Compaction v2 (2/3): ModelSummary and ProviderDefault strategies, delete signal pruning

[pbdeuchler]

Closes #195. Builds on merged PR #197 / #194, and incorporates the boundary requirements discovered while designing #196.

Cohesive issue lineage

Issue	Pull request	Responsibility
#194	#197	Token ledger, Halter-owned triggers, hard context cap, and the first-class strategy seam
#195	#198	ModelSummary and ProviderDefault, config selection, and deletion of signal pruning
#196	follow-up	CleanWindow; its per-session reminders and forced rollover drove the revised boundary API in this PR

Summary

This supplies what happens when #197's ledger says it is time to rewrite context.

ModelSummary (new default)

• When the task tool is registered, first nudges the model to persist concise remaining work. Only task calls execute; text and foreign calls are excluded from the next request while the successful exchange remains in the event log.
• Sends the built-in checkpoint instructions plus manual custom instructions.
• Starts a fresh window with one user-role checkpoint message after the byte-stable static prefix. No old tail is retained; a todo reminder is appended only when task calls ran.

ProviderDefault

• Delegates to Provider::compact only when Halter's ledger requests it. Provider-side automatic triggers remain disabled.
• Uses provider capability metadata to select a dedicated or inline transport.
• Dedicated compaction rewrites everything before the latest assistant block. Inline compaction rewrites the older prefix before the latest user message and preserves the user-led suffix, so the provider-native summary remains chronologically before retained messages.
• Empty provider output is an error and cannot erase the session.

Config and deletion

• context.compaction = "model_summary" | "provider_default"; model_summary is the default.
• Selecting provider_default for an unsupported default provider fails during HalterBuilder::build.
• Removes signal scoring and pruning, preserved-tail summary types, context.pre_compaction_target, context.prune_signal_threshold, and Provider::compaction_window.

Cohesive-review remediation

The follow-up commit 8fae7e3 remediates the findings from reviewing #197 and #198 together:

• Complete context accounting: the ledger now includes prompt/skill/hook segments, tool declarations, per-message overhead, and media-only messages. It tracks request-base deltas without double-counting provider anchors.
• Safe persistence and replay: versioned legacy/unknown ledgers rebuild from the transcript before use. ContextProjectionUpdated makes request-base changes replayable; compaction usage and logical-window advancement fold identically in live and replayed state.
• Correct boundaries and caps: automatic compaction triggers exactly at the configured threshold; the hidden 100-token buffer is gone. Stop-hook and PostCompact hook context, plus request-only model-judge guidance, participate in cap checks.
• Transactional strategies: Err and Ok(None) restore staged transcript, usage, events, and fired-hook state. Empty ModelSummary and ProviderDefault output cannot destroy context. Automatic no-op passes still complete the PreCompact/PostCompact hook pair.
• Usage telemetry: ModelSummary inference and provider-native compaction usage reach SessionState::usage_so_far, TurnCompleted, compaction events, and replay.
• CleanWindow-ready boundary API: threshold_notifications is replaced by context_boundary(CompactionBoundary), with session/window identity, previous/current counts, persisted per-window notification IDs, and Continue / Compact / Rollover directives. Successful rewrites advance the logical window and re-arm notifications.

Commit 96cb77a makes the boundary tests derive their thresholds from the session's actual prompt and compiled tool specs, keeping their intended ordering stable under both default and all-features builds.

Breaking changes

• The default strategy changes from provider-native compaction to ModelSummary; select provider_default to retain the prior behavior.
• Removed pruning config/types and Provider::compaction_window as described above.
• CompactionStrategy::threshold_notifications is replaced by context_boundary; CompactionTrigger gains Rollover.
• CompactionContext fields are private; use its accessors and action methods.
• CompactionEffects and CompactionEventEffects gain usage.
• SessionState gains context_window and compaction_notifications.
• SessionEventPayload gains ContextProjectionUpdated; exhaustive matches need a new arm.
• TokenLedger gains request-base/accounting-version fields; struct literals should use ..TokenLedger::default().
• RuntimeServices gains context/strategy fields, ContextSettings gains max_tokens, and resolve_response_chain takes four arguments.

The full migration list is recorded in CHANGELOG.md.

Verification

• PLAYWRIGHT_DRIVER_VERSION=1.59.1 cargo test --workspace — 937 unit/integration tests plus 5 doctests passed.
• PLAYWRIGHT_DRIVER_VERSION=1.59.1 cargo test --workspace --all-features — 968 unit/integration tests plus 5 doctests passed.
• PLAYWRIGHT_DRIVER_VERSION=1.59.1 cargo clippy --workspace --all-targets --all-features -- -D warnings — clean.
• cargo fmt --all -- --check and git diff --check — clean.
• Mutation checks deliberately broke six crucial assumptions: the exact-threshold comparison, PostCompact request-base refresh, logical-window replay comparison, compiled-tool contribution to test thresholds, the pre-tool one-token boundary gap, and ModelSummary headroom. Every predicted regression test failed, and every mutation was restored.