diff --git a/packages/compress-core/.gitattributes b/packages/compress-core/.gitattributes
new file mode 100644
index 00000000..83364b94
--- /dev/null
+++ b/packages/compress-core/.gitattributes
@@ -0,0 +1,5 @@
+# Keep one line ending in the repository; Windows checkouts may still be CRLF.
+* text=auto
+*.png binary
+*.webp binary
+*.woff2 binary
\ No newline at end of file
diff --git a/packages/compress-core/.gitignore b/packages/compress-core/.gitignore
new file mode 100644
index 00000000..aa007d89
--- /dev/null
+++ b/packages/compress-core/.gitignore
@@ -0,0 +1,20 @@
+node_modules/
+
+# What this plugin writes on the machine it runs on, none of it belongs in the repo:
+# per-request byte counts, captured requests, temp files.
+requests.jsonl
+*.jsonl
+captures/
+page/captures/
+# The two files the hook republishes for the page to load: index metadata and the
+# savings summary, generated on this machine, never shipped.
+page/captures-index.js
+page/compress-stats.js
+page/compress-ccr-status.js
+# Local safety nets: timestamped .bak copies and dated backup snapshots.
+*.bak
+*.bak.*
+backup/
+*.tmp
+*.log
+.DS_Store
diff --git a/packages/compress-core/DEBUGGING.md b/packages/compress-core/DEBUGGING.md
new file mode 100644
index 00000000..ec61c64e
--- /dev/null
+++ b/packages/compress-core/DEBUGGING.md
@@ -0,0 +1,48 @@
+# 面板点不动的时候先看这里
+
+这份记录写的是 0.4.0 之前的那次 UI 交互失效：**magpie 设置面板里所有按钮都没反应**——预设点不动，齿轮和烧瓶切不了视图，策略开关也按不动。
+
+结论先说：跟 iframe 沙箱没关系。是渲染函数抛了异常，`init()` 中断在半路，按钮的监听根本没绑上。
+
+## 排查走过弯路
+
+现象很容易让人怀疑沙箱，下面这几条**都不是**原因：
+
+- `sandbox="allow-scripts"` 加 `connect-src 'none'` 的 CSP：页面确实拿不到网络，但点击、`hidden`、`style.display` 全都不受影响。
+- 视图切换的写法（只用 `hidden`、只用 `display`、两者都写）：三种都试过，都没用——因为压根没走到那一步。
+- 脚本加载顺序、`node --check` 语法检查、HTML 是否被浏览器缓存：都查过，全是干净的。
+- 也不要在 iframe 里靠 `console.log` 找线索：magpie 主界面的 devtools 里看不到插件 iframe 的输出，日志会静悄悄地丢掉。
+
+## 真正的原因
+
+`paint()` 是按「想当然的接口」写的，magpie 一挂载就抛错：
+
+- 把 `V.engines()` 当 map/对象遍历，它其实是数组；
+- 调了 `page/ui.js` 里不存在的 `U.row` / `U.box`；
+- 读了 `page/view.js` 的 TEXT 里不存在的字段（例如 `T.status`）。
+
+第一行就 `TypeError`。而 `init()` 的顺序是「先渲染、后绑定事件」，异常把 `init()` 打断在渲染那一步，后面 `bindViewButtons()` 之类的绑定一次都没执行——所以整个面板死掉。表现上跟「沙箱拦住点击」一模一样，排查方向很容易被带跑。
+
+修法：每个渲染函数外面套一层 `safePaint()`，单个区块炸掉不再拖死整轮；然后所有渲染严格按 `page/view.js` / `page/ui.js` 的真实契约重写。
+
+## 契约（不要再猜）
+
+- `page/view.js:293` `cards(strategies, stats, lang)` → 返回卡片数组，每项 `{id, label, why, description, badge, tone, available, requires, on, rule}`。
+- `page/ui.js:6` `el(tag, cls, text)`、`page/ui.js:13` `clear(host)`、`page/ui.js:21` `switchButton(on, disabled, onChange, label)`、`page/ui.js:37` `meter(host, m, T)`、`rows(host, cards, ctx)`，其中 `ctx = {T, open, config, onToggle, onSwitch, onField}`。
