +10.0, −3.3, +50.0, +16.7 and +13.3 points; leaving out chain t03 it is +9.2. The bootstrap resamples tasks, not chains. The pi-tuck arm ran at a different time from the others. One model, one window. pi-tuck refused to cut mid-run in 5 tasks, where one fresh tool result was larger than the room; they count as unresolved. In the same setup pi-tuck 1.0.3 resolved 72 of 150, with 52 tasks lost because an earlier refusal carried forward; 1.0.5 fixes that | [`benchmark/RESULTS-32K-ACCEPT.md`](benchmark/RESULTS-32K-ACCEPT.md) |
 | Cut time, live | pi-tuck median 0.087 s (90th percentile 0.205 s); Pi's built-in median 268.8 s (90th percentile 421.6 s). Context carried after a cut, median: 27,751 against 29,241 tokens | **Interim.** pi-tuck 1.0.1, Pi 1.4.0, SWE-bench Verified chains of 30 tasks, 131,072-token window, reply reserve 32,768, local model `mac-studio/main` writing Pi's summaries. 27 cuts per arm, 5 chains. The built-in time depends on that model and on server load. pi-tuck's time is an upper bound read from the session file | [`benchmark/RESULTS-INTERIM.md`](benchmark/RESULTS-INTERIM.md) section 1 |
 | Cut time, paired replay | pi-tuck median 0.062 s (range 0.005 to 0.48 s); local-model summarizer 193.4 s (77.3 to 413.3 s); frontier summarizer 96.1 s (39.1 to 267.8 s; measured on the retired model `openai/gpt-6-astra`; feeds no test). Context carried after a cut, median: 28,006 (pi-tuck), 26,424 (local), 25,555 (frontier) tokens | **Interim.** The same recorded sessions cut at the same positions. pi-tuck: 10 recordings, 52 cuts. Summarizers: 6 recordings, 28 and 29 cuts. pi-tuck's time leaves out the background search index | [`benchmark/RESULTS-INTERIM.md`](benchmark/RESULTS-INTERIM.md) section 2 |
 | Billed input, cutting at 60% of the room instead of 100% | −17.9% at 128k, −14.0% at 32k with automatic prompt caching; −17.0% and −9.6% with explicit cache breakpoints. Cuts go from 6 to 12 (128k) and from 84 to 157 (32k); none frees under a tenth of the room | Simulated billing, not provider bills. Prompt caching priced. Build `1bda64b` (the default shipped in 1.0.3). 5 recorded live sessions. 128k = 131,072 window, reserve 32,768. 32k = 32,768 window, reserve 16,384 | [`rnd/replay32/RESULT-lean.md`](rnd/replay32/RESULT-lean.md) |
@@ -139,7 +139,7 @@ pi-tuck needs none. Two are optional. Put them in `pi-tuck.json` in Pi's agent f
 ```
 
 - **`cutAt`** (above 0, at most 1; default 0.6) is the part of the input room a request may fill before pi-tuck cuts. At 0.6, each cut leaves room to grow, so fewer tokens are carried and billed per request. `{ "cutAt": 1 }` cuts at the full room. A lower value cuts earlier and smaller. The whole room still decides which request pi-tuck refuses.
-- **`semanticRecall`** (`false` turns semantic search off). Nothing is then downloaded, and `tuck_search` uses keywords only.
+- **`semanticRecall`** (`false` turns semantic search off, on Apple silicon). Nothing is then downloaded, and `tuck_search` uses keywords only.
 
 A bad file is reported at session start, and pi-tuck uses the defaults.
 
@@ -161,7 +161,7 @@ If you reach the model through OpenRouter, you can also pin one upstream, so tha
 
 ## Semantic search
 
-Semantic search is on by default on macOS with Apple silicon. It runs entirely on your Mac: an embedding model, [EmbeddingGemma-2](https://huggingface.co/google/embeddinggemma-2), served by [llama.cpp](https://github.com/ggml-org/llama.cpp) on the CPU. No text leaves your machine. Elsewhere, `tuck_search` uses keywords, and everything else works.
+Semantic search is on by default on macOS with Apple silicon. It runs entirely on your Mac: an embedding model, [EmbeddingGemma-2](https://huggingface.co/google/embeddinggemma-2), served by [llama.cpp](https://github.com/ggml-org/llama.cpp) on your Mac's GPU (Metal). No text leaves your machine. Elsewhere (Linux, Intel Macs) there is no `tuck_search`, and nothing is downloaded; compaction and `tuck_recall` work. On a Mac where Metal fails to start, semantic recall goes off with the reason "Semantic recall needs Metal; word recall still works".
 
 The first time a session starts, pi-tuck downloads what it needs, once, about 390 MB, in the background. Keyword search works meanwhile:
 

package/dist/index.js

@@ -18,7 +18,9 @@ export default async function (pi) {
     // `/tuck-semantic off` holds for the rest of the session, including over a setup that finishes later.
     let off = false;
     const settings = readSettings(join(getAgentDir(), "pi-tuck.json"));
-    const handle = await installCompaction(pi, { semanticRecall, cutAt: settings.cutAt, onSemanticSetting: async (enabled) => { off = !enabled; } });
+    // Semantic recall runs on Metal, so only on Apple silicon; elsewhere the model is not offered tuck_search at all.
+    const appleSilicon = process.platform === "darwin" && process.arch === "arm64";
+    const handle = await installCompaction(pi, { semanticRecall, search: appleSilicon, cutAt: settings.cutAt, onSemanticSetting: async (enabled) => { off = !enabled; } });
     if (settings.semanticRecall === false)
         return;
     let session = 0, said = "", setup;
@@ -37,8 +39,8 @@ export default async function (pi) {
         off = false;
         if (settings.error)
             once(ctx, `pi-tuck: ${settings.error}; using the defaults.`, "warning");
-        if (process.platform !== "darwin" || process.arch !== "arm64")
-            return once(ctx, "pi-tuck: semantic recall needs macOS on Apple silicon for now; compaction and word recall work.", "info");
+        if (!appleSilicon)
+            return once(ctx, "pi-tuck: semantic recall needs macOS on Apple silicon; compaction and word recall work.", "info");
         // Semantic recall keeps its runtime and indexes outside the project it serves, so not when Pi runs in a folder that holds its
         // agent folder, such as the home folder.
         if (within(real(getAgentDir()), real(ctx.cwd)))

package/dist/src/build-id.d.ts

@@ -1 +1 @@
-export declare const BUILD_ID = "d2b2e6b0e594b5dd41e9771c43f4ed0355d8fd048c4e247541199f3b812751d3";
+export declare const BUILD_ID = "52dc04a544dfbc3cdf7e9dccd5f192350d56889968cf2bd4bd176405ab65a29a";

package/dist/src/build-id.js

@@ -1 +1 @@
-export const BUILD_ID = "d2b2e6b0e594b5dd41e9771c43f4ed0355d8fd048c4e247541199f3b812751d3";
+export const BUILD_ID = "52dc04a544dfbc3cdf7e9dccd5f192350d56889968cf2bd4bd176405ab65a29a";

package/dist/src/clip.d.ts

@@ -0,0 +1,14 @@
+import type { ToolResultMessage } from "@earendil-works/pi-ai";
+/** What a request carries in place of one fresh tool result that the room cannot hold: its head and tail, and where the rest is. */
+export interface Clip {
+    toolCallId: string;
+    content: ToolResultMessage["content"];
+}
+/** The round's text results within `budget` tokens together: each result smaller than an equal share of what is left stays whole, and the
+ * rest are clipped to that share, keeping the most head and tail characters that fit it. None when the round already fits, or when a share
+ * cannot hold even the locator. A round of one result gets the whole budget. Deterministic: the same round and budget always clip the same way. */
+export declare function clipFor(results: readonly ToolResultMessage[], entryIdOf: (toolCallId: string) => string | undefined, budget: number): Clip[];
+/** The messages with each clipped result replaced; the same array when nothing is clipped. */
+export declare const applyClips: <M extends {
+    role: string;
+}>(messages: M[], clips: ReadonlyMap<string, Clip>) => M[];

package/dist/src/clip.js

@@ -0,0 +1,52 @@
+import { conversationTokens } from "./budget.js";
+import { MAX_RECALL_CHARACTERS } from "./recall.js";
+/** The text `tuck_recall {entryId, offset}` reads from a text-only result; any other result is not clipped. */
+const textOf = (message) => message.content.every(block => block.type === "text")
+    ? message.content.map(block => block.type === "text" ? block.text : "").join("\n") : undefined;
+const clipped = (text, keep, entryId) => {
+    const head = Math.ceil(keep / 2), tail = keep - head;
+    return [{ type: "text", text: text.slice(0, head) +
+                `\n[pi-tuck: characters ${head}-${text.length - tail} of ${text.length} are not shown, to fit the context window; read them with ` +
+                `tuck_recall {"entryId":"${entryId}","offset":${head}}, up to ${MAX_RECALL_CHARACTERS} characters a call]\n` + text.slice(text.length - tail) }];
+};
+/** The round's text results within `budget` tokens together: each result smaller than an equal share of what is left stays whole, and the
+ * rest are clipped to that share, keeping the most head and tail characters that fit it. None when the round already fits, or when a share
+ * cannot hold even the locator. A round of one result gets the whole budget. Deterministic: the same round and budget always clip the same way. */
+export function clipFor(results, entryIdOf, budget) {
+    const tokens = (message) => conversationTokens([message]);
+    const round = results.flatMap(result => {
+        const text = textOf(result), entryId = entryIdOf(result.toolCallId);
+        return text === undefined || !entryId ? [] : [{ result, text, entryId, size: tokens(result) }];
+    })
+        .sort((a, b) => a.size - b.size);
+    if (round.reduce((sum, item) => sum + item.size, 0) <= budget)
+        return [];
+    const clips = [];
+    let left = budget;
