pi-fold 1.0.1 → 1.0.3

package/extensions/active-context.ts

@@ -2,25 +2,29 @@ import {
   denseOwnArrayValues,
   evidenceSha256,
   objectRefKey,
+  sha256Text,
   sha256Value,
   stableStringify,
 } from "./json.ts";
-import {
-} from "./lib/advisory.ts";
+import type { EvidenceRef } from "./json.ts";
 import {
   bytes,
   clone,
   emptyActiveContextState,
   ownValue,
+  sessionEntryMessages,
   uniqueMessageDigestAnchor,
 } from "./lib/canonical.ts";
 import {
   activeContextStatus,
   automaticPreparationId,
+  boundedOrientation,
   boundStatusPayload,
   commitPreparedFold,
+  consolidationSourceText,
   descendantIds,
   encodedFoldSource,
+  generatedBriefs,
   foldCandidatesDetail,
   foldTreeDetail,
   peekFoldSource,
@@ -42,6 +46,8 @@ import {
   capacityAccounting,
   contextUsageRatio,
   contextWindowFor,
+  explicitProtectedMass,
+  budgetOccupancy,
   hardFenceRatio,
   latestProviderContextMeasurement,
   orderedRoots,
@@ -49,6 +55,7 @@ import {
   parseNativeCompactionDecision,
   parseProviderContextMeasurementReceipt,
   persistenceProjection,
+  protectedStaleMass,
   providerContextMeasurement,
   providerTokens,
   refsProtected,
@@ -74,6 +81,7 @@ import {
   makeStateDelta,
   MAX_ACTIVE_FOLD_RECORDS,
   materializeStatePersistence,
+  foldProvenance,
   normalizeFoldsForPersistedRecords,
   normalizeLegacyProvenance,
   protectionSha256,
@@ -93,47 +101,58 @@ import {
   DEFAULT_ACTIVE_CONTEXT_TOOL_LABEL,
   DEFAULT_ACTIVE_CONTEXT_TOOL_NAME,
   COMMIT_RECLAIM_FLOOR_SHARE,
-  CURATION_OCCUPANCY_SHARE,
-  CURATION_STALE_TOOL_SHARE,
   CONTEXT_RECEIPT_BLOCK_BYTES,
-  CURATION_TARGET_OCCUPANCY_SHARE,
   DEFAULT_CONTEXT_WINDOW,
-  DEFAULT_FOLD_SCHEDULING,
+  EPOCH_CONSOLIDATION_ROUNDS,
+  MAX_THRESHOLD_NOTICES,
+  THRESHOLD_NOTICE_SHARES,
+  resolveGuidance,
+  assertThresholdsServable,
+  resolveThresholds,
+  servingBudgetTokens,
   ESTIMATED_BYTES_PER_TOKEN,
   entryTypeNamespace,
-  EPOCH_ACTIVE_CONTEXT_TOOL_ACTIONS,
-  EPOCH_COMMIT_TARGET_WINDOW_SHARE,
+  MAX_BRIEF_BATCH_SPANS,
+  MAX_BRIEF_UPGRADE_QUEUE,
+  MAX_BRIEF_UPGRADES_IN_FLIGHT,
   MAX_FOLD_SPAN_CHARS,
+  MAX_PINNED_SHARE,
   MAX_WEDGE_ABSORB_TOKENS,
   OVERFLOW_RECOVERY_MAX_ATTEMPTS,
   PEEK_DEFAULT_MAX_BYTES,
   PEEK_MIN_SLICE_BYTES,
   PEEK_READ_ONLY_CONTEXT_ACTIONS,
-  FOLD_SCHEDULING_MODES,
-  READ_ONLY_CONTEXT_ACTIONS_DEFAULT,
-  READ_ONLY_TOOLS_DEFAULT,
+  AUTO_FOLD_BLACKLIST_DEFAULT,
+  SURFACING_BRIEF_HIT,
+  SURFACING_CONTENT_HIT,
+  SURFACING_DIVERGENCE_MARGIN,
+  SURFACING_OUTCOME_WINDOW_ORDINALS,
+  SURFACING_SLATE_SIZE,
   USER_RESCUE_MAX_SOURCE_CHARS,
 } from "./lib/policy.ts";
 import type {
+  ActiveContextGuidance,
   ActiveContextSnapshot,
   ActiveContextState,
+  ActiveContextThresholds,
   ActiveContextToolAction,
+  BriefProvenance,
   FoldCandidate,
   FoldKind,
   FoldRecordEntry,
-  FoldSchedulingMode,
   PreparedFold,
-  SuggestionSource,
 } from "./lib/policy.ts";
 import {
   absorbWedgeMarks,
 } from "./lib/scheduling.ts";
 import {
   contextReceipt,
+  contextRiderText,
   curationSignals,
-  curationTriggerFires,
+  lastCallText,
   markAwarenessText,
   receiptBlockText,
+  thresholdNoticeText,
   withReceipt,
 } from "./lib/curation.ts";
 import type {
@@ -144,6 +163,7 @@ import {
   addPendingMark,
   claimedRefKeys,
   commitPendingMarks,
+  consolidationMarks,
   ephemeralPeekMarks,
   epochCommitDue,
   estimatedTokens,
@@ -169,16 +189,21 @@ import {
   deterministicChapterCandidateBrief,
   deterministicConsolidationBrief,
   manualFoldCandidate,
+  peekedSourceFoldIds,
   selectAutomaticToolBatch,
-  selectAutomaticToolForRung,
   snapFoldCandidate,
   snapToFoldBoundaries,
   splitCandidateBySize,
 } from "./lib/selection.ts";
 import type { SpanCorrection } from "./lib/selection.ts";
 import {
-  acceptSurfacingSuggestion,
-  surfacingOrdinal,
+  issueSurfacing,
+  noteSurfacingAction,
+  resolveSurfacing,
+  selectSurfacingSlate,
+  surfacingLedger,
+  surfacingSilenced,
+  surfacingSlateText,
 } from "./lib/surfacing.ts";
 import {
   compareProjections,
@@ -199,11 +224,27 @@ import { buildActiveContextCommands, buildActiveContextTool } from "./lib/tool-s
 import {
   currentTurnRefKeys,
   mapActiveContext,
-  toolFreshIndices,
 } from "./lib/transcript.ts";
+import {
+  findOverflowErrorEntry,
+  overflowEventShape,
+  preStripHolds,
+  probeRollbackSurfaces,
+  rollbackNoticeText,
+  unansweredToolCalls,
+} from "./lib/rollback.ts";
+
+/**
+ * How a projection's token reading was reached.
+ *
+ * "anchored": the provider's own count for the projection this one extends, plus a rate
+ * estimate of the bytes appended after it. "rewritten": the current projection does not
+ * begin with the measured one, so there is nothing to add a delta to and the whole
+ * projection is estimated. "unmeasured": no accepted provider count yet.
+ */
+export type ProjectionReadingBasis = "anchored" | "rewritten" | "unmeasured";
 
 // Test seam only; the package API is registerPiFold because package.json exports block deep imports.
-export * from "./lib/advisory.ts";
 export * from "./lib/canonical.ts";
 export * from "./lib/curation.ts";
 export * from "./lib/folding.ts";
@@ -211,19 +252,12 @@ export * from "./lib/instrumentation.ts";
 export * from "./lib/measurement.ts";
 export * from "./lib/persistence.ts";
 export * from "./lib/policy.ts";
+export * from "./lib/rollback.ts";
 export * from "./lib/scheduling.ts";
 export * from "./lib/selection.ts";
 export * from "./lib/surfacing.ts";
 export * from "./lib/transcript.ts";
 
-/** Handle a suggestion source keeps: withdraw itself, and report that its item was acted on. */
-export interface SuggestionSourceHandle {
-  unregister: () => void;
-  accepted: (id: string) => void;
-}
-
-export type SuggestionSourceRegistrar = (source: SuggestionSource) => SuggestionSourceHandle;
-
 /**
  * The batched fold request: several {span, brief} pairs in one call, with the single
  * `ids` form still accepted because it is the shape a status action hands back.
@@ -261,113 +295,139 @@ export function batchedMarkRequests(params: Record<string, unknown>): BatchedMar
 }
 
