git:20260930.2f50853 to git:20261012.dd21170

- Cuts the inventory size of potential context sources with three levers — cross-layer dedup,

- non-default instruction survives byte-exact or acceptance fails. Recover only recorded owned

- drafts; concurrent changes remain intact and recovery refusal is reported explicitly.

- Orchestration ONLY: every decision rule lives in `references/`, read at the phase that needs it.

- Position 1 of `$ARGUMENTS` is a **free-form prompt** (RU/EN) — modes and flags are optional and may

- follow in any order. Nobody types keys: resolve mode + scope FROM the prompt.

- 1. Strip flags (`--target=N%`, `--global`, `--memory`, `--noask`). An explicit mode token anywhere

- wins outright, no scoring.

- 2. Else score modes by distinct whole-word keyword hits (table below). Highest unique score wins.

- Tie with a destructive mode -> `AskUserQuestion`; tie with `measure` -> `measure`; tie of two

- mutating modes -> the keyword appearing first; all zero -> `measure`.

- 3. Empty arguments -> `measure`. A read-only run asks nothing.

- 4. Outcome-changing ambiguity -> ONE `AskUserQuestion` (max 4 questions) BEFORE any work, and only

- when the answer changes what gets written.

- 5. Prose that is not a mode/path is still input: extract the target, the ratio and the layer from it

- (`сожми контекст на 40%, глобальный тоже` -> mode `slim`, `--target=40%`, `--global`).

- Then print this block ONCE, before the first action:

- Labels are literal; INPUT stays verbatim; authored values follow the active work-artifact language policy.

-

- | ALWAYS-ON | Potential instruction inventory: startup files, recursive rules (path-scoped rules are conditional), imported/read conventions, client-dependent `AGENTS.md`, memory index/topics, agent descriptions, hook text | yes |

- Tier totals are potential inventory, not observed session context. `loading` reports conditions;

- `measurement.actual_loading_observed=false` requires checking runtime context before claiming actual

- cost. Legacy `token_model=chars/4` denotes the `bytes/4` proxy; Unicode/tokenizer error is corpus-dependent.

- Membership and historical measurements: `references/measurement.md`.

- `--memory` includes the memory directories; `--target=N%` is measured against THIS run's freshly

- scanned scope, never a prior run (measurement.md, "Target-ratio baseline rule").

- | Global `~/.claude` (`L3`) | ALWAYS, as authority | ONLY when `--global` is granted |

- | MCP servers, plugin enablement, `settings.json`, `~/.claude/plugins/cache/**` | signals only | NEVER — advice rows in the final report per `references/mcp-advice.md` |

- Deleting from — or REWRITING — the global layer to serve one project is a cross-project regression.

- The guard and its two branches live in `references/dedup-arbitration.md` section 5, binding on every

- mutation. Cite it, obey it, do not restate it.

- | 0 | Resolve mode + scope, one `AskUserQuestion` | no | — |

- | 3 | Cross-layer dedup analysis — orchestrator only | no | yes |

- | 4 | Fan out one optimizer subagent per file | yes | — |

- | 5 | Verify + independent checker | checkpoint-proven recovery on miss; unsafe recovery refused | yes |

- `measure` stops after phase 1. `preview` stops after phase 3 and prints the plan it would execute.

- `restore` runs phase 2's restore path alone (see Restore below).

- Apply the Prompt contract. Then ONE `AskUserQuestion` (max 4 questions), only for answers that change

- what gets written:

- SKIPPED ENTIRELY by `measure` and by `--noask`; record the literal `Skipped (--noask)` in the report.

-

- **`--noask` skips ONLY those four.** The three gates below and every ground-truth STOP always fire —

- `--noask` answering them is a defect, not a convenience:

- | Destructive mode | `hard`, `restore` | Name the mode, the scope and what is irreversible; require an explicit yes |

- | Global write | any `--global` run that will WRITE (all mutating modes) | `~/.claude` is read by EVERY project on this machine — confirm the machine-wide write |

- **EXECUTE** using Bash tool (add `--global` only when the global layer is in scope):

- > **STOP on nonzero, invalid JSON, or missing/malformed/nonempty `scan_issues`** — partial rows are diagnostics,

- > never a measurement baseline. Fix discovery and re-run; do not use partial totals in metrics, state or reports.