+    for (const [at, { result, text, entryId, size }] of round.entries()) {
+        const share = Math.floor(left / (round.length - at));
+        if (size <= share) {
+            left -= size;
+            continue;
+        }
+        const fits = (keep) => tokens({ ...result, content: clipped(text, keep, entryId) }) <= share;
+        if (!fits(0))
+            return [];
+        let low = 0, high = text.length;
+        while (low < high) {
+            const mid = Math.ceil((low + high) / 2);
+            if (fits(mid))
+                low = mid;
+            else
+                high = mid - 1;
+        }
+        const content = clipped(text, low, entryId);
+        clips.push({ toolCallId: result.toolCallId, content });
+        left -= tokens({ ...result, content });
+    }
+    return clips;
+}
+/** The messages with each clipped result replaced; the same array when nothing is clipped. */
+export const applyClips = (messages, clips) => !clips.size ? messages
+    : messages.map(message => message.role === "toolResult" && clips.has(message.toolCallId)
+        ? { ...message, content: clips.get(message.toolCallId).content } : message);

package/dist/src/compaction.d.ts

@@ -23,6 +23,8 @@ export declare const MEASURED_CALIBRATION: Readonly<Record<string, number>>;
 export declare function seedWindow(branch: readonly SessionEntry[], key: string): number[];
 export interface CompactionOptions {
     semanticRecall?: SemanticRecallController;
+    /** Whether `tuck_search` exists: false where semantic recall cannot run (off Apple silicon), so the model is offered word recall only. */
+    search?: boolean;
     /** Optional host-owned transient operator preference; handle operations never call back. */
     onSemanticSetting?: (enabled: boolean) => Promise<unknown>;
     semanticStatus?: () => unknown;

package/dist/src/compaction.js

@@ -5,6 +5,7 @@ import { exportSource } from "./source-export.js";
 import { isDeepStrictEqual } from "node:util";
 import { assertNativeToolRounds } from "./protocol.js";
 import { projectedMessages } from "./omissions.js";
+import { applyClips, clipFor } from "./clip.js";
 import { DEFAULT_CUT_AT, bandOf, chooseCut, conversationTokens, decideCut, gateCut, incomingEventTokens, incomingTokens, measurableConversationTokens, planningReserve, projectedConversationTokens, requestTokens, systemPart, validCutAt } from "./budget.js";
 import { isContextOverflow } from "@earendil-works/pi-ai";
 import { convertToLlm, SessionManager, SettingsManager } from "@earendil-works/pi-coding-agent";
@@ -97,7 +98,7 @@ export async function installCompaction(pi, options = {}) {
     const cutAt = options.cutAt ?? DEFAULT_CUT_AT;
     if (!validCutAt(cutAt))
         throw new Error("Invalid cut point: cutAt must be a number above 0 and at most 1");
-    const semantic = options.semanticRecall ?? createSemanticRecall();
+    const semantic = options.semanticRecall ?? createSemanticRecall(), search = options.search ?? true;
     const hostAccess = () => {
         if (!active())
             throw new Error("Compaction host is inactive");
@@ -269,7 +270,7 @@ export async function installCompaction(pi, options = {}) {
             learn(ratio);
     });
     pi.on("agent_start", () => { admittedRun = true; pending = undefined; phase = "idle"; });
-    pi.on("agent_settled", () => { admittedRun = false; pending = undefined; phase = "idle"; forgetFailure(); });
+    pi.on("agent_settled", () => { admittedRun = false; pending = undefined; phase = "idle"; forgetFailure(); clips.clear(); });
     const active = () => options.active?.() ?? true;
     const settingsFor = () => options.settings ?? SettingsManager.inMemory(pi.getSettings());
     // The standalone default reserves the model's catalogue maximum output: a transport may omit the output cap, and then only that
@@ -298,10 +299,10 @@ export async function installCompaction(pi, options = {}) {
     };
     const fits = (tokens, limit, ctx) => corrected(tokens, ctx) < limit;
     // The saved conversation and a cut's quantities are counted by the one function the guard counts with (strict, as the context hook is).
-    const measureFor = (ctx) => (messages) => projectedConversationTokens(messages, ctx, options.recallPolicy);
+    const measureFor = (ctx) => (messages) => projectedConversationTokens(applyClips(messages, clips), ctx, options.recallPolicy);
     // The planner counts with the same function, except that it does not fail on a summary in another format: a cut can replace one
     // (an operator's /compact repairs a session whose saved summary is foreign). Identical to the strict one for this compactor's summaries.
-    const plannerMeasureFor = (ctx) => (messages) => measurableConversationTokens(messages, ctx, options.recallPolicy);
+    const plannerMeasureFor = (ctx) => (messages) => measurableConversationTokens(applyClips(messages, clips), ctx, options.recallPolicy);
     const hostTokens = (ctx) => options.hostMessages ? conversationTokens(options.hostMessages(ctx)) : 0;
     const toolShapes = (names) => {
         const selected = new Set(names);
@@ -315,6 +316,9 @@ export async function installCompaction(pi, options = {}) {
     let pendingCut;
     let failure;
     let pendingBoundaryCommit = false;
+    // Fresh tool results the room cannot hold, by call id: each request of the run carries the clip in their place; the session keeps them
+    // whole. A clip ends with its run like any failure would: the next run plans from the session as it is, where the result is no longer fresh.
+    const clips = new Map();
     const fail = (error, ctx) => {
         recorder.stop("native-attempt-failed");
         const notify = !failure && error instanceof CapacityError;
@@ -364,7 +368,7 @@ export async function installCompaction(pi, options = {}) {
     });
     pi.registerTool({
         name: "tuck_recall", label: "pi-tuck history", parameters: RecallInput,
-        description: "Keyword lookup locates particular text in your current branch. {query} returns ranked passages with read coordinates; punctuation separates words. Pass the returned next as {continuation} unchanged. Use tuck_search for historical information relevant to a question, including different wording and qualifications. Knowing an identifier does not itself justify narrowing discovery. {entryId} or {index} (a summary sourceIndex or #N) reads one source, optionally with query, offset and limit in UTF-16 characters (limit defaults to 8000). {} browses history; {around} expands neighbors; {entryId,image} reads an image; outputPath writes an original to a file with the native write tool. Hidden reasoning and system records are excluded.",
+        description: "Keyword lookup locates particular text in your current branch. {query} returns ranked passages with read coordinates; punctuation separates words. Pass the returned next as {continuation} unchanged. " + (search ? "Use tuck_search for historical information relevant to a question, including different wording and qualifications. " : "") + "Knowing an identifier does not itself justify narrowing discovery. {entryId} or {index} (a summary sourceIndex or #N) reads one source, optionally with query, offset and limit in UTF-16 characters (limit defaults to 8000). {} browses history; {around} expands neighbors; {entryId,image} reads an image; outputPath writes an original to a file with the native write tool. Hidden reasoning and system records are excluded.",
         async execute(_id, raw, signal, _update, ctx) {
             access();
             const input = checkedInput(raw);
@@ -391,31 +395,32 @@ export async function installCompaction(pi, options = {}) {
             return reply(tuckRecall(tuck, ctx.sessionManager.getEntries(), branch, input, options.recallPolicy));
         },
     });
-    pi.registerTool({ name: "tuck_search", label: "History search", parameters: SearchInput,
-        description: "Find historical information relevant to a question, including different wording and related qualifications. Combines keyword and local embedding search. Knowing a name or identifier does not imply keyword-only lookup is sufficient. Returns original evidence up to 20000 characters; not exhaustive. Semantic search may be off or incomplete, which is not the same as no matches. Read exact originals and their context with tuck_recall at the returned locators. priorResults lists source ranges already read.",
-        async execute(_id, raw, signal, _update, ctx) {
-            access();
-            if (!Check(SearchInput, raw))
-                throw new Error("Invalid broad search input");
-            const input = structuredClone(raw);
-            recorder.capture("recall-action", "authorized-native-tool-invocation-no-result-copy", input);
-            // Bind the actual independent lexical offer, including attribution derived
-            // from custom markers and receipts excluded from semantic indexing. Rebuild
-            // under current caller policy after await, when the session moved; never send this block to the encoder.
-            const wordOffer = () => tuckRecall(tuck, ctx.sessionManager.getEntries(), ctx.sessionManager.getBranch(), { query: input.query }, options.recallPolicy);
-            // The key is taken in the same synchronous step as the first lexical pass. After the await the second pass runs only if it moved (see eligibilityKey); a moved key alone invalidates nothing.