 export function registerActiveContext(pi: any, options: {
+  /**
+   * INTERNAL brief-generator seam, not a public option: `registerPiFold` refuses the
+   * name and builds the generator from `summarizer`. It stays a parameter because it
+   * is the runtime's only brief-generator interface.
+   */
   summarizeContextSpan?: (request: Record<string, unknown>, ctx: unknown) => Promise<Record<string, unknown>>;
-  setProjectionProvider?: (provider: (ctx: any) => Array<Record<string, unknown>>) => void;
-  setSuggestionSourceRegistrar?: (register: SuggestionSourceRegistrar) => void;
-  toolActions?: readonly ActiveContextToolAction[];
+  /**
+   * INTERNAL deployment-identity seam, not public options: the package entry refuses all
+   * five by name and the shipped identity is the one in `policy.ts`. They survive here
+   * because the neutrality gate has to register a synthetic brand to prove none of it
+   * reaches the defaults, and the experiment harness registers the pi-fold identity
+   * explicitly so its sealed runs keep their entry types.
+   */
   toolName?: string;
   toolLabel?: string;
   brandNoun?: string;
   entryTypePrefix?: string;
-  commandPrefix?: string;
   commandNames?: { status?: string; fold?: string };
-  readOnlyTools?: ReadonlySet<string>;
-  blockingTools?: readonly string[];
-  foldScheduling?: FoldSchedulingMode;
-  foldPeekResults?: boolean;
-  providerTotalWindow?: number;
+  /**
+   * The auto-fold EXCEPTION list, empty by default: every completed tool batch folds
+   * unmarked, and this names the tools whose results must stay raw.
+   */
+  blacklistAutoFoldTools?: ReadonlySet<string>;
+  /** The serving budget itself, ALREADY NET of the deployment's output reservation. */
+  providerInputBudget?: number;
+  /**
+   * The thermostat, set whole or not at all. USER policy: no agent action reads it back
+   * as a mutable surface, and status reports the values without offering to change them.
+   */
+  thresholds?: ActiveContextThresholds;
+  /** Both guidance surfaces, set together, defaulting on. */
+  guidance?: Partial<ActiveContextGuidance>;
 }): {
   projectionCandidates: (ctx: any) => Array<Record<string, unknown>>;
-  registerSuggestionSource: SuggestionSourceRegistrar;
 } {
   const toolName = options.toolName ?? DEFAULT_ACTIVE_CONTEXT_TOOL_NAME;
   const toolLabel = options.toolLabel ?? DEFAULT_ACTIVE_CONTEXT_TOOL_LABEL;
   const brandNoun = options.brandNoun ?? DEFAULT_ACTIVE_CONTEXT_BRAND_NOUN;
   const entryTypePrefix = options.entryTypePrefix ?? DEFAULT_ACTIVE_CONTEXT_ENTRY_TYPE_PREFIX;
-  const commandPrefix = options.commandPrefix ?? "";
-  const readOnlyTools = options.readOnlyTools ?? READ_ONLY_TOOLS_DEFAULT;
-  const foldScheduling = options.foldScheduling ?? DEFAULT_FOLD_SCHEDULING;
-  if (!FOLD_SCHEDULING_MODES.includes(foldScheduling)) {
-    throw new Error(`foldScheduling must be one of ${FOLD_SCHEDULING_MODES.join(", ")}`);
+  const blacklistAutoFoldTools = options.blacklistAutoFoldTools ?? AUTO_FOLD_BLACKLIST_DEFAULT;
+  // Deleted options are REFUSED by name, never ignored. A deployment still passing one
+  // believes it asked for something, and silence would hand it the opposite behavior:
+  // `foldScheduling` chose between epoch and the deleted immediate scheduler,
+  // `foldPeekResults` opted peek results out of the foldable classification, and
+  // `toolActions` narrowed the action surface. All three are unconditional now.
+  for (const removed of ["foldScheduling", "foldPeekResults", "toolActions"]) {
+    if (Object.hasOwn(options, removed)) {
+      throw new Error(`${removed} is no longer an option: epoch scheduling, peek foldability ` +
+        "and the whole action surface are unconditional");
+    }
+  }
+  if (Object.hasOwn(options, "blockingTools")) {
+    throw new Error("blockingTools is no longer an option: a tool call never causes a rewrite of " +
+      "its own, and the commit epoch is the only path that mutates the projection");
+  }
+  // The per-request surfacing channel. `setProjectionProvider` was a second delivery
+  // path for the value this call already returns, and `setSuggestionSourceRegistrar`
+  // handed out registration into a carrier that no longer exists: the slate rode a
+  // per-request ephemeral tail, which moved the prefix on every single pass. The
+  // selector survives and returns at the commit boundary; the channel does not.
+  for (const removed of ["setProjectionProvider", "setSuggestionSourceRegistrar"]) {
+    if (Object.hasOwn(options, removed)) {
+      throw new Error(`${removed} is no longer an option: projection candidates are returned by ` +
+        "registration, and external suggestion sources have no carrier to render into");
+    }
   }
-  const epochScheduling = foldScheduling === "epoch";
-  if (options.foldPeekResults !== undefined && typeof options.foldPeekResults !== "boolean") {
-    throw new Error("foldPeekResults must be a boolean");
+  // The renamed options are refused by their OLD names, each pointing at the new one.
+  // `readOnlyTools` and then `autoFoldableTools` were both ALLOW-lists, and the list runs
+  // the other way now, so neither may be forwarded silently: an allow-list read as a
+  // blacklist bars exactly the tools it meant to permit. `commandPrefix` derived two
+  // command names from a stem the full-name override then overrode anyway;
+  // `providerTotalWindow` was a gross window the runtime netted down with a GUESSED
+  // reservation, and the guess is what the reshape deleted.
+  for (const inverted of ["readOnlyTools", "autoFoldableTools"]) {
+    if (Object.hasOwn(options, inverted)) {
+      throw new Error(`${inverted} is now blacklistAutoFoldTools, and the sense is INVERTED: ` +
+        "every completed tool batch folds unmarked, and the list names the exceptions whose " +
+        "results must stay raw. An allow-list moved across verbatim would bar exactly the " +
+        "tools it meant to permit");
+    }
+  }
+  if (Object.hasOwn(options, "commandPrefix")) {
+    throw new Error("commandPrefix is no longer an option: give whole names with commandNames");
   }
-  // Peek mutates nothing, so its own tool result is a foldable read batch. Epoch mode
-  // adopts that classification with its scheduling; immediate mode keeps the narrower
-  // one unless the deployment opts in, because a peek copies a fold's stored source
-  // back into the window and a window that cannot reclaim it grows without bound.
-  const foldPeekResults = options.foldPeekResults ?? epochScheduling;
-  if (options.providerTotalWindow !== undefined &&
-      (!Number.isSafeInteger(options.providerTotalWindow) || options.providerTotalWindow <= 0)) {
-    throw new Error("providerTotalWindow must be a positive integer");
+  if (Object.hasOwn(options, "providerTotalWindow")) {
+    throw new Error("providerTotalWindow is now providerInputBudget, and it is ALREADY NET: " +
+      "pass the tokens the deployment may actually fill, not the total window the runtime " +
+      "then subtracts a guessed output reservation from");
+  }
+  if (options.providerInputBudget !== undefined &&
+      (!Number.isSafeInteger(options.providerInputBudget) || options.providerInputBudget <= 0)) {
+    throw new Error("providerInputBudget must be a positive integer");
   }
   // The deployment's own fact, and the only capacity knob: declaring it makes every
   // ratio, fence and budget truthful, and leaving it out falls back to the provider
   // descriptor and SAYS "descriptor" in the capacity accounting.
-  const providerTotalWindow = options.providerTotalWindow ?? null;
-  const readOnlyContextActions = foldPeekResults
-    ? PEEK_READ_ONLY_CONTEXT_ACTIONS
-    : READ_ONLY_CONTEXT_ACTIONS_DEFAULT;
-  if (!toolName || !toolLabel || !brandNoun || !entryTypePrefix || typeof commandPrefix !== "string" ||
-      (commandPrefix && !/^[a-z0-9-]+$/.test(commandPrefix)) ||
-      [...readOnlyTools].some((name) => typeof name !== "string" || !name)) {
-    throw new Error("Active-context names and read-only tools must be nonempty strings");
+  const providerInputBudget = options.providerInputBudget ?? null;
+  const readOnlyContextActions = PEEK_READ_ONLY_CONTEXT_ACTIONS;
+  if (!toolName || !toolLabel || !brandNoun || !entryTypePrefix ||
+      [...blacklistAutoFoldTools].some((name) => typeof name !== "string" || !name)) {
+    throw new Error("Active-context names and blacklisted auto-fold tools must be nonempty strings");
   }
-  const commandStem = commandPrefix ? `${commandPrefix.replace(/-+$/, "")}-` : "";
-  // Full-name override for hosts that need non-default command names (e.g. the
-  // pi-fold package's neutral "context"); commandPrefix remains the derived form.
   const commandNames = {
-    status: options.commandNames?.status ?? `${commandStem}${DEFAULT_ACTIVE_CONTEXT_COMMAND_NAMES.status}`,
-    fold: options.commandNames?.fold ?? `${commandStem}${DEFAULT_ACTIVE_CONTEXT_COMMAND_NAMES.fold}`,
+    status: options.commandNames?.status ?? DEFAULT_ACTIVE_CONTEXT_COMMAND_NAMES.status,
+    fold: options.commandNames?.fold ?? DEFAULT_ACTIVE_CONTEXT_COMMAND_NAMES.fold,
   };
   if (![commandNames.status, commandNames.fold].every((name) =>
       typeof name === "string" && /^[a-z0-9][a-z0-9-]*$/.test(name)) ||
       commandNames.status === commandNames.fold) {
     throw new Error("Active-context command names must be distinct kebab-case strings");
   }
-  const configuredBlockingTools = denseOwnArrayValues(options.blockingTools ?? ["Agent"]);
-  if (!configuredBlockingTools || configuredBlockingTools.some((name) => typeof name !== "string" || !name) ||
-      new Set(configuredBlockingTools).size !== configuredBlockingTools.length) {
-    throw new Error("Blocking tools must be one dense array of unique nonempty strings");
-  }
-  const blockingTools = new Set(configuredBlockingTools as string[]);
+  // The thermostat, validated atomically before anything else reads a threshold, and
+  // then checked against the budget this deployment can actually serve.
+  const thresholds = resolveThresholds(options.thresholds);
+  assertThresholdsServable(thresholds, providerInputBudget ?? servingBudgetTokens(DEFAULT_CONTEXT_WINDOW));
+  const guidance = resolveGuidance(options.guidance);
   const stateEntryType = `${entryTypePrefix}-state`;
   const foldRecordEntryType = `${entryTypePrefix}-fold-record`;
   const milestoneProjectionType = `${entryTypePrefix}-milestone`;
   const advisoryProjectionType = `${entryTypePrefix}-advisory`;
   const surfacingProjectionType = `${entryTypePrefix}-surfacing`;
   const receiptProjectionType = `${entryTypePrefix}-receipts`;
+  const riderProjectionType = `${entryTypePrefix}-rider`;
+  const lastCallProjectionType = `${entryTypePrefix}-lastcall`;
+  const noticeProjectionType = `${entryTypePrefix}-notice`;
   const curationProjectionType = `${entryTypePrefix}-curation`;
   const entryNamespace = entryTypeNamespace(entryTypePrefix);
   const providerMeasurementEntryType = `${entryNamespace}-provider-context-measurement`;
   const nativeReceiptEntryType = `${entryNamespace}-native-compaction-receipt`;
   const contextEventEntryType = `${entryNamespace}-context-event`;
   const nativeDecisionEntryType = `${entryNamespace}-native-compaction-decision`;
-  // The commit verb only exists where marks exist; immediate mode keeps its exact
-  // seven-action surface and description.
-  const defaultToolActions = epochScheduling
-    ? EPOCH_ACTIVE_CONTEXT_TOOL_ACTIONS
-    : ACTIVE_CONTEXT_TOOL_ACTIONS;
-  const configuredToolActions = denseOwnArrayValues(
-    options.toolActions ?? defaultToolActions,
-  );
-  if (!configuredToolActions || configuredToolActions.length < 1) {
-    throw new Error("Active-context tool actions must be one non-empty dense array");
-  }
-  const allowedToolActions: ActiveContextToolAction[] = [];
-  const allowedToolActionSet = new Set<string>();
-  for (const value of configuredToolActions) {
-    if (typeof value !== "string" ||
-        !EPOCH_ACTIVE_CONTEXT_TOOL_ACTIONS.includes(value as ActiveContextToolAction) ||
-        allowedToolActionSet.has(value)) {
-      throw new Error(`Invalid or duplicate active-context tool action '${String(value)}'`);
-    }
-    allowedToolActions.push(value as ActiveContextToolAction);
-    allowedToolActionSet.add(value);
-  }
-  Object.freeze(allowedToolActions);
+  const allowedToolActions: readonly ActiveContextToolAction[] = ACTIVE_CONTEXT_TOOL_ACTIONS;
+  const allowedToolActionSet = new Set<string>(allowedToolActions);
 
