dsh-switchman 1.10.3 → 1.11.0

package/host/context-trim/index.js

@@ -12,23 +12,29 @@
  * - agent/status idle hook: the only place fold decisions run (design §4:
  *   fold at the idle boundary, never mid-stream).
  * - ctx_trim_fold / ctx_trim_status tools: the L1 advisory surface — the
- *   session model may fold ranges itself and inspect trim state.
- * - systemPrompt head section (byte-stable protocol text) + live context
- *   line (bucketed view tokens / fold count / growth — byte-stable between
- *   5k-token steps so the serialized tail stops churning).
+ *   session model may fold ranges itself and inspect compressible ranges
+ *   (true sizes only — NEVER a fill percentage or water level; bili lesson
+ *   #2, docs/ladder-fold.md).
+ *
+ * MODEL-VISIBILITY INVARIANT: the trim layer registers NO systemPrompt
+ * context line. Water levels, view-token estimates, growth numbers, and
+ * fold counts are engine internals; the model sees only the byte-stable
+ * protocol head and (on demand) the true-size recommendation list. Human
+ * diagnostics live in decisions.log.
  *
  * Config fields (host/config.js, all volatile): trimEnabled, trimMode
  * ("off"|"advisory"|"auto"), trimGrowthTokens, trimIncrementTokens,
  * trimPressurePercent, trimEmergencyPercent, trimWindowTokens,
- * trimProtectedTail,
- * trimMaxFoldsPerHour, trimSideModel, trimStateDir.
+ * trimProtectedTail, trimMaxFoldsPerHour, trimSideModel, trimFoldFallbackModel, trimStateDir,
+ * trimLadderEnabled, trimLadderT2Tokens, trimLadderT2MinBlocks,
+ * trimLadderT3Tokens, trimLadderT3MinBlocks.
  */
 
 import { appendFileSync, mkdirSync, renameSync, statSync } from "node:fs";
 import { join } from "node:path";
-import { buildView, estimateTokensOf, injectView, ledgerIsStale, rangeIsSegmentAligned, refOf, refPositions } from "./view.js";
+import { buildView, estimateTokensOf, injectView, ledgerIsStale, messageTokens, rangeIsSegmentAligned, refOf, refPositions } from "./view.js";
 import { computeFoldableRange, evaluateTrigger, EMERGENCY_COOLDOWN_MS } from "./trigger.js";
-import { mechanicalSummary, renderMaterial, summarizeWithModel } from "./summarizer.js";
+import { LADDER_SYSTEM_PROMPT, mechanicalSummary, renderLadderMaterial, renderMaterial, summarizeWithModel } from "./summarizer.js";
 import { createStore } from "./state.js";
 import { createMetrics, extractUsage, promptTokensOf, wrapStreamForMetrics } from "./metrics.js";
 import { forkLinkOf, loadForkLinks, recordForkLink, resolveInheritance, INHERIT_WINDOW_MS } from "./fork.js";
@@ -42,13 +48,16 @@ import { childSessionIdOf } from "../subagent-model.js";
  * agent/status and assembleContextFor's context.agent are both the object
  * form). Mirrors the host/context-watch.js:122 precedent. Returns null when
  * nothing usable is present. */
-// ---- cross-layer view registry (meter duality, design §8) ------------------
-// Latest outbound-view token estimate per session, refreshed on EVERY
-// llm/stream call. host/context-watch.js prefers this over the token meter's
-// stored tally while it is fresh, so the watermark tracks what the model
-// actually sees after billion-context folding instead of over-triggering
-// handovers off a stale stored measure.
+// ---- cross-layer meter registries (meter duality, design §8) ---------------
+// Per session: the latest outbound-view token estimate plus the last sampled
+// provider prompt, refreshed on every ACCEPTED main llm/stream call (the
+// side-dispatch guard keeps auxiliary calls out of both). host/context-watch.js
+// reads the wire-domain bridge over these (recentTrimPromptTokensOf:
+// max(view, wire)) so the watermark meters on the same boundary as the trim
+// pressure tiers; the wire-truth gate decides when neither registry may drive
+// it and the stored tally takes over.
 const trimViewBySession = new Map(); // sessionId -> { viewTokens, at, inject, lastNoneAt }
+const trimWireBySession = new Map(); // sessionId -> { promptTokens, at } — last sampled provider prompt of an accepted MAIN dispatch (side calls never write; a tiny inherited-id usage sample must not lower the watermark's wire floor)
 /** Freshness TTL for the in-memory view/injection registry (watermark and
  *  banner display only). NEVER a fold gate: gating folds on "did the surface
  *  channel ship recently" deadlocks resumed sessions (2026-11-05). The fold
@@ -72,33 +81,87 @@ const SIDE_DISPATCH_SKIP_BUDGET = 2;
  *  accepted main dispatch). */
 const sideDispatchSkipsBySession = new Map();
 
