# Context Window Discipline — brain_guard

Essay 5.3 of 8 — The Always-On Digital Cortex.

Essay 5.2 covered the floor — the test gate that makes every plugin code change conditional. This part covers the ceiling: the always-on plugin that owns the seed agent’s relationship to the model’s context window.

What it owns

brain_guard is the always-on plugin that owns the self-compaction the opener of this essay names. It works by watching context usage on every tool call and progressively tightening the agent’s grip on tools as the window fills. The whole mechanism fires well before Claude Code’s default auto-compact at 100%, which lets the seed agent operate even when the user is away from the terminal. ⓘ

How it works — the progressive squeeze

A pre-call sensor reads the running token count on every tool call. At the first tier (currently around 20% of the window), the plugin injects a coaching voice prompting the agent to draft a structured /compact instruction. The reasoning behind 20%: Opus 4.7's effective reasoning starts to soften around 30% of a 1M-token window, so acting at 20% leaves headroom. If the agent ignores the prompt, the next tier (around 25%) starts blocking the agent’s read tools. The hardest tier (around 30%) adds the write tools to the block list. ⓘ

The tier positions are tunable; the architectural fact is the progressive tightening. Rather than letting the agent drift toward a hard wall, brain_guard removes one tool at a time until the only graceful move left is to compact. ⓘ

Shape compels production

The compaction itself is shape-enforced. The plugin requires the /compact instruction to carry five named sections (Scope reminder, Lessons learned, Verbatim user directives, Recognition moments, Continuation hint) before it is accepted; any instruction missing a section gets blocked until the agent rewrites it. ⓘ

The five sections aren’t gospel. The shape is.

Call this shape compels production: a compartment that demands a structured shape forces the agent to produce content that fits the shape, and the production itself becomes useful context. The agent thinks more carefully about compaction because it has to write under headers. ⓘ

The pattern is portable. Structured git commits, structured plan files, structured subagent dispatches — every time a shape demands content, the content rewards the next step. The same trick lands in interaction_summary later in this essay.

The dispatch mechanic

Mechanically, the /compact self-issue is hacky. A small script injects the instruction into the active terminal — through clipboard-and-keystroke input-injection under X11, or through terminal-multiplexer paste primitives under tmux — because Claude Code does not yet expose an API for an agent to trigger compaction before the 100% auto-compact. The script records the compaction time in the plugin’s hidden state, and the next firing of the tier guards reads that timestamp to grant a brief grace window so the compacted transcript can register before the gate would otherwise re-block. If Claude Code ships a native intermittent self-compact API, this plugin’s terminal-typing layer retires; the rest of the discipline carries forward unchanged. ⓘ

What would break without it

Without brain_guard, the agent runs the conversation off a cliff. The default 100% auto-compact fires eventually, but without the agent’s own plan for what to preserve — and the next session starts from whatever the model happened to have in the window at that moment. ⓘ

What you would customize

brain_guard is the plugin most architects tune the moment they adopt the seed. Almost every knob has a defensible reason to move.

You would tune the tier positions for your model and your context budget. The 20% / 25% / 30% values map to Opus 4.7's 1M token window — they encode the empirical finding that reasoning softens around 30%. Your seed may run on a different model with a different effective-reasoning curve; the tier thresholds should track wherever that curve actually bends for the model you use. Sonnet’s window is smaller; Haiku’s smaller still; a future model with cleaner long-context behavior may not need the 25% tier at all. ⓘ

You would customize the /compact template. The five sections name what this prototype values — Scope reminder, Lessons learned, Verbatim user directives, Recognition moments, Continuation hint. Your seed may need different sections for your kind of work: a legal-research seed may want a "citation-state" section instead of "Recognition moments"; a project-management seed may want a "decision-log" section instead of "Verbatim user directives." The five names aren’t gospel. The shape is.

You would choose your dispatch mechanism. The current prototype ships two paths — X11 keyboard injection and tmux paste-buffer. Your environment may need a third (an SSH-bridge variant, a Windows Terminal handler). If Claude Code ships a native self-compact API, you drop the keyboard-injection layer entirely without touching the rest of the plugin.

You would add or split tiers. Three tiers is the current shape; nothing in the architecture forbids four or five. A high-stakes seed may want an extra tier between 25% and 30% that blocks Bash before write tools. A seed working in shorter, hotter cycles may collapse the soft tier and start blocking immediately at 22%.

What you would not do is remove the progressive-tightening principle. Letting the agent drift toward the 100% wall, then surprise-compacting at the worst moment, is exactly the failure mode brain_guard was built to prevent.

The next part covers the plugin that gives the seed agent a notion of what work it is doing — the unit of compartmentalization, the dynamic mega-prompt, the refusal to stop while jobs remain.

Essay 5.3 of 8 — The Always-On Digital Cortex — Hadosh Academy series on agent architecture.

Previous: Essay 5.2 — Plugin Edit Safety (plugin_integrity) — the test gate underneath every plugin edit. Next: Essay 5.4 — Job Lifecycle (job_core) — the agent’s unit of compartmentalization and the refusal-to-stop discipline.