compaction: idle cache-lapse guard so deep-ride never spikes the price

Deep-ride (95%) is cheap only while the prompt cache holds the prefix.
The one case it would cost you: ride a 1M window to 950k, walk away past
the cache TTL (~1h), and the next message re-prices all 950k at full
input rate. That's the "price went up" case.

Fix: a bounded, idle-only pre-compaction. StreamState stamps last_wire_at
on every stream start; the Tick handler (update/meta.cpp), while idle and
not already compacting, calls should_compact_on_idle() — which fires a
compaction only when the prefix is large (>= 200k) AND we've been idle
~48 min (80% of the 1h TTL). The summary runs while the prefix is still a
warm cache hit, so the user returns to a small warm context instead of
eating a cold full re-price.

Bounded to large + near-TTL-idle so ordinary pauses never trip it and
active work still rides to 95% — no early compaction during a live
session. Net: deep context retention with no price spike, ever.

Tests cover should_compact_on_idle (fires only on large prefix +
near-TTL idle; never before the first request; never on short idle even
with a huge prefix). ARCHITECTURE.md updated. Full compaction/stream/
persist/palette test group green (8/8).

Author: 1ay1

docs/ARCHITECTURE.md

@@ -313,6 +313,18 @@ tax:
   (~150K) of the most recent transcript, keeping the first user turn so the
   original task framing survives. A cheap model compresses 150K of recent
   history far better — and cheaper — than 650K in one shot.
+- **Idle cache-lapse pre-compaction — the one guard against a price spike.**
+  Deep-ride is cheap *only while the prompt cache holds the prefix*. The one
+  case it would cost you: ride to 950K, walk away past the cache TTL (~1h),
+  and your next message re-prices all 950K at full input rate. So the `Tick`
+  handler (`update/meta.cpp`) watches for it: `should_compact_on_idle()`
+  (`domain/session.hpp`) fires a compaction PRE-EMPTIVELY once the session
+  has been idle ~48 min (`kIdleCompactAfter`, 80 % of the TTL) AND the prefix
+  is large (≥ `kIdleCompactMinTokens`, 200K). The summary runs while the
+  prefix is still a warm cache hit (cheap), so you return to a small warm
+  context instead of eating a cold re-price. It is bounded to large +
+  near-TTL-idle states, so ordinary pauses never trip it — this is the *only*
+  proactive early-compaction path.
 - **The summarization request itself runs on the cheapest capable model on
   the active provider** (the same `cheapest_capable_model` router subagents
   use — see §8.5.1), not the flagship model you're chatting with.

include/agentty/domain/session.hpp

@@ -406,6 +406,15 @@ static_assert( is_legal_transition(PhaseKind::ExecutingTool,      PhaseKind::Idl
 struct StreamState {
     Phase phase = phase::Idle{};
     std::chrono::steady_clock::time_point last_tick{};
+    // Wall-clock (steady) of the most recent request we sent to the model —
+    // stamped when a stream starts. Drives the idle cache-lapse compaction
+    // trigger (see should_compact_on_idle): the prompt cache that makes a
+    // deep prefix cheap only survives ~kCacheTtl of idle, so once we've been
+    // idle nearly that long AND the prefix is large, we compact NOW (while
+    // the summary is still a cheap cache hit) rather than let the next user
+    // message re-price the whole prefix at fresh input rate after the cache
+    // has lapsed. Zero until the first request of the session.
+    std::chrono::steady_clock::time_point last_wire_at{};
     int tokens_in   = 0;
     int tokens_out  = 0;
     int context_max = 200000;
@@ -468,6 +477,43 @@ struct StreamState {
         if (thr < 0) thr = 0;
         return static_cast<int>(thr);
     }
+
+    // ── Idle cache-lapse pre-compaction ──────────────────────────────────
+    // The one case where riding deep (95 %) WOULD spike the price: the
+    // prompt cache that makes a large live prefix cheap only survives a
+    // bounded idle window (Anthropic's extended TTL is 1 hour; OpenAI's
+    // prompt-cache reuse similarly decays). Ride to 950 k, walk away past
+    // the TTL, and your next message re-prices all 950 k at FULL input rate
+    // — exactly the "price went up" the user never wants.
+    //
+    // Fix: while idle, if the prefix is large enough that a cold re-price
+    // would hurt AND we're approaching the cache TTL, compact PRE-EMPTIVELY.
+    // The summary request runs now, while the prefix is STILL a warm cache
+    // hit (cheap), and the user returns to a small warm context instead of a
+    // huge cold one. Net: the expensive cold re-price never happens.
+    //
+    // Bounded so it never fires early during ACTIVE work (that path is the
+    // 95 % threshold): it needs both a genuinely large prefix
+    // (kIdleCompactMinTokens) and a near-TTL idle gap.
+    static constexpr int kIdleCompactMinTokens = 200000;
+    static constexpr std::chrono::seconds kCacheTtl{3600};       // 1 h
+    // Fire at 80 % of the TTL so the summary request completes and re-warms
+    // the (now small) prefix before the old cache would have lapsed.
+    static constexpr std::chrono::seconds kIdleCompactAfter{2880}; // 48 min
+
+    // Should we pre-emptively compact because we've gone idle long enough
+    // that the prefix cache is about to lapse and a cold re-price looms?
+    // `est_prefix_tokens` is the calibrated wire estimate of the current
+    // transcript. Returns false when idle-timing is unknown (no request yet)
+    // or the prefix is small (a cold re-price of < 200 k is not worth a
+    // summary round).
+    [[nodiscard]] bool should_compact_on_idle(
+        std::chrono::steady_clock::time_point now,
+        int est_prefix_tokens) const noexcept {
+        if (last_wire_at.time_since_epoch().count() == 0) return false;
+        if (est_prefix_tokens < kIdleCompactMinTokens) return false;
+        return (now - last_wire_at) >= kIdleCompactAfter;
+    }
     // True while a compaction round is in flight: the request that
     // includes the synthesised "summarise per spec" prompt has been
     // dispatched and the assistant is streaming its summary into the