+/** Shared wire-truth gate (docs/context-trim.md): the view-registry entry for
+ * one session when the recent dispatch stream provably carried the view —
+ * null when missing, stale, injected "none", or inside the sticky lastNoneAt
+ * window (mixed sessions exist — one real session logged 46 none + 14
+ * swapped). Observed 2026-11-04: a view that never reaches the wire must not
+ * drive the watermark (view ~80k vs a 176k wire while the force tier stayed
+ * silent and the auto-handover never fired). Both watermark accessors read
+ * through this gate; itself fail-open. */
+function gatedViewEntry(sessionId, maxAgeMs) {
+	if (typeof sessionId !== "string" || sessionId === "") return null;
+	const entry = trimViewBySession.get(sessionId);
+	if (entry === undefined) return null;
+	if (Date.now() - entry.at > maxAgeMs) return null;
+	if (entry.inject === "none") return null;
+	if (Number.isFinite(entry.lastNoneAt) && entry.lastNoneAt > 0 && Date.now() - entry.lastNoneAt < maxAgeMs) return null;
+	return entry;
+}
+
 /** Most recent outbound-view token estimate for a session, or null when
- * missing, non-positive, older than maxAgeMs — or when the recent dispatch
- * stream could not carry the view (injected "none": frozen options AND
- * messages, so the model still receives the raw history and the provider
- * tally is the only truthful meter). The gate is deliberately sticky: a
- * single mutable dispatch right after frozen ones re-arms maybeFold, but
- * the WATERMARK keeps falling back to the tally until no "none" occurred
- * within the TTL window (mixed sessions exist — one real session logged 46
- * none + 14 swapped). Read by the watermark layer (meter duality); itself
- * fail-open. */
+ * missing, non-positive, or gate-rejected. The bare-view half of the meter
+ * duality bridge — kept for diagnostics and as the gate primitive; the
+ * watermark layer reads the wire-domain accessor below. */
 export function recentTrimViewTokensOf(sessionId, maxAgeMs = TRIM_VIEW_MAX_AGE_MS) {
 	try {
-		if (typeof sessionId !== "string" || sessionId === "") return null;
-		const entry = trimViewBySession.get(sessionId);
-		if (entry === undefined) return null;
-		if (Date.now() - entry.at > maxAgeMs) return null;
-		// Wire-truth gate: a view that never reaches the wire must not drive
-		// the watermark (observed 2026-11-04: view ~80k vs a 176k wire while
-		// the force tier stayed silent and the auto-handover never fired).
-		if (entry.inject === "none") return null;
-		if (Number.isFinite(entry.lastNoneAt) && entry.lastNoneAt > 0 && Date.now() - entry.lastNoneAt < maxAgeMs) return null;
-		return Number.isFinite(entry.viewTokens) && entry.viewTokens > 0 ? entry.viewTokens : null;
+		const entry = gatedViewEntry(sessionId, maxAgeMs);
+		return entry !== null && Number.isFinite(entry.viewTokens) && entry.viewTokens > 0 ? entry.viewTokens : null;
 	} catch {
 		return null;
 	}
 }
 
+/** Meter-duality bridge, wire domain (design §8): the same number the trim
+ * pressure tiers evaluate in maybeFold — Math.max(outbound view estimate,
+ * the last sampled provider prompt) — or null when the gate rejects or
+ * neither component is fresh. The watermark layer reads THIS (not the bare
+ * view) so its soft/hard/force tiers and the read budget sit on the same
+ * boundary as the fold engine: the view estimate never counts the
+ * system/tool sections (a session-shape-dependent mass — live decision-log
+ * pairs drift −5k…+6k between view and wire in steady state), so a
+ * view-only watermark tightens every protective tier late by exactly that
+ * mass, and the wmHardTokens-95k ≙ trim-pressure-90k alignment (c453b91)
+ * is silently defeated. The wire half comes from accepted MAIN dispatches
+ * only (noteTrimWireTokens below). Same sticky gate as the view bridge;
+ * fail-open — null means the caller falls back to the stored tally. */
+export function recentTrimPromptTokensOf(sessionId, maxAgeMs = TRIM_VIEW_MAX_AGE_MS) {
+	try {
+		const entry = gatedViewEntry(sessionId, maxAgeMs);
+		if (entry === null) return null;
+		let best = 0;
+		if (Number.isFinite(entry.viewTokens) && entry.viewTokens > 0) best = entry.viewTokens;
+		const wire = trimWireBySession.get(sessionId);
+		if (wire !== undefined && Date.now() - wire.at <= maxAgeMs && Number.isFinite(wire.promptTokens) && wire.promptTokens > best) best = wire.promptTokens;
+		return best > 0 ? best : null;
+	} catch {
+		return null;
+	}
+}
+
+/** Record the provider prompt size (uncached + cacheRead + cacheWrite) of one
+ * usage sample from an ACCEPTED main dispatch. Side dispatches (fold-span
+ * re-sends, title generation, web-search summaries) sample usage on the same
+ * session id but must never reach this registry: their tiny prompts would
+ * LOWER the watermark's wire floor below the main history's real prompt —
+ * exactly the pollution the side-dispatch guard keeps out of the view
+ * registry. Fail-open, bounded like the view registry. */
+function noteTrimWireTokens(sessionId, usage) {
+	try {
+		if (typeof sessionId !== "string" || sessionId === "") return;
+		const promptTokens = promptTokensOf({
+			lastInputTokens: usage.inputTokens,
+			cachedTokens: usage.cachedTokens,
+			cacheWriteTokens: usage.cacheWriteTokens,
+		});
+		if (promptTokens === null) return;
+		trimWireBySession.set(sessionId, { promptTokens, at: Date.now() });
+		if (trimWireBySession.size > 200) trimWireBySession.delete(trimWireBySession.keys().next().value);
+	} catch {
+		/* observability must never throw */
+	}
+}
+
 /** Injection outcome of the last dispatch for one session ("in-place" |
  * "swapped" | "none"), or null when unknown or stale. Read by maybeFold:
  * when the wire cannot carry the view, folding cannot relieve anything and
@@ -124,14 +187,6 @@ export function agentSessionIdOf(agent) {
 	return null;
 }
 
-/** Display label for the banner: object → name, string → itself, else the
- * session id (never prints [object Object]). */
-export function agentLabelOf(agent) {
-	if (typeof agent === "string") return agent;
-	if (agent !== null && typeof agent === "object" && typeof agent.name === "string" && agent.name !== "") return agent.name;
-	return agentSessionIdOf(agent);
-}
-
 // ---- config field readers (fail-open defaults) -------------------------------
 
 function readBool(config, key, fallback) {
@@ -189,12 +244,14 @@ function readRoute(config, key) {
 // ---- prompt texts -------------------------------------------------------------
 