+- 会话索引**不在** `options.stats.captures[]` 里：`stats-writer.js` 已经不再写 `plugins.json`，那个字段是冻死的旧值。索引由钩子发布成页面同目录的 `page/captures-index.js`，页面用 `<script src="captures-index.js?t=…">` 载入后读 `globalThis.__COMPRESS_CAPTURES_INDEX__`，字段是 `{id, at, agent, protocol, model, before, after, saved, summary}`。**旧的 `cap.ts` / `cap.strategy` / `rate` / `beforeText` 都不存在**，照着写只会渲染出 `Invalid Date … NaN MB → NaN MB NaN%`。
+- `capture` 默认**开**（`!== false` 就算开），所以每一次经过网关的请求都会留一条，最新 50 条封顶。它一旦默认关，会话列表就只有开关被手动打开的那段时间有内容，看上去就是「永远停在旧的、只有本机 harness 的会话」。
+- `page/captures-index.js` 只装索引元数据，对话原文一条都不进去（那是审查否掉上一版的原因）。原文只在 `<config>/magpie/compress-core/captures/<id>.json`，页面读不到，弹窗只显示摘要与文件位置。
+- 那个脚本是生成物，不随包发布（`.gitignore` 里有），plugin 更新后由宿主下一次请求重发（`refreshCapturesIndex()`，每进程一次）。
+- `report.strategies[]` 每项 `{id, label, available, enabled, status, reason, beforeBytes, afterBytes, ms, savedBytes}`。
+- 页面在沙箱里唯一的数据通道是 `magpie.options`，而且 `set` 是**整包替换**：保存时必须提交完整 options（包括钩子写进去的 `stats`），只提交改动字段会把 `strategies`、`preserve` 一起抹掉。
+
+## 怎么复验
+
+```bash
+node test/run.mjs          # 全部引擎与钩子套件
+node test/live-probe.mjs   # 对着真的 magpie 打一次
+```
+
+UI 本身不进 `test/run.mjs`（那套只跑引擎和钩子）。要给面板做交互回归，用最小 DOM 加 `vm` 直接加载 `page/engines.js` + `view.js` + `ui.js` + `panel.js`（或 `app.js`）+ 一个 `magpie` stub，断言按钮数量、点击后的写回和视图切换；注意保存走 1100ms 节流窗口，断言要跨过去。
+
+要连真机看的话，magpie 开了远程调试端口后，用 CDP 附着到 `settings.html` 那个 iframe target：`Runtime.consoleAPICalled` / `Runtime.exceptionThrown` 能收到里面抛的异常，`Runtime.evaluate` 可以读 `#viewMain` / `#viewCustom` 的 `hidden` 与几何，改完 `location.reload()` 即可。注意 iframe target 不支持 `Page.reload`。
\ No newline at end of file
diff --git a/packages/compress-core/README.en.md b/packages/compress-core/README.en.md
new file mode 100644
index 00000000..b332856f
--- /dev/null
+++ b/packages/compress-core/README.en.md
@@ -0,0 +1,174 @@
+# compress-core
+
+Context compression for the magpie gateway. It rewrites `messages` before a request leaves this machine — dropping what repeats, what is noise, what is only formatting — and hands the rest upstream unchanged.
+
+This is a full port of OmniRoute's compression strategies: same ids, names, priorities and lossy flags. Whatever could be carried over was; whatever could not is marked with the reason in the table below.
+
+## Install
+
+```bash
+magpie plugin add @magpie-community/middleware-compress-core   # from the registry
+magpie plugin add <this directory>                            # from a local directory
+magpie plugin add github:magpie-community/plugins             # from the repo (packages/compress-core)
+```
+
+Afterwards `magpie plugin list` should show this plugin declaring `middleware`, `hooks`, `page` and two `panels`.
+
+## Strategies
+
+Run in ascending `stackPriority`. Each one switches and tunes on its own.