src/runtime/app/update/meta.cpp

@@ -607,6 +607,34 @@ Step meta_update(Model m, msg::MetaMsg mm) {
                 return {std::move(m), std::move(midrun_trim)};
             if (!settle_freeze_trim.is_none())
                 return {std::move(m), std::move(settle_freeze_trim)};
+
+            // ── Idle cache-lapse pre-compaction ───────────────────────────
+            // Deep-ride (95 %) is cheap only while the prompt cache holds the
+            // prefix. If we've sat idle long enough that the cache is about
+            // to lapse AND the prefix is large, the user's NEXT message would
+            // re-price the whole thing at full input rate. Pre-empt it: fire
+            // a compaction NOW while the prefix is still a warm cache hit, so
+            // they come back to a small warm context. This is the ONLY
+            // proactive early-compaction path; it is bounded to genuinely
+            // large + near-TTL-idle states so ordinary pauses never trip it.
+            if (m.s.is_idle()
+                && !m.s.compacting
+                && !m.s.autocompact_disabled
+                && !m.d.current.messages.empty()) {
+                const int est = static_cast<int>(
+                    cmd::estimate_wire_tokens(m.d.current) * m.s.est_calibration);
+                if (m.s.should_compact_on_idle(now, est)) {
+                    // Clear last_wire_at so we don't re-fire every Tick while
+                    // the compaction request is being dispatched; StreamStarted
+                    // re-stamps it when the summary request actually goes out.
+                    m.s.last_wire_at = {};
+                    auto compact_cmd = Cmd<Msg>::task(
+                        [](std::function<void(Msg)> dispatch) {
+                            dispatch(CompactContext{});
+                        });
+                    return {std::move(m), std::move(compact_cmd)};
+                }
+            }
             return done(std::move(m));
         },
         [&](Quit) -> Step {

src/runtime/app/update/stream.cpp

@@ -784,6 +784,12 @@ Step stream_update(Model m, msg::StreamMsg sm) {
     return std::visit(overload{
         [&](StreamStarted) -> Step {
             auto now = std::chrono::steady_clock::now();
+            // Stamp the last-request clock for the idle cache-lapse
+            // pre-compaction trigger (StreamState::should_compact_on_idle).
+            // NOT gated on !compacting: a compaction request re-warms the
+            // (soon-to-be-small) prefix too, so it legitimately resets the
+            // idle timer.
+            m.s.last_wire_at = now;
             // The phase variant guarantees a non-null ctx when active;
             // StreamStarted only fires after submit_message / retry has
             // already moved us into Streaming.

tests/compaction_threshold_test.cpp

@@ -97,6 +97,41 @@ int main() {
         std::puts("threshold: unknown/zero window never triggers");
     }
 
+    // ── idle cache-lapse pre-compaction ──────────────────────────────────
+    // The safety net for the ONE case deep-ride would spike price: sitting
+    // idle past the cache TTL with a huge prefix. It fires only when BOTH
+    // the prefix is large and the idle gap is near the TTL, and never before
+    // the first request of the session.
+    {
+        using namespace std::chrono;
+        StreamState s;
+        const auto t0 = steady_clock::time_point{} + hours{5};  // arbitrary base
+
+        // No request sent yet → never fires, regardless of size/idle.
+        assert(!s.should_compact_on_idle(t0 + hours{2}, 500000));
+
+        s.last_wire_at = t0;
+
+        // Large prefix + long idle (48+ min) → FIRES.
+        assert(s.should_compact_on_idle(t0 + StreamState::kIdleCompactAfter,
+                                        300000));
+        assert(s.should_compact_on_idle(t0 + minutes{55}, 300000));
+
+        // Large prefix but still ACTIVELY working (short idle) → does NOT
+        // fire — no early compaction during a live session.
+        assert(!s.should_compact_on_idle(t0 + minutes{5}, 900000));
+        assert(!s.should_compact_on_idle(t0 + minutes{30}, 900000));
+
+        // Long idle but SMALL prefix → not worth a summary round.
+        assert(!s.should_compact_on_idle(t0 + hours{2},
+                                         StreamState::kIdleCompactMinTokens - 1));
+
+        // Exactly at the min-tokens boundary + past the idle gap → fires.
+        assert(s.should_compact_on_idle(t0 + hours{2},
+                                        StreamState::kIdleCompactMinTokens));
+        std::puts("idle-compaction: fires only on large prefix + near-TTL idle");
+    }
+
     std::puts("ALL COMPACTION-THRESHOLD TESTS PASSED");
     return 0;
 }