 /** Byte-stable head section: the trim protocol (digit-free, like the
- * watermark protocol, so it stays out of KV invariants' way). */
+ * watermark protocol, so it stays out of KV invariants' way). States the
+ * number-free disclosure policy explicitly — the model never receives
+ * water levels or progress numbers from this engine. */
 export const TRIM_PROTOCOL_TEXT = [
-	"[SWITCHMAN:TRIM] This session has automatic context trimming.",
+	"[SWITCHMAN:TRIM] This session has automatic context trimming. The engine folds consumed ranges itself and never reports sizes, percentages, or progress to you — no action or pacing is expected of you on that front.",
 	"- Old message ranges may be replaced by ONE synthetic [SWITCHMAN:TRIM] summary message; treat those summaries as faithful compressions, and message refs inside them as historical anchors.",
 	"- NEVER contradict or re-derive content a summary already settled; build on it.",
-	"- When context grows large, you may fold a contiguous range yourself with the ctx_trim_fold tool (give firstId/lastId message refs and a summary following the compression rules); inspect state with ctx_trim_status.",
+	"- You may fold a contiguous range yourself with the ctx_trim_fold tool (give firstId/lastId message refs and a summary following the compression rules); ctx_trim_status lists the compressible ranges with their true sizes.",
 	"- Tool-call pairs (an assistant tool call and its results) must always be folded together or not at all.",
 ].join("\n");
 
@@ -209,37 +266,6 @@ export function effectiveWindowTokens(resolved, cap) {
 	return Math.min(a, b);
 }
 
-/** Live context line renderer (pure; exported for tests). Silent in "off"
- * mode and whenever nothing has been measured yet. wireRaw marks a session
- * whose last dispatch could not carry the fold view (frozen request) — the
- * displayed view is then meter-only and the watermark governs off the
- * provider tally. */
-export function renderTrimContextLine(agent, { enabled, mode, viewTokens, windowTokens, folds, growthTokens, lastModel, wireRaw = false }) {
-	if (!enabled) return "";
-	if (mode === "off") return "";
-	if (agent === null || agent === undefined || agent === "") return "";
-	const hasView = Number.isFinite(viewTokens) && viewTokens > 0;
-	const hasFolds = Number.isFinite(folds) && folds > 0;
-	if (!hasView && !hasFolds) return "";
-	const kilo = (n) => `${Math.round(n / 1000)}k`;
-	const parts = [];
-	if (hasView) {
-		let usage = "";
-		if (Number.isFinite(windowTokens) && windowTokens > 0) usage = ` (${Math.round((viewTokens / windowTokens) * 100)}% of window ${kilo(windowTokens)})`;
-		else usage = " (window unknown — pressure tiers off)";
-		parts.push(`view ~${kilo(viewTokens)} tokens${usage}`);
-		if (wireRaw) parts.push("wire=raw (folds not shipping; watermark reads the tally)");
-	}
-	if (hasFolds) {
-		parts.push(`folds ${folds}`);
-		if (Number.isFinite(growthTokens)) parts.push(`growth ~${kilo(growthTokens)} since last fold`);
-	}
-	if (lastModel !== null && typeof lastModel === "object" && typeof lastModel.model === "string" && lastModel.model !== "") parts.push(`model ${lastModel.model}`);
-	if (parts.length === 0) return "";
-	const modeNote = mode === "advisory" ? "advisory: fold via ctx_trim_fold when context feels heavy" : "auto folding active";
-	return `[SWITCHMAN:TRIM] agent ${agent}: ${parts.join(", ")}; ${modeNote}.\n`;
-}
-
 // ---- layer ---------------------------------------------------------------------
 
 /** Register the context-trim layer. Wired from the plugin root after
@@ -254,6 +280,28 @@ export function applyContextTrim(ctx, config) {
 		}
 	};
 
+	// Reload/teardown marker: HMR disposes and remounts this section on every
+	// plugin edit (the profile's node_modules entry is a dev symlink into this
+	// checkout). An in-flight fold whose llm stream is cut by the dispose ends
+	// as a clean zero-chunk stream — inside the summarizer that is
+	// indistinguishable from a genuine empty model reply. Cycles record their
+	// start time; a dispose at/after that time reclassifies the outcome as
+	// reload-aborted so it neither climbs the failure ladder nor reads as a
+	// model failure in decisions.log.
+	let disposedAt = 0;
+	try {
+		// cordis emits no "dispose" event: self-teardown arrives as
+		// "internal/plugin" carrying OUR fiber with its uid CLEARED — uid is a
+		// positive counter at construction (vendor/cordis fiber.ts:239) and is
+		// set to null right before the disposal emit (:274-275; the DISPOSED
+		// state is defined as uid === null at :581). Same guard DSH ships in
+		// mcp-manager:249 and client-ui-cot-translation mount.ts:123.
+		ctx.on("internal/plugin", (fiber) => { if (fiber === ctx.fiber && fiber.uid === null) disposedAt = Date.now(); });
+	} catch {
+		/* lifecycle events unavailable on this ctx — flag stays 0, behavior unchanged */
+	}
+	const disposedSince = (since) => disposedAt !== 0 && disposedAt >= since;
+
 	// Per-process pipeline state (process-wide by design: ledgers persist on
 	// disk per session, metrics/captures live per session in memory).
 	const store = createStore({ stateDir: readString(config, "trimStateDir", null) ?? undefined, warn });
@@ -276,21 +324,6 @@ export function applyContextTrim(ctx, config) {
 			return false;
 		}
 	};
-	// Durable surface-channel EVIDENCE for the banner: a block that already
-	// SHIPPED a replacement (surfaceReplaced) proves the channel reaches the
-	// wire, even across a process restart and after the in-memory recency
-	// window expired. A commit-time capture (surfaceSeqs) does NOT — the block
-	// may never ship, and a capture must not silence the honest wire=raw
-	// warning. Display only — the fold gate uses the live capability probe.
-	const ledgerShowsShippedReplacement = (sessionId) => {
-		try {
-			const blocks = store.ledgerOf(sessionId)?.blocks;
-			if (!Array.isArray(blocks)) return false;
-			return blocks.some((block) => block?.surfaceReplaced !== null && block?.surfaceReplaced !== undefined);
-		} catch {
-			return false;
-		}
-	};
 	const metrics = createMetrics();
 