-            // The snapshot id check covers every in-contract change (any branch change moves the id); the key-gated second pass is defence in depth for out-of-contract callers.
-            const provider = semanticProvider(ctx), initialSnapshot = provider(), initialKey = eligibilityKey(ctx), words = wordOffer(), wordText = JSON.stringify(words);
-            const related = await semantic.search(input.query, provider, signal, input.priorResults ?? [], words);
-            access();
-            if (signal?.aborted)
-                throw Object.assign(new Error('Semantic recall cancelled'), { name: 'AbortError' });
-            const now = provider();
-            if (initialSnapshot.id !== now.id || (eligibilityKeyMoved(ctx, initialKey) && wordText !== JSON.stringify(wordOffer())))
-                return { ...reply({ status: "snapshot_invalidated", notice: "Search source eligibility or version changed; no earlier evidence delivered. Request a fresh query." }), isError: true };
-            const page = budgetSemantic(related, 20000 - wordText.length - 1);
-            return { content: [{ type: "text", text: wordText }, { type: "text", text: JSON.stringify(page) }], details: { semantic: { status: page.status, snapshotId: page.coverage.snapshotId } } };
-        } });
+    if (search)
+        pi.registerTool({ name: "tuck_search", label: "History search", parameters: SearchInput,
+            description: "Find historical information relevant to a question, including different wording and related qualifications. Combines keyword and local embedding search. Knowing a name or identifier does not imply keyword-only lookup is sufficient. Returns original evidence up to 20000 characters; not exhaustive. Semantic search may be off or incomplete, which is not the same as no matches. Read exact originals and their context with tuck_recall at the returned locators. priorResults lists source ranges already read.",
+            async execute(_id, raw, signal, _update, ctx) {
+                access();
+                if (!Check(SearchInput, raw))
+                    throw new Error("Invalid broad search input");
+                const input = structuredClone(raw);
+                recorder.capture("recall-action", "authorized-native-tool-invocation-no-result-copy", input);
+                // Bind the actual independent lexical offer, including attribution derived
+                // from custom markers and receipts excluded from semantic indexing. Rebuild
+                // under current caller policy after await, when the session moved; never send this block to the encoder.
+                const wordOffer = () => tuckRecall(tuck, ctx.sessionManager.getEntries(), ctx.sessionManager.getBranch(), { query: input.query }, options.recallPolicy);
+                // The key is taken in the same synchronous step as the first lexical pass. After the await the second pass runs only if it moved (see eligibilityKey); a moved key alone invalidates nothing.
+                // The snapshot id check covers every in-contract change (any branch change moves the id); the key-gated second pass is defence in depth for out-of-contract callers.
+                const provider = semanticProvider(ctx), initialSnapshot = provider(), initialKey = eligibilityKey(ctx), words = wordOffer(), wordText = JSON.stringify(words);
+                const related = await semantic.search(input.query, provider, signal, input.priorResults ?? [], words);
+                access();
+                if (signal?.aborted)
+                    throw Object.assign(new Error('Semantic recall cancelled'), { name: 'AbortError' });
+                const now = provider();
+                if (initialSnapshot.id !== now.id || (eligibilityKeyMoved(ctx, initialKey) && wordText !== JSON.stringify(wordOffer())))
+                    return { ...reply({ status: "snapshot_invalidated", notice: "Search source eligibility or version changed; no earlier evidence delivered. Request a fresh query." }), isError: true };
+                const page = budgetSemantic(related, 20000 - wordText.length - 1);
+                return { content: [{ type: "text", text: wordText }, { type: "text", text: JSON.stringify(page) }], details: { semantic: { status: page.status, snapshotId: page.coverage.snapshotId } } };
+            } });
     pi.on("session_before_compact", (event, ctx) => {
         try {
             if (!active())
@@ -494,7 +499,7 @@ export async function installCompaction(pi, options = {}) {
         }
     });
     pi.on("session_before_tree", (event) => event.preparation.userWantsSummary ? { cancel: true } : undefined);
-    pi.on("session_start", () => { recorder.stop("session-transition"); proposalId = undefined; failure = undefined; admittedRun = false; pendingBoundaryCommit = false; identity = ""; factor = 1; pending = undefined; phase = "idle"; });
+    pi.on("session_start", () => { clips.clear(); recorder.stop("session-transition"); proposalId = undefined; failure = undefined; admittedRun = false; pendingBoundaryCommit = false; identity = ""; factor = 1; pending = undefined; phase = "idle"; });
     // The cut before a run. Pi 1.4 counts a run as started before before_agent_start, and ctx.compact() first aborts and waits for an
     // idle session, so a cut asked for there would wait on its own run. A prompt's cut is therefore made on `input`, while the session
     // is idle. before_agent_start decides only for a run no input started (one a custom message starts) and cuts only if the session is
@@ -570,30 +575,31 @@ export async function installCompaction(pi, options = {}) {
             fail(error, ctx);
         }
     });
-    pi.on("turn_end", (event, ctx) => {
-        try {
-            if (!active() || !admittedRun || event.outcome !== "completed" || ctx.signal?.aborted ||
-                !event.context.canContinue || !event.toolResults.length || !settingsFor().getCompactionSettings(ctx.model).enabled)
-                return;
-            access();
-            // Earlier boundary drafts have a public preview but no original-source compiler
-            // contract. Preserve them and leave admission to the final guard.
-            if (event.entries.length || !isDeepStrictEqual(event.context.contextMessages, ctx.sessionManager.buildSessionProjection().messages))
-                return;
-            if (!ctx.model)
-                return;
-            const { response, room, band } = limits(ctx);
-            const measure = measureFor(ctx), saved = event.context.contextMessages;
-            // One snapshot per decision. Messages queued for the next request (steering, follow-ups) are in that request but not in the
-            // saved conversation. Pi's peek returns the steering queue, else the follow-up queue; a follow-up is not in the very next
-            // request while tools still run, so it can be counted early: conservative, and nothing else would cut at that later boundary.
-            const system = systemPart(ctx.getSystemPrompt(), toolShapes(pi.getActiveTools()), saved, ctx.getSystemPrompt());
-            const host = hostTokens(ctx);
-            const queued = event.context.pendingMessages.length ? conversationTokens(event.context.pendingMessages) : 0;
-            const mandatory = system + host + queued;
+    // A cut at a public boundary, drafted against the boundary's own preview: "tool-loop" between the rounds of a run, "run-end" once its
+    // last reply is in. A run-end cut is made only at or above the band, as a tool-loop one, so the next prompt starts from below it: an
+    // input cut is bound by Pi's keepRecentTokens, and a large prompt right after a cut could leave it nothing to cut. A run-end cut that
+    // cannot be planned is no fault: the run is over, and the next prompt decides afresh. Only a tool-loop boundary has fresh results to clip.
+    const boundaryCut = (event, ctx, reason) => {
+        access();
+        // Earlier boundary drafts have a public preview but no original-source compiler
+        // contract. Preserve them and leave admission to the final guard.
+        if (event.entries.length || !isDeepStrictEqual(event.context.contextMessages, ctx.sessionManager.buildSessionProjection().messages))
+            return;
+        if (!ctx.model)
+            return;
+        const { response, room, band } = limits(ctx);
+        const measure = measureFor(ctx), saved = event.context.contextMessages;
+        // One snapshot per decision. Messages queued for the next request (steering, follow-ups) are in that request but not in the
+        // saved conversation. Pi's peek returns the steering queue, else the follow-up queue; a follow-up is not in the very next
+        // request while tools still run, so it can be counted early: conservative, and nothing else would cut at that later boundary.
+        const system = systemPart(ctx.getSystemPrompt(), toolShapes(pi.getActiveTools()), saved, ctx.getSystemPrompt());
+        const host = hostTokens(ctx);
+        const queued = event.context.pendingMessages.length ? conversationTokens(event.context.pendingMessages) : 0;
+        const mandatory = system + host + queued;
+        const previousSummary = saved.find(message => message.role === "compactionSummary")?.summary;
+        const decide = () => {
             const before = measure(saved);
-            const previousSummary = saved.find(message => message.role === "compactionSummary")?.summary;
-            const decision = decideCut({
+            return decideCut({
                 total: before + mandatory, mandatory, before, room, band, fits: (tokens, limit) => fits(tokens, limit, ctx),
                 unreduced: "Tool-loop preflight compaction did not reduce context within the estimated request budget",
                 plan: (target) => {
@@ -611,14 +617,44 @@ export async function installCompaction(pi, options = {}) {
                     return { draft: true, after: measure(messages), mode: draft.mode, compaction: draft.compaction, reserve };
                 },
             });
-            if (decision.kind === "fault")
-                throw new (decision.capacity ? CapacityError : Refusal)(decision.message);
-            if (decision.kind !== "cut")
+        };
+        let decision = decide();
+        // Only a request that would be refused is clipped. A fresh result is kept whole by every cut (it has not reached the model yet), so
+        // a round larger than the room refuses the run. In their place the request carries the results' heads and tails, together at most
+        // half of what the room leaves the conversation, each with a tuck_recall locator to its rest. When even that is refused the refusal stands.
