fix: thread Rust decay history budget

Author: ualtinok

crates/mc-module/src/decay_render.rs

@@ -367,6 +367,7 @@ pub fn extract_m0_block(m0_text: &str, tag: &str) -> Option<String> {
 mod tests {
     use super::*;
     use serde::Deserialize;
+    use sha2::{Digest, Sha256};
 
     fn comp(
         start: i64,
@@ -657,6 +658,130 @@ mod tests {
         }
     }
 
+    #[test]
+    fn redacted_store_shape_matches_ts_at_real_history_budgets() {
+        #[derive(Deserialize)]
+        struct ShapeFixture {
+            compartments: Vec<RawComp>,
+        }
+        #[derive(Deserialize)]
+        struct DifferentialCase {
+            budget: f64,
+            #[serde(rename = "tsCost")]
+            ts_cost: usize,
+            #[serde(rename = "tsTierCounts")]
+            ts_tier_counts: [usize; 5],
+            #[serde(rename = "bodySha256")]
+            body_sha256: String,
+        }
+        #[derive(Deserialize)]
+        struct DifferentialFixture {
+            cases: Vec<DifferentialCase>,
+        }
+
+        let shape: ShapeFixture =
+            serde_json::from_str(include_str!("../testdata/decay-store-shape.json"))
+                .expect("parse redacted store shape");
+        assert_eq!(
+            shape.compartments.len(),
+            388,
+            "fixture must preserve the store shape"
+        );
+        let compartments: Vec<DecayRenderCompartment> = shape
+            .compartments
+            .iter()
+            .map(|raw| DecayRenderCompartment {
+                start_message: raw.start,
+                end_message: raw.end,
+                title: raw.title.clone(),
+                content: raw.content.clone(),
+                start_date: raw.start_date.clone(),
+                end_date: raw.end_date.clone(),
+                p1: raw.p1.clone(),
+                p2: raw.p2.clone(),
+                p3: raw.p3.clone(),
+                p4: raw.p4.clone(),
+                importance: raw.importance,
+                legacy: raw.legacy,
+            })
+            .collect();
+        let differential: DifferentialFixture =
+            serde_json::from_str(include_str!("../testdata/decay-store-differential.json"))
+                .expect("parse TS differential table");
+        assert_eq!(differential.cases.len(), 4);
+
+        let mut previous_cost = None;
+        for case in &differential.cases {
+            let body = render_decayed_compartments(
+                &compartments,
+                case.budget,
+                mc_tokenizer::estimate_tokens,
+            );
+            let rust_cost = mc_tokenizer::estimate_tokens(&body);
+            assert_eq!(
+                rust_cost, case.ts_cost,
+                "token cost drift at budget {}",
+                case.budget
+            );
+            assert!(
+                rust_cost as f64 <= case.budget || body.is_empty(),
+                "render exceeded budget {} with {} tokens",
+                case.budget,
+                rust_cost
+            );
+            if let Some(previous) = previous_cost {
+                assert!(
+                    rust_cost > previous,
+                    "shrinking budget must not grow rendered cost: previous {previous}, current {rust_cost}"
+                );
+            }
+            previous_cost = Some(rust_cost);
+
+            let digest = Sha256::digest(body.as_bytes());
+            let rust_hash = digest
+                .iter()
+                .map(|byte| format!("{byte:02x}"))
+                .collect::<String>();
+            assert_eq!(
+                rust_hash, case.body_sha256,
+                "byte drift at budget {}",
+                case.budget
+            );
+
+            let sections = if body.is_empty() {
+                Vec::new()
+            } else {
+                body.split("\n\n").collect::<Vec<_>>()
+            };
+            let mut tier_counts = [0usize; 5];
+            for compartment in &compartments {
+                let heading = format!(
+                    "## {}-{}",
+                    compartment.start_message, compartment.end_message
+                );
+                let section = sections
+                    .iter()
+                    .find(|section| section.starts_with(&heading))
+                    .copied();
+                let mut selected = 5usize;
+                for tier in 1..=5u8 {
+                    if render_compartment_at_tier(compartment, tier).as_str()
+                        == section.unwrap_or("")
+                    {
+                        selected = tier as usize;
+                        break;
+                    }
+                }
+                tier_counts[selected - 1] += 1;
+            }
+            assert_eq!(
+                tier_counts, case.ts_tier_counts,
+                "tier drift at budget {}",
+                case.budget
+            );
+        }
+    }
+
     #[test]
     fn render_tight_golden_matches_reference_with_real_estimator() {
         // The budget GUARD path: these cases use budgets tight enough that the TS