 	/** Most recent provider prompt size for one session, or null when unknown.
@@ -448,8 +481,47 @@ export function applyContextTrim(ctx, config) {
 		pressurePercent: readNumber(config, "trimPressurePercent", 60),
 		emergencyPercent: readNumber(config, "trimEmergencyPercent", 95),
 		protectedTail: Math.max(0, Math.round(readNumber(config, "trimProtectedTail", 6))),
-		maxFoldsPerHour: readNumber(config, "trimMaxFoldsPerHour", 6),
+		maxFoldsPerHour: readNumber(config, "trimMaxFoldsPerHour", 16),
+		ladderT2Tokens: readNumber(config, "trimLadderT2Tokens", 8_000),
+		ladderT2MinBlocks: readNumber(config, "trimLadderT2MinBlocks", 3),
+		ladderT3Tokens: readNumber(config, "trimLadderT3Tokens", 6_000),
+		ladderT3MinBlocks: readNumber(config, "trimLadderT3MinBlocks", 2),
 	});
+	const ladderEnabledNow = () => readBool(config, "trimLadderEnabled", true);
+	/** CJK-aware summary-mass estimator for the ladder census (same units
+	 * the view estimate speaks, applied to summary text). */
+	const summaryTokensOf = (text) => messageTokens({ role: "user", content: [{ type: "text", text: typeof text === "string" ? text : "" }] });
+	/** Maximal runs of consecutive ACTIVE tier-1 / tier-2 blocks in ledger
+	 * order — the ladder's candidate consumes sets (docs/ladder-fold.md).
+	 * A run breaks on an inactive member, a tier change, or a tier-3 block
+	 * interleaving. Runs carry { consumes, mass, count }; mass is the
+	 * CJK-aware summary-mass estimate. Pure over the ledger. */
+	function ladderRunsOf(ledger) {
+		const runs = { t2: [], t3: [] };
+		if (ledger === null || !Array.isArray(ledger.blocks)) return runs;
+		let cur = null;
+		const flush = () => {
+			if (cur !== null && cur.ids.length > 0) {
+				const run = { consumes: cur.ids, mass: cur.mass, count: cur.ids.length };
+				if (cur.tier === 1) runs.t2.push(run);
+				else if (cur.tier === 2) runs.t3.push(run);
+			}
+			cur = null;
+		};
+		for (const block of ledger.blocks) {
+			const tier = block?.active === true && (block.tier === 1 || block.tier === 2) ? block.tier : null;
+			if (tier === null || (cur !== null && cur.tier !== tier)) {
+				flush();
+			}
+			if (tier !== null && cur === null) cur = { tier, ids: [], mass: 0 };
+			if (cur !== null) {
+				cur.ids.push(block.id);
+				cur.mass += summaryTokensOf(block.summary);
+			}
+		}
+		flush();
+		return runs;
+	}
 	/** Effective-window cap: explicit trimWindowTokens, else auto-follow
 	 * wmForceTokens (keeps fold tiers ahead of the handover tier). */
 	const windowCapNow = () => {
@@ -530,7 +602,11 @@ export function applyContextTrim(ctx, config) {
 		// some dispatch options are frozen on top of that. injectView picks the
 		// best strategy per dispatch and fails open; the view-applied line
 		// records which strategy was used.
-		const injected = injectView(options, messages, view);
+		// [2026-11-07]-[trimMode "off" means measure only]-[the view build runs
+		// for the meter, but the fold must not reach the wire — inspection
+		// report P0-2: off previously still spliced the folded view into the
+		// dispatch.]
+		const injected = modeNow() !== "off" ? injectView(options, messages, view) : "nothing-to-apply";
 		const viewTokens = estimateTokensOf(view.messages);
 		const blocksCount = Array.isArray(ledger.blocks) ? ledger.blocks.length : 0;
 		// Wire truth in the row: the most recent provider prompt size (from the
@@ -558,8 +634,17 @@ export function applyContextTrim(ctx, config) {
 		// history below the floor, so the guard must not stick: after
 		// SIDE_DISPATCH_SKIP_BUDGET consecutive skips the dispatch is accepted
 		// as main, which re-arms capture/baseline on the compacted history.
-		const sideCandidate = inFlight.has(sessionId)
-			|| (view.applied === 0 && messages.length < SIDE_DISPATCH_MIN_MESSAGES && (blocksCount > 0 || captures.has(sessionId) || trimViewBySession.has(sessionId)));
+		// [2026-11-07]-[fold-span dispatches are self-noise, not side
+		// candidates]-[an in-flight fold cycle's own summarizer re-sends used
+		// to consume the side-dispatch skip budget: three consecutive span
+		// dispatches got "budget exhausted — accepting as main" and polluted
+		// the capture/baseline (the 2026-11-04 regression path). They now
+		// bypass unconditionally — never counted, never main.]
+		if (inFlight.has(sessionId)) {
+			decisionLog(`session=${sessionId} fold-span dispatch skipped view=${Math.round(viewTokens)} msgs=${messages.length}`);
+			return { sessionId, viewTokens, sideDispatch: true };
+		}
+		const sideCandidate = view.applied === 0 && messages.length < SIDE_DISPATCH_MIN_MESSAGES && (blocksCount > 0 || captures.has(sessionId) || trimViewBySession.has(sessionId));
 		const skipCount = sideDispatchSkipsBySession.get(sessionId) ?? 0;
 		if (sideCandidate && skipCount < SIDE_DISPATCH_SKIP_BUDGET) {
 			sideDispatchSkipsBySession.set(sessionId, skipCount + 1);
@@ -613,11 +698,60 @@ export function applyContextTrim(ctx, config) {
 		return null;
 	}
 