+        if (decision.kind === "fault" && event.toolResults) {
+            const branch = ctx.sessionManager.getBranch();
+            const entryIdOf = (toolCallId) => branch.findLast(entry => entry.type === "message" && entry.message.role === "toolResult" && entry.message.toolCallId === toolCallId)?.id;
+            const round = clipFor(event.toolResults, entryIdOf, Math.floor((room - mandatory) / 2));
+            if (round.length) {
+                for (const clip of round)
+                    clips.set(clip.toolCallId, clip);
+                const clippedDecision = decide();
+                if (clippedDecision.kind === "fault")
+                    for (const clip of round)
+                        clips.delete(clip.toolCallId);
+                else
+                    decision = clippedDecision;
+            }
+        }
+        const before = measure(saved);
+        if (decision.kind === "fault" && reason === "tool-loop")
+            throw new (decision.capacity ? CapacityError : Refusal)(decision.message);
+        if (decision.kind !== "cut")
+            return;
+        const compaction = captureDraft(decision.plan.compaction, ctx, decision.plan.reserve, reason, before, true, false, previousSummary, { response, host, mandatory, target: decision.target, margin: room - band });
+        return { entries: [{ type: "compaction", summary: compaction.summary,
+                    firstKeptEntryId: compaction.firstKeptEntryId, details: compaction.details }] };
+    };
+    pi.on("turn_end", (event, ctx) => {
+        try {
+            if (!active() || !admittedRun || event.outcome !== "completed" || ctx.signal?.aborted ||
+                !event.context.canContinue || !event.toolResults.length || !settingsFor().getCompactionSettings(ctx.model).enabled)
                 return;
-            const compaction = captureDraft(decision.plan.compaction, ctx, decision.plan.reserve, "tool-loop", before, true, false, previousSummary, { response, host, mandatory, target: decision.target, margin: room - band });
-            pendingBoundaryCommit = true;
-            return { entries: [{ type: "compaction", summary: compaction.summary,
-                        firstKeptEntryId: compaction.firstKeptEntryId, details: compaction.details }] };
+            const result = boundaryCut(event, ctx, "tool-loop");
+            if (result)
+                pendingBoundaryCommit = true;
+            return result;
         }
         catch (error) {
             fail(error, ctx);
@@ -629,7 +665,7 @@ export async function installCompaction(pi, options = {}) {
             if (!active())
                 return;
             access();
-            return { messages: projectedMessages(event.messages, ctx, options.recallPolicy) };
+            return { messages: applyClips(projectedMessages(event.messages, ctx, options.recallPolicy), clips) };
         }
         catch (error) {
             try {
@@ -664,12 +700,21 @@ export async function installCompaction(pi, options = {}) {
             fail(new (event.fromExtension ? CommitFault : Error)(event.errorMessage ?? "Compaction failed"), ctx);
     });
     pi.on("agent_before_settle", (event, ctx) => {
-        if (!pendingBoundaryCommit)
-            return;
-        if (event.outcome === "error")
-            fail(new CommitFault("Native tool-loop boundary draft remained unconfirmed at error settlement"), ctx);
-        else
+        if (pendingBoundaryCommit) {
+            if (event.outcome === "error")
+                return void fail(new CommitFault("Native tool-loop boundary draft remained unconfirmed at error settlement"), ctx);
             pendingBoundaryCommit = false;
+        }
+        // Pi commits these entries before the run settles.
+        try {
+            if (!active() || !admittedRun || event.outcome !== "completed" || ctx.signal?.aborted || failure ||
+                !settingsFor().getCompactionSettings(ctx.model).enabled)
+                return;
+            return boundaryCut(event, ctx, "run-end");
+        }
+        catch (error) {
+            fail(error, ctx);
+        }
     });
     pi.on("context_with_system", (event, ctx) => {
         // Reaching the next request boundary proves native commit returned, not durable storage.

package/dist/src/diagnostics.d.ts

@@ -1,6 +1,6 @@
 import { type RecallPolicy } from './recall.js';
 import type { SessionEntry } from '@earendil-works/pi-coding-agent';
-export declare const DIAGNOSTIC_BUILD = "d2b2e6b0e594b5dd41e9771c43f4ed0355d8fd048c4e247541199f3b812751d3";
+export declare const DIAGNOSTIC_BUILD = "52dc04a544dfbc3cdf7e9dccd5f192350d56889968cf2bd4bd176405ab65a29a";
 export interface Receipt {
     id: string;
     build: string;

package/dist/src/diagnostics.js

@@ -8,7 +8,7 @@ import { createRecall } from './recall.js';
 export const DIAGNOSTIC_BUILD = BUILD_ID;
 export function attachReceipt(draft, reason, reserveTokens, contextWindow, resolved = {}) {
     const details = draft.details && typeof draft.details === 'object' ? draft.details : {};
-    const receipt = { id: randomUUID(), build: DIAGNOSTIC_BUILD, reason, selectedView: typeof details.view === 'string' ? details.view : 'deterministic-selected-draft', boundary: draft.firstKeptEntryId, settings: { draftReservedTokens: reserveTokens, contextWindow, ...resolved }, before: { value: draft.tokensBefore, unit: 'estimated-input-tokens', scope: reason === 'tool-loop' ? 'public-conversation' : 'native-preparation' }, after: { value: typeof details.tokensAfter === 'number' ? details.tokensAfter : null, unit: 'estimated-input-tokens', scope: 'draft-preview' } };
+    const receipt = { id: randomUUID(), build: DIAGNOSTIC_BUILD, reason, selectedView: typeof details.view === 'string' ? details.view : 'deterministic-selected-draft', boundary: draft.firstKeptEntryId, settings: { draftReservedTokens: reserveTokens, contextWindow, ...resolved }, before: { value: draft.tokensBefore, unit: 'estimated-input-tokens', scope: reason === 'tool-loop' || reason === 'run-end' ? 'public-conversation' : 'native-preparation' }, after: { value: typeof details.tokensAfter === 'number' ? details.tokensAfter : null, unit: 'estimated-input-tokens', scope: 'draft-preview' } };
     return { ...draft, details: { ...details, diagnosticReceipt: receipt } };
 }
 export function receiptId(entry) {

package/dist/src/semantic-recall.d.ts

@@ -112,13 +112,15 @@ export declare const HEAL_STEADY_MS = 600000;
 export declare const IDLE_STOP_MS = 600000;
 /** A worker call's deadline once the worker has answered a call after `ready`: index, embed and tokenize on a loaded model. */
 export declare const CALL_DEADLINE_MS = 60000;
+/** Why semantic recall is off where the embedding server cannot start on Metal (a VM, a Mac without a GPU): it runs on Metal only. */
+export declare const METAL_UNAVAILABLE = "Semantic recall needs Metal; word recall still works";
 /** What an `embed` call adds to its deadline for each text it carries. A batch of 8 passages on a starved CPU took longer than the per-call
  * deadline, and the worker failed when it should have slowed down; a query (one text) still fails fast when the server hangs. The worker
  * scales its native request timeout by the same amount (semantic-worker.py), so that limit is not reached first. */
 export declare const EMBED_TEXT_MS = 30000;
 /** The deadline for a worker's start: Python start, `ready` (which verifies every runtime file) and the first call after it, which loads the
  * model and starts its native server. On a busy machine that takes minutes; held to the per-call deadline, the worker never started and
- * semantic recall went unavailable. It stays above the worker's own native start limits (120 s on Metal, then 400 s on the CPU, in semantic-worker.py). */
+ * semantic recall went unavailable. It stays above the worker's own native start limit (540 s, in semantic-worker.py). */
 export declare const START_DEADLINE_MS = 600000;
 /** The most units one index window holds. The worker's SQLite store stops at 8,008 rows (`PRAGMA max_page_count=8192` in scripts/semantic-worker.py), so a cap below that keeps a window of short units from filling the store and sticking in `unavailable`. Raise it only together with the store. */
 export declare const MAX_INDEX_UNITS = 8000;

package/dist/src/semantic-recall.js

@@ -171,13 +171,15 @@ export const HEAL_STEADY_MS = 600000;
 export const IDLE_STOP_MS = 600000;
 /** A worker call's deadline once the worker has answered a call after `ready`: index, embed and tokenize on a loaded model. */
 export const CALL_DEADLINE_MS = 60000;
+/** Why semantic recall is off where the embedding server cannot start on Metal (a VM, a Mac without a GPU): it runs on Metal only. */
+export const METAL_UNAVAILABLE = 'Semantic recall needs Metal; word recall still works';
 /** What an `embed` call adds to its deadline for each text it carries. A batch of 8 passages on a starved CPU took longer than the per-call
  * deadline, and the worker failed when it should have slowed down; a query (one text) still fails fast when the server hangs. The worker
  * scales its native request timeout by the same amount (semantic-worker.py), so that limit is not reached first. */
 export const EMBED_TEXT_MS = 30000;
 /** The deadline for a worker's start: Python start, `ready` (which verifies every runtime file) and the first call after it, which loads the
  * model and starts its native server. On a busy machine that takes minutes; held to the per-call deadline, the worker never started and
- * semantic recall went unavailable. It stays above the worker's own native start limits (120 s on Metal, then 400 s on the CPU, in semantic-worker.py). */
+ * semantic recall went unavailable. It stays above the worker's own native start limit (540 s, in semantic-worker.py). */
 export const START_DEADLINE_MS = 600000;
 /** The most units one index window holds. The worker's SQLite store stops at 8,008 rows (`PRAGMA max_page_count=8192` in scripts/semantic-worker.py), so a cap below that keeps a window of short units from filling the store and sticking in `unavailable`. Raise it only together with the store. */
 export const MAX_INDEX_UNITS = 8000;
@@ -274,7 +276,7 @@ class LocalWorker {
                     if (pending) {
                         clearTimeout(pending.timer);
                         this.pending.delete(reply.id);
-                        reply.ok ? pending.resolve(reply.result) : pending.reject(new WorkerFailure('Local semantic runtime: ' + reply.error?.code, reply.error?.code ?? null));
+                        reply.ok ? pending.resolve(reply.result) : pending.reject(new WorkerFailure(reply.error?.code === 'metal_unavailable' ? METAL_UNAVAILABLE : 'Local semantic runtime: ' + reply.error?.code, reply.error?.code ?? null));
                         if (this.nativeHelper && this.nativeInputId === reply.id) {
                             this.nativeInputId = undefined;
                             this.pumpNativeInput();

package/index.ts

@@ -22,7 +22,9 @@ export default async function (pi: ExtensionAPI) {
 	// `/tuck-semantic off` holds for the rest of the session, including over a setup that finishes later.
