fix(pi/reasoning): empty cleared reasoning instead of "[cleared]" (#162 D2, Pi)

Pi's clearOldReasoningPi/replayClearedReasoningPi rewrote aged thinking blocks to
the non-empty string "[cleared]" while KEEPING the original thinkingSignature.
Pi has no empty-sentinel conversion step (unlike OpenCode), so on canonical
Claude/Bedrock that "[cleared]" + original signature reached the wire as a
content/signature MISMATCH — a real 400 hazard (the old PARITY note calling this
"safe, matches OpenCode" was wrong).

Fix (confirmed against Pi serializer source via the Pi peer): empty the thinking
text and drop the stale signature, with no per-provider gate — EXCEPT leave
`redacted` thinking blocks untouched. Every Pi serializer drops an empty
NON-redacted thinking block before the wire (anthropic.ts, openai-completions.ts
with reasoning_content="" auto-fill, amazon-bedrock.ts, google-shared.ts,
mistral.ts). Redacted blocks are the exception: they serialize `redacted` BEFORE
the empty-thinking check (transform-messages.ts, anthropic.ts), so emptying one +
dropping its signature would put a MALFORMED redacted block (no data, no sig) on
the wire — caught by Oracle review of this diff. Redacted blocks carry no
plaintext to save, so we keep them verbatim (safe + byte-stable).

Intentionally DIFFERENT from OpenCode's gated [cleared]→sentinel path (OpenCode's
non-Anthropic adapters forward empty parts, so it must gate; Pi's drop them, so
it needn't) — PARITY.md #10 rewritten. clearOldReasoning only touches OLD
assistants; the latest keeps its real reasoning on both harnesses. Replay sets
the identical empty+no-sig shape so defer passes stay byte-identical. +1 redacted
regression test. Pi 471/0, tsc + biome clean.

Author: ualtinok

CONFIGURATION.md

@@ -311,7 +311,7 @@ Configures the background historian agent that compresses session history into c
 | `variant` | `string` | **OpenCode only.** Agent variant — selects a thinking/reasoning preset configured in OpenCode itself. Pi uses `thinking_level` instead. |
 | `thinking_level` | `string` | **Pi only.** Explicit reasoning level passed to Pi when spawning the historian subagent (`off`, `low`, `medium`, `high`). Required for GitHub Copilot reasoning models on Pi — without it, Copilot injects `"minimal"` as a default and then rejects it (HTTP 400). The Pi setup wizard prompts for this when you pick a `github-copilot/*` model. |
 | `prompt` | `string` | Custom system prompt override. |
-| `two_pass` | `boolean` | Default `false`. When `true`, runs a second editor pass after each successful historian output. The editor (a separate hidden `historian-editor` agent using the same fallback chain) re-reads the draft and removes low-signal `U:` lines, redundant paraphrases, and cross-compartment duplicates, producing cleaner narrative-first summaries. Falls back to the draft if the editor call or its validation fails, so it can never regress behavior. Adds one extra historian-scale call per compartment publication. Recommended for non-reasoning models and open-weight local models where the single-pass draft is noisier. For models with extended thinking/reasoning enabled in OpenCode (Claude 4+, GPT-5.x reasoning variants), the single-pass output is usually already clean and `two_pass` can stay `false`. |
+| `two_pass` | `boolean` | Default `false`. When `true`, runs a second editor pass after each successful historian output. The editor (a separate hidden `historian-editor` agent using the same model resolution as the historian) re-reads the draft and removes low-signal `U:` lines, redundant paraphrases, and cross-compartment duplicates, producing cleaner narrative-first summaries. Falls back to the draft if the editor call or its validation fails, so it can never regress behavior. Adds one extra historian-scale call per compartment publication. Recommended for non-reasoning models and open-weight local models where the single-pass draft is noisier. For models with extended thinking/reasoning enabled in OpenCode (Claude 4+, GPT-5.x reasoning variants), the single-pass output is usually already clean and `two_pass` can stay `false`. |
 
 ---
 

packages/docs/src/content/docs/concepts/dreamer.md

@@ -52,7 +52,7 @@ When `dreamer.inject_docs` is true (the default), these files inject into the co
 
 ## Cost and model selection
 
-The dreamer uses your configured dreamer model (or fallback chain) and reads your codebase during verification and doc maintenance. Each task spawns a child session with its own context window. Budget accordingly — a full dream run with all five tasks can be several API calls.
+The dreamer uses your configured dreamer model (and any `fallback_models` you set, then your session model as a last resort) and reads your codebase during verification and doc maintenance. Each task spawns a child session with its own context window. Budget accordingly — a full dream run with all five tasks can be several API calls.
 
