docs: compaction at 85% of n_ctx, and ToolSummary in the index

Co-Authored-By: Grok 4.6 <noreply@x.ai>

docs/decisions.md

@@ -6,6 +6,7 @@ Newest first. A decision that changes `docs/design.md` lands in the same commit
 
 | Date | Decision | Reason |
 |---|---|---|
+| 2026-10-03 | M5d design (spec `docs/specs/2026-10-03-m5d-scheduler.md`, approved): two halves, epochs and compaction then the scheduler; compaction after a turn at 85% of `n_ctx` (configurable), never because the session has been quiet; turn numbers monotonic across epoch files; `untrusted()` reads every epoch; heartbeat and cron on the background slot, answers in the session log only; `http_fetch` summaries indexed as `ToolSummary` with the result's labels; the tiering job is an ordinary cron job that may call `memory`. | Owner's answers, 2026-10-03 (spec section 11). Closes the open row on trust across compaction. |
 | 2026-09-28 | One Rust toolchain everywhere: 1.98.1, which titan and talos run, pinned in the flake through `rust-overlay` for the Nix build and the dev shell; `rust-version` rises from 1.95 to 1.98. | Owner's decision, 2026-09-27. Plans are checked on titan and run on straylight or talos; a clippy difference between hosts stopped an M5a task (T34). nixos-26.05's own Rust stays 1.95.0, so the toolchain comes from the overlay rather than a newer nixpkgs, which host configs that follow `nixpkgs` would undo. |
 | 2026-09-27 | M5c design (spec `docs/specs/2026-09-27-m5c-honcho.md`, approved): the owner and other people are observed Honcho peers, the agent's peer is not; every trusted memory write is mirrored as a conclusion at once (a `user.md` entry as the owner's, a `memory.md` entry or note as the agent's), and undo deletes it; a turn without complete speaker information is not synced; `memoryd` records each decision and send in an append-only ledger, `memory/honcho.jsonl`, which is also the outbox; `recall` searches the local index, other agents' trusted workspaces and the fleet, never the agent's own workspaces; `ask_memory` asks each named workspace by workspace chat, `minimal` by default; API keys per workspace from `bxcore::secrets`. M5c is planned and run in two halves, the write path first. | Owner's decisions, 2026-09-27, grounded in `roncho` 1.0.0 (checked against its requirements) and Honcho 3.2.0 (source read at `v3.2.0`, and rift's live metrics). |
 | 2026-09-27 | M5b settles three open items. An invalid-arguments denial carries its reason (`ToolResponse::Denied.detail`, one line, 300 characters at most). `loopd` neutralises the model's chat-template tags when text from outside is first logged (user messages, tool results after their cap, the memory block), checked against the tokenizer by the self-test in two `/tokenize` requests. The secret store is `bxcore::secrets`, behind the `secrets` feature, for every role but `loopd`. | M5b spec, sections 4, 5 and 8; landed 2026-09-27, device-checked on straylight (review in `docs/implementer-log.md`). The self-test's per-tag requests overran `inferproxy`'s burst on the device and were batched (review finding 10). |
@@ -78,7 +79,6 @@ Newest first. A decision that changes `docs/design.md` lands in the same commit
 | Whether cloud-led sessions are ever allowed, and for which data classes. | M6 |
 | Session-scoped and standing approvals for tools other than memory: answering an approval with `!approve 42 session` (the same pattern for the rest of the session) or `!approve 42 always` (standing), words after the id as `!deny 42 <reason>` has (owner's syntax, 2026-09-24). To settle: what "session" covers (this call's tool and path or host, or the whole grant it matched); and where "always" writes, since `brokerd` cannot write grants (a proposed grant for the owner, or a separate directory of chat-approved grants). A temporary grant is new authority (the grants are the owner's files, and `brokerd` cannot write them), so it needs its own design. Owner's point, 2026-09-24: a harness should not ask a stream of questions. | after M5 |
 | Projects in memory. Honcho can separate projects by a workspace per project (hard walls, shared naturally by every agent on the project, but Honcho's picture of the owner splits per workspace) or by scopes inside one workspace (one picture, recall filtered by project; semantics not yet read). Either way a project is a `memoryd` setting: its channels and threads, its workspace or scope, `write` and `trust`. A shared project workspace is written by several agents, so its trust is the owner's call per project. Test both on rift before choosing. Owner's idea, 2026-09-24. | M5c or later |
-| A session's trust across compaction. From M5b (plan task 09) `loopd` reads whether a session has read untrusted content from its log: true once any tool result in `sessions/<id>/0.jsonl` is labelled untrusted, and it never goes back. Compaction starts a new epoch file, so the state must be carried into the new epoch (a record at its head, or `untrusted()` reading every epoch), or a compacted session would read as clean and `gatewayd` would leave its links live. | the milestone that adds compaction |
 
 ## Applied to the design brief
 
@@ -114,6 +114,8 @@ Later changes to the brief:
 | 2026-09-24 | P20, Milestones: M5 becomes M5a (local memory in `memoryd`), M5b (Honcho) and M5c (the scheduler and the tiering job); the embedding-index M5b goes. | Owner's approval, 2026-09-24; see the row of that date under Decided. |
 | 2026-09-24 | P21, Memory 1, 2, 6, 7, State and Milestones: memory is identity (`soul.md`, `memory.md`, `user.md`, in the prompt, edited only by clean sessions) and experience (`notes.md` and session logs, recalled with a source tag: `identity`, `memory`, `memory-tainted`); writes need no approval; `note` in any session; an untrusted session's identity `add` becomes a note; a check on every write, a journal and undo; the policy of the memory tools is built in. | Owner's approval, 2026-09-24; see the rows of that date under Decided. |
 | 2026-09-27 | P23, as amended by the M5c spec (`docs/specs/2026-09-27-m5c-honcho.md`), Memory 4 and 5: per agent a trusted and an untrusted Honcho workspace for turns (the speaker's message and the final reply); untrusted notes, as messages, to one fleet workspace every agent shares and reads, always untrusted; nothing above `private`, and never a `secret` session; the gate is `brokerd`'s session state, asked over a read-only socket when the turn ends, with `loopd`'s labels as a second check; no rebuild from the logs. | Owner's decisions, 2026-09-25 (P23) and 2026-09-27 (the amendments). The fleet workspace keeps one agent's raw untrusted turns out of the others' dialectic (Honcho cannot delete a message, and its dialectic filters only by session); rebuild is dropped because Honcho accumulates and is corrected by contrary facts. |
+| 2026-10-03 | P25, Inference contract 4: compaction runs after a turn when `cache_n + prompt_n` is at or above a configured fraction of `n_ctx` (default 0.85), while the session is not in another turn. A quiet session stays on its current epoch. | Owner's approval, 2026-10-03; M5d spec `docs/specs/2026-10-03-m5d-scheduler.md`. An idle timer would compact while the owner slept. |
+| 2026-10-03 | P26, Memory 3: the local index also holds `ToolSummary` records for tools that opt in, labelled as the tool result was. Raw tool results stay unindexed. | Owner's approval, 2026-10-03; M5d spec. A fetch's body is otherwise invisible to `recall`. |
 
 ## Proposed changes to the design brief