 	let off = false;
 	const settings = readSettings(join(getAgentDir(), "pi-tuck.json"));
-	const handle = await installCompaction(pi, { semanticRecall, cutAt: settings.cutAt, onSemanticSetting: async enabled => { off = !enabled; } });
+	// Semantic recall runs on Metal, so only on Apple silicon; elsewhere the model is not offered tuck_search at all.
+	const appleSilicon = process.platform === "darwin" && process.arch === "arm64";
+	const handle = await installCompaction(pi, { semanticRecall, search: appleSilicon, cutAt: settings.cutAt, onSemanticSetting: async enabled => { off = !enabled; } });
 	if (settings.semanticRecall === false) return;
 	let session = 0, said = "", setup: Promise<unknown> | undefined;
 	// A context outlives its session (a setup can finish after /new); a notice to an ended session is dropped.
@@ -33,8 +35,8 @@ export default async function (pi: ExtensionAPI) {
 		const current = ++session;
 		off = false;
 		if (settings.error) once(ctx, `pi-tuck: ${settings.error}; using the defaults.`, "warning");
-		if (process.platform !== "darwin" || process.arch !== "arm64")
-			return once(ctx, "pi-tuck: semantic recall needs macOS on Apple silicon for now; compaction and word recall work.", "info");
+		if (!appleSilicon)
+			return once(ctx, "pi-tuck: semantic recall needs macOS on Apple silicon; compaction and word recall work.", "info");
 		// Semantic recall keeps its runtime and indexes outside the project it serves, so not when Pi runs in a folder that holds its
 		// agent folder, such as the home folder.
 		if (within(real(getAgentDir()), real(ctx.cwd)))

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-tuck",
-  "version": "1.0.6",
+  "version": "1.0.8",
   "description": "Deterministic compaction for Pi: compact summaries that keep the dialogue and the files touched, plus history recall by keyword and by meaning, all local.",
   "keywords": [
     "pi-package",

package/scripts/semantic-worker.py

@@ -92,9 +92,9 @@ def load():
    # Pinned common/arg.cpp supports LLAMA_API_KEY; server-http.cpp requires Bearer
    # on /props and embeddings, but /health is public. No token in process argv.
    env['LLAMA_API_KEY']=encoder_token
-  def launch(gpu_layers,limit):
+  def launch(limit):
    """The server, or None when it exits or is not healthy within `limit` seconds (it is then stopped)."""
-   child=subprocess.Popen([str(executable),'-m',str(ROOT/'model.gguf'),'--embedding','--pooling','mean','--embd-normalize','2','--ctx-size','8192','--batch-size','8192','--ubatch-size','8192','--parallel','1','--n-gpu-layers',str(gpu_layers),'--cache-type-k','f32','--cache-type-v','f32','--flash-attn','off','--threads','4',*transport,'--no-webui','--log-disable'],stdin=subprocess.DEVNULL,stdout=subprocess.DEVNULL,stderr=subprocess.DEVNULL,env=env)
+   child=subprocess.Popen([str(executable),'-m',str(ROOT/'model.gguf'),'--embedding','--pooling','mean','--embd-normalize','2','--ctx-size','8192','--batch-size','8192','--ubatch-size','8192','--parallel','1','--n-gpu-layers','99','--cache-type-k','f32','--cache-type-v','f32','--flash-attn','off','--threads','4',*transport,'--no-webui','--log-disable'],stdin=subprocess.DEVNULL,stdout=subprocess.DEVNULL,stderr=subprocess.DEVNULL,env=env)
    started=time.monotonic()
    while child.poll() is None and time.monotonic()-started<=limit:
     try:
@@ -106,13 +106,12 @@ def load():
    if child.poll() is None:
     child.kill();child.wait()
    return None
-  # Metal first: on Apple silicon it embeds a batch about 56 times faster than the CPU (0.7 s against 39 s for 8 passages at load 44-76),
-  # with vectors of cosine 0.9998 or more to the CPU's. Where Metal cannot start (a VM, CI, no GPU) the server exits or never becomes
-  # healthy, and the same server starts on the CPU. A busy machine can take minutes to start it; both limits stay under the host's start
-  # deadline (START_DEADLINE_MS, 600 s). Windows has no Metal.
-  server=None if WINDOWS else launch(99,120)
-  if server is None:server=launch(0,400)
-  if server is None:raise Refusal('native_start_failure')
+  # Semantic recall runs on Metal only (the project's platform choice): on Apple silicon it embeds a batch about 56 times faster than the
+  # CPU did (0.7 s against 39 s for 8 passages at load 44-76). Where Metal cannot start (a VM, no GPU) the server exits or never becomes
+  # healthy, and semantic recall goes off with that reason; word recall keeps working. A busy machine can take minutes to start it; the
+  # limit stays under the host's start deadline (START_DEADLINE_MS, 600 s).
+  server=launch(540)
+  if server is None:raise Refusal('metal_unavailable')
  return server
 def run(req):
  op=req['op']

package/src/build-id.ts

@@ -1 +1 @@
-export const BUILD_ID = "d2b2e6b0e594b5dd41e9771c43f4ed0355d8fd048c4e247541199f3b812751d3";
+export const BUILD_ID = "52dc04a544dfbc3cdf7e9dccd5f192350d56889968cf2bd4bd176405ab65a29a";

package/src/clip.ts

@@ -0,0 +1,47 @@
+import type { ToolResultMessage } from "@earendil-works/pi-ai";
+import { conversationTokens, type Messages } from "./budget.js";
+import { MAX_RECALL_CHARACTERS } from "./recall.js";
+
+/** What a request carries in place of one fresh tool result that the room cannot hold: its head and tail, and where the rest is. */
+export interface Clip { toolCallId: string; content: ToolResultMessage["content"] }
+
+/** The text `tuck_recall {entryId, offset}` reads from a text-only result; any other result is not clipped. */
+const textOf = (message: ToolResultMessage) => message.content.every(block => block.type === "text")
+    ? message.content.map(block => block.type === "text" ? block.text : "").join("\n") : undefined;
+
+const clipped = (text: string, keep: number, entryId: string): ToolResultMessage["content"] => {
+    const head = Math.ceil(keep / 2), tail = keep - head;
+    return [{ type: "text", text: text.slice(0, head) +
+        `\n[pi-tuck: characters ${head}-${text.length - tail} of ${text.length} are not shown, to fit the context window; read them with ` +
+        `tuck_recall {"entryId":"${entryId}","offset":${head}}, up to ${MAX_RECALL_CHARACTERS} characters a call]\n` + text.slice(text.length - tail) }];
+};
+
+/** The round's text results within `budget` tokens together: each result smaller than an equal share of what is left stays whole, and the
+ * rest are clipped to that share, keeping the most head and tail characters that fit it. None when the round already fits, or when a share
+ * cannot hold even the locator. A round of one result gets the whole budget. Deterministic: the same round and budget always clip the same way. */
+export function clipFor(results: readonly ToolResultMessage[], entryIdOf: (toolCallId: string) => string | undefined, budget: number): Clip[] {
+    const tokens = (message: ToolResultMessage) => conversationTokens([message] as Messages);
+    const round = results.flatMap(result => { const text = textOf(result), entryId = entryIdOf(result.toolCallId);
+        return text === undefined || !entryId ? [] : [{ result, text, entryId, size: tokens(result) }]; })
+        .sort((a, b) => a.size - b.size);
+    if (round.reduce((sum, item) => sum + item.size, 0) <= budget) return [];
+    const clips: Clip[] = [];
+    let left = budget;
+    for (const [at, { result, text, entryId, size }] of round.entries()) {
+        const share = Math.floor(left / (round.length - at));
+        if (size <= share) { left -= size; continue; }
+        const fits = (keep: number) => tokens({ ...result, content: clipped(text, keep, entryId) }) <= share;
+        if (!fits(0)) return [];
+        let low = 0, high = text.length;
+        while (low < high) { const mid = Math.ceil((low + high) / 2); if (fits(mid)) low = mid; else high = mid - 1; }
+        const content = clipped(text, low, entryId);
+        clips.push({ toolCallId: result.toolCallId, content });
+        left -= tokens({ ...result, content });
+    }
+    return clips;
+}
+
+/** The messages with each clipped result replaced; the same array when nothing is clipped. */
+export const applyClips = <M extends { role: string }>(messages: M[], clips: ReadonlyMap<string, Clip>): M[] => !clips.size ? messages
+    : messages.map(message => message.role === "toolResult" && clips.has((message as unknown as ToolResultMessage).toolCallId)
+        ? { ...message, content: clips.get((message as unknown as ToolResultMessage).toolCallId)!.content } : message);

package/src/compaction.ts

@@ -5,6 +5,7 @@ import { exportSource } from "./source-export.js";
 import { isDeepStrictEqual } from "node:util";
 import { assertNativeToolRounds } from "./protocol.js";
 import { projectedMessages } from "./omissions.js";
+import { applyClips, clipFor, type Clip } from "./clip.js";
 import { DEFAULT_CUT_AT, bandOf, chooseCut, conversationTokens, decideCut, gateCut, incomingEventTokens, incomingTokens, measurableConversationTokens, planningReserve, projectedConversationTokens, requestTokens, systemPart, validCutAt,
     type AgentMessage, type Messages, type Plan, type Target, type ToolShape } from "./budget.js";
 import { isContextOverflow } from "@earendil-works/pi-ai";