+
+| id | name | priority | lossy | state | what it does |
+| --- | --- | --- | --- | --- | --- |
+| `session-dedup` | Session Dedup | 3 | no | ported | Text already sent earlier in this session becomes `[dedup:ref sha=…]`; the original is recoverable from the map. |
+| `ccr` | CCR | 4 | no | ported | Large repeated or contiguous blocks become content-addressed refs; the original stays searchable. |
+| `lite` | Lite Cleanup | 5 | no | ported | Whitespace, repeated lines and formatting only — never wording. Fastest, always safe. |
+| `rtk` | RTK Tool Output | 10 | yes | ported | Strips ANSI noise, progress bars and repeated rows; keeps errors, warnings and summaries. |
+| `codex-responses` | Codex Tool Output | 12 | yes | ported | Conservative trimming of shell / patch / search / build output on the Responses API. |
+| `headroom` | Headroom (GCF) | 15 | no | ported | Tabular JSON becomes columnar, long rows fold to `[N rows]`, restorable from the GCF payload in a fenced block. |
+| `relevance` | Relevance | 18 | yes | ported | Scores sentences against the last user message and drops the low ones; numbers, URLs, errors, code and stack lines are never dropped. |
+| `caveman` | Caveman | 20 | yes | ported | Rule-based prose compression, rule packs for 11 languages. |
+| `read-lifecycle` | Read Lifecycle | 22 | yes | ported | Folds file reads that a later Read/Write has superseded into a short stub. |
+| `aggressive` | Aggressive | 30 | yes | ported | Summarise and age older turns. |
+| `llmlingua` | LLMLingua-2 | 35 | yes | unavailable | Needs an ONNX model and worker threads; cannot run inside the plugin host. |
+| `ultra` | Ultra | 40 | yes | ported | Heuristic token-level pruning, the most aggressive purely local option. |
+| `ionizer` | Ionizer | 50 | yes | ported | Sampling-based compression, deliberately lossy. |
+| `llm` | LLM Compressor | 60 | yes | unavailable | Needs an external chat-completion backend this plugin cannot provide. |
+| `omniglyph` | OmniGlyph | 90 | yes | unavailable | Needs the omniglyph package plus a provider that accepts inline images. |
+
+The three unavailable ones still appear in the panel, marked `unavailable` with the missing piece spelled out; their switches do not move.
+
+## Presets
+
+| preset | meaning |
+| --- | --- |
+| Off | everything off. |
+| Safe | OmniRoute's "safe default": every strategy that is **lossless and available** is on, the rest are off — that is `session-dedup`, `ccr`, `lite`, `headroom`. |
+| Custom | whatever you clicked your way to. Touching any switch lands you here. |
+| All | every available strategy on (the unavailable ones still cannot be turned on). |
+
+"Custom" is a state, not a button — clicking it does nothing, which is why it is greyed out.
+
+## Caching and prefixes
+
+Providers match prompt cache by **request prefix**: one byte changing inside the prefix makes everything after it bill as uncached input.
+
+lite rewrites everything by default, which makes the prefix strictly stable: every message goes through the same deterministic transform from its first turn (whitespace folding is idempotent), so a message that has been sent renders byte-identically forever and the cache never misses. The price is that the turn being sent right now is folded and deduped too — what the user just typed included.
+
+Set `preserveCurrentTurn` to `true` for the conservative mode: everything after the last assistant message (or the whole body when there is none) is sent as it arrived, and gets rewritten exactly once — in the request where it stops being the current turn — missing the cache that once and stable after that.
+
+`session-dedup` reads the same switch: by default it treats the turn being sent like any other, and only an explicit `preserveCurrentTurn: true` protects it. Same reason — protecting just that turn means the message is rewritten once in the next request, and the prefix moves with it.
+
+`test/prefix-stability.test.mjs` is the acceptance test for this: the transcript grows turn by turn and the prefix sent in each round must be byte-identical to the previous round — checked for the default preset, the safe preset, and every lossless engine on its own.
+
+`preserve.lastTurns` defaults to `0` (no extra protection). Setting it to N keeps the newest N turns out of every rewrite; the turn rewrites itself once when it slides out of that window — that comes from the window, not from lite.
