simplify(lcm): replace JSON-in-route summary metadata with a typed input #4296

Priority and scope

P2 · medium compatibility risk · small/medium implementation. Source-audited on master 064973de6e32bb2f31475d65bac9d184094fa470 (2026-10-18). This is an input-contract simplification, not a change to summary selection, token accounting, retention, or authorization.

Evidence

• LcmSummarizerMode::Provided in hermes.rs carries only summary_text and route: Option<String>.
• split_summary_route in extraction.rs interprets a brace-delimited route as another JSON document containing route and pre_compaction_extraction. If decoding fails, it silently treats the entire document as a route string instead. A syntactically valid empty object takes the successful envelope path and loses the original route text.
• CompressionSummarizerAdapter::from_mode reconstructs the typed PersistedSummaryInvocation after this second decoding pass. Its provided_mode_selects_persisted_summary_and_splits_route_envelope test explicitly constructs nested JSON as a string.
• Real daemon producers in lcm_effects.rs pass actual summary routes through the same field. The persisted metadata behavior is covered in crates/tracedecay/tests/session_suite/lcm_compression/summarizer_modes.rs.

This overload maintains two input grammars and makes malformed extraction data indistinguishable from a successful opaque route. No observed production data loss or exploit is asserted; the ambiguity follows from the decoder branches.

Exact implementation instructions

1. Give the provided-summary input explicit typed fields for the route and optional LcmExtractionResult; reuse the existing type rather than inventing a parallel extraction DTO. Route must have one meaning after boundary decoding.
2. Pass those fields directly into PersistedSummaryInvocation. Remove LcmProvidedSummaryRouteEnvelope and split_summary_route from the internal compression path.
3. Migrate every producer, including DaemonLcmEffectService, host/bridge producers discovered by the caller audit, and integration fixtures. Search both the Rust symbol and the serialized pre_compaction_extraction key. Do not assume the comment about a generated Hermes producer proves a current caller exists.
4. Determine whether the overloaded JSON-string shape actually shipped in a released host bundle or is consumed externally. If it did, contain the minimum required legacy normalization in the existing transport boundary, with explicit decoding failures; never propagate the overloaded string into the LCM domain. If it did not, change the input in place and delete the old grammar. Do not add a V2 contract merely because a type is versioned.
5. Keep persisted summary-node metadata readable and preserve not_requested, not_applicable, and the actual extraction content. This issue does not authorize dropping historical extraction results.
6. Regenerate any affected generated host/SDK contracts from their owning source; do not hand-edit outputs or introduce a new schema registry.

Required behavioral verification

• Plain route, no route, absent extraction, valid extraction, and Unicode/brace-containing route values round-trip with one meaning.
• Malformed extraction input is rejected or reported explicitly, never silently converted into a successful route.
• Valid supplied summaries persist identical text, route, extraction metadata, source range, and frontier effects.
• Empty-summary authoritative resolution, cancellation before commit, retained-source mismatch, and transaction rollback retain existing behavior.
• Run the affected LCM unit and session-suite targets through Bazel; resolve their exact labels from the existing BUILD files. A compile-only or zero-test result is not completion evidence.

Acceptance

• Internal provided-summary inputs no longer contain JSON serialized inside route.
• The internal heuristic parser and its duplicate envelope type are deleted.
• All real producers and tests use the same typed input.
• Any retained compatibility adapter is justified by shipped-wire evidence and exists only at ingress.
• Existing persisted data and failure/rollback semantics remain intact.

Distinct from #4228 (token budgets) and the completed ownership/copy concern in #1036. Review was static; no Rust tests were executed while filing this issue.