@@ -88,6 +89,8 @@ export function seedWindow(branch: readonly SessionEntry[], key: string): number
 }
 export interface CompactionOptions {
  semanticRecall?: SemanticRecallController;
+ /** Whether `tuck_search` exists: false where semantic recall cannot run (off Apple silicon), so the model is offered word recall only. */
+ search?: boolean;
  /** Optional host-owned transient operator preference; handle operations never call back. */
  onSemanticSetting?: (enabled: boolean) => Promise<unknown>;
  semanticStatus?: () => unknown;
@@ -119,7 +122,7 @@ export interface CompactionOptions {
 export async function installCompaction(pi: ExtensionAPI, options: CompactionOptions = {}) {
     const cutAt = options.cutAt ?? DEFAULT_CUT_AT;
     if (!validCutAt(cutAt)) throw new Error("Invalid cut point: cutAt must be a number above 0 and at most 1");
-    const semantic = options.semanticRecall ?? createSemanticRecall();
+    const semantic = options.semanticRecall ?? createSemanticRecall(), search = options.search ?? true;
     const hostAccess = () => {
         if (!active()) throw new Error("Compaction host is inactive");
         options.assertAccess?.();
@@ -238,7 +241,7 @@ export async function installCompaction(pi: ExtensionAPI, options: CompactionOpt
         if (input > 0 && Number.isSafeInteger(input) && Number.isFinite(ratio)) learn(ratio);
     });
     pi.on("agent_start", () => { admittedRun = true; pending = undefined; phase = "idle"; });
-    pi.on("agent_settled", () => { admittedRun = false; pending = undefined; phase = "idle"; forgetFailure(); });
+    pi.on("agent_settled", () => { admittedRun = false; pending = undefined; phase = "idle"; forgetFailure(); clips.clear(); });
 	const active = () => options.active?.() ?? true;
 	const settingsFor = () => options.settings ?? SettingsManager.inMemory(pi.getSettings());
 	// The standalone default reserves the model's catalogue maximum output: a transport may omit the output cap, and then only that
@@ -268,10 +271,10 @@ export async function installCompaction(pi: ExtensionAPI, options: CompactionOpt
     };
     const fits = (tokens: number, limit: number, ctx: ExtensionContext) => corrected(tokens, ctx) < limit;
     // The saved conversation and a cut's quantities are counted by the one function the guard counts with (strict, as the context hook is).
-    const measureFor = (ctx: ExtensionContext) => (messages: Messages) => projectedConversationTokens(messages, ctx, options.recallPolicy);
+    const measureFor = (ctx: ExtensionContext) => (messages: Messages) => projectedConversationTokens(applyClips(messages, clips), ctx, options.recallPolicy);
     // The planner counts with the same function, except that it does not fail on a summary in another format: a cut can replace one
     // (an operator's /compact repairs a session whose saved summary is foreign). Identical to the strict one for this compactor's summaries.
-    const plannerMeasureFor = (ctx: ExtensionContext) => (messages: Messages) => measurableConversationTokens(messages, ctx, options.recallPolicy);
+    const plannerMeasureFor = (ctx: ExtensionContext) => (messages: Messages) => measurableConversationTokens(applyClips(messages, clips), ctx, options.recallPolicy);
     const hostTokens = (ctx: ExtensionContext) => options.hostMessages ? conversationTokens(options.hostMessages(ctx)) : 0;
     const toolShapes = (names: Iterable<string>): ToolShape[] => {
         const selected = new Set(names);
@@ -285,6 +288,9 @@ export async function installCompaction(pi: ExtensionAPI, options: CompactionOpt
     let pendingCut: { mandatory: number; before: number; host: number; opportunistic: boolean; proposed: boolean } | undefined;
     let failure: Error | undefined;
     let pendingBoundaryCommit = false;
+    // Fresh tool results the room cannot hold, by call id: each request of the run carries the clip in their place; the session keeps them
+    // whole. A clip ends with its run like any failure would: the next run plans from the session as it is, where the result is no longer fresh.
+    const clips = new Map<string, Clip>();
 	const fail = (error: unknown, ctx: ExtensionContext) => {
 		recorder.stop("native-attempt-failed");
         const notify = !failure && error instanceof CapacityError;
@@ -318,7 +324,7 @@ export async function installCompaction(pi: ExtensionAPI, options: CompactionOpt
     });
 	pi.registerTool({
 		name: "tuck_recall", label: "pi-tuck history", parameters: RecallInput,
-        description: "Keyword lookup locates particular text in your current branch. {query} returns ranked passages with read coordinates; punctuation separates words. Pass the returned next as {continuation} unchanged. Use tuck_search for historical information relevant to a question, including different wording and qualifications. Knowing an identifier does not itself justify narrowing discovery. {entryId} or {index} (a summary sourceIndex or #N) reads one source, optionally with query, offset and limit in UTF-16 characters (limit defaults to 8000). {} browses history; {around} expands neighbors; {entryId,image} reads an image; outputPath writes an original to a file with the native write tool. Hidden reasoning and system records are excluded.",
+        description: "Keyword lookup locates particular text in your current branch. {query} returns ranked passages with read coordinates; punctuation separates words. Pass the returned next as {continuation} unchanged. " + (search ? "Use tuck_search for historical information relevant to a question, including different wording and qualifications. " : "") + "Knowing an identifier does not itself justify narrowing discovery. {entryId} or {index} (a summary sourceIndex or #N) reads one source, optionally with query, offset and limit in UTF-16 characters (limit defaults to 8000). {} browses history; {around} expands neighbors; {entryId,image} reads an image; outputPath writes an original to a file with the native write tool. Hidden reasoning and system records are excluded.",
 		async execute(_id, raw, signal, _update, ctx) {
 			access();
             const input = checkedInput(raw);
@@ -341,7 +347,7 @@ export async function installCompaction(pi: ExtensionAPI, options: CompactionOpt
             return reply(tuckRecall(tuck, ctx.sessionManager.getEntries(), branch, input, options.recallPolicy));
 		},
 	});
-    pi.registerTool({name:"tuck_search",label:"History search",parameters:SearchInput,
+    if (search) pi.registerTool({name:"tuck_search",label:"History search",parameters:SearchInput,
         description:"Find historical information relevant to a question, including different wording and related qualifications. Combines keyword and local embedding search. Knowing a name or identifier does not imply keyword-only lookup is sufficient. Returns original evidence up to 20000 characters; not exhaustive. Semantic search may be off or incomplete, which is not the same as no matches. Read exact originals and their context with tuck_recall at the returned locators. priorResults lists source ranges already read.",
         async execute(_id,raw,signal,_update,ctx){
             access();if(!Check(SearchInput,raw))throw new Error("Invalid broad search input");const input=structuredClone(raw);
@@ -421,7 +427,7 @@ export async function installCompaction(pi: ExtensionAPI, options: CompactionOpt
 		}
 	});
 	pi.on("session_before_tree", (event) => event.preparation.userWantsSummary ? { cancel: true } : undefined);
-    pi.on("session_start", () => { recorder.stop("session-transition"); proposalId = undefined; failure = undefined; admittedRun = false; pendingBoundaryCommit = false; identity = ""; factor = 1; pending = undefined; phase = "idle"; });
+    pi.on("session_start", () => { clips.clear(); recorder.stop("session-transition"); proposalId = undefined; failure = undefined; admittedRun = false; pendingBoundaryCommit = false; identity = ""; factor = 1; pending = undefined; phase = "idle"; });
     // The cut before a run. Pi 1.4 counts a run as started before before_agent_start, and ctx.compact() first aborts and waits for an
     // idle session, so a cut asked for there would wait on its own run. A prompt's cut is therefore made on `input`, while the session
     // is idle. before_agent_start decides only for a run no input started (one a custom message starts) and cuts only if the session is
@@ -481,57 +487,82 @@ export async function installCompaction(pi: ExtensionAPI, options: CompactionOpt
             else await preflight(ctx, incomingEventTokens(event), event.systemPrompt, event.systemPromptOptions.selectedTools);
         } catch (error) { fail(error, ctx); }
     });
+    // A cut at a public boundary, drafted against the boundary's own preview: "tool-loop" between the rounds of a run, "run-end" once its
+    // last reply is in. A run-end cut is made only at or above the band, as a tool-loop one, so the next prompt starts from below it: an
+    // input cut is bound by Pi's keepRecentTokens, and a large prompt right after a cut could leave it nothing to cut. A run-end cut that
+    // cannot be planned is no fault: the run is over, and the next prompt decides afresh. Only a tool-loop boundary has fresh results to clip.