   type AutomaticFailureState = {
     key: string;
@@ -408,6 +468,62 @@ export function registerActiveContext(pi: any, options: {
     actionQueue: Promise.resolve<unknown>(undefined),
   };
 
+  /**
+   * THE BRIEF UPGRADE LANE.
+   *
+   * A fold brief is model-written from this campaign forward; the deterministic brief is
+   * what a failure leaves behind. The automatic ladder cannot wait for a generator: the
+   * commit path is synchronous with a measured projection and a fold deferred until a
+   * provider answers is a fold that does not happen. So the ladder commits deterministic,
+   * a generator runs between boundaries, and the brief it writes lands as an UPGRADE
+   * riding the next commit: the same law wedge absorption and the surfacing slate follow,
+   * mutations only inside a rewrite the session already paid for.
+   *
+   * Everything here is process-local. An upgrade lost to a reload is a brief that stays
+   * deterministic, which is exactly the failure the fallback exists for, and the state
+   * wire keeps one shape instead of carrying work in progress.
+   */
+  const upgrades = {
+    /**
+     * BATCHES of folds committed deterministic, each holding the exact source its briefs
+     * will cover. One batch is one generator call: a commit folds its spans together, so
+     * they are briefed together, and the spans of one batch orient each other. Sending them
+     * one at a time is what left the 2026-08-11 rep with 14 model briefs across 87 folds.
+     */
+    queue: [] as Array<{
+      members: Array<{ foldId: string; sourceSha256: string }>;
+      request: Record<string, unknown>;
+    }>,
+    /**
+     * Generator calls in flight, keyed by every fold each one briefs, bounded by a constant
+     * and cancel-safe on session change or shutdown. Keyed rather than counted because
+     * the queue has to know a fold is already being briefed.
+     */
+    running: new Map<string, { controller: AbortController; promise: Promise<void> }>(),
+    /** Written briefs waiting for a boundary. They never apply anywhere else. */
+    ready: [] as Array<{ foldId: string; sourceSha256: string; brief: string; provenance: BriefProvenance }>,
+    /** A generator that failed a fold does not get it back: one attempt, then deterministic stands. */
+    failed: new Set<string>(),
+    /**
+     * Parents whose turn has not come: a group is read at depth one, so a child still
+     * waiting on its own brief would be read through the sentence that brief is about to
+     * replace. They are retried at every boundary and never dropped, because the wait ends
+     * the moment the lane drains and a parent that was skipped once is a parent no
+     * generator ever writes.
+     */
+    deferred: new Set<string>(),
+    /** Failures since the last commit record carried them, so none of this is silent. */
+    failures: 0,
+    /**
+     * Briefs that took a second ask before they met the contract. Counted because the cure
+     * is the mechanism that lets the brief cap be a real limit rather than a truncation
+     * point, so how often it fires is how we learn whether the cap is set anywhere near
+     * right (Shane 2026-08-11).
+     */
+    cures: 0,
+    lastError: null as string | null,
+  };
+
   // Owns provider receipts, anchors, and usage; providerMeasurementQueue serializes receipt writes.
   const measurements = {
     latestRatio: null as number | null,
@@ -430,10 +546,31 @@ export function registerActiveContext(pi: any, options: {
     lastProjectedEstimate: null as number | null,
     /** Whether that estimate used a measured ratio rather than the bootstrap constant. */
     lastProjectedEstimateCalibrated: false,
+    /** How that reading was reached, so an audit can tell an anchor from a fallback. */
+    lastProjectedEstimateBasis: "unmeasured" as ProjectionReadingBasis,
+    /** That projection's own size at one rate, the baseline a reduction is measured from. */
+    lastProjectedSizeTokens: null as number | null,
+    /**
+     * The provider's own count for the last projection this process TRANSMITTED, held
+     * with that projection's serialized text so a later projection can be tested against
+     * it by construction. `head` is the serialization minus its closing bracket, which is
+     * what makes "the same projection with more appended after it" a byte-exact prefix
+     * test rather than a size comparison.
+     */
+    projectionAnchor: null as {
+      tokens: number;
+      chars: number;
+      head: string;
+      messageSha256: string;
+      sessionId: string;
+      generation: number;
+    } | null,
     /** Signed estimator error against recent measurements, as a share of measured tokens. */
     estimatorErrors: [] as number[],
     /** Growth in measured tokens between consecutive requests. */
     inflowSteps: [] as number[],
+    /** Growth steps the OUTPUT WALL reads. Separate from `inflowSteps` on purpose: see noteWallInflow. */
+    wallInflowSteps: [] as number[],
     providerMeasurementQueue: Promise.resolve<void>(undefined),
     providerMeasurementReceipts: new Set<string>(),
     providerMeasurementRevisionByMessageSha: new Map<string, number>(),
@@ -517,6 +654,15 @@ export function registerActiveContext(pi: any, options: {
      * runtime rewrites the projection, which is the whole cost model.
      */
     reopenBaselineShare: null as number | null,
+    /** Whether the output wall's crossing has already spent its one forced commit. */
+    wallEpisodeOpen: false,
+    /**
+     * Where the armed last-call actually LANDED: the exposure it rendered and the
+     * ordinal of the pass that rendered it. In-memory on purpose: after a reload the
+     * carrier re-renders on the first projection, this re-arms, and the commit waits
+     * one more round rather than firing on a prompt nobody saw.
+     */
+    lastCallDelivery: null as { exposure: number; ordinal: number } | null,
     /** Recovery attempts spent on the CURRENT inflow; reset by any accepted request. */
     recoveryAttempts: 0,
     /** A provider rejection observed but not yet recovered from. */
@@ -525,6 +671,29 @@ export function registerActiveContext(pi: any, options: {
     instrumentationQueue: Promise.resolve<void>(undefined),
   };
 
+  /**
+   * The tree-rollback lane.
+   *
+   * Armed once per session against the pi surfaces it calls, because every one of them
+   * is an internal the extension contract does not promise. Disarmed, the lane is OFF
+   * and says so on the record: an overflow still emits `context.rollback` with
+   * `armed: false` and the reason, the user is notified, and the session behaves
+   * exactly as it did before this build -- the projection-budget fence aborts an
+   * over-budget request rather than half-performing a recovery.
+   */
+  const rollback = {
+    probes: null as ReturnType<typeof probeRollbackSurfaces> | null,
+    armed: false,
+    /** pi's own overflow classifier, resolved from the host; null when unreachable. */
+    classifier: null as ((message: unknown, contextWindow: number) => boolean) | null,
+    classifierSource: null as string | null,
+    /** Ordinals of episodes handled, so the one-shot and the ledger agree. */
+    attempts: 0,
+    last: null as Record<string, unknown> | null,
+    /** An overflow seen at message_end and not yet claimed by the compaction event. */
+    pendingOverflow: null as { at: number; entryId: string | null } | null,
+  };
+
   // Owns advisory arming and hard-fence delivery; durable effects use persistenceQueue.
   const advisory = {
     hardFenceNoticeKey: null as string | null,
@@ -532,16 +701,6 @@ export function registerActiveContext(pi: any, options: {
     hardFenceReleasedProjectionKeys: new Set<string>(),
   };
 