- The JSON carries `files[]` (path, tier, kind, bytes, tokens, estimated, loading), inventory `measurement`,

- `scan_issues` and `totals` per tier. Print

- the PLAN block NOW, with `SCOPE` naming real paths and real tier counts from this output. `measure`

- prints the per-tier table and the Advice section and stops here.

- **BOTH layers are snapshotted**, each with its own run dir under

- `~/.claude/backups/<YYYYMMDD-HHMMSS>-<layer>_context-slim/` — the one location outside both trees. The

- LAYER is in the name, so same-second project and global runs cannot collide; a further collision adds

- `-2`, `-3`. Git is an ADDITIONAL protection over TRACKED project files, never the only one — the

- snapshot is what covers the untracked and git-ignored ones. Both **EXECUTE** using Bash tool, project first:

- bash "${CLAUDE_PLUGIN_ROOT}/skills/context-slim/scripts/context-guard.sh" snapshot --project <file>...; rc=$?

- > STOP on nonzero. `EXIT:3`: dirty TRACKED paths; show them verbatim, require explicit named-edit

- > authorization before `--allow-dirty` (existing authorization suffices), otherwise ask user to

- > commit/stash those paths. `EXIT:2`: usage/state error, including existing snapshot directory;

- > use auto-named `<ts>-<layer>` dirs. Any other nonzero: snapshot failure, no edit follows.

- > `SNAPSHOT-ONLY: <n> untracked/git-ignored target(s)` is NOT an error and never blocks the run. Git has no pre-state for those files — `.claude/` and `CLAUDE.md` are git-ignored in many repos, this one included — so the manifest is their ONLY recovery path, which is exactly what phase 2 exists for. Relay the line: it names the files `git checkout` cannot bring back. Git covers TRACKED targets; the snapshot covers all of them.

- > Documented side effect, tell the user once: the guard appends `.claude/reports/` to the repo's own `.gitignore` (creating it if absent). It is NOT snapshotted and NOT restored — the line survives a `restore` and shows up in the next `git status`; remove it by hand if unwanted.

- bash "${CLAUDE_PLUGIN_ROOT}/skills/context-slim/scripts/context-guard.sh" snapshot --global <file>...; rc=$?

- > STOP on nonzero: no global edit without manifest. Guard re-roots at `$HOME/.claude` via

- > `CLAUDE_PROJECT_DIR`; non-Git roots create no `.gitignore`.

- Capture the printed `MANIFEST:` path of EACH layer — phases 5-7 need both run dirs, and a project run

- dir can never verify or restore a global file. The guard JSON-validates each manifest with `jq`, else

- `python3`; with NEITHER it prints `⚠️ ... written UNVALIDATED` and still exits 0 — relay verbatim.

- ORCHESTRATOR ONLY. A per-file subagent sees one file, so it can never judge cross-layer duplication —

- two agents would each delete the same fact "because the other keeps it". Read

- 1. Mechanical prefilter over the L0-L5 lattice only (3a exact file hashes, 3b normalized line hashes,

- 3c rare topic keys) — no LLM, no judgement. 3b and 3c are siblings; neither gates the other.

- 2. LLM judge on the UNION of 3b and 3c candidate pairs, using the verbatim question in 3d.

- 3. A differing exact value in any verdict is NOT a duplicate -> `references/contradiction-policy.md`.

- 4. Arbitrate by the precedence lattice + cost weighting; apply the global-write branch of section 5.

- 5. RU/EN spans resolve through `references/language-policy.md`. Its CARVE-OUT is absolute: a skill

- mode table's last Cyrillic cell is never proposed for removal at any depth.