 Because it runs during idle time, the dreamer is a good fit for local models, even slow ones. Configure the model in `magic-context.jsonc` under `dreamer.model`.
 

packages/docs/src/content/docs/reference/configuration.md

@@ -78,6 +78,7 @@ The background agent that condenses old conversation into compact history.
 | `historian.fallback_models` | string \\| string[] | — | Fallback model IDs if primary is unavailable |
 | `historian.two_pass` | boolean | `false` | Run a second editor pass over historian output to clean low-signal U: lines and cross-compartment duplicates. Adds ~1 extra API call and ~1.3x cost per historian run. Useful for models without extended thinking support. (default: false) |
 | `historian.thinking_level` | `"off"` \\| `"minimal"` \\| `"low"` \\| `"medium"` \\| `"high"` \\| `"xhigh"` | — | Pi only: explicit thinking level passed as --thinking <level> to Pi historian subagent invocations. Required when using reasoning models (e.g. github-copilot/gpt-5.4) because Pi's default thinking-level resolution can pick a value the provider rejects. OpenCode users set variant instead. Valid: off \| minimal \| low \| medium \| high \| xhigh |
+| `historian.disallowed_tools` | `"*"` \\| `"read"` \\| `"aft_outline"` \\| `"aft_zoom"` \\| `"aft_search"`[] | `[]` | OpenCode only. Tools to REMOVE from the historian's default allow-list [read, aft_outline, aft_zoom, aft_search]. Applies to both historian and historian-editor agents. Use ["*"] to strip all tool definitions from the model request — this prevents weak instruction-following models (e.g. mistral-small-latest) from entering tool-calling loops. Individual tool names remove just that tool. Note: a user-supplied historian.permission override can re-allow a tool that disallowed_tools removed — disallowed_tools sets the baseline, permission overrides take precedence. (default: []) |
 | `historian_timeout_ms` | number (60000–) | `300000` | Timeout for each historian prompt call in milliseconds (default: 300000) |
 | `commit_cluster_trigger` | object | — | Commit-cluster trigger: fire historian when enough commit clusters accumulate in the unsummarized tail |
 | `commit_cluster_trigger.enabled` | boolean | `true` | Enable commit-cluster based historian triggering (default: true) |

packages/pi-plugin/PARITY.md

@@ -280,13 +280,19 @@ deliberate and source-justified.
   signature) on the wire. (#162 D2.)
 
 - **Pi** (`reasoning-replay-pi.ts`): EMPTIES the thinking text (`thinking = ""`)
-  and **drops the now-stale `thinkingSignature`**, UNCONDITIONALLY (no
-  per-provider gate). Every Pi serializer drops an empty thinking block before the
-  wire — `anthropic.ts` (empty thinking skipped), `openai-completions.ts`
-  (filtered out of `nonEmptyThinkingBlocks`, with `reasoning_content=""`
-  auto-filled for providers that require it), `amazon-bedrock.ts` (empty thinking
-  skipped). So no block and no signature reach ANY provider, which structurally
-  eliminates the stale-signature mismatch and needs no gate.
+  and **drops the now-stale `thinkingSignature`**, with NO per-provider gate —
+  EXCEPT it leaves `redacted` thinking blocks **untouched**. Every Pi serializer
+  drops an *empty non-redacted* thinking block before the wire — `anthropic.ts`
+  (empty thinking skipped), `openai-completions.ts` (filtered out of
+  `nonEmptyThinkingBlocks`, with `reasoning_content=""` auto-filled for providers
+  that require it), `amazon-bedrock.ts`/`google-shared.ts`/`mistral.ts` (empty
+  thinking skipped). So no normal block and no signature reach ANY provider, which
+  structurally eliminates the stale-signature mismatch and needs no gate.
+  **Redacted blocks are the exception**: they serialize `redacted` BEFORE the
+  empty-thinking check (`transform-messages.ts`, `anthropic.ts`), so emptying one
+  + dropping its signature would put a malformed redacted block (no data, no sig)
+  on the wire. They carry no plaintext to save, so Pi keeps them verbatim — safe
+  and byte-stable.
 