crates/mc-module/src/historian.rs

@@ -1517,6 +1517,7 @@ mod tests {
             mid_turn: false,
             prev_response_completed_at_ms: None,
             request_observed_at_ms: None,
+            history_budget_tokens: None,
             declared_trim: None,
         }
     }

crates/mc-module/src/lib.rs

@@ -92,8 +92,8 @@ use subc_protocol::{
 use transform::ReductionDecision;
 use transform::{transform_with_projection, DeclaredTrim, HistorianDiagnostics, TransformRequest};
 
-/// The per-route binding: the project, harness, session-slot value, and render budget
-/// frozen at bind. Transform routes carry the durable session in `session`; MCP facade
+/// The per-route binding: the project, harness, session-slot value, and fallback render
+/// budget frozen at bind. Transform routes carry the durable session in `session`; MCP facade
 /// routes carry an instance token there and must resolve it before touching the store.
 /// The project is NEVER taken from a per-pass request field — a crafted request could
 /// spoof it to read another project's memories — so it lives here, keyed by the route
@@ -105,10 +105,8 @@ pub struct SessionBinding {
     pub session: String,
     pub model_key: Option<String>,
     pub config: McModuleConfig,
-    /// The history budget (tokens) FROZEN at bind. Byte-affecting (a different budget → a
-    /// different m0 trim → different bytes), so it's read once and never per-pass. A
-    /// default for now (reading it from config is a later refinement); the freeze-once is
-    /// the load-bearing part — it can't change mid-session.
+    /// The fallback history budget (tokens) frozen at bind. A transform request may carry
+    /// a newer harness-resolved value because config can change while the route remains open.
     pub history_budget_tokens: f64,
 }
 
@@ -4113,6 +4111,19 @@ impl McHandler {
             "inactive"
         };
         let historian = historian_status_summary(&loaded.meta.historian);
+        // When the Rust module is active, it manages the frozen m0 in its own store
+        // instead of the harness SQLite cache. Report the exact session-history slice so
+        // status attribution does not estimate size by summing all raw-history p1 rows.
+        let compartment_tokens = loaded
+            .core
+            .frozen_units
+            .iter()
+            .find(|unit| unit.key == "m0")
+            .and_then(|unit| {
+                decay_render::extract_m0_block(&unit.frozen_payload, "session-history")
+            })
+            .map(|block| mc_tokenizer::estimate_tokens(&block))
+            .unwrap_or(0);
         let newest_pass_at = pass_trace
             .as_ref()
             .map(|trace| {
@@ -4152,6 +4163,7 @@ impl McHandler {
             "row_version": loaded.row_version,
             "boundary_present": !loaded.core.boundary_id.trim().is_empty(),
             "compartment_count": compartment_count,
+            "compartment_tokens": compartment_tokens,
             "pending_drop_count": pending_drop_count,
             "usage": {
                 "current_total_input_tokens": loaded.meta.last_usage.as_ref().map_or(0, |usage| usage.current_total_input_tokens),
@@ -5174,7 +5186,13 @@ impl McHandler {
             let producer_ctx = transform::ProducerContext {
                 project_path: &project_path,
                 project_directory: &project_path,
-                history_budget_tokens: binding.history_budget_tokens,
+                // The authority adapter resolves this from the model context limit and
+                // sends it on each pass. Keep the bind-time value only for older callers
+                // that omit the field, and reject unusable values without disabling decay.
+                history_budget_tokens: parsed
+                    .history_budget_tokens
+                    .filter(|budget| budget.is_finite() && *budget >= 0.0)
+                    .unwrap_or(binding.history_budget_tokens),
                 memory_enabled: binding.config.memory_enabled,
                 now_ms: pass_now,
                 execute_threshold_percentage: binding.config.execute_threshold_percentage,
@@ -6494,6 +6512,7 @@ impl McHandler {
             mid_turn: parsed.pass_inputs.mid_turn,
             prev_response_completed_at_ms: None,
             request_observed_at_ms: None,
+            history_budget_tokens: None,
             declared_trim: parsed.declared_trim.clone(),
         };
         let shadow_project = shadow_project_path(&binding.session);
@@ -7100,9 +7119,8 @@ impl ModuleHandler for McHandler {
                 session: req.identity.session.clone(),
                 model_key: None,
                 config,
-                // Frozen at bind. Currently a default constant (reading it from config is a
-                // later refinement); the load-bearing part is the freeze-once — a different
-                // budget would change the rendered m0 bytes, so it can't move mid-session.
+                // Older callers may omit the per-pass budget. Keep a safe fallback on the
+                // route, while authority requests carry the harness-resolved value.
                 history_budget_tokens: memory_render::DEFAULT_HISTORY_BUDGET_TOKENS,
             },
         );
@@ -11992,6 +12010,42 @@ mod tests {
             .to_string()
     }
 