- reason) and keep rows. A fact with no row means "keep it where it is". `preview` prints these lists

- and the projected token delta, then STOPS.

- **SELF-EXCLUSION, unconditional.** `brewtools/skills/context-slim/**` is removed from the fan-out list

- at every depth, in every mode, `bodies` included. The scan still COUNTS these files (measurement.md,

- "The scan counts this skill"); phase 4 never writes them — rewriting the drop/keep catalogs mid-run

- changes the orchestrator's decision basis while siblings still execute rows derived from the old text.

- Compressing this skill is a separate, single-purpose run.

-

- Assert disjointness AND self-exclusion BEFORE spawning — one file must belong to exactly one agent.

- **EXECUTE** using Bash tool against the file list you are about to fan out:

- > **STOP if ❌** — two agents editing one file is a lost-update race; a `self_hits` above 0 is the skill about to rewrite itself. Repartition, or drop the self-paths, then re-run the gate.

- Then spawn one `brewtools:text-optimizer` per file, ALL in ONE message. Each spawn brief carries the

- 6 fields and THAT file's decision list:

- | GOAL | cut permanent context weight across N files; this agent owns one file, siblings own the rest |

- | ROLE | optimize `{file}` in place; do NOT touch any other path, do NOT judge cross-layer dedup |

- | SCOPE | edit `{file}` only; read snapshot for comparison; `{RUN_DIR}/orig/**` never written/deleted/re-snapshotted |

- | CONTEXT | depth = deep (LLM-only files) or standard (user-facing); the drop rows from phase 3, verbatim; the drop-catalog and keep-catalog paths; siblings run in parallel |

- | CONSUMER | the skill merges every report; the file itself is loaded as a permanent prompt, and sibling files still point at its headings |

- | DONE | apply listed rows; checkpoint each owned atomic edit/deletion immediately; mode verification; report before/after size (named tokenizer or chars/4 proxy), rules, losses, semantic match % |

- Decision authority per line: `references/drop-catalog.md` (52 default-knowledge patterns + the 14

- inverted near-twins that LOOK droppable and are KEEPS + the decision rule 0-5, unresolved = KEEP) and

- `references/keep-catalog.md` (invariant classes + `crit_tokens_ext()`). Ship the paths, not contents.

- After each owned atomic write/deletion and before any later edit/check, record the known draft:

- CLAUDE_PROJECT_DIR="<LAYER_ROOT>" bash "${CLAUDE_PLUGIN_ROOT}/skills/text-optimize/scripts/text-guard.sh" checkpoint --run-dir <LAYER_RUN_DIR> <file>

- Record only bytes just produced by this optimizer (or its completed deletion); another writer's

- intervening change -> preserve bytes and report uncertain recovery. Never manufacture proof at

- failure/rollback time. Refresh after owned repairs. Guard checks recorded hashes, cannot infer ownership.

- Step 1, mechanical. **ONE verify per LAYER** — verifying a global file against the project run dir

- returns "outside the project root", exit 2, indistinguishable from "no snapshot" unless the layers are

- kept apart. Project call always, global call only when that layer was in scope. **EXECUTE** using Bash tool:

- bash "$G" verify --run-dir <PROJECT_RUN_DIR> <project file>...; rc=$?

- bash "$G" verify --global --run-dir <GLOBAL_RUN_DIR> <global file>...; rc=$?

- Read the number, both layers must reach `EXIT:0`:

- | 0 | every critical token survived | proceed to step 2 |

- | 1 | gate/checksum failure, missing snapshot or refused restoration | refuse acceptance; read recovery output, attempt only checkpoint-proven recovery for other layer, report FAILED and exact preserved/refused files |

- | 2 | usage/state error: no snapshot for these paths in this run dir (phase 2 skipped, or the wrong layer's run dir), or an unreadable/invalid manifest | STOP, do not accept the result. Re-check you paired each layer with its own run dir before concluding the snapshot is missing |

- A dedup row that DELETES a file is verified with `verify-deleted`, never plain `verify` (a deleted target exits 2, "target vanished"). It proves the deletion's own justification — every critical token of the deleted file present in the survivor that stays:

- bash "$G" verify-deleted --project --run-dir <RUN_DIR> --survivor <survivor path> <deleted file>

- `MERGED_VERIFIED` proves deletion. `EXIT:1` means unproven; recovery may be refused for missing

- ownership evidence/concurrent edits. Report actual restored/refused files, never assumed rollback.