+    const boundaryCut = (event: { entries: readonly unknown[]; context: { contextMessages: Messages; pendingMessages: readonly unknown[] }; toolResults?: Parameters<typeof clipFor>[0] }, ctx: ExtensionContext, reason: "tool-loop" | "run-end") => {
+        access();
+        // Earlier boundary drafts have a public preview but no original-source compiler
+        // contract. Preserve them and leave admission to the final guard.
+        if (event.entries.length || !isDeepStrictEqual(event.context.contextMessages,
+            ctx.sessionManager.buildSessionProjection().messages)) return;
+        if (!ctx.model) return;
+        const { response, room, band } = limits(ctx);
+        const measure = measureFor(ctx), saved = event.context.contextMessages;
+        // One snapshot per decision. Messages queued for the next request (steering, follow-ups) are in that request but not in the
+        // saved conversation. Pi's peek returns the steering queue, else the follow-up queue; a follow-up is not in the very next
+        // request while tools still run, so it can be counted early: conservative, and nothing else would cut at that later boundary.
+        const system = systemPart(ctx.getSystemPrompt(), toolShapes(pi.getActiveTools()), saved, ctx.getSystemPrompt());
+        const host = hostTokens(ctx);
+        const queued = event.context.pendingMessages.length ? conversationTokens(event.context.pendingMessages as Messages) : 0;
+        const mandatory = system + host + queued;
+        const previousSummary = saved.find(message => message.role === "compactionSummary")?.summary;
+        const decide = () => {
+            const before = measure(saved);
+            return decideCut({
+            total: before + mandatory, mandatory, before, room, band, fits: (tokens, limit) => fits(tokens, limit, ctx),
+            unreduced: "Tool-loop preflight compaction did not reduce context within the estimated request budget",
+            plan: (target): Plan<{ compaction: NonNullable<ReturnType<typeof tuckObservedDraft>["compaction"]>; reserve: number }> => {
+                const reserve = planReserve(target, room, mandatory, ctx);
+                const draft = tuckObservedDraft(tuck, { branchEntries: ctx.sessionManager.getBranch(), tokensBefore: before, previousSummary }, ctx, reserve, plannerMeasureFor(ctx), options.recallPolicy, true);
+                if (!draft.compaction) return { draft: false, capacityRejected: Boolean(draft.capacityRejected), reason: draft.unavailable };
+                const header = ctx.sessionManager.getHeader();
+                if (!header) throw new Error("Missing native session header at tool-loop boundary");
+                const preview = SessionManager.inMemory(ctx.cwd, undefined, [header, ...ctx.sessionManager.getBranch()]);
+                preview.appendCompaction(draft.compaction.summary, draft.compaction.firstKeptEntryId, before, draft.compaction.details, true);
+                const messages = preview.buildSessionProjection().messages;
+                assertNativeToolRounds(messages);
+                return { draft: true, after: measure(messages), mode: draft.mode, compaction: draft.compaction, reserve };
+            },
+            });
+        };
+        let decision = decide();
+        // Only a request that would be refused is clipped. A fresh result is kept whole by every cut (it has not reached the model yet), so
+        // a round larger than the room refuses the run. In their place the request carries the results' heads and tails, together at most
+        // half of what the room leaves the conversation, each with a tuck_recall locator to its rest. When even that is refused the refusal stands.
+        if (decision.kind === "fault" && event.toolResults) {
+            const branch = ctx.sessionManager.getBranch();
+            const entryIdOf = (toolCallId: string) => branch.findLast(entry => entry.type === "message" && entry.message.role === "toolResult" && entry.message.toolCallId === toolCallId)?.id;
+            const round = clipFor(event.toolResults, entryIdOf, Math.floor((room - mandatory) / 2));
+            if (round.length) {
+                for (const clip of round) clips.set(clip.toolCallId, clip);
+                const clippedDecision = decide();
+                if (clippedDecision.kind === "fault") for (const clip of round) clips.delete(clip.toolCallId); else decision = clippedDecision;
+            }
+        }
+        const before = measure(saved);
+        if (decision.kind === "fault" && reason === "tool-loop") throw new (decision.capacity ? CapacityError : Refusal)(decision.message);
+        if (decision.kind !== "cut") return;
+        const compaction = captureDraft(decision.plan.compaction, ctx, decision.plan.reserve, reason, before, true, false, previousSummary,
+            { response, host, mandatory, target: decision.target, margin: room - band });
+        return { entries: [{ type: "compaction" as const, summary: compaction.summary,
+            firstKeptEntryId: compaction.firstKeptEntryId, details: compaction.details }] };
+    };
     pi.on("turn_end", (event, ctx) => {
         try {
             if (!active() || !admittedRun || event.outcome !== "completed" || ctx.signal?.aborted ||
                 !event.context.canContinue || !event.toolResults.length || !settingsFor().getCompactionSettings(ctx.model).enabled) return;
-            access();
-            // Earlier boundary drafts have a public preview but no original-source compiler
-            // contract. Preserve them and leave admission to the final guard.
-            if (event.entries.length || !isDeepStrictEqual(event.context.contextMessages,
-                ctx.sessionManager.buildSessionProjection().messages)) return;
-            if (!ctx.model) return;
-            const { response, room, band } = limits(ctx);
-            const measure = measureFor(ctx), saved = event.context.contextMessages;
-            // One snapshot per decision. Messages queued for the next request (steering, follow-ups) are in that request but not in the
-            // saved conversation. Pi's peek returns the steering queue, else the follow-up queue; a follow-up is not in the very next
-            // request while tools still run, so it can be counted early: conservative, and nothing else would cut at that later boundary.
-            const system = systemPart(ctx.getSystemPrompt(), toolShapes(pi.getActiveTools()), saved, ctx.getSystemPrompt());
-            const host = hostTokens(ctx);
-            const queued = event.context.pendingMessages.length ? conversationTokens(event.context.pendingMessages as Messages) : 0;
-            const mandatory = system + host + queued;
-            const before = measure(saved);
-            const previousSummary = saved.find(message => message.role === "compactionSummary")?.summary;
-            const decision = decideCut({
-                total: before + mandatory, mandatory, before, room, band, fits: (tokens, limit) => fits(tokens, limit, ctx),
-                unreduced: "Tool-loop preflight compaction did not reduce context within the estimated request budget",
-                plan: (target): Plan<{ compaction: NonNullable<ReturnType<typeof tuckObservedDraft>["compaction"]>; reserve: number }> => {
-                    const reserve = planReserve(target, room, mandatory, ctx);
-                    const draft = tuckObservedDraft(tuck, { branchEntries: ctx.sessionManager.getBranch(), tokensBefore: before, previousSummary }, ctx, reserve, plannerMeasureFor(ctx), options.recallPolicy, true);
-                    if (!draft.compaction) return { draft: false, capacityRejected: Boolean(draft.capacityRejected), reason: draft.unavailable };
-                    const header = ctx.sessionManager.getHeader();
-                    if (!header) throw new Error("Missing native session header at tool-loop boundary");
-                    const preview = SessionManager.inMemory(ctx.cwd, undefined, [header, ...ctx.sessionManager.getBranch()]);
-                    preview.appendCompaction(draft.compaction.summary, draft.compaction.firstKeptEntryId, before, draft.compaction.details, true);
-                    const messages = preview.buildSessionProjection().messages;
-                    assertNativeToolRounds(messages);
-                    return { draft: true, after: measure(messages), mode: draft.mode, compaction: draft.compaction, reserve };
-                },
-            });
-            if (decision.kind === "fault") throw new (decision.capacity ? CapacityError : Refusal)(decision.message);
-            if (decision.kind !== "cut") return;
-            const compaction = captureDraft(decision.plan.compaction, ctx, decision.plan.reserve, "tool-loop", before, true, false, previousSummary,
-                { response, host, mandatory, target: decision.target, margin: room - band });
-            pendingBoundaryCommit = true;
-            return { entries: [{ type: "compaction" as const, summary: compaction.summary,
-                firstKeptEntryId: compaction.firstKeptEntryId, details: compaction.details }] };
+            const result = boundaryCut(event, ctx, "tool-loop");
+            if (result) pendingBoundaryCommit = true;
+            return result;
         } catch (error) { fail(error, ctx); }
     });
     pi.on("context", (event, ctx) => {
         try {
             if (!active()) return;
             access();
-            return { messages: projectedMessages(event.messages, ctx, options.recallPolicy) };
+            return { messages: applyClips(projectedMessages(event.messages, ctx, options.recallPolicy), clips) };
         } catch (error) { try { fail(error, ctx); } finally { return { messages: [] }; } }
     });
 	pi.on("session_compact_failed", (event, ctx) => {
@@ -552,9 +583,16 @@ export async function installCompaction(pi: ExtensionAPI, options: CompactionOpt
 		if (active() && !event.aborted) fail(new (event.fromExtension ? CommitFault : Error)(event.errorMessage ?? "Compaction failed"), ctx);
 	});
     pi.on("agent_before_settle", (event, ctx) => {
-        if (!pendingBoundaryCommit) return;
-        if (event.outcome === "error") fail(new CommitFault("Native tool-loop boundary draft remained unconfirmed at error settlement"), ctx);
-        else pendingBoundaryCommit = false;
+        if (pendingBoundaryCommit) {
+            if (event.outcome === "error") return void fail(new CommitFault("Native tool-loop boundary draft remained unconfirmed at error settlement"), ctx);
+            pendingBoundaryCommit = false;
+        }
+        // Pi commits these entries before the run settles.
