Decide the `viewFilter` × derived-summary contract: invalidate, or keep "documented, not enforced"

[Anarchid]

Deferred out of #54 by explicit agreement — the review's Major 4 asked for either invalidation or a loud doc, the doc landed, and the invalidation question was named as belonging "on its own issue rather than inside tune-out". This is that issue.

Where it stands on main (5dbbc47)

The documentation half is in: src/context-manager.ts:85 now states the filter is "NOT retroactive, and NOT a confidentiality boundary."

The mechanism is unchanged:

• the filter wraps only the live view (context-manager.ts:185-193);
• AutobiographicalStrategy loads persisted summaries with no visibility check;
• the hierarchical selector admits unmerged summaries filtered only by the anti-redundancy exclusion set, never by leaf-message visibility.

So: reopen an already-compressed store with a new or tighter filter, and a summary authored from now-hidden messages remains eligible for emission. The live path is genuinely clean — onNewMessage rebuilds chunks from the filtered view — so this bites on exactly two shapes: stores compressed before the filter existed, and a predicate that changes.

The argument for leaving it as-is (from #54)

1. Tune-out's stamp is written in the same store call as the message and never changes, so a diverted message is hidden from its first instant and can never have been summarized.
2. removeMessage (the host's hide command) already has this property — the memory strategy has no removal hook and its records degrade by id — and branching before the content entered is the excision path.
3. Invalidating summaries on a predicate change would delete an agent's memories as a side effect of a config edit: a larger and more dangerous behavior than the one it prevents.

That reasoning is sound for the predicate that exists today. It is an argument about the current only caller, not about the contract.

The decision this issue wants

Pick one, deliberately:

• (a) Keep it documented-only. Then the doc should also say it out loud at the strategy level (not just on ContextManager), and any future filter predicate that can hide a previously-visible message needs to arrive with its own invalidation story.
• (b) Build invalidation/rebuild for summaries whose leaf set isn't fully visible — with the memory-deletion hazard handled explicitly (rebuild rather than drop, or operator-gated).

The regression currently on the branch pins (a): persist a summary, reopen with a filter hiding its sources, prove the raw sources don't compile and the summary still does. That's the right pin for the documented contract — it just needs flipping if (b) is chosen.

Refs: review of #54 (Major 4).

---

Part of the 2026-09-08 merged-PR review-debt harvest; lower-severity items from the same pass are in #92.