- Step 2, semantic. Spawn ONE INDEPENDENT checker subagent (`general-purpose`, read-only, not an author

- of any rewrite) per file, all in one message. It re-reads every dropped item from the phase 3 ledger

- against the current file and the snapshot: is each dropped fact still present, or provably present in

- its named survivor?

- Any mechanical/semantic miss in either layer refuses acceptance for the whole run. Attempt recovery

- for every layer with existing ownership proof; preserve concurrent files, report FAILED and exact

- recovery/refusals. A partially recovered run is never accepted:

- bash "$G" rollback --run-dir <PROJECT_RUN_DIR> --run-dir <GLOBAL_RUN_DIR> # omit the layer that did not run

- Require exit 0 before claiming every file restored. Exit 1/refusal leaves current bytes intact for

- that refused layer; inspect output and snapshot evidence, never overwrite or checkpoint to bypass it.

- Re-run phase 1's `context-scan.sh` command with the same scope/flags and retain its actual exit code. Nonzero,

- invalid JSON, or missing/malformed/nonempty `scan_issues` -> **STOP**: report incomplete measurement, preserve

- verified edits/prior state, and fix/re-run discovery. Never compute savings, compare `--target`, escalate or

- enter phase 7 from partial rows. Only complete scans compare against phase 1; target met/absent -> phase 7.

- Target unmet in ANY mutating mode (`slim`, `hard`, `bodies`) -> the gate fires; the mode decides only

- how far the lossy pass may go, never whether the user is asked. First test the surface — **EXECUTE**

- using Bash tool:

- `STATE: absent` = virgin surface, which has lossless headroom by definition: the unmet target is a

- PLAN defect, not a reason to cut meaning. Report the shortfall, ask nothing, go to phase 7.

- `STATE: present` -> ONE destructive `AskUserQuestion`, at most once per run:

- | approve | re-enter phases 4-5 with the lossy list — every phase 5 gate still applies, every item ledgered |

- | decline | ZERO further writes: no edit, no rollback, no second question. Phase 7 records the shortfall and `escalation: declined` |

- **Decline preserves the LOSSLESS result, not the pre-run tree** — say so, never promise an untouched

- tree. Phases 4-5 are committed and verified before this gate can fire, by construction: it compares a

- re-measure that exists only after those writes. The pre-run tree stays one command away, named in the

- report: bare `rollback` (every layer of newest run), subject to matching draft ownership; later

- concurrent changes refuse recovery.

- Write the ratchet from the two live scans plus the phase 3 ledger as a TSV

- (`path<TAB>line-range<TAB>survivor<TAB>reason`, one row per drop). **EXECUTE** using Bash tool:

- bash "$G" state --mode <mode> --flags "<flags>" --before <phase1.json> --after <phase6.json> --ledger <ledger.tsv>; rc=$?

- Nonzero -> **STOP**: no achieved/success report or state-publication claim. The guard rejects partial, missing

- or malformed discovery evidence before writes; preserve prior state and repair/re-run the failed scan.

-

- It writes `.claude/brewtools/context-slim/state.json` — run timestamp, mode, flags, per-file

- before/after tokens, achieved ratio, drop ledger — and JSON-validates it (schema: measurement.md,

- "Ratchet state file"). The next run reads it to know what is already banked, phase 6 reads its

- absence; a stale baseline would double-count savings.

- 4. Advice — render `references/mcp-advice.md`'s template, rows above threshold only; omit the whole

- section when every signal is below threshold.