+    #[tokio::test(flavor = "current_thread")]
+    async fn authority_transform_uses_request_history_budget_on_hard() {
+        let producer = Arc::new(ProducerState::default());
+        let (handler, store, _dir, _project) =
+            handler_with_store(Arc::clone(&producer), default_test_config());
+        store
+            .replace_compartments(
+                "ses",
+                &[
+                    stored_comp(1, 1, 40, "m40", &"OLD ".repeat(200)),
+                    stored_comp(2, 41, 80, "m80", &"NEW ".repeat(200)),
+                ],
+            )
+            .unwrap();
+        let mut request = request(big_messages());
+        request["history_budget_tokens"] = json!(300.0);
+
+        let response = call_transform_request(&handler, request).await;
+        assert_eq!(response["action"], "HARD");
+        let m0 = m0_text(&response);
+        assert!(m0.contains("NEW"), "newest compartment remains at P1: {m0}");
+        assert!(
+            !m0.contains("OLD"),
+            "request budget must reach the HARD decay renderer: {m0}"
+        );
+        let status = tool_body(handler.handle_session_status_value(
+            7,
+            &json!({ "method": "session.status", "v": 1, "session_id": "ses" }),
+        ));
+        let history = decay_render::extract_m0_block(&m0, "session-history").unwrap();
+        assert_eq!(
+            status["compartment_tokens"],
+            json!(mc_tokenizer::estimate_tokens(&history))
+        );
+    }
+
     #[tokio::test(flavor = "current_thread")]
     async fn handler_full_autonomous_cycle_fires_publishes_and_next_pass_folds() {
         let producer = Arc::new(ProducerState::default());

crates/mc-module/src/m0_compose.rs

@@ -90,8 +90,8 @@ pub struct M0ComposeInputs<'a> {
     /// The expiry cutoff, FROZEN at the HARD (a memory expiring after this still renders;
     /// a later defer uses the same cutoff → identical bytes).
     pub now_ms: i64,
-    /// The history budget in tokens (frozen at route bind). The decay renderer fits the
-    /// compartments to it; under a loose budget the render is estimator-independent.
+    /// The history budget in tokens selected for this frozen render decision. The decay
+    /// renderer fits the compartments to it; under a loose budget the render is estimator-independent.
     pub history_budget_tokens: f64,
     /// System-role content that is no longer in the live tail because the current fold
     /// covers its ordinal. Passing it explicitly keeps m0 composition deterministic and