-  // Registered suggestion sources. RETRIEVAL IS UNWIRED FROM THE PROJECTION as of this
-  // build: the slate that rendered these was a per-pass tail carrier, and a tail carrier
-  // is displaced by every append, so it diverged the prefix on every single pass. The
-  // selector in lib/surfacing.ts is kept and still gated, because proactive retrieval is
-  // the right idea in the wrong place: when it returns it must ride a commit like every
-  // other carrier. Until then nothing renders a suggestion, so nothing selects one.
-  const surfacing = {
-    sources: [] as SuggestionSource[],
-  };
-
   // Owns native-compaction decisions and completion retry state; nativeReceiptQueue serializes it.
   const nativeCompaction = {
     lastThresholdDecision: null as Record<string, unknown> | null,
@@ -560,8 +719,6 @@ export function registerActiveContext(pi: any, options: {
     shuttingDown: false,
     latestSnapshot: null as ActiveContextSnapshot | null,
     latestSnapshotError: null as string | null,
-    blockingToolHarvestedThisTurn: false,
-    blockingToolHarvestQueuedThisTurn: false,
     contextQueue: Promise.resolve<void>(undefined),
   };
 
@@ -620,6 +777,103 @@ export function registerActiveContext(pi: any, options: {
     return record;
   };
 
+  /**
+   * The generator, wrapped once so every brief it writes is on the record.
+   *
+   * Wrapping HERE rather than instrumenting the two call sites is deliberate. The inline
+   * path in `prepareFold` and the async upgrade lane both receive this function, so one
+   * wrapper covers both, no signature changes and no way to add a third caller that
+   * quietly escapes the ledger. It also covers a deployment's OWN summarizer, which is
+   * the case a call-site patch would have missed.
+   *
+   * A generator call is invisible everywhere else: it runs outside the session, so it
+   * lands in no provider ledger, and it runs off the turn, so it lands in no turn timing.
+   * Duration, queue wait and usage are therefore recorded here or nowhere.
+   *
+   * A failure is emitted and rethrown unchanged. This observes; it decides nothing, and
+   * the fallback to the deterministic brief stays exactly where it was.
+   */
+  const observedSummarize = options.summarizeContextSpan
+    ? async (request: Record<string, unknown>, summarizerCtx: unknown): Promise<Record<string, unknown>> => {
+      const startedAt = Date.now();
+      const queuedAt = typeof request.queuedAtMs === "number" ? request.queuedAtMs : null;
+      const spans = Array.isArray(request.spans)
+        ? request.spans as Array<Record<string, unknown>>
+        : null;
+      const sourceText = typeof request.sourceText === "string" ? request.sourceText : "";
+      // A span is a CONSOLIDATION when it is a group of folds, and an automatic fold
+      // otherwise. Both kinds are counted and both kinds' source is measured, because a
+      // call can carry a mix and the honest way to attribute its tokens across kinds is by
+      // the share of source each kind contributed, never by pretending the call was one
+      // kind (Shane 2026-08-11: track cures and tokens by fold type).
+      const groupSpan = (span: Record<string, unknown>): boolean =>
+        Number.isInteger(span.children) && (span.children as number) > 1;
+      const charsOf = (span: Record<string, unknown>): number =>
+        typeof span.sourceText === "string" ? span.sourceText.length : 0;
+      const kindCounts = spans
+        ? {
+          spans: spans.length,
+          group_spans: spans.filter(groupSpan).length,
+          leaf_spans: spans.filter((span) => !groupSpan(span)).length,
+          group_source_chars: spans.filter(groupSpan).reduce((sum, span) => sum + charsOf(span), 0),
+          leaf_source_chars: spans.filter((span) => !groupSpan(span))
+            .reduce((sum, span) => sum + charsOf(span), 0),
+          fold_ids: spans.map((span) => typeof span.candidateId === "string" ? span.candidateId : ""),
+        }
+        : {
+          spans: 1,
+          group_spans: groupSpan(request) ? 1 : 0,
+          leaf_spans: groupSpan(request) ? 0 : 1,
+          group_source_chars: groupSpan(request) ? sourceText.length : 0,
+          leaf_source_chars: groupSpan(request) ? 0 : sourceText.length,
+        };
+      const base = {
+        fold_id: typeof request.candidateId === "string" ? request.candidateId : "",
+        source_chars: spans ? spans.reduce((sum, span) => sum + charsOf(span), 0) : sourceText.length,
+        source_sha256: typeof request.sourceSha256 === "string" ? request.sourceSha256 : sha256Text(sourceText),
+        ...kindCounts,
+        // The second ask, not the first. How often this fires is how we learn whether the
+        // brief cap is anywhere near right, so it is a field rather than an inference.
+        cure: typeof request.cure === "string" && request.cure.length > 0,
+        ...(queuedAt === null ? {} : { queued_ms: Math.max(0, startedAt - queuedAt) }),
+      };
+      try {
+        const result = await options.summarizeContextSpan!(request, summarizerCtx);
+        const written = Array.isArray(result?.briefs)
+          ? (result.briefs as unknown[]).map((item) => typeof item === "string" ? item.trim() : "")
+          : [typeof result?.brief === "string" ? result.brief.trim() : ""];
+        emit("context.brief", {
+          ...base,
+          outcome: "ok",
+          duration_ms: Date.now() - startedAt,
+          provider: typeof result?.provider === "string" ? result.provider : "",
+          model: typeof result?.model === "string" ? result.model : "",
+          effort: typeof result?.effort === "string" ? result.effort : "",
+          brief_chars: written.reduce((sum, item) => sum + item.length, 0),
+          // Per span, so a batch where one brief came back empty is visible as that rather
+          // than as a slightly short total.
+          brief_chars_each: written.map((item) => item.length),
+          brief_sha256: written.length === 1 && written[0] ? sha256Text(written[0]) : "",
+          // Absent when the provider reported none. Never defaulted: a call whose cost we
+          // do not know and a call that cost nothing are different facts.
+          usage: result?.usage && typeof result.usage === "object" ? clone(result.usage) : null,
+        });
+        return result;
+      } catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        emit("context.brief", {
+          ...base,
+          // A timeout is not a refusal and not a provider fault, and telling them apart is
+          // the difference between raising the bound and changing the generator.
+          outcome: /exceeded \d+ms/.test(message) ? "timeout" : "error",
+          duration_ms: Date.now() - startedAt,
+          error: boundReceiptText(message, 240, "brief generator"),
+        });
+        throw error;
+      }
+    }
+    : undefined;
+
   /**
    * Actions of ours that move bytes at or before a prefix position. Receipts, gate
    * notices and suggestions are appended after the whole projection, so they can only
@@ -641,6 +895,7 @@ export function registerActiveContext(pi: any, options: {
       split_from_chars: receipt.splitFromChars,
       absorbed_wedges: receipt.absorbedWedges,
       recovered: receipt.recovered,
+      protected_bytes: receipt.protectedBytes,
       note: receipt.note,
     });
   };
@@ -671,18 +926,18 @@ export function registerActiveContext(pi: any, options: {
   };
 
   /**
-   * The window every ratio, fence and budget is computed against. With truthful
-   * capacity on this is the provider's TOTAL admission window, not the per-request
-   * max-input descriptor: the descriptor bakes in a full output reservation the
-   * deployment never asked for, and treating it as the ceiling aborts requests inside
-   * real headroom. The descriptor is still read, and still reported, so the gap stays
+   * The number every ratio, fence and budget is computed against. Declared, it is the
+   * deployment's own serving budget, already net of whatever output reservation it holds
+   * back; undeclared, it is the per-request max-input descriptor, which bakes in a full
+   * output reservation the deployment never asked for and so aborts requests inside real
+   * headroom. The descriptor is still read, and still reported, so the gap stays
    * auditable rather than assumed.
    */
   const budgetWindowFor = (ctx: any): number | null => {
     // Remembered so the ctx-free callers (trigger, gate, reminders, advisory) report the
     // same descriptor gap the fence does instead of re-reading a second source.
     measurements.descriptorWindow = contextWindowFor(ctx);
-    return providerTotalWindow ?? measurements.descriptorWindow;
+    return providerInputBudget ?? measurements.descriptorWindow;
   };
 
   /**
@@ -698,7 +953,7 @@ export function registerActiveContext(pi: any, options: {
   const servingCapacity = (window: number | null): ReturnType<typeof capacityAccounting> =>
     capacityAccounting({
       window: window ?? lifecycle.latestSnapshot?.contextWindow ?? DEFAULT_CONTEXT_WINDOW,
-      truthful: providerTotalWindow !== null,
+      truthful: providerInputBudget !== null,
       descriptorWindow: measurements.descriptorWindow,
       usedTokens: measurements.lastProviderMeasurement?.tokens ?? null,
     });
@@ -713,9 +968,11 @@ export function registerActiveContext(pi: any, options: {
     toolName,
     brandNoun,
     entryTypePrefix,
-    readOnlyTools,
+    blacklistAutoFoldTools,
     readOnlyContextActions,
     contextWindow: budgetWindowFor(ctx) ?? undefined,
+    netBudget: providerInputBudget !== null,
+    thresholds,
   });
 
   const authoritativeSnapshotFor = (ctx: any): ActiveContextSnapshot => {
@@ -731,9 +988,11 @@ export function registerActiveContext(pi: any, options: {
       toolName,
       brandNoun,
       entryTypePrefix,
-      readOnlyTools,
+      blacklistAutoFoldTools,
       readOnlyContextActions,
       contextWindow: budgetWindowFor(ctx) ?? undefined,
+      netBudget: providerInputBudget !== null,
+      thresholds,
     });
   };
 
