v0.21.12 — invisible-overhead calibration (400-loop fix, attempt #9)

Fix

Invisible request overhead (2026-08-20 incident, attempt #9 / TRUE root cause of the surviving 400 loop). pi adds a fixed per-request overhead H at request time — system prompt + tool definitions + extension systemPrompt prepends — that never appears in the stored transcript. Every estimator counted messages only: pi's banner, pi's `estimateContextTokens`, and our `estimateSessionTokens`/`applyTailCap`. On a 32k-window model (GLM-4.7, qwen3.8-27b via plexus) H is ~13–16k tokens — roughly HALF the window. After the first 400, provider usage goes null, the estimate path undercounted by ~50%, the anchor floor's `criticalOver` hatch stayed closed at an estimated ~80%, `cut=null` shipped the raw view, and the loop repeated forever — pi's one-shot overflow recovery only resets on user `message_start`, so auto-retries burn it permanently.

Mechanisms:

• Wire-truth parse — the provider's 400 text (`request (39048 tokens) exceeds the available context size (32768 tokens)`) is parsed into ground-truth request/available counts that override the blind estimate for THAT event's gate. Mid-loop, usage is null — but the 400 text carries the real numbers, so the loop un-blinds itself.
• Per-model overhead EMA — every usage-bearing context event samples `H = wire − messageEstimate` and persists it in SQLite meta as a fraction of the window. Calibrated H is added back on the estimate path so the headroom gate sees the real request size, and subtracted from the tail-cap budget so the cap bounds the REAL wire prompt, not just messages.
• Cap-the-skip-path invariant — when `computeLiveTrimCut` returns null (anchor floor refuses), the view is STILL tail-capped instead of shipping raw. The trim path can never return a view the budget wouldn't allow; this alone breaks the 400 loop even if calibration is cold.

Flags (dashboard Settings > Compaction): `MEGACOMPACT_WIRE_OVERHEAD` (default ON; OFF = byte-identical v0.21.11), `MEGACOMPACT_WIRE_OVERHEAD_DEFAULT_PCT` (0.15 fallback fraction when no EMA sample exists, clamped 0–0.85).

Tests + docs

+52 tests: wire-truth regex fixtures (incl. the exact incident string), EMA init/update/clamp, percent-based budget ratios at 32k/200k/1M windows, the incident regression (est 26k + H 16k on 32768 window now caps correctly), liveTrim skip-cap with flag-OFF byte-identity. `docs/LIVE_TRIM_AND_OVERFLOW_RECOVERY.md` §5 documents the mechanism end-to-end.

Verification

• 4464 tests / 0 fail, lint clean, regression `--all` + `--soft-as-hard --pre-commit` both green, guardrails clean
• Live: `pi update --extensions` → resume the idolaigame01 GLM/qwen session; expect `wire_truth_parse` + `skip_cap_applied` events and the 400 loop to break. Watch dashboard.json diag (`diagCtxWireTruth`, `diagCtxSkipCapped`, `headroomTrips`), not the banner (untrimmed transcript).

Co-Authored-By: Claude Opus 4.6 noreply@anthropic.com