crates/mc-module/src/transform.rs

@@ -122,15 +122,16 @@ struct LegacyCkItemWire {
 
 /// The project context the module composes m0/m1 FROM. Resolved once per request from the
 /// authenticated route binding (never a request body field) and threaded into the
-/// transform. Production ALWAYS supplies it; it carries the frozen render inputs (budget,
-/// expiry cutoff) so a HARD freezes them and later passes replay identical bytes.
+/// transform. Production ALWAYS supplies it; it carries the render inputs (budget,
+/// expiry cutoff) so the frozen render decision preserves them and later passes replay identical bytes.
 pub struct ProducerContext<'a> {
     /// The project identity the store reads key off (memories, mutation log, workspace).
     pub project_path: &'a str,
     /// The project directory on disk, for reading ARCHITECTURE.md / STRUCTURE.md.
     pub project_directory: &'a str,
-    /// The history budget in tokens, FROZEN at route bind (byte-affecting: a different
-    /// budget → a different m0 trim → different bytes, so it can't change mid-session).
+    /// The history budget in tokens for this pass. Authority callers resolve it from the
+    /// stable model limit and may refresh it after a config change; the route binding
+    /// supplies a fallback for older callers. A cache-busting render pass freezes the selected value in m0.
     pub history_budget_tokens: f64,
     /// Whether memory tools and m0 memory rendering are enabled for this binding.
     pub memory_enabled: bool,
@@ -257,6 +258,11 @@ pub struct TransformRequest {
     /// and would inflate every gap by that delay. Request evidence only.
     #[serde(default, skip_serializing_if = "Option::is_none")]
     pub request_observed_at_ms: Option<u64>,
+    /// History budget resolved by the harness from the stable context limit, threshold,
+    /// and history-budget percentage. Authority transforms carry it per pass because a
+    /// route can outlive a config reload; absent values use the bind-time fallback.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub history_budget_tokens: Option<f64>,
     #[serde(default, skip_serializing_if = "Option::is_none")]
     pub declared_trim: Option<DeclaredTrim>,
 }
@@ -310,6 +316,8 @@ struct TransformRequestWire {
     #[serde(default)]
     request_observed_at_ms: Option<u64>,
     #[serde(default)]
+    history_budget_tokens: Option<f64>,
+    #[serde(default)]
     declared_trim: Option<DeclaredTrim>,
 }
 
@@ -344,6 +352,7 @@ impl<'de> Deserialize<'de> for TransformRequest {
             mid_turn: wire.mid_turn,
             prev_response_completed_at_ms: wire.prev_response_completed_at_ms,
             request_observed_at_ms: wire.request_observed_at_ms,
+            history_budget_tokens: wire.history_budget_tokens,
             declared_trim: wire.declared_trim,
         })
     }
@@ -5266,6 +5275,7 @@ mod tests {
             mid_turn: false,
             prev_response_completed_at_ms: None,
             request_observed_at_ms: None,
+            history_budget_tokens: None,
             declared_trim: None,
         }
     }
@@ -6403,6 +6413,7 @@ mod tests {
             "full_array_fingerprint": "fp-full-array",
             "messages": [{ "mid": "m", "ordinal": 7, "ck": text_message("m", "hello") }],
             "usage": { "current_total_input_tokens": 1, "context_limit_tokens": 2 },
+            "history_budget_tokens": 42_000.0,
             "provider_error": "prompt is too long"
         });
         let parsed: TransformRequest = serde_json::from_value(value).unwrap();
@@ -6415,6 +6426,7 @@ mod tests {
         );
         assert_eq!(parsed.messages[0].mid, "m");
         assert_eq!(parsed.usage.unwrap().context_limit_tokens, 2);
+        assert_eq!(parsed.history_budget_tokens, Some(42_000.0));
         assert_eq!(parsed.provider_error.as_deref(), Some("prompt is too long"));
     }