+
+`preserve.system` defaults to `false`. Turning it on protects the whole system segment behind a placeholder for the length of the run, and the price is that the step which depends on the system text (say, "the same system prompt written twice keeps one copy") goes dead — the previous version defaulted it to `true`, which made that step a piece of dead configuration. Write `true` explicitly if the system segment must not move at all.
+
+`compressToolResults` defaults to `false`, so tool results in the history are not cut. Cutting a tool result asks the model to read a thing it was never told had been cut, and it rewrites a message the model has already read by length, so the prefix moves with it. Write `compressToolResults: true` for the old behaviour (`maxToolLength` is still parsed, and anything under 2000 falls back to 2000).
+
+## Oversized bodies
+
+`maxBytes` defaults to `8000000`: **a body bigger than that runs no engine at all and goes out as it arrived**, recorded in telemetry as `tooLarge` with `body_too_large`. The hook has 250 ms, and a 20 MB body costs around 70 ms in `JSON.stringify` alone before any engine has looked at it — that size cannot fit the budget on any machine. Skipping by size rather than by clock is what keeps the decision deterministic: the same body always gets the same answer, so the prefix it contributes to the provider's prompt cache never moves. The decision does not count bytes exactly: it counts text length first (O(n), no allocation, and always a lower bound on the real byte count); a lower bound already over the line ends the decision, one far below it passes, and only the narrow band between the two pays for an exact count.
+
+`budgetMs` defaults to `0`, meaning no strategy is skipped on time. Give it a positive value and the pipeline stops the remaining strategies once it expires — but the same request can then compress two different ways under load, and a body that changed is a body the prompt cache can never reuse, so there is no time budget by default. Engines carry no deadline of their own either (`session-dedup`'s `timeBudgetMs` defaults to `0` as well).
+
+## The page
+
+Sidebar → Plugins → Compress. One compression meter, the preset, one row per strategy, and the last eight requests.
+
+Each row shows order, name, lossless/lossy, a one-line description, bytes saved and the switch; clicking it expands the full description, hits/saved/share, execution order, cache impact, what it reads, and that strategy's own parameters (number boxes, selects, checkbox groups).
+
+## The settings panel
+
+Settings → Plugins. The same preset and strategy rows as the page, in a compact form.
+
+## The usage panel
+
+Usage → the end of Overview. The compression meter plus the last four requests.
+
+All three surfaces share the computation in `page/view.js` and the styles in `page/style.css`; every colour comes from magpie's own `--magpie-*` variables, so both themes follow along.
+
+One known behaviour: this plugin ships both `middleware` and `hooks`, so saving options from the UI makes magpie restart the hooks host (under a second). Requests pass through untouched during that window, and compression resumes after it. A page-only plugin does not pay this cost.
+
+Another trap: `magpie.options.set` **replaces the whole options object**, it does not deep-merge. Every save from the UI must submit the complete options; submitting only the changed fields wipes `strategies` and `preserve`. `save()` in `app.js` / `panel.js` already writes the whole object.
+
+## Where the numbers come from
+
+The hooks write cumulative stats to `stats.json` in the plugin's config folder, next to `requests.jsonl` and `captures/`. They never write magpie's own `plugins.json`: magpie watches that file's stamp and restarts the hooks host on every change, which would mean one restart per compressed request — far more cost than the numbers are worth.
+
+The sandbox magpie gives the page and panels is `connect-src 'none'` with no filesystem, and `magpie.options` is the only thing they can read. So the page cannot read `stats.json`: the meter says which file the numbers live in, and no live figures are shown in the UI.
+
+Writes are deliberately timid:
+
+- write `.tmp`, then rename; failures stay silent;
+- at most once every 30 seconds (the first compressed request writes at once);
+- refuse to parse anything above 4MB, so a corrupt file cannot stall a request;
+- with `COMPRESS_CORE_NO_STATS=1` nothing touches the disk at all (used by the tests).
+
+Compression does not depend on any of it: if the file cannot be written, compression still runs.
+
+## Session records
+
+The hooks can keep a snapshot of **every** request that goes through the gateway; `capture` is **on** by default, and an explicit `false` turns it off. Snapshots land in `captures/` inside the plugin's config folder, indexed in `captures-index.json`, newest 50, each capped at 2MB.