+	/** Resolve the fold-fallback route (trimFoldFallbackModel): the second
+	 * chance when the side/session route fails, and the last model stop
+	 * before a raw pressure fold degrades to mechanical. Null = no fallback. */
+	function foldFallbackRouteFor() {
+		return readRoute(config, "trimFoldFallbackModel");
+	}
+
+	/** True when two resolved routes name the same provider+model (a fallback
+	 * identical to the primary route would only double the failure latency). */
+	function sameRoute(a, b) {
+		return a !== null && b !== null && a.provider === b.provider && a.model === b.model;
+	}
+
 	/** Run one fold cycle for a session (called at the idle boundary ONLY).
 	 * Returns a short outcome string for logging. */
-	async function runFoldCycle(sessionId, decision) {
+	async function runFoldCycle(sessionId, decision, cycleStartedAt) {
 		const capture = captures.get(sessionId);
 		if (capture === undefined) return "no-capture";
+		const { protectedTail } = thresholdsNow();
+		// Ladder cycle (docs/ladder-fold.md): distill the decision's consumed
+		// run of block summaries into ONE replacement. Never mechanical — a
+		// failed distillation skips the cycle (fail-open + failure ladder).
+		if (decision.kind === "ladder") {
+			const ledgerBefore = store.ledgerOf(sessionId);
+			const byId = new Map(Array.isArray(ledgerBefore.blocks) ? ledgerBefore.blocks.map((block) => [block.id, block]) : []);
+			const consumed = decision.consumes.map((id) => byId.get(id)).filter((block) => block !== undefined);
+			if (consumed.length !== decision.consumes.length) return "ladder-consumed-missing";
+			const llm = ctx.get("llm", false);
+			const route = sideRouteFor(sessionId);
+			const fallback = foldFallbackRouteFor();
+			const approxTokens = consumed.reduce((sum, block) => sum + (Number.isFinite(block.approxTokens) && block.approxTokens > 0 ? block.approxTokens : 0), 0);
+			const summarize = (r, tag) => summarizeWithModel(llm, r, renderLadderMaterial(consumed), {
+				systemPrompt: LADDER_SYSTEM_PROMPT,
+				onFail: (why) => decisionLog(`session=${sessionId} summary-fail route=${tag} why=${why} blocks=${consumed.length} ~${approxTokens}t ladder=${decision.tier}`),
+			});
+			let summary = route !== null ? await summarize(route, "side") : null;
+			if (summary === null && fallback !== null && !sameRoute(fallback, route)) summary = await summarize(fallback, "fallback");
+			// Ladder folds never degrade to mechanical (docs/ladder-fold.md):
+			// after both routes fail the cycle stays fail-open with backoff.
+			if (summary === null) return disposedSince(cycleStartedAt) ? "reload-aborted" : "summary-unavailable"; // skip cycle, fail-open; a dispose cut is not a model failure
+			const result = store.commitFold(
+				sessionId,
+				{ consumes: decision.consumes.slice(), summary, kind: "summary", tier: decision.tier === "ladder-3" ? 3 : 2, approxTokens },
+				null, // ladder commits validate against the ledger, never the capture
+			);
+			if (!result.ok) return `commit-rejected:${result.reason}`;
+			// Post-fold low baseline: the ladder shrinks the view; re-anchor
+			// the growth gate at the new low so it does not re-fire on stale
+			// anchor math (same pair semantics as raw folds).
+			const lowLedger = store.ledgerOf(sessionId);
+			const lowView = estimateTokensOf(buildView(capture.messages, lowLedger, { protectedTail }).messages);
+			store.recordFoldBaseline(sessionId, capture.viewTokens, lowView);
+			return `folded:${decision.tier}:${decision.consumes.length} blocks (~${approxTokens} tokens)`;
+		}
 		const { startIdx, endIdx } = decision;
 		const slice = capture.messages.slice(startIdx, endIdx + 1);
 		if (slice.length === 0) return "empty-slice";
@@ -626,6 +760,7 @@ export function applyContextTrim(ctx, config) {
 		const approxTokens = estimateTokensOf(slice);
 		let summary = null;
 		let kind = "summary";
+		let degraded = false; // set when a PRESSURE fold falls back to mechanical
 		if (decision.action === "emergency") {
 			// Emergency cooldown timestamp set BEFORE the cycle: a commitFold
 			// rejection (e.g. duplicate-range) must cool the emergency tier
@@ -639,10 +774,25 @@ export function applyContextTrim(ctx, config) {
 		} else {
 			const llm = ctx.get("llm", false);
 			const route = sideRouteFor(sessionId);
-			summary = await summarizeWithModel(llm, route, renderMaterial(capture.messages, startIdx, endIdx, refOf), {
-				onFail: (why) => decisionLog(`session=${sessionId} summary-fail why=${why}`),
+			const fallback = foldFallbackRouteFor();
+			const material = renderMaterial(capture.messages, startIdx, endIdx, refOf);
+			const summarize = (r, tag) => summarizeWithModel(llm, r, material, {
+				onFail: (why) => decisionLog(`session=${sessionId} summary-fail route=${tag} why=${why} msgs=${count} ~${approxTokens}t`),
 			});
-			if (summary === null) return "summary-unavailable"; // skip cycle, fail-open
+			summary = route !== null ? await summarize(route, "side") : null;
+			if (summary === null && fallback !== null && !sameRoute(fallback, route)) summary = await summarize(fallback, "fallback");
+			// Last resort for PRESSURE folds only: relief beats fidelity when
+			// the window is nearly gone; growth folds stay fail-open (a
+			// mechanical growth fold would burn fold budget on junk). The
+			// outcome row marks the degrade so the log shows why no model
+			// summary landed.
+			if (summary === null && decision.tier === "pressure") {
+				if (disposedSince(cycleStartedAt)) return "reload-aborted";
+				summary = mechanicalSummary(capture.messages, startIdx, endIdx, refOf);
+				kind = "mechanical";
+				degraded = true;
+			}
+			if (summary === null) return disposedSince(cycleStartedAt) ? "reload-aborted" : "summary-unavailable"; // skip cycle, fail-open; a dispose cut is not a model failure
 		}
 		const positions = refPositions(capture.messages);
 		const result = store.commitFold(
@@ -659,9 +809,9 @@ export function applyContextTrim(ctx, config) {
 		// post-fold low (tier-a anchor — keeps the gate armed after folds
 		// that commit at high view points).
 		const lowLedger = store.ledgerOf(sessionId);
-		const lowView = estimateTokensOf(buildView(capture.messages, lowLedger, { protectedTail: thresholdsNow().protectedTail }).messages);
+		const lowView = estimateTokensOf(buildView(capture.messages, lowLedger, { protectedTail }).messages);
 		store.recordFoldBaseline(sessionId, capture.viewTokens, lowView);
-		return `folded:${decision.tier}:${count} msgs (~${approxTokens} tokens)`;
+		return `folded:${decision.tier}:${count} msgs (~${approxTokens} tokens)${degraded ? " fallback=mechanical" : ""}`;
 	}
 
