feat: reclaimable cost map, in-place recondense, and long-session freeze fix

[Ther-zh]

Steer compression to the largest reclaimable region, stop summary bloat, and fix the long-session freeze

Problem

DCP is model-driven: the nudge only says "you are over the limit", never where the tokens actually are. In long sessions this produced three observable failure modes:

1. Wrong target. In a real 418-message session, 134 messages (0.95 MB) were covered by blocks while 267 messages (5.64 MB) had never been covered at all. The model kept compressing a few nearby messages instead of the 237-message uncovered prefix. Block count grew; context did not shrink.
2. Summary bloat. Recursive merges rewrote child summaries into ever-larger parents (b116→b119, each ~31K tokens), and single-block re-wraps stacked bN → bN+1 chains.
3. Freeze on large sessions. Every transform synchronously re-tokenized the entire history, constructing a fresh tokenizer per call (~35–40 s across ~380 tool outputs), blocking the event loop before the provider request was sent.

What this PR does

1. Tell the model where the tokens are — reclaimable cost map

• lib/messages/inject/reclaimable.ts: findReclaimableRegions() collects uncovered raw ranges and active summaries, ranks them by token size, and reports each region's share of visible context.
• renderReclaimableGuidance() renders a compact cost map into the nudge, marking the largest region ← COMPRESS THIS FIRST.
• The compress range tool description now prioritizes COMPRESS THE LARGEST RECLAIMABLE CONTENT FIRST and treats UNCOVERED RAW CONTENT AS FIRST-CLASS.
• Real-session result: the map pointed at m0001..m0237 (~364.8K tokens); the model compressed it in a single call — −590.9K removed / +9.4K summary, context 759K → 60K.

2. Stop summary bloat — in-place recondense + recursiveCondense

• lib/compress/recondense.ts: a single-block re-wrap is re-condensed in place (replaced only when strictly smaller; self-references stripped) instead of creating a new block.
• recursiveCondense condenses child summaries instead of re-expanding full child text into the parent.
• enforceSummaryShrink (reject a compression whose summary is not smaller than the replaced content) is available but default off — rejecting inside the tool loop can drive model retry loops.

3. Fix the long-session freeze

• Shared, reused tokenizer + cached per-message/tool token counts.
• Context accounting and fork recovery moved off the default transform hot path; both opt-in.
• Measured on the long session: transform ~38 s → ~374 ms.

4. Fork/inherited recovery (opt-in), structured protected content, cooldowns

• lib/state/recovery.ts replays completed compress calls to rebuild blocks for forked/inherited sessions.
• Structured protected content is preserved across recursive merges.
• Stale-token nudge cooldown after a DCP compression; poll-turn cooldown; "don't compress a single message" guidance.

5. Tooling

• scripts/gray-replay.mts — offline replay of a real session against a local dist.
• scripts/gray-instance.ps1 — fully isolated XDG instance that loads a local dist without touching the installed cache.
• .gitattributes to enforce LF.

Defaults / compatibility

Every new behavior is opt-in or backward-compatible:

Option	Default
experimental.contextAccounting	false
experimental.recoverInherited	false
compress.recursiveCondense	false
compress.enforceSummaryShrink	false
compress.pollCooldown	3

The reclaimable cost map is text-only guidance and changes no state.

Verification

• npm test — 148 pass (new coverage for reclaimable regions, recondense, protected content, recovery, accounting, token usage, perf guards).
• npm run typecheck — clean.
• Build (tsup + tsc --emitDeclarationOnly) — clean.
• prettier --check . — clean.
• Gray test on the real 418-message session: the model compressed the largest uncovered region in one call (759K → 60K).

Notes

• Happy to split this into smaller PRs (cost map / recondense / freeze fix / recovery) if that is easier to review.