+
+The page's policy is `connect-src 'none'` and its own folder only, so the numbers and the list travel as two scripts beside it, loaded with `<script src>`: `captures-index.js` (the session list: id, time, `agent`, model, byte counts) and `compress-stats.js` (the savings meter and each strategy's total). The conversation text stays in `captures/` and never enters the installed package. The `agent` on each row (`dsh`, `pi`, …) says which harness sent the request.
+
+The page re-reads the two published scripts and `magpie.options` every 5 seconds and repaints on change — no manual refresh.
+
+## Privacy
+
+Files are written only inside the plugin's own folder (`MAGPIE_CONFIG_DIR` first, then `XDG_CONFIG_HOME/magpie`, defaulting to `compress-core/` under `~/.config/magpie`; `COMPRESS_CORE_DATA_DIR` moves the whole thing):
+
+- `requests.jsonl`: one stats line per request (raw/compressed bytes, strategy that hit, model, client), **no bodies**. With `telemetry.samples` on, up to 8 question/answer pairs of 1600 characters each are stored too, after the redaction below.
+- `captures/`: only when `capture` is on; full request bodies, 2MB per entry (an oversized one is skipped and marked `too_large` in the index), newest 50 kept.
+- `captures-index.json`, `options-override.json`: index and local overrides, no bodies.
+
+Redaction lives in `SECRET_RULES` in `telemetry-store.js` and is shared by snapshots and samples: whole private-key blocks, `ghp_`/`github_pat_`/`AKIA`/`AIza`/`sk-`/`xox?-` tokens, `eyJ…` JWTs, `Bearer …`, and the values of `authorization`, `api_key`, `password`, `client_secret` and similar become `[redacted:…]`. E-mail addresses and `C:\Users\…` paths are replaced in samples only — a snapshot has to keep the code readable. Field names stay, values go, so you can still see what a request carried.
+
+Neither switch touches the code being compressed — they exist to answer "what did compression do to this text". If a conversation holds something that must not reach the disk, leave `capture` and `telemetry.samples` off.
+
+To clear: "clear snapshots" in the UI deletes both folders and resets the index; `requests.jsonl` can simply be deleted and is recreated on the next request.
+
+## The lab
+
+The lab answers "what did this strategy do to this text", so it **ignores `preserve`**: its input is a single user message, and with `preserve` on that message always falls inside the "newest N turns" window, where every strategy only sees placeholders and every strategy reports "no difference".
+
+Two input shapes: **plain text** is treated as one user message; **request body JSON** pastes a real body, which is the only way to exercise `rtk` (tool output), `session-dedup` (repeated blocks) and `headroom` (JSON arrays).
+
+When nothing hits, the panel says why, rather than leaving "identical before and after" to be guessed at.
+
+## Licence and provenance
+
+MIT (`LICENSE`, which keeps OmniRoute's copyright line). Every engine is a port of OmniRoute's `open-sse/services/compression`; the repository each one came from, the file it reaches, and a sha256 of the ported copy are in `PROVENANCE.json`.
+
+The Apache-2.0 upstreams reached through OmniRoute: `caveman` (github.com/JuliusBrussee/caveman), `headroom` (github.com/headroomlabs-ai/headroom, including the GCF columnar codec under `engines/gcf/`) and `rtk` (github.com/rtk-ai/rtk). Their licence text is in `LICENSES/Apache-2.0.txt` and the attribution is in `NOTICE`.
+
+## Development
+
+```bash
+node test/run.mjs                 # every test (24 suites)
+node test/run.mjs lite            # one suite: the argument is the suite name (the name in each suite file; e.g. `lite`, `gateway cases (cases.json)`)
+bun test                          # the same suites the way CI runs them
+node scripts/gen-page-catalog.mjs # regenerate page/engines.js after editing catalog.js
+npm run build:page                # re-bundle page/lab-engine.bundle.js after editing lab.js / engines
+node test/live-probe.mjs          # one shot against a real magpie
+```
+
+`catalog.js` is the single source of truth for strategy metadata; `page/engines.js` mirrors it (`<script>` in a sandbox cannot import ES modules), so editing the catalog means regenerating it.