@@ -777,13 +1036,15 @@ export function registerActiveContext(pi: any, options: {
     lifecycle.generation += 1;
     lifecycle.shuttingDown = false;
     cancelPreparation();
+    cancelBriefUpgrades();
     lifecycle.latestSnapshot = null;
     lifecycle.latestSnapshotError = null;
     measurements.latestRatio = null;
     measurements.lastProviderMeasurement = null;
+    measurements.wallInflowSteps.length = 0;
+    measurements.projectionAnchor = null;
+    measurements.lastProjectedEstimateBasis = "unmeasured";
     ladder.pendingManual = false;
-    lifecycle.blockingToolHarvestedThisTurn = false;
-    lifecycle.blockingToolHarvestQueuedThisTurn = false;
     if (!preserveThresholdDecision) nativeCompaction.lastThresholdDecision = null;
     ladder.lastPreparationError = null;
     ladder.boundaryFailure = null;
@@ -1240,11 +1501,10 @@ export function registerActiveContext(pi: any, options: {
       protection: persistence.state ? protectionSha256(persistence.state) : null,
       selection,
       policy: snapshot ? {
-        toolFoldRatio: snapshot.policy.toolFoldRatio,
-        refoldRatio: snapshot.policy.refoldRatio,
-        prepareRatio: snapshot.policy.prepareRatio,
+        maxTarget: snapshot.thresholds.maxTarget,
+        minTarget: snapshot.thresholds.minTarget,
+        freshTail: snapshot.thresholds.freshTail,
         hardFenceRatio: hardFenceRatio(snapshot),
-        consolidationRatio: snapshot.policy.consolidationRatio,
       } : null,
     });
   };
@@ -1385,7 +1645,7 @@ export function registerActiveContext(pi: any, options: {
     if (chars === null || chars < PROJECTION_CALIBRATION_MIN_CHARS) return;
     if (!Number.isFinite(measurement.tokens) || measurement.tokens < PROJECTION_CALIBRATION_MIN_TOKENS) return;
     // The signed error of the estimate we made for the projection this measurement
-    // describes. This is the only honest measure of how wrong the fence can be.
+    // describes. This is the only direct measure of how wrong the fence can be.
     // Only a CALIBRATED estimate's error belongs in the window. The bootstrap constant
     // is wrong by design -- 76% high in rep12 -- and letting that one reading set the
     // margin would keep every later request permanently inside it.
@@ -1424,8 +1684,126 @@ export function registerActiveContext(pi: any, options: {
     );
   };
 
-  const projectedTokenEstimate = (projected: unknown[]): number =>
-    Math.ceil(bytes(projected) / projectionCharsPerToken());
+  /**
+   * Bind the provider's count to the projection it counted.
+   *
+   * The anchor is the number the provider reported for a request this process actually
+   * TRANSMITTED, held with that projection's serialized bytes. Identity is carried three
+   * ways so a stale anchor cannot pass for a fresh one: the session it belongs to, the
+   * attribution generation (a model or thinking-level change is a different tokenizer, so
+   * its counts describe nothing here), and the projection text itself, which the reading
+   * re-checks byte for byte before adding anything to it.
+   */
+  const noteProviderProjectionAnchor = (measurement: ProviderContextMeasurement): void => {
+    // ONE ANCHOR PER MEASURED RESPONSE. A pass that re-observes the same assistant
+    // message -- the retry after a provider rejection, or any pass the host runs without
+    // a new response -- would otherwise re-bind that count to a newer projection the
+    // provider never counted, and the count would silently describe the wrong bytes.
+    if (measurements.projectionAnchor?.messageSha256 === measurement.messageSha256) return;
+    const text = instrumentation.previousText;
+    // Only a TRANSMITTED projection can be anchored: an aborted pass built a projection
+    // the provider never saw, so no reported count describes it.
+    if (!text || text.length < 2 || !text.endsWith("]") || !persistence.state) {
+      measurements.projectionAnchor = null;
+      return;
+    }
+    const chars = bytes(text);
+    // AND THE COUNT HAS TO FIT THE BYTES IT IS BOUND TO.
+    //
+    // An anchor is exact for the bytes it covers only if it actually describes them. A
+    // pairing that implies fewer serialized chars per token than any tokenizer produces
+    // is not describing this projection, and taken at face value it would put the fence
+    // under permanent pressure a projection of that size cannot explain. The calibration
+    // window already refuses such a ratio through the same floor; the anchor refuses it
+    // outright and falls back to the estimate. Only the FLOOR applies: a rate ABOVE the
+    // calibration ceiling is the signature-heavy composition this mechanism exists to
+    // read, and clamping it would throw away the measurement that motivated the build.
+    if (!(measurement.tokens > 0) || chars / measurement.tokens < PROJECTION_CHARS_PER_TOKEN_FLOOR) {
+      measurements.projectionAnchor = null;
+      return;
+    }
+    measurements.projectionAnchor = {
+      tokens: measurement.tokens,
+      chars,
+      head: text.slice(0, -1),
+      messageSha256: measurement.messageSha256,
+      sessionId: persistence.state.sessionId,
+      generation: lifecycle.generation,
+    };
+  };
+
+  /**
+   * THE OCCUPANCY READING: what the provider counted, plus only what arrived after it.
+   *
+   * A whole-projection estimate divides every byte in the window by one rate, and one
+   * rate does not fit the window's contents. Measured 2026-08-10 on the sealed rep-23
+   * run, byte exact against that run's own projection records: the estimate is unbiased
+   * at the pre-commit PEAKS (provider over estimate, mean 1.004 across six) and over-reads
+   * the post-fold TROUGHS by 22 to 35 percent (mean ratio 0.784 across six). It is a phase
+   * effect, not drift: encrypted reasoning-signature blobs on assistant messages grew from
+   * 14.6 to 51.3 percent of projection bytes over that run and price at a fitted 24.8 chars
+   * per token against 3.957 for ordinary content, so a projection's rate depends on what it
+   * is made of. The runtime therefore believed its floor climbed 0.298 to 0.490 of budget
+   * while the provider read 0.276 to 0.382: roughly 45 percent of the apparent floor rise
+   * was measurement error, five of six true troughs sat at or below the 0.35 minTarget, and
+   * the ladder was folding past its own floor without seeing it.
+   *
+   * So the rate is applied to the DELTA only. The provider's count for the projection this
+   * one extends is exact for every byte it covers, whatever those bytes are made of, and
+   * only the material appended since is estimated. Measured on the same run: mean absolute
+   * occupancy error across all requests falls from 8.38 to 3.08 percent, and inside every
+   * post-fold refill window it drops from the +9 to +27 percent band to under 4 percent from
+   * the second request onward.
+   *
+   * Two things this deliberately does NOT do. It does not move the commit trigger: at all
+   * twelve commit points of that run the delta since the last provider count was exactly
+   * zero, because the commit hook runs after the response and its usage record have landed.
+   * And it does not fix the one pass per cycle where the projection is REWRITTEN rather than
+   * appended, right after a commit: the anchor describes a projection this one does not
+   * begin with, so there is nothing to add a delta to and the whole-projection estimate
+   * stands, error and all (+27 to +35 percent, measured). That case is detected by
+   * construction, not by the sign of the delta: the current serialization must begin with
+   * the anchored one verbatim, up to the array separator.
+   *
+   * The anchor is the provider's TOTAL for that request, which includes the output tokens
+   * of the response the next projection appends and then prices again as bytes. That is one
+   * response's worth of double count, it runs HIGH rather than low, and it keeps a single
+   * definition of "the provider's number" across occupancy, the ratio and the calibration
+   * instead of a second one that only this reading would use.
+   */
+  const projectedTokenReading = (projected: unknown[]): {
+    tokens: number;
+    basis: ProjectionReadingBasis;
+    chars: number;
+    anchorTokens: number | null;
+    deltaChars: number | null;
+  } => {
+    const text = stableStringify(projected);
+    const chars = Buffer.byteLength(text, "utf8");
+    const charsPerToken = projectionCharsPerToken();
+    const estimate = Math.ceil(chars / charsPerToken);
+    const anchor = measurements.projectionAnchor;
+    if (!anchor || anchor.generation !== lifecycle.generation ||
+        anchor.sessionId !== persistence.state?.sessionId) {
+      return { tokens: estimate, basis: "unmeasured", chars, anchorTokens: null, deltaChars: null };
+    }
+    // By construction: the anchored serialization minus its closing bracket must be a
+    // byte-exact prefix, and the byte after it must be the array separator or the close.
+    // A message that merely GREW in place fails this, because the anchored head ends with
+    // that message's own closing brace.
+    const separator = text.length > anchor.head.length ? text[anchor.head.length] : "";
+    if (!text.startsWith(anchor.head) || (separator !== "," && separator !== "]")) {
+      return { tokens: estimate, basis: "rewritten", chars, anchorTokens: anchor.tokens, deltaChars: null };
+    }
+    const deltaChars = chars - anchor.chars;
+    return {
+      tokens: Math.max(0, anchor.tokens + Math.ceil(deltaChars / charsPerToken)),
+      basis: "anchored",
+      chars,
+      anchorTokens: anchor.tokens,
+      deltaChars,
+    };
+  };
 
   /** The largest recent estimator error, as a share. Unmeasured sessions assume none. */
   const estimatorErrorShare = (): number => measurements.estimatorErrors.length
@@ -1437,6 +1815,38 @@ export function registerActiveContext(pi: any, options: {
     ? Math.max(...measurements.inflowSteps)
     : 0;
 
