fix(reflect): use framed summaries for reliable condensation

[HsienW]

What & why

• This follows the framed output approach suggested in the issue. Condensed memory is now returned through a shared delimiter contract instead of being embedded inside a JSON string, so literal quotes, backslashes, Windows paths, multiline text, Markdown, and JSON-like fragments no longer depend on correct JSON escaping.

• The parser handles framed responses deterministically, normalizes CRLF input, accepts a complete outer code fence, and fails closed on partial, duplicated, out-of-order, unterminated, contaminated, or malformed frames. Valid legacy JSON responses remain supported as a backward-compatible fallback.

• This change is intentionally scoped to the structured-output failure described in Memory condensation aborts ~80% of the time: the payload has to survive JSON string escaping #459. Existing load, spawn, timeout, invocation failure, backup, verification, and atomic swap behavior remains unchanged.

Closes #459.

Type of change

• Bug fix
• New feature
• Refactor / cleanup
• Docs
• Build / CI

Evidence

Before

Using the same framed summary fixture on the pre-fix implementation, parseSummary() returns null.

The fixture contains a Windows path, quoted text, a literal backslash, Markdown, and an incomplete JSON-like fragment. These are representative of the content that previously depended on surviving JSON string escaping.

After

Using the same fixture after this change, parseSummary() preserves the literal condensed text and extracts the expected hoist entry.

The condensed payload no longer needs to be encoded as a JSON string, while malformed framed output still fails closed.

Focused regression coverage also passes all 7 cases.

How I tested it

• The issue's production evidence came from an 18-day agent run. Since this change is isolated to the deterministic parseSummary() boundary, the regression is reproduced directly in PowerShell with the same representative output shape rather than requiring another multi-day soak run.

• OS: Windows 11

• Steps:

node --test test/reflect-summary.test.cjs
7/7 PASS

npm run typecheck
PASS

npm run build
PASS

git diff --check
PASS
Windows CRLF warning only

I also ran:

npm run test:focused

The new reflect-summary coverage passes in the focused suite. The full focused suite still contains existing Windows/platform-sensitive failures around symlink permissions, transcript HOME handling, and other unrelated baseline cases.

The same framed fixture was used for the Before and After evidence. The pre-fix parser returns null; after the change, the same input returns the expected condensed and hoist values.

Regression coverage includes:

• literal quotes and backslashes
• Windows paths
• multiline condensed text
• Markdown and nested code fences
• JSON-like and incomplete JSON content inside the framed body
• CRLF normalization
• CLI result and text envelopes
• complete outer code fences
• partial, duplicated, out-of-order, contaminated, and unterminated frames
• malformed hoist sections
• valid legacy JSON compatibility
• malformed legacy JSON remaining fail-closed

Checklist

• Before and after evidence is attached above, under both headings.
• npm run typecheck passes.
• npm run test:focused passes.
• npm run build succeeds.
• This PR is one change. Unrelated fixes belong in their own PR.
• I read the diff myself before opening this, and there is no debug output, commented-out code, or unrelated formatting churn in it.
• Any new UI derives from DESIGN.md / tokens.ts with no ad-hoc colors, spacing, or fonts.
• If I added art, it's my own or compatibly licensed, and listed in ATTRIBUTION.md.