+
+`page/lab-engine.bundle.js` is a build artifact too: entry point `page/lab-engine.js`, importing `lab.js` and `catalog.js`, bundled to an IIFE by esbuild. esbuild is not a dependency of this package — run `npm run build:page` by hand only after changing those sources and commit the artifact, so nobody installing the plugin needs a build environment. Do not hand-edit either artifact; the next generation overwrites it.
+
+If a panel button does nothing, or you are about to change how the page renders, read `DEBUGGING.md` first: it records the rendering contract, how session snapshots are fetched, and why "looks like a sandbox problem" usually is not one.
+
+`test/lite-spec.md` and `test/session-dedup-spec.md` are the behaviour contracts for those two strategies; read them before touching the engines.
+
+`cases.json` is the outward contract: of its 23 cases, 21 are copied verbatim from the history-trim package merged into magpie-community/plugins (#423) and 2 record this package's own default-preset behaviour (the turn being sent is folded too; a tabular tool result becomes a `gcf-generic` block). It answers one concrete question — after a body goes through this middleware, is it exactly the body that implementation leaves? A difference is a semantic fork: either fix it here or argue for it there. Those 21 cases ask for the conservative mode explicitly (`preserveCurrentTurn: true`), because "send the turn being sent as it arrived" is what history-trim did, and this middleware now rewrites everything by default. In the magpie repo it runs as `bun scripts/check.mjs`; the local equivalent is `node test/run.mjs "gateway cases (cases.json)"`.
+
+## Uninstall
+
+```bash
+magpie plugin rm compress-core
+```
+
+Telemetry under `~/.config/magpie/compress-core/` (`requests.jsonl`) is not deleted automatically.
diff --git a/packages/compress-core/README.md b/packages/compress-core/README.md
index ddce9808..f1f5db59 100644
--- a/packages/compress-core/README.md
+++ b/packages/compress-core/README.md
@@ -133,7 +133,7 @@ lite 默认**全量改写、严格前缀稳定**：每条消息从第一轮起
 
 钩子能在**每一次**经过网关的请求上留一条快照，社区版 `capture` 默认**关**（显式设 `true` 才开）。快照落在插件配置目录的 `captures/`，索引另存 `captures-index.json`，最多保留最近 50 条，每条上限 2MB。
 
-快照索引同时会发布成插件数据目录里的 `captures-index.js`，供第二个 PR 里的页面读取；本包只带钩子与数据层。
+页面的 CSP 是 `connect-src 'none'`，只放行插件自己的 `page/` 目录。所以数字和列表由钩子发布成同目录的两个脚本，页面用 `<script src>` 载入：`captures-index.js`（会话列表）和 `compress-stats.js`（顶部统计与每个策略的 saving）。
 
 ## 隐私
 
@@ -174,6 +174,8 @@ node test/live-probe.mjs          # 对着真的 magpie 打一次
 

 

 
+面板按钮点不动、或者要改页面的渲染层，先读 `DEBUGGING.md`：里面记了渲染契约、会话快照的取法，以及为什么「看起来像沙箱问题」其实不是。
+
 `test/lite-spec.md` 和 `test/session-dedup-spec.md` 是这两个策略的行为契约，改引擎之前先看。
 
 `cases.json` 是对外契约：23 条用例里，21 条与 magpie-community/plugins 里被合并的 history-trim (#423) 逐字一致，另外 2 条是这一包自己的默认档行为（正在发送的这一轮同样被改写、表格化的工具结果转成 `gcf-generic` 块）。它回答一个具体问题——同一份输入经过这个中间件之后，body 是否与那份实现留下的完全一致；不一致就是语义分叉，要么这里改，要么去那边论证。那 21 条显式写成保守模式（`preserveCurrentTurn: true`），因为 history-trim 的语义就是「正在发送的这一轮原样送出」，而这里默认是全量改写。magpie 仓库跑它用 `bun scripts/check.mjs`，这边等价的入口是 `node test/run.mjs "gateway cases (cases.json)"`。