 	/** Idle-boundary hook (also re-used by the stream-path fallback): decide
@@ -692,18 +842,22 @@ export function applyContextTrim(ctx, config) {
 			return;
 		}
 		inFlight.add(sessionId);
+		const cycleStartedAt = Date.now();
+		// Hoisted for the catch below: a dispose-cut throw may land before the
+		// trigger ever ran, and the catch must not touch a dead binding.
+		let decision = null;
 		try {
 			const { protectedTail, ...thresholds } = thresholdsNow();
-			const foldable = computeFoldableRange(capture.messages, store.ledgerOf(sessionId), protectedTail);
-			const windowTokens = await windowTokensFor(capture.model);
 			const ledger = store.ledgerOf(sessionId);
+			const foldable = computeFoldableRange(capture.messages, ledger, protectedTail);
+			const windowTokens = await windowTokensFor(capture.model);
 			// Pressure tiers run on the REAL prompt size when the tally is known:
 			// max(view, wire). The view estimate misses the system/context
 			// sections, so a 136k wire once read as a 50k view and the tiers
 			// stayed silent. Unknown tally → exactly today's behavior.
 			const wireTokens = wireTokensOf(sessionId);
 			const pressureTokens = wireTokens !== null ? Math.max(capture.viewTokens, wireTokens) : capture.viewTokens;
-			const decision = evaluateTrigger({
+			decision = evaluateTrigger({
 				foldable,
 				messages: capture.messages,
 				viewTokens: pressureTokens,
@@ -714,23 +868,31 @@ export function applyContextTrim(ctx, config) {
 				foldsThisHour: ledger.foldsThisHour,
 				lastEmergencyAt: lastEmergencyAtBySession.get(sessionId) ?? 0,
 				ledger,
+				ladderRuns: ladderEnabledNow() ? ladderRunsOf(ledger) : { t2: [], t3: [] },
 			});
 			decisionLog(`session=${sessionId} via=${via} action=${decision.action} tier=${decision.tier ?? "-"} reason=${decision.reason || "-"} view=${Math.round(capture.viewTokens)}${wireTokens === null ? "" : ` wire=${wireTokens}`} window=${windowTokens ?? "null"}`);
 			if (decision.action === "none") return;
-			const outcome = await runFoldCycle(sessionId, decision);
+			const outcome = await runFoldCycle(sessionId, decision, cycleStartedAt);
 			// Failure ladder: commit resets it; a summarize/commit failure
 			// climbs it (the no-backoff loop this closes — those outcomes
-			// advance no cadence gate on their own).
+			// advance no cadence gate on their own). A ladder run whose
+			// consumed blocks vanished between trigger and commit is the same
+			// family: without backoff it would re-fire at every boundary.
 			if (outcome.startsWith("folded:")) clearFoldFailure(sessionId);
-			else if (outcome === "summary-unavailable" || outcome.startsWith("commit-rejected:")) recordFoldFailure(sessionId);
+			else if (outcome === "summary-unavailable" || outcome.startsWith("commit-rejected:") || outcome === "ladder-consumed-missing") recordFoldFailure(sessionId);
 			// Outcome lands in the decision log too: warn() has no reachable
 			// sink on some hosts, and the commit/fail boundary is exactly what
 			// live diagnosis needs.
-			decisionLog(`session=${sessionId} outcome=${outcome} tier=${decision.tier}`);
+			decisionLog(`session=${sessionId} outcome=${outcome} tier=${decision.tier ?? "-"}`);
 			warn(`[context-trim] ${sessionId}: ${outcome} (${decision.reason})`);
 		} catch (error) {
-			recordFoldFailure(sessionId); // a thrown cycle counts as failed too
-			warn(`[context-trim] fold cycle failed: ${error?.message ?? error}`);
+			// A dispose mid-cycle throws through here too (ctx/service teardown) —
+			// that is a reload cut, not a model failure: log it and skip the ladder.
+			if (disposedSince(cycleStartedAt)) decisionLog(`session=${sessionId} outcome=reload-aborted tier=${decision?.tier ?? "-"}`);
+			else {
+				recordFoldFailure(sessionId); // a thrown cycle counts as failed too
+				warn(`[context-trim] fold cycle failed: ${error?.message ?? error}`);
+			}
 		} finally {
 			inFlight.delete(sessionId);
 		}
@@ -738,63 +900,17 @@ export function applyContextTrim(ctx, config) {
 
 	// ---- host registrations (each individually fail-open) --------------------
 
+	// MODEL-VISIBILITY INVARIANT: only the byte-stable protocol head is
+	// registered. The previous live context line (view tokens, % of window,
+	// folds, growth) is gone by design — water levels and progress numbers
+	// steer model judgment (bili lesson #2, docs/ladder-fold.md). Human
+	// diagnostics live in decisions.log (view-applied / decision / outcome
+	// rows) and the client badge.
 	try {
-		ctx.systemPrompt?.section?.({ name: "switchman:trim", order: 10450, interpolate: false, text: () => TRIM_PROTOCOL_TEXT });
+		ctx.systemPrompt?.section?.({ name: "switchman:trim", order: 10450, interpolate: false, text: () => (enabledNow() && modeNow() !== "off" ? TRIM_PROTOCOL_TEXT : "") });
 	} catch (error) {
 		warn(`[context-trim] systemPrompt.section failed: ${error?.message ?? error}`);
 	}
-	try {
-		ctx.systemPrompt?.context?.({
-			name: "switchman:trim",
-			order: 299,
-			required: true,
-			interpolate: false,
-			text: (context) => {
-				try {
-					const agent = context?.agent ?? null;
-					// context.agent is also the agent OBJECT — derive the id plus a
-					// display label so the banner never prints [object Object].
-					const sessionId = agentSessionIdOf(agent);
-					const label = agentLabelOf(agent);
-					const record = sessionId !== null ? metrics.of(sessionId) : null;
-					const ledger = sessionId !== null ? store.ledgerOf(sessionId) : null;
-					const model = captureModelOf(sessionId);
-					const windowTokens = model === null ? null : cachedWindowOf(model);
-					const growthBaseline = ledger !== null && Number.isFinite(ledger.lastFoldLowTokens) && ledger.lastFoldLowTokens > 0 ? ledger.lastFoldLowTokens : ledger !== null && Number.isFinite(ledger.lastFoldViewTokens) && ledger.lastFoldViewTokens > 0 ? ledger.lastFoldViewTokens : null;
-					// Honest wire status: the wire is only "raw" when NEITHER channel
-					// can reach it — a capable surface pass, or a ledger that already
-					// proves a SHIPPED replacement (a capture alone does not: it may
-					// never ship), keeps the marker off even after the in-memory
-					// recency window expired.
-					const wireRaw = recentTrimInjectOf(sessionId) === "none" && !surfaceChannelCapable(sessionId) && !ledgerShowsShippedReplacement(sessionId);
-					return renderTrimContextLine(label, {
-						enabled: enabledNow(),
-						mode: modeNow(),
-						viewTokens: record?.viewTokens ?? null,
-						windowTokens,
-						folds: Array.isArray(ledger?.blocks) ? ledger.blocks.length : 0,
-						growthTokens: record?.viewTokens !== null && record !== undefined && growthBaseline !== null ? record.viewTokens - growthBaseline : null,
-						lastModel: record?.lastModel ?? null,
-						wireRaw,
-					});
-				} catch {
-					return "";
-				}
-			},
-		});
-	} catch (error) {
-		warn(`[context-trim] systemPrompt.context failed: ${error?.message ?? error}`);
-	}
-
-	/** Synchronous window lookup for the banner: raw cache composed with
-	 *  the cap (async resolution happens in the idle path / stream path). */
-	function captureModelOf(sessionId) {
-		return captures.get(sessionId)?.model ?? null;
-	}
-	function cachedWindowOf(model) {
-		const resolved = model !== null && typeof model.provider === "string" && typeof model.model === "string" ? windowCache.get(`${model.provider}/${model.model}`)?.windowTokens ?? null : null;
-		return effectiveWindowTokens(resolved, windowCapNow());
-	}
 
 	try {
 		ctx.on("agent/status", (payload) => {
@@ -860,29 +976,56 @@ export function applyContextTrim(ctx, config) {
 
 	// ---- tools (L1 advisory surface) ------------------------------------------
 
+	/** Render the fold ledger for the status tool: ACTIVE blocks with true
+	 * sizes, absorbed history as one line. NO water level, NO fill
+	 * percentage, NO window math, NO threshold percentages — sizes of
+	 * concrete ranges are the model-facing interface (bili mechanism #5);
+	 * global progress numbers are not (lesson #2). */
+	function renderStatusLedger(ledger) {
+		const blocks = Array.isArray(ledger?.blocks) ? ledger.blocks : [];
+		const active = blocks.filter((block) => block?.active === true);
+		const absorbed = blocks.length - active.length;
+		const lines = [];
+		if (blocks.length === 0) {
+			lines.push("fold ledger: empty (nothing folded yet)");
+			return lines;
+		}
+		lines.push(`fold ledger: ${active.length} active block(s)${absorbed > 0 ? `, ${absorbed} absorbed by higher tiers` : ""} (oldest first)`);
+		for (const block of active) {
+			const tier = block.tier === 3 ? "T3" : block.tier === 2 ? "T2" : "T1";
+			const range = block.refRange !== null && block.refRange !== undefined ? ` refs [m${block.refRange.firstId}]..[m${block.refRange.lastId}]` : ` distills ${block.count} lower-tier block(s)`;
+			lines.push(`- ${block.id} ${tier}: ~${Math.round(Number.isFinite(block.approxTokens) ? block.approxTokens : 0)} tokens of material${range}${block.tier >= 2 ? ` — foldable into a higher tier together with its sibling blocks` : ""}`);
+		}
+		return lines;
+	}
+
 	try {
 		ctx.tools?.register?.({
 			name: "ctx_trim_status",
-			description: "Inspect the context-trim state of the current session: mode, thresholds, view token estimate, fold ledger, per-message refs of the captured history. Read-only.",
+			description: "List this session's compressible context ranges with their true sizes: the fold ledger, the raw range a fold would cover, and distillation targets. Read-only. Contains sizes only — never progress percentages.",
 			parameters: { type: "object", properties: {}, additionalProperties: false },
 			required: [],
 			async execute() {
 				const sessionId = sessionIdOf({});
 				if (sessionId === null) return "No session context available.";
+				if (!enabledNow()) return "Context trimming is disabled for this deployment.";
 				const ledger = store.ledgerOf(sessionId);
-				const record = metrics.of(sessionId);
 				const capture = captures.get(sessionId);
-				const { protectedTail, ...thresholds } = thresholdsNow();
-				const lines = [
-					"ctx_trim_status",
-					`mode: ${modeNow()} (enabled: ${enabledNow()})`,
-					`view tokens (estimate): ${record?.viewTokens ?? "n/a"}`,
-					`window tokens: ${cachedWindowOf(capture?.model ?? null) ?? "unknown"}`,
-					`folds: ${Array.isArray(ledger.blocks) ? ledger.blocks.length : 0}, frontier: ${ledger.frontier ?? "none"}, last fold view tokens: ${ledger.lastFoldViewTokens || "n/a"}`,
-					`thresholds: growth>${thresholds.growthTokens} increment>=${thresholds.incrementTokens} pressure=${thresholds.pressurePercent}% emergency=${thresholds.emergencyPercent}% maxPerHour=${thresholds.maxFoldsPerHour} protectedTail=${protectedTail}`,
-				];
+				const { protectedTail } = thresholdsNow();
+				const lines = [`ctx_trim_status — mode: ${modeNow()} (enabled: ${enabledNow()})`];
+				lines.push(...renderStatusLedger(ledger));
+				// The raw range a fold would cover next, with its true size.
 				if (capture !== undefined) {
-					lines.push("", `captured history (${capture.messages.length} messages; refs [m...] are fold anchors):`);
+					const foldable = computeFoldableRange(capture.messages, ledger, protectedTail);
+					if (foldable !== null) {
+						const firstRef = refOf(capture.messages[foldable.startIdx], foldable.startIdx);
+						const lastRef = refOf(capture.messages[foldable.endIdx], foldable.endIdx);
+						lines.push("", `compressible raw range: [m${firstRef}]..[m${lastRef}] (${foldable.endIdx - foldable.startIdx + 1} messages, ~${estimateTokensOf(capture.messages, foldable.startIdx, foldable.endIdx)} tokens) — a ctx_trim_fold over this range replaces it with your summary.`);
+					} else {
+						lines.push("", "compressible raw range: none right now (everything settled is already folded).");
+					}
+					// Message refs stay available for fold targeting (sizes only).
+					lines.push("", `captured history (${capture.messages.length} messages; refs [m...] are fold anchors, per-message sizes are estimates):`);
 					capture.messages.forEach((message, i) => {
 						lines.push(`- [m${refOf(message, i)}] (${message?.role ?? "?"}) ~${estimateTokensOf(capture.messages, i, i)} tokens`);
 					});
@@ -914,6 +1057,7 @@ export function applyContextTrim(ctx, config) {
 			async execute(args) {
 				const sessionId = sessionIdOf({});
 				if (sessionId === null) return "No session context available.";
+				if (!enabledNow() || modeNow() === "off") return "Context trimming is disabled for this deployment.";
 				const capture = captures.get(sessionId);
 				if (capture === undefined) return "No captured history yet — fold is unavailable until the next model call.";
 				const positions = refPositions(capture.messages);
@@ -945,7 +1089,7 @@ export function applyContextTrim(ctx, config) {
 						approxTokens: estimateTokensOf(capture.messages, firstIdx, lastIdx),
 						summary: String(args.summary ?? ""),
 						kind: "summary",
-						tier: "model",
+						tier: 1,
 					},
 					positions,
 				);
@@ -968,10 +1112,14 @@ export function applyContextTrim(ctx, config) {
 
 	function streamListener(options, next) {
 		let viewTokens = null;
+		let mainDispatch = false;
 		try {
 			if (enabledNow()) {
 				const applied = applyViewToOptions(options);
-				if (applied !== null) viewTokens = applied.viewTokens;
+				if (applied !== null) {
+					viewTokens = applied.viewTokens;
+					mainDispatch = applied.sideDispatch !== true;
+				}
 			}
 		} catch (error) {
 			decisionLog(`view-build-failed why=${error?.message ?? error}`);
@@ -985,7 +1133,10 @@ export function applyContextTrim(ctx, config) {
 			if (wrappedSession === null) return result;
 			return wrapStreamForMetrics(result, (chunk) => {
 				const usage = extractUsage(chunk);
-				if (usage !== null) metrics.recordUsage(wrappedSession, usage);
+				if (usage !== null) {
+					metrics.recordUsage(wrappedSession, usage);
+					if (mainDispatch) noteTrimWireTokens(wrappedSession, usage);
+				}
 			});
 		} catch (error) {
 			warn(`[context-trim] stream wrap failed: ${error?.message ?? error}`);
@@ -1050,5 +1201,5 @@ export function applyContextTrim(ctx, config) {
 		warn(`[context-trim] ctx.inject(llm) failed: ${error?.message ?? error}`);
 	}
 
-	return { store, metrics, captures, inFlight, maybeFold, maybeInherit, applyViewToOptions, surfacePass, renderTrimContextLine: (agent) => renderTrimContextLine(agent, { enabled: enabledNow(), mode: modeNow(), viewTokens: null, windowTokens: null, folds: 0, growthTokens: null, lastModel: null, wireRaw: false }) };
+	return { store, metrics, captures, inFlight, maybeFold, maybeInherit, applyViewToOptions, surfacePass };
 }