…nverters

Both the standard and Beta message converters duplicated the same
comment and 4-breakpoint budgeting logic; hoist it into
messageCacheBreakpoints.

…trol.go

Pure move: messageCacheBreakpoints, applyMessageCacheControl, and
applyBetaMessageCacheControl relocate unchanged so the prompt-caching
breakpoint logic lives in one file.

… the limit

The 4-breakpoint budget was an implicit cross-layer contract: the
session marks up to two system messages and the provider spends the
rest, but nothing enforced the global invariant \u2014 a third upstream
mark (e.g. from a hook-rewritten message list) would produce a request
Anthropic rejects outright (the failure mode of docker#2236).

Own the whole budget in cache_control.go: document the ledger and cap
honored system marks at maxSystemCacheBreakpoints, dropping the excess
instead of forwarding it. Behavior is unchanged for compliant input.

Cost and CacheControl clearing lived in two mirrored copies (the
compactor's CompactionInput wrapper and the compaction benchmark),
each a forget-to-clear hazard for the next consumer \u2014 exactly how
where the message copies are made: every consumer now gets clean input
by construction, and the compactor and benchmark no longer handle
cache control at all.

…control.go

Pure move of extractSystemBlocks and extractBetaSystemBlocks so the
entire checkpoint mechanism (budget ledger, system-block marking with
cap, message-tail breakpoints) lives in one file, and document the
CacheControl contract on chat.Message: request-assembly state, set by
the session on assembled copies, JSON-serialized only because marks
must survive the before_llm_call hook rewrite round-trip.

Note: deleting the field in favor of out-of-band boundary indices was
considered and rejected \u2014 hooks.Input.Messages / updated_messages
round-trip assembled messages through external hook processes as JSON,
and per-message marks are the only representation that survives
hook-driven message-list rewrites (index-based boundaries would be
silently misplaced by an insert/delete).

… accessor contract

Two hardening follow-ups to the breakpoint-budget work:
- log (debug) when an over-budget system mark is dropped, so upstream
  misbehavior is diagnosable instead of silent
- pin GetCacheControl coverage for every block kind the converters
  produce, on both the standard and Beta unions, so an SDK bump that
  changes accessor coverage fails tests instead of silently changing
  which requests get cached

…marks

The contract on chat.Message.CacheControl said stored transcript items
never carry marks, but nothing enforced it \u2014 an API client echoing a
mark back could persist it and have it resurface on every future
prompt assembly. Strip the flag at AddMessage ingestion (alongside the
existing capToolResultContent normalization) and reword the
CompactionInput clearing rationale in session terms rather than
compactor internals.