+  /**
+   * THE OUTPUT WALL'S OWN FORWARD LOOK, AND WHY IT IS NOT THE ONE ABOVE.
+   *
+   * `inflowSteps` is filled by `noteProjectionCalibration`, which runs on the context pass.
+   * By then the message-end path has already advanced `lastProviderMeasurement` to the
+   * count being calibrated, so the difference is a measurement against itself and the step
+   * is zero. That window has therefore been empty in every session ever run, which means
+   * the transmission fence margin and the commit depth floor, both of which read it, have
+   * been running on their floor shares alone. Reviving it moves both, and both are
+   * calibrated against reps recorded while it was empty, so that is its own build with its
+   * own gates rather than a rider on this one.
+   *
+   * This window is filled where the previous count is still readable, and nothing but the
+   * wall reads it. When a count reaches only the context pass the window stays empty and
+   * the wall degrades to the condition it replaced, which is the safe direction.
+   */
+  const WALL_INFLOW_WINDOW = 8;
+  const noteWallInflow = (measurement: ProviderContextMeasurement): void => {
+    const previous = measurements.lastProviderMeasurement;
+    if (!previous || !Number.isFinite(measurement.tokens) || !Number.isFinite(previous.tokens)) return;
+    const step = measurement.tokens - previous.tokens;
+    // Only GROWTH. A commit shrinks the window; that is what the wall has to survive, not
+    // a size the next request can be predicted from.
+    if (step <= 0) return;
+    measurements.wallInflowSteps.push(step);
+    if (measurements.wallInflowSteps.length > WALL_INFLOW_WINDOW) measurements.wallInflowSteps.shift();
+  };
+
+  const expectedWallInflowTokens = (): number => measurements.wallInflowSteps.length
+    ? Math.max(...measurements.wallInflowSteps)
+    : 0;
+
   /**
    * The safety margin.
    *
@@ -1478,7 +1888,18 @@ export function registerActiveContext(pi: any, options: {
    * transmission, which is the whole point of having a fence.
    */
   const projectionExceedsBudget = (projected: unknown[], ctx: any): {
+    /** Occupancy: what the provider counted, plus what was appended after it. */
     tokens: number;
+    /**
+     * This projection's OWN size, every byte of it at one rate. Occupancy answers "how
+     * full is the window"; a before-and-after comparison between two projections answers
+     * "did this pass make the request smaller", and those are different questions. A
+     * reduction is measured in size space on both sides, because the projection the pass
+     * rebuilds is a rewrite the anchor does not describe, and subtracting an anchored
+     * reading from an unanchored one reports a change that no folding caused.
+     */
+    sizeTokens: number;
+    basis: ProjectionReadingBasis;
     budgetTokens: number;
     marginTokens: number;
     /** Past the wire: this request must not be transmitted at all. */
@@ -1490,12 +1911,16 @@ export function registerActiveContext(pi: any, options: {
     const budgetTokens = Number.isFinite(capacity.budgetTokens) && capacity.budgetTokens > 0
       ? capacity.budgetTokens
       : Number.POSITIVE_INFINITY;
-    const tokens = projectedTokenEstimate(projected);
+    const reading = projectedTokenReading(projected);
+    const tokens = reading.tokens;
+    const sizeTokens = Math.ceil(reading.chars / projectionCharsPerToken());
     const marginTokens = Number.isFinite(budgetTokens)
       ? projectionMarginTokens(tokens, capacity.window)
       : 0;
     return {
       tokens,
+      sizeTokens,
+      basis: reading.basis,
       budgetTokens,
       marginTokens,
       over: tokens > budgetTokens,
@@ -1560,6 +1985,24 @@ export function registerActiveContext(pi: any, options: {
     // is the one built after this one. A provider rejection outranks our own estimate:
     // it is ground truth that the last request did not fit, whatever we measured.
     if (!measured.crowded && !rejected) return { projected, aborted: false };
+    // Crowded is a MARGIN PREDICTION, not an overflow. While a last-call round is
+    // genuinely OPEN, exposure rendered this pass or the agent's response still
+    // outstanding, the prediction waits for it: this request still fits and the
+    // round ends on the very next context pass. Once the round has elapsed the
+    // margin lane acts freely, because a stale exposure parked behind the reopen
+    // latch must never muzzle the one reducer that can still act (the 20k-window
+    // probe climbed from crowded to the wire in exactly that state). Genuine
+    // untransmissibility, an over-budget projection or a provider rejection, never
+    // waits: a request whose projection exceeds the provider input budget is rejected
+    // outright, so recovery must produce a window that fits. Economy does not outrank
+    // the one round.
+    const lastCall = persistence.state?.lastCall;
+    const delivery = curation.lastCallDelivery;
+    const roundOpen = Boolean(lastCall) && (!delivery || delivery.exposure !== lastCall.exposure ||
+      markOrdinal(snapshot) <= delivery.ordinal);
+    if (!measured.over && !rejected && roundOpen) {
+      return { projected, aborted: false };
+    }
     // Why this fired, recorded from the measurement that TRIGGERED it rather than the
     // one taken afterwards, which by then describes a projection that fits.
     const trigger = measured;
@@ -1574,7 +2017,6 @@ export function registerActiveContext(pi: any, options: {
       let action: Record<string, unknown> | null = null;
       try {
         action = await attemptAutomaticRung(snapshot, 1, ctx, "projection-budget", {
-          waiveToolCadence: true,
           waiverRatio: 1,
         });
       } catch (error) {
@@ -1589,8 +2031,11 @@ export function registerActiveContext(pi: any, options: {
     }
     if (reducedAtLeastOnce) {
       ladder.overBudgetReduction = {
-        estimatedTokensBefore: projectedTokenEstimate(projected),
-        estimatedTokensAfter: measured.tokens,
+        // Size space on both sides: what this pass CHANGED, not how full the window is.
+        estimatedTokensBefore: trigger.sizeTokens,
+        estimatedTokensAfter: measured.sizeTokens,
+        occupancyTokensAfter: measured.tokens,
+        occupancyBasis: measured.basis,
         budgetTokens: trigger.budgetTokens,
         marginTokens: trigger.marginTokens,
         estimatorErrorShare: estimatorErrorShare(),
@@ -1603,39 +2048,87 @@ export function registerActiveContext(pi: any, options: {
       };
     }
     if (rejected) {
+      const overflowBefore = trigger.sizeTokens;
+      // RECOVERY IS A CHANGE, NOT AN OPINION.
+      //
+      // This read `!measured.over`: our own estimator answering the question the
+      // provider had just answered differently. A rejection is ground truth that the
+      // estimate was wrong, so the estimate cannot also be the evidence that the retry
+      // will work. And a rejection mutates nothing durable -- the rolled-back branch
+      // rebuilds the same projection -- so a pass that changed nothing hands the
+      // provider a byte-identical request and calls it a rescue. Measured 2026-08-10
+      // (luna-20260810 pifold rep 2): two rejections at stage 25, not one byte folded
+      // either time, both recorded recovered true, and the run died anyway.
+      //
+      // The baseline is the request that was actually REJECTED, which is the last
+      // projection this process built: it is written at the end of every pass that
+      // builds one, and this lane runs before the current pass overwrites it. Measuring
+      // against the projection handed to this function instead would credit only the
+      // recovery loop's own folds and miss the ordinary commit that already ran earlier
+      // in the same pass, which is the usual way a retried request gets smaller.
+      //
+      // Size space on both sides. Occupancy is anchored to the provider's count for the
+      // projection it measured, and the projection this lane rebuilds is a rewrite that
+      // anchor does not describe, so a rejected-minus-retried subtraction across the two
+      // bases reports a change no folding caused.
+      const rejectedTokens = measurements.lastProjectedSizeTokens;
+      const freedTokens = typeof rejectedTokens === "number"
+        ? Math.max(0, rejectedTokens - measured.sizeTokens)
+        : 0;
+      // Smaller than what the provider refused, AND inside the budget. Either half alone
+      // is a claim this runtime has already been wrong about once.
+      const recovered = freedTokens > 0 && !measured.over;
       curation.lastRecovery = {
         status: curation.pendingRejection?.status ?? null,
         attempts,
-        estimatedTokensAfter: measured.tokens,
+        estimatedTokensAfter: measured.sizeTokens,
         budgetTokens: measured.budgetTokens,
-        recovered: !measured.over,
+        recovered,
       };
       emit("context.recovery", {
         provider_status: curation.pendingRejection?.status ?? null,
         attempts,
         max_attempts: OVERFLOW_RECOVERY_MAX_ATTEMPTS,
-        tokens_before: projectedTokenEstimate(projected),
-        tokens_after: measured.tokens,
+        tokens_before: overflowBefore,
+        tokens_after: measured.sizeTokens,
+        occupancy_tokens_after: measured.tokens,
+        occupancy_basis: measured.basis,
         budget_tokens: measured.budgetTokens,
         margin_tokens: measured.marginTokens,
-        recovered: !measured.over,
+        recovered,
+        // What the verdict rests on, so a false claim cannot be read back as a true one:
+        // the size of the request the provider refused, and how much smaller this one is.
+        rejected_tokens: typeof rejectedTokens === "number" ? rejectedTokens : null,
+        freed_tokens: freedTokens,
+        // Whether the recovery loop itself folded, as distinct from the pass as a whole.
+        loop_reduced: reducedAtLeastOnce,
+        // The join. `context.rollback` records what left the branch; this records what
+        // the retried pass folded to make the shorter window fit, and the two are one
+        // episode. Null when a rejection was recorded without a tree rollback.
+        rollback_seq: typeof rollback.last?.seq === "number" ? rollback.last.seq : null,
       });
-      const overflowBefore = projectedTokenEstimate(projected);
+      const unchangedNote = "The provider rejected the last request and this pass made it no smaller, so the " +
+        `rebuilt request is ${measured.tokens} estimated tokens against a ${measured.budgetTokens}-token ` +
+        "serving budget. Our own estimate says it fits; the provider already said otherwise about a request " +
+        "this size, so this is not a recovery. Fold or protect deliberately, or the next request meets the " +
+        "same rejection.";
       deliverReceipt(contextReceipt({
         kind: "overflow-recovery",
         ordinal: markOrdinal(snapshot),
         trigger: `provider-rejection:${curation.pendingRejection?.status ?? "unknown"}`,
-        freedTokens: Math.max(0, overflowBefore - measured.tokens),
-        occupancyBefore: overflowBefore,
-        occupancyAfter: measured.tokens,
-        recovered: true,
+        freedTokens,
+        occupancyBefore: typeof rejectedTokens === "number" ? rejectedTokens : overflowBefore,
+        occupancyAfter: measured.sizeTokens,
+        recovered,
         note: measured.over
           ? `The rebuilt request is still ${measured.tokens} tokens against a ${measured.budgetTokens}-token ` +
             "serving budget, so the run stops here rather than sending a request the provider will reject again."
-          : "A rollback was required: the provider rejected the last request, which overfilled the serving " +
-            `budget at ${overflowBefore} estimated tokens against ${measured.budgetTokens}. ` +
-            `${attempts} reduction(s) landed it at ${measured.tokens} tokens. Nothing durable was written ` +
-            "for it, and the request was rebuilt inside the budget rather than dropped.",
+          : recovered
+            ? "A rollback was required: the provider rejected the last request, which overfilled the serving " +
+              `budget at ${rejectedTokens} estimated tokens against ${measured.budgetTokens}. This pass ` +
+              `landed it at ${measured.sizeTokens} tokens. Nothing durable was written for it, and the request ` +
+              "was rebuilt inside the budget rather than dropped."
+            : unchangedNote,
       }));
       curation.pendingRejection = null;
     }
@@ -1675,7 +2168,7 @@ export function registerActiveContext(pi: any, options: {
       snapshot,
       state: capturedState,
       generation: capturedGeneration,
-      summarize: ladder.failedPreparations.has(id) ? undefined : options.summarizeContextSpan,
+      summarize: ladder.failedPreparations.has(id) ? undefined : observedSummarize,
       onSummarizerFailure: (error) => {
         ladder.lastPreparationError = error instanceof Error ? error.message : String(error);
         ladder.failedPreparations.add(id);
@@ -1745,6 +2238,96 @@ export function registerActiveContext(pi: any, options: {
     return projected;
   };
 