 Why the OLD "keep the signature" note was wrong: a `thinkingSignature` is a
 cryptographic signature over the ORIGINAL thinking text, so `[cleared]` (or any

packages/pi-plugin/src/reasoning-replay-pi.test.ts

@@ -148,6 +148,43 @@ describe("clearOldReasoningPi", () => {
 		expect(result.cleared).toBe(0);
 		expect(result.newWatermark).toBe(0);
 	});
+
+	it("leaves REDACTED thinking blocks untouched (signature + data preserved)", () => {
+		// A redacted block bypasses the empty-thinking drop in Pi's serializers
+		// (transform-messages.ts / anthropic.ts serialize `redacted` before the
+		// empty check), so emptying it + dropping the signature would leave a
+		// malformed redacted block on the wire. It must be preserved verbatim.
+		const messages = [
+			{
+				role: "assistant",
+				timestamp: 1,
+				content: [
+					{
+						type: "thinking",
+						thinking: "opaque-redacted-payload",
+						thinkingSignature: "sig-abc",
+						redacted: true,
+					},
+				],
+			},
+		];
+		const id0 = piMessageStableId(messages[0], 0);
+		if (!id0) throw new Error("piMessageStableId returned undefined");
+		const messageIdToMaxTag = new Map<string, number>([[id0, 1]]);
+		const result = clearOldReasoningPi({
+			messages,
+			messageIdToMaxTag,
+			clearReasoningAge: 1,
+			piMessageStableId,
+		});
+		expect(result.cleared).toBe(0);
+		expect(messages[0].content[0]).toMatchObject({
+			type: "thinking",
+			thinking: "opaque-redacted-payload",
+			thinkingSignature: "sig-abc",
+			redacted: true,
+		});
+	});
 });
 
 describe("replayClearedReasoningPi", () => {

packages/pi-plugin/src/reasoning-replay-pi.ts

@@ -13,7 +13,7 @@
  *     OpenCode's reasoning-clearing replay was added to fix.
  *
  * Behavior:
-  *   - On execute passes (cache-busting): walk Pi assistant messages
+ *   - On execute passes (cache-busting): walk Pi assistant messages
  *     whose tag number is older than `clear_reasoning_age` from the
  *     newest tag, EMPTY each `PiThinkingContent.thinking` (and drop its
  *     stale signature), persist watermark = max-tag-cleared in
@@ -153,6 +153,14 @@ export function clearOldReasoningPi(args: {
 				(part as { type?: unknown }).type === "thinking"
 			) {
 				const tp = part as PiThinkingContent;
+				// Leave REDACTED thinking blocks untouched. Unlike normal thinking,
+				// redacted blocks bypass the empty-drop in Pi's serializers
+				// (transform-messages.ts and anthropic.ts serialize `redacted`
+				// before the empty-thinking check), so emptying one + dropping its
+				// signature would leave a malformed redacted block (no data, no sig)
+				// on the wire. A redacted block carries no plaintext to save anyway;
+				// keeping it verbatim is both safe and byte-stable across passes.
+				if (tp.redacted) continue;
 				// Empty the thinking AND drop its now-stale signature (a signature
 				// over the original text would mismatch the emptied content). The
 				// empty block is dropped by every Pi serializer, so neither reaches
@@ -271,6 +279,10 @@ export function replayClearedReasoningPi(args: {
 				(part as { type?: unknown }).type === "thinking"
 			) {
 				const tp = part as PiThinkingContent;
+				// Mirror clearOldReasoningPi exactly: redacted blocks are left
+				// untouched (they bypass the serializers' empty-drop, so emptying
+				// one would put a malformed redacted block on the wire).
+				if (tp.redacted) continue;
 				// Replay the exact clear shape from clearOldReasoningPi: empty
 				// thinking + dropped signature, so defer passes are byte-identical
 				// to the cache-busting pass that set the watermark.