+        try {
+            if (!active() || !admittedRun || event.outcome !== "completed" || ctx.signal?.aborted || failure ||
+                !settingsFor().getCompactionSettings(ctx.model).enabled) return;
+            return boundaryCut(event, ctx, "run-end");
+        } catch (error) { fail(error, ctx); }
     });
 	pi.on("context_with_system", (event, ctx) => {
         // Reaching the next request boundary proves native commit returned, not durable storage.

package/src/diagnostics.ts

@@ -10,7 +10,7 @@ export const DIAGNOSTIC_BUILD = BUILD_ID;
 export interface Receipt { id: string; build: string; reason: string; selectedView: string; boundary: string; settings: { draftReservedTokens: number; contextWindow: number; responseReserveTokens?: number; hostInputTokens?: number; mandatoryInputTokens?: number; target?: 'band' | 'room'; triggerMarginTokens?: number; cutAt?: number; calibrationFactor?: number; calibrationWindow?: number[]; calibrationIdentity?: string; activeInputCeilingTokens?: number | null }; before: { value: number; unit: 'estimated-input-tokens'; scope: 'native-preparation' | 'public-conversation' }; after: { value: number | null; unit: 'estimated-input-tokens'; scope: 'draft-preview' }; }
 export function attachReceipt<T extends { details?: unknown; firstKeptEntryId: string; tokensBefore: number }>(draft: T, reason: string, reserveTokens: number, contextWindow: number, resolved: Partial<Receipt['settings']> = {}): T & { details: Record<string, unknown> & { diagnosticReceipt: Receipt } } {
  const details = draft.details && typeof draft.details === 'object' ? draft.details as Record<string, unknown> : {};
- const receipt: Receipt = { id: randomUUID(), build: DIAGNOSTIC_BUILD, reason, selectedView: typeof details.view === 'string' ? details.view : 'deterministic-selected-draft', boundary: draft.firstKeptEntryId, settings: { draftReservedTokens: reserveTokens, contextWindow, ...resolved }, before: { value: draft.tokensBefore, unit: 'estimated-input-tokens', scope: reason === 'tool-loop' ? 'public-conversation' : 'native-preparation' }, after: { value: typeof details.tokensAfter === 'number' ? details.tokensAfter : null, unit: 'estimated-input-tokens', scope: 'draft-preview' } };
+ const receipt: Receipt = { id: randomUUID(), build: DIAGNOSTIC_BUILD, reason, selectedView: typeof details.view === 'string' ? details.view : 'deterministic-selected-draft', boundary: draft.firstKeptEntryId, settings: { draftReservedTokens: reserveTokens, contextWindow, ...resolved }, before: { value: draft.tokensBefore, unit: 'estimated-input-tokens', scope: reason === 'tool-loop' || reason === 'run-end' ? 'public-conversation' : 'native-preparation' }, after: { value: typeof details.tokensAfter === 'number' ? details.tokensAfter : null, unit: 'estimated-input-tokens', scope: 'draft-preview' } };
  return { ...draft, details: { ...details, diagnosticReceipt: receipt } };
 }
 export function receiptId(entry: { details?: unknown }): string | undefined {

package/src/semantic-recall.ts

@@ -104,13 +104,15 @@ export const HEAL_STEADY_MS=600000;
 export const IDLE_STOP_MS=600000;
 /** A worker call's deadline once the worker has answered a call after `ready`: index, embed and tokenize on a loaded model. */
 export const CALL_DEADLINE_MS=60000;
+/** Why semantic recall is off where the embedding server cannot start on Metal (a VM, a Mac without a GPU): it runs on Metal only. */
+export const METAL_UNAVAILABLE='Semantic recall needs Metal; word recall still works';
 /** What an `embed` call adds to its deadline for each text it carries. A batch of 8 passages on a starved CPU took longer than the per-call
  * deadline, and the worker failed when it should have slowed down; a query (one text) still fails fast when the server hangs. The worker
  * scales its native request timeout by the same amount (semantic-worker.py), so that limit is not reached first. */
 export const EMBED_TEXT_MS=30000;
 /** The deadline for a worker's start: Python start, `ready` (which verifies every runtime file) and the first call after it, which loads the
  * model and starts its native server. On a busy machine that takes minutes; held to the per-call deadline, the worker never started and
- * semantic recall went unavailable. It stays above the worker's own native start limits (120 s on Metal, then 400 s on the CPU, in semantic-worker.py). */
+ * semantic recall went unavailable. It stays above the worker's own native start limit (540 s, in semantic-worker.py). */
 export const START_DEADLINE_MS=600000;
 /** The most units one index window holds. The worker's SQLite store stops at 8,008 rows (`PRAGMA max_page_count=8192` in scripts/semantic-worker.py), so a cap below that keeps a window of short units from filling the store and sticking in `unavailable`. Raise it only together with the store. */
 export const MAX_INDEX_UNITS=8000;
@@ -149,7 +151,7 @@ class LocalWorker {
    const launchLine=JSON.stringify(launch)+'\n';if(this.nativeHelper&&Buffer.byteLength(launchLine)>2*1048576)throw new Error('Native owner launch bound');
    const child=spawn(this.nativeHelper?this.config.nativeOwnerHelperPath!:this.config.pythonPath,this.nativeHelper?['--run']:args,{cwd:this.scratch,env:this.nativeHelper?osEnvironment:env,stdio:'pipe',detached:!this.nativeHelper});
    this.child=child;this.exited=new Promise<void>(done=>child.once('close',(code,signal)=>{this.nativeExit={code,signal};this.rejectAll(new WorkerFailure('Local worker stopped'));done();this.lose('Local worker stopped');}));
-   child.stdout.on('data',data=>{this.buffer+=data.toString();if(this.buffer.length>16*1024*1024){this.lose('Local worker output bound');return;}let end;while((end=this.buffer.indexOf('\n'))>=0){const line=this.buffer.slice(0,end);this.buffer=this.buffer.slice(end+1);try{const reply=JSON.parse(line),pending=this.pending.get(reply.id);if(pending){clearTimeout(pending.timer);this.pending.delete(reply.id);reply.ok?pending.resolve(reply.result):pending.reject(new WorkerFailure('Local semantic runtime: '+reply.error?.code,reply.error?.code??null));if(this.nativeHelper&&this.nativeInputId===reply.id){this.nativeInputId=undefined;this.pumpNativeInput();}}}catch{this.lose('Local worker framing');}}});
+   child.stdout.on('data',data=>{this.buffer+=data.toString();if(this.buffer.length>16*1024*1024){this.lose('Local worker output bound');return;}let end;while((end=this.buffer.indexOf('\n'))>=0){const line=this.buffer.slice(0,end);this.buffer=this.buffer.slice(end+1);try{const reply=JSON.parse(line),pending=this.pending.get(reply.id);if(pending){clearTimeout(pending.timer);this.pending.delete(reply.id);reply.ok?pending.resolve(reply.result):pending.reject(new WorkerFailure(reply.error?.code==='metal_unavailable'?METAL_UNAVAILABLE:'Local semantic runtime: '+reply.error?.code,reply.error?.code??null));if(this.nativeHelper&&this.nativeInputId===reply.id){this.nativeInputId=undefined;this.pumpNativeInput();}}}catch{this.lose('Local worker framing');}}});
    child.stdout.on('error',()=>this.lose('Local worker output'));
    if(this.nativeHelper)this.helperReceipt=observeNativeFrames(child.stderr,()=>{},()=>this.closeInBackground());
    else child.stderr.resume();