- `restore` is destructive: confirm at ENTRY, before touching anything, naming the run dir(s) and the

- files that will be overwritten. `--noask` does not skip this.

- `restore` takes `last`, a `<ts>` from `list`, or `--run-dir D`; omitted means the latest run.

- Selection is LAYER-AWARE: with `--global`/`--project`, `last` and a bare `<ts>` resolve inside THAT

- layer; with neither flag and no file arguments, both cover EVERY layer dir of the run in one call.

- Naming files pins one layer (default `--project`) — a global path passed to the project run dir exits

- 2. `rollback` is `restore` for whole run dirs, used by phase 5. Both restore manifest-listed files

- only with matching recorded draft hashes (already-original files need no overwrite); neither

- removes run-created files. Missing proof/concurrent change -> refuse and preserve current bytes.

- bash "$G" restore <TS> # a ts from `list`, every layer of that run

- bash "$G" restore --run-dir <RUN_DIR> # one exact run dir

- bash "$G" rollback --run-dir <A> --run-dir <B> # whole run, all files, named layers

- The manifest, not the flag, decides where files go back. Every restored file is re-hashed against it;

- the last line per run dir is `RESTORE_VERIFIED:`/`ROLLBACK_VERIFIED: <N> mismatches, <M> missing from

- snapshot` — only `0, 0` with `EXIT:0` proves restoration. `EXIT:1` also covers checksum mismatch,

- missing manifest-listed snapshot, or `RESTORE_REFUSED` for unproven/changed draft ownership.

- Failed/refused recovery never proves all files restored. `EXIT:2` = usage/state error: missing, unreadable or

- invalid manifest, a named file NOT in the manifest, or a path outside the snapshot root.

- | Read-only default | A bare invocation measures and stops. No question, no write, no global touch |

- | Snapshot first | No edit before phase 2 prints a manifest. Fail-closed, both layers, one manifest + one run dir EACH |

- | Confirm destruction | `hard`, `restore` and any `--global` write need an explicit ENTRY confirmation. `--noask` suppresses clarifying questions ONLY, never these |

- | Never self-edit | `brewtools/skills/context-slim/**` is excluded from phase 4 in every mode — the run may not rewrite its own decision basis |

- | Print the exit code | Every gate prints `EXIT:$rc`; 1, 2 and 3 mean different things and the phases branch on the number |

- | Dirty TRACKED target refused | Exit 3 names paths. Explicit named-edit authorization permits `--allow-dirty`; otherwise commit/stash. Untracked/git-ignored targets are `SNAPSHOT-ONLY`, covered by manifest |

- | Global opt-in | `--global` to write `~/.claude`; read as authority always. A project-layer survivor NEVER justifies a global deletion |

- | Dedup is the skill's | Cross-layer judgement never leaves phase 3. Agents execute rows, they do not decide them |

- | Refuse, don't warn | Any miss refuses whole-run acceptance; recover checkpoint-proven drafts only, preserve concurrent files, report FAILED and actual recovery status |

- | Unsure -> keep | The drop-catalog decision rule's tiebreak, at every depth |

- | RU keyword columns | Never stripped — `validate-skill.sh` check 10 fails without them (`language-policy.md` CARVE-OUT) |

- | Live numbers only | Every number in the report comes from THIS run's `context-scan.sh` output, never baked |

- | `references/measurement.md` | Token proxy, tier membership globs, prune list, target-ratio baseline rule |

- | `references/contradiction-policy.md` | Two statements, one differing exact value — classification + resolution ladder |

- | `references/drop-catalog.md` | 52 default-knowledge patterns, 14 inverted near-twins, decision rule |

- | `references/language-policy.md` | RU/EN handling, RU-drop rule, RU-domain exceptions, the mode-table CARVE-OUT |

- | `references/mcp-advice.md` | Advisory-only thresholds for the untouched surface + the report template |

- | `scripts/context-guard.sh` | snapshot / verify / verify-deleted / rollback / restore / state / list, two roots, manifest, retention |