+  /**
+   * The rider rides the SAME admission as the receipt block: it renders from the
+   * persisted literal bytes, lands once per freeze cycle, and the freeze closes over
+   * it, so it can never diverge a prefix on its own. It is never regenerated: the
+   * bytes the epoch persisted are the bytes every re-render carries.
+   */
+  const appendRider = (projected: unknown[], snapshot: ActiveContextSnapshot): unknown[] => {
+    const rider = persistence.state?.rider;
+    if (!rider) return projected;
+    if (!carrierAdmitted("rider")) return projected;
+    projected.push({
+      role: "custom",
+      customType: riderProjectionType,
+      content: rider.text,
+      display: false,
+      details: {
+        source: activeContextSource(entryTypePrefix),
+        ephemeral: true,
+        riderEpoch: rider.epoch,
+      },
+      timestamp: typeof ownValue(snapshot.messages.at(-1), "timestamp") === "number"
+        ? ownValue(snapshot.messages.at(-1), "timestamp")
+        : 0,
+    });
+    return projected;
+  };
+
+  /**
+   * Threshold notices are APPEND-ONCE: each delivered notice is its own carrier with
+   * its own key, so a notice that fires mid-freeze lands at the tail as a pure append,
+   * the freeze closes over it, and it then persists in the window the way a tool
+   * result does. A freeze break re-renders every retained notice from its persisted
+   * literal bytes inside the rewrite that broke the freeze.
+   */
+  const appendNotices = (projected: unknown[], snapshot: ActiveContextSnapshot): unknown[] => {
+    const notices = persistence.state?.notices;
+    if (!notices?.ring.length) return projected;
+    for (const notice of notices.ring) {
+      if (!carrierAdmitted(`notice-${notice.share}-${notice.ordinal}`)) continue;
+      projected.push({
+        role: "custom",
+        customType: noticeProjectionType,
+        content: notice.text,
+        display: false,
+        details: {
+          source: activeContextSource(entryTypePrefix),
+          ephemeral: true,
+          share: notice.share,
+          noticeOrdinal: notice.ordinal,
+        },
+        timestamp: typeof ownValue(snapshot.messages.at(-1), "timestamp") === "number"
+          ? ownValue(snapshot.messages.at(-1), "timestamp")
+          : 0,
+      });
+    }
+    return projected;
+  };
+
+  /**
+   * The pre-commit last-call rides the commit BOUNDARY: it is armed when the band-top
+   * trigger fires, appended at the tail (a pure append) for exactly one gated round,
+   * and the commit that consumes it clears the state, so the carrier's disappearance
+   * rides the rewrite that commit already pays for. Rendering records the delivery,
+   * which is what the one-round clock is measured from.
+   */
+  const appendLastCall = (projected: unknown[], snapshot: ActiveContextSnapshot): unknown[] => {
+    const lastCall = persistence.state?.lastCall;
+    if (!lastCall) return projected;
+    if (carrierAdmitted(`lastcall-${lastCall.exposure}`)) {
+      projected.push({
+        role: "custom",
+        customType: lastCallProjectionType,
+        content: lastCall.text,
+        display: false,
+        details: {
+          source: activeContextSource(entryTypePrefix),
+          ephemeral: true,
+          exposure: lastCall.exposure,
+        },
+        timestamp: typeof ownValue(snapshot.messages.at(-1), "timestamp") === "number"
+          ? ownValue(snapshot.messages.at(-1), "timestamp")
+          : 0,
+      });
+    }
+    if (curation.lastCallDelivery?.exposure !== lastCall.exposure) {
+      curation.lastCallDelivery = { exposure: lastCall.exposure, ordinal: markOrdinal(snapshot) };
+    }
+    return projected;
+  };
+
   /**
    * Whatever this pass ended up sending becomes the frozen surface for the next one, in
    * full. Nothing rides after the frozen region.
@@ -1779,7 +2362,8 @@ export function registerActiveContext(pi: any, options: {
       const customType = ownValue(message, "customType");
       return customType !== milestoneProjectionType && customType !== advisoryProjectionType &&
         customType !== surfacingProjectionType && customType !== receiptProjectionType &&
-        customType !== curationProjectionType;
+        customType !== riderProjectionType && customType !== curationProjectionType &&
+        customType !== lastCallProjectionType && customType !== noticeProjectionType;
     });
     // The freeze test, stated as bytes rather than as intent: if the rebuilt body still
     // OPENS with the frozen body verbatim, nothing structural moved and the previous
@@ -1805,6 +2389,9 @@ export function registerActiveContext(pi: any, options: {
     // bought nothing anyway: voluntary fold share was 0.00, and the three runs built
     // specifically to invite curation produced 0, 1 and 0 voluntary folds.
     appendReceipts(projected, snapshot);
+    appendRider(projected, snapshot);
+    appendNotices(projected, snapshot);
+    appendLastCall(projected, snapshot);
     return holdFrozen(projected);
   };
   /**
@@ -1830,14 +2417,20 @@ export function registerActiveContext(pi: any, options: {
     const charsPerToken = projectionCharsPerToken();
     const causes = instrumentation.sinceHandoff.filter((event) =>
       PREFIX_MUTATING_KINDS.has(event.kind));
+    // The reading this projection was judged by, with the pieces it was built from, so
+    // the anchored series is readable from the stream instead of reconstructed.
+    const reading = projectedTokenReading(projected);
     emit("context.projection", {
       change: comparison.change,
       previous_count: comparison.previousCount,
       next_count: comparison.nextCount,
       appended_count: comparison.appendedCount,
       first_divergent_index: comparison.firstDivergentIndex,
-      chars: bytes(projected),
-      estimated_tokens: projectedTokenEstimate(projected),
+      chars: reading.chars,
+      estimated_tokens: reading.tokens,
+      estimate_basis: reading.basis,
+      anchor_tokens: reading.anchorTokens,
+      delta_chars: reading.deltaChars,
       chars_per_token: charsPerToken,
     });
     // Emission only. Which of these is a provider-side miss and which is a rewrite we
@@ -1870,15 +2463,354 @@ export function registerActiveContext(pi: any, options: {
     instrumentation.mutationsSinceHandoff = 0;
   };
 
