winnow

Cache reads bill at 0.1× and writes at 1.25× or 2×, and matching is exact and prefix-ordered — so an edit invalidates everything after the cut. A prune pays 1.9·S − 2·D once and earns 0.1·D back on every later turn.

Break-even is T* = 19·(S/D) − 20 further turns. The ratio decides, not the size of the session: cut half the suffix and it pays for itself in 18 turns; cut a tenth and it needs 170 more turns than the session has had.

winnow context reports what is in one session's context window and where it came from: the total read exactly out of the last priced request, the parts apportioned inside it. It writes nothing.

It replaces winnow inspect, which still runs and now opens by deprecating itself: every token figure inspect prints is a lifetime sum rather than a window, and its cache_read_input_tokens reads 18,378,780 on a session whose window was 219,485. Milestone 1's number is still inspect's — tier CB strips 10.2% of message content pooled and 8.8% at the median, against the 22.6% / 21.6% section 6 of docs/SPEC.md recorded. It misses, and it was built to be allowed to say so.

winnow filter is a local pass-through proxy. A tool result a rule would strip goes out in full on the one request the model acts on it, placed after the last cache_control breakpoint so the API never writes it to cache, and is dropped on the next request.

There is no break-even term, because nothing is edited. On a replay over 175 historical sessions it reaches 8.21% and is worth +3.76% of the bill, against the tier-CB pruner's 10.17% and +3.27% — 1.1×, and positive in 175 sessions out of 175 rather than 97 of 168. That replay was computed at a 2,048-byte floor the filter has since left behind.

winnow savings reads ~/.winnow/filter.jsonl, joins each line to the Claude Code transcript on request_id to recover the session and how many API turns followed, and prices it. The simulation is a corpus average; this is one install's ledger.

The filter is stateless, so it re-drops the same result on every later request that still carries it: a ledger of 1,283 removal events on one install holds 49 distinct results, and summing bytes_dropped over lines would report 27× what was removed. The figure is modelled, not billed, and the command says so in its own output.

The vendored tool assumes an interactive user: it can defer a prune until you quit, ask you to run init, and start a daemon that will SIGKILL a session it judges too large. Under an unattended harness the session that daemon would kill is the one the tool is running inside.

Orchestrator-safe mode is one switch and six guarantees, each held from outside the tree it wraps: no termination, no resume, no updater, no writes to ~/.claude, no competing with the harness's own context and cost controls, and nothing written into the model's memory.

There is no winnow bench. winnow fork and winnow recover are written, but three of milestone 2's acceptance criteria have not been answered, so the milestone is built and not passed.

No claim that pruning a Claude Code session saves money has been made, by anyone. The 100-fork resume test was attempted on 2026-09-07 and blocked by its environment before a fork was written; nothing has been labelled against the 200-sample bar; the week of disk cost has no observations and no figure for it appears anywhere in the repository. The kill criteria are written against those three rows, and stopping on one of them is the intended outcome rather than a failure of it.