docs(cache-policy): MC-under-SUBC migration map (collapse/relocate/survive)

The grand picture of the self-inflicted transform machinery and its fate under
the SUBC migration. Establishes that most of MC's transform is
state-reconstruction + multi-writer-defense + per-harness-divergence machinery
that exists only because MC is a stateless guest in someone else's process
(re-handed a fresh array every pass), sharing one DB with sibling processes, over
two message models. Three collapse drivers (no held state / shared DB / two
message models), a per-machinery fate table, what genuinely survives, and the
honest risk relocation (many shallow per-pass defenses -> three deep
golden-vector-testable invariants: delta-anchor correctness, encode/decode
byte-fidelity, restart recovery).

Co-authored-by: Alfonso [Magic Context] <288211368+alfonso-magic-context@users.noreply.github.com>

Author: ualtinok

docs/cache-policy/mc-subc-migration-map.md

@@ -0,0 +1,104 @@
+# MC-under-SUBC migration map: what collapses, what survives
+
+The grand picture for moving MC's transform into a SUBC Rust module. Companion to
+`ck-message-field-inventory.md` (message representation) and
+`cache-stability-golden-vectors.json` (cache mechanics). This one maps the
+**self-inflicted machinery** - the code that exists not because of provider or
+cache requirements, but because of MC's runtime POSITION today.
+
+## Thesis
+
+> Most of MC's transform is not reduction logic. It is **state-reconstruction
+> and multi-writer-defense machinery** that exists only because MC is a stateless
+> guest in someone else's process, re-handed a freshly-rebuilt message array
+> every pass, sharing one SQLite DB with sibling processes, over two different
+> message models. CK + a single stateful SUBC daemon + one canonical message
+> deletes that machinery. The cache discipline is not deleted - it is
+> centralized into the cache-policy core we already specced.
+
+## The three collapse drivers
+
+Every self-inflicted quirk traces to exactly one of these, each changed by the migration:
+
+1. **MC holds no state between passes.** OpenCode/Pi re-hand a fresh array with
+   ORIGINAL un-prefixed content every pass, so every mutation (tag prefix, strip,
+   clear, drop, compress) must be RE-DERIVED deterministically each pass and
+   gated by a persisted-DB watermark to stay byte-identical. -> CK: the module
+   HOLDS the canonical array; it receives a tail-delta + fingerprint, not the
+   full array.
+2. **Many processes share one session DB.** OpenCode + Pi + multiple instances
+   race, so every persisted decision is written via CAS/delta and guarded by
+   `BEGIN IMMEDIATE` and leases. -> CK: one MC daemon is the single writer.
+3. **Two message models** (OpenCode MessageV2, Pi AgentMessage). -> CK: one CK
+   Message with thin per-harness encoders/decoders.
+
+## The fate table
+
+Fate ∈ {COLLAPSE (gone), RELOCATE (survives but moves/centralizes), SURVIVE
+(genuine, largely unchanged)}.
+
+| Machinery (today) | Driver | Fate | Why |
+|---|---|---|---|
+| `§N§` re-prefix every pass (`tag.loop`, O(parts)/pass, ~53ms on 2M sessions, note #283) | 1 | RELOCATE | The held array stays prefixed; prefixing becomes incremental on tail-entry only. The hottest perf path largely vanishes. |
+| Reasoning-clear replay (`cleared_reasoning_through_tag` watermark, re-applied every pass) | 1 | RELOCATE | The held array already has cleared reasoning; the watermark demotes from per-pass-hot to cold restart-recovery. |
+| Placeholder-strip replay (`stripped_placeholder_ids`) | 1 | RELOCATE | Same - decision embodied in held state. |
+| Stale-`ctx_reduce`-strip replay (`stale_reduce_stripped_ids`) | 1 | RELOCATE | Same. |
+| Processed-image-strip replay (`stripped_image_ids`) | 1 | RELOCATE | Same. |
+| Synthetic-todowrite byte-identical replay (`mc_synthetic_todo_<hash>` anchor) | 1 | RELOCATE | Same - held, not re-synthesized per pass. |
+| Emergency-drop idempotence latch (`last_emergency_input_sample`) | 1 | RELOCATE | Held-state makes the "did I already drop on this input" check trivial. |
+| Caveman depth replay (`tags.caveman_depth`) + `drop_mode` replay (`tags.drop_mode`) | 1 | RELOCATE | Held compressed/dropped state replaces per-pass re-derivation. |
+| **All of the above unify into the cache-policy core's single frozen-set** | 1 | RELOCATE | Per-strip watermark tables -> one `frozen_units` set in the Rust core (the golden-vector state). N tables -> 1. |
+| Empty-text **sentinels for index stability** (`makeSentinel`/`isSentinel`/`replaySentinelByMessageIds`) | 1 | COLLAPSE | They exist ONLY to keep array-index shape stable across re-handed arrays. We hold post-strip state -> just omit the part. Gone. (The VISIBLE `[dropped §N§]` placeholder is NOT this - it survives as a frozen-unit render.) |
+| Sentinel-in-place (OpenCode) **vs** splice-out (Pi) drop mechanism split | 3 | COLLAPSE | One CK drop mechanism. The split was pure message-model accident. |
+| Pi omits `stripStructuralNoise` / `stripReasoningFromMergedAssistants` | 3 | COLLAPSE | Becomes an encoder property (CK carries no structural-noise parts; merge is a serializer property), not divergent transform code. |
+| CAS/delta writes (`applyStrippedPlaceholderDelta`, `casChannel2NudgeState`, "sibling concurrent discovery" guards) | 2 | COLLAPSE | One writer -> no races -> no CAS/delta defense. |
+| Lease subsystem (Channel-2 claims + `healWedgedChannel2Claims`, compartment leases, dream leases, `BEGIN IMMEDIATE` coordination) | 2 | RELOCATE/COLLAPSE | Single-daemon serialization replaces cross-process leases; intra-daemon task ordering is in-process, not DB-lease. |
+| Per-harness duplicated transform code (the whole PARITY.md tax) | 3 | COLLAPSE | One transform + two thin adapters. PARITY.md mostly retires. |
+| Provider-quirk residual (empty-content `[dropped]`, reasoning shape) | (prev round) | RELOCATE | Downstream quirk pass; ZERO on owned path if llm-runner heals like Pi (see inventory healing profiles). |
+| Compaction-marker coordination with OpenCode (`filterCompacted` boundary) | 3 | SURVIVE (plugin-path only) | Still needed where MC is a guest in OpenCode; internal/absent on the owned harness. |
+
+## What genuinely SURVIVES (not artifacts)
+
+These are real session facts, not reconstruction machinery - they persist under CK too:
+
+- The reduction/reclaim **decisions** (what to drop, when, the scheduler) - the
+  actual product logic.
+- The cache classification (SOFT+/SOFT/HARD) and frozen-set discipline -
+  **hoisted** into the SUBC cache core, not deleted.
+- The VISIBLE `[dropped §N§]` placeholder content (model awareness) - a
+  frozen-unit render.
+- Usage tracking, protected-tail boundary, overflow detection, historian-failure
+  state, emergency-drain latch.
+- The note system, auto-search hints, nudge cooldown bands (the cooldown is
+  genuine; only the multi-writer claim machinery collapses).
+- The `tags` table identity + cached token counts (agent references + sums) -
+  genuine; only the re-prefix-every-pass loop relocates.
+- Durable restart-recovery persistence - still required, but COLD path
+  (reconstruct on daemon restart), not per-pass.
+
+## Honest risk relocation (complexity moves, does not vanish)
+
+The migration trades MANY shallow per-pass defenses for a FEW deep invariants.
+The new load-bearing risks:
+
+1. **Delta-anchor correctness.** The tail-delta + fingerprint protocol must be
+   exactly right or it is a cache catastrophe - this is the golden-vector
+   anchor-validity (host-trim-below-coverage vs in-coverage-revert). One bug
+   here replaces a whole class of small ones.
+2. **Encode/decode byte-fidelity.** The keystone invariant
+   `render(project(ck)) == render(project(strip_harness_flags(ck)))` must hold,
+   or held-state diverges from wire.
+3. **Restart recovery.** The stateful daemon must reconstruct canonical + the
+   frozen-set from durable store on restart, byte-identically.
+
+These are fewer, centralized, and golden-vector-testable - which is the good
+trade. The self-inflicted machinery is replaced by three invariants we have
+already specced.
+
+## Headline
+
+CK + single stateful daemon + one canonical message deletes the
+state-reconstruction half of MC's transform and unifies the multi-writer-defense
+and per-harness-divergence halves. The perf hot paths (re-prefix, full-scan
+re-derivation) largely vanish because the held array is incremental. What remains
+is reduction logic + the centralized cache core + three load-bearing invariants.