+  /**
+   * Enqueue the folds this commit created with a deterministic brief.
+   *
+   * The request is built HERE, against the snapshot and the pre-commit state, because
+   * this is the last moment the fold's source is still exact active evidence: after the
+   * commit its span is a placeholder and the orientation either side of it is gone.
+   * These are the bytes `prepareFold` already hashed into the fold's identity, so the
+   * generator briefs the span that was folded and nothing else.
+   *
+   * A PARENT is queued too, and reads its children at depth one rather than through their
+   * briefs: `consolidationSourceText` opens each child and leaves the grandchildren folded,
+   * so the group is briefed from material instead of from a summary of summaries. The one
+   * thing it must not race is a child's own upgrade, so a parent whose children are still
+   * in this lane is deferred to the next boundary instead of reading briefs about to be
+   * replaced. Unlike a leaf, a parent's source keeps: its children are folds, and folds
+   * stay resolvable after the commit that nested them.
+   */
+  const queueBriefUpgrades = (
+    snapshot: ActiveContextSnapshot,
+    stateBeforeCommit: ActiveContextState,
+    foldIds: readonly string[],
+  ): void => {
+    if (!observedSummarize || !persistence.state) return;
+    const queued = (id: string): boolean =>
+      upgrades.queue.some((entry) => entry.members.some((member) => member.foldId === id));
+    const pending = (id: string): boolean => upgrades.running.has(id) || queued(id) ||
+      upgrades.ready.some((entry) => entry.foldId === id) ||
+      upgrades.deferred.has(id);
+    // Gathered before any packing, because a batch is a property of the whole commit and
+    // not of the fold that happens to be read first.
+    const gathered: Array<{
+      foldId: string;
+      sourceSha256: string;
+      refs: EvidenceRef[];
+      span: Record<string, unknown>;
+      chars: number;
+      parent: boolean;
+    }> = [];
+    // Parents that waited are considered first and at every boundary, so the wait ends as
+    // soon as the children settle rather than whenever the ladder happens to build another.
+    for (const foldId of [...upgrades.deferred, ...foldIds]) {
+      const full = upgrades.queue.length >= MAX_BRIEF_UPGRADE_QUEUE;
+      if (upgrades.failed.has(foldId) || upgrades.running.has(foldId) || queued(foldId) ||
+          upgrades.ready.some((entry) => entry.foldId === foldId)) continue;
+      const fold = persistence.state.folds.find((item) => item.id === foldId);
+      // A supplied brief is agent judgment and outranks the generator; a model brief is
+      // already what this lane exists to produce. A fold that is no longer there is no
+      // longer owed anything, so a rolled-back parent leaves the wait rather than sitting
+      // in it.
+      if (!fold || foldProvenance(fold, persistence.state).kind !== "deterministic") {
+        upgrades.deferred.delete(foldId);
+        continue;
+      }
+      const parent = fold.parts.some((part) => part.kind === "fold");
+      // A parent waits rather than being shed: its children are folds, so its source is
+      // still there whenever the lane has room, and a group that loses its turn at a busy
+      // boundary would otherwise keep the index its children could not write. A leaf is the
+      // other way round. Its source is exact active evidence at this commit and a
+      // placeholder after it, so a full queue drops it here and the receipt says so.
+      if (parent && (full || childFoldIds(fold).some(pending))) {
+        upgrades.deferred.add(foldId);
+        continue;
+      }
+      if (full) continue;
+      upgrades.deferred.delete(foldId);
+      const refs = parent
+        ? flattenFoldRefs(fold, persistence.state)
+        : fold.parts.every((part) => part.kind === "raw")
+          ? fold.parts.map((part) => (part as { kind: "raw"; ref: EvidenceRef }).ref)
+          : null;
+      if (!refs) continue;
+      try {
+        // The parent reads the state that holds its children and their upgraded briefs;
+        // a leaf reads the state where its own span was still raw active evidence.
+        const sourceText = parent
+          ? consolidationSourceText(snapshot, persistence.state, fold.parts)
+          : encodedFoldSource(snapshot, stateBeforeCommit, fold.parts, fold.kind);
+        const chars = bytes(sourceText);
+        if (chars > snapshot.policy.maxSourceChars) continue;
+        gathered.push({
+          foldId,
+          sourceSha256: fold.sourceSha256,
+          refs,
+          chars,
+          parent,
+          span: {
+            candidateId: fold.id,
+            sourceRefs: clone(refs),
+            sourceText,
+            sourceSha256: sha256Text(sourceText),
+            // What the PAYLOAD holds, which is one entry per part: a consolidation can
+            // carry absorbed raw evidence beside its folded children, and the coverage
+            // rule counts the things the model is actually shown. Counting only the fold
+            // children told it to write fewer clauses than the payload has subjects.
+            children: parent ? fold.parts.length : 0,
+          },
+        });
+      } catch (error) {
+        // Evidence drift between the commit and this read leaves the deterministic brief
+        // standing, and the next commit record reports the attempt rather than hiding it.
+        upgrades.failed.add(foldId);
+        upgrades.failures += 1;
+        upgrades.lastError = boundReceiptText(
+          error instanceof Error ? error.message : String(error), 240, "brief upgrade",
+        );
+      }
+    }
+    // Pack the commit's spans into as few calls as the source budget allows. Order is the
+    // order they were gathered, which is span order within the commit, so the numbered
+    // spans a batch shows the generator run the way the session did and one really is the
+    // orientation for the next.
+    for (let at = 0; at < gathered.length;) {
+      if (upgrades.queue.length >= MAX_BRIEF_UPGRADE_QUEUE) {
+        // No room for another call. A parent goes back to waiting, because its children are
+        // folds and its source will still be there whenever the lane frees up. A leaf
+        // cannot wait: its source is exact active evidence at THIS commit and a placeholder
+        // after it, so it keeps the deterministic brief it committed with.
+        for (const item of gathered.slice(at)) {
+          if (item.parent) upgrades.deferred.add(item.foldId);
+        }
+        break;
+      }
+      const members: typeof gathered = [];
+      let chars = 0;
+      while (at < gathered.length && members.length < MAX_BRIEF_BATCH_SPANS &&
+             (!members.length || chars + gathered[at].chars <= snapshot.policy.maxSourceChars)) {
+        chars += gathered[at].chars;
+        members.push(gathered[at]);
+        at += 1;
+      }
+      // Orientation is the run's, not each span's: where this batch of consecutive spans
+      // sits in the wider conversation. Taken from the ends rather than from the union,
+      // because a commit can fold spans with protected material still raw between them and
+      // the union of those refs is not one contiguous range.
+      const before = boundedOrientation(snapshot, members[0].refs);
+      const after = boundedOrientation(snapshot, members[members.length - 1].refs);
+      upgrades.queue.push({
+        members: members.map((item) => ({ foldId: item.foldId, sourceSha256: item.sourceSha256 })),
+        request: {
+          spans: members.map((item) => item.span),
+          beforeRefs: clone(before.beforeRefs),
+          beforeText: before.beforeText,
+          beforeSha256: sha256Text(before.beforeText),
+          afterRefs: clone(after.afterRefs),
+          afterText: after.afterText,
+          afterSha256: sha256Text(after.afterText),
+          maxBriefChars: snapshot.policy.maxBriefChars,
+          // Read by the observed wrapper and by nothing else, so a queue that backs up is
+          // visible as waiting rather than as a slow generator. The summarizer contract is
+          // on the RESULT, so an extra request field reaches it harmlessly.
+          queuedAtMs: Date.now(),
+        },
+      });
+    }
+  };
+
+  /**
+   * One generator call, between boundaries, cancel-safe. It writes nothing durable: a
+   * finished brief waits in `ready` for a commit to carry it, and an aborted or failed
+   * call leaves the fold exactly as it committed.
+   *
+   * Returns whether a call was started, which is what lets the drain below stop.
+   */
+  const startBriefUpgrade = (snapshot: ActiveContextSnapshot, ctx: any): boolean => {
+    const summarize = observedSummarize;
+    // In CALLS, not folds. `running` is keyed by every fold a call briefs so the queue can
+    // ask whether one is already being written, so its size is a fold count and reading it
+    // as the in-flight bound would stop the lane after a single batch.
+    const inFlight = new Set(upgrades.running.values()).size;
+    if (!summarize || lifecycle.shuttingDown || !upgrades.queue.length ||
+        inFlight >= MAX_BRIEF_UPGRADES_IN_FLIGHT) return false;
+    const entry = upgrades.queue.shift()!;
+    const controller = new AbortController();
+    const slot = { controller, promise: Promise.resolve() };
+    // Keyed by EVERY fold the call briefs, so the queue's "already being briefed" check and
+    // the in-flight bound both read one call as the one thing it is.
+    for (const member of entry.members) upgrades.running.set(member.foldId, slot);
+    const capturedSessionId = snapshot.sessionId;
+    const capturedGeneration = lifecycle.generation;
+    let timeout: ReturnType<typeof setTimeout> | undefined;
+    slot.promise = (async () => {
+      const timed = new Promise<never>((_resolve, reject) => {
+        timeout = setTimeout(() => {
+          controller.abort();
+          reject(new Error(`Brief upgrade exceeded ${snapshot.policy.briefTimeoutMs}ms`));
+        }, snapshot.policy.briefTimeoutMs);
+      });
+      // The same contract `prepareFold` holds a generated brief to, through the same
+      // function: an upgrade with its own copy of the check would drift from the fold
+      // path's, and the cure a missed criterion earns belongs to both or to neither.
+      const generated = await Promise.race([
+        generatedBriefs({
+          summarize: (request, callCtx) => summarize({ ...request, signal: controller.signal }, callCtx),
+          request: entry.request,
+          spans: entry.request.spans as Array<Record<string, unknown>>,
+          ctx,
+          maxBriefChars: snapshot.policy.maxBriefChars,
+          toolName: snapshot.toolName,
+        }),
+        timed,
+      ]);
+      if (controller.signal.aborted ||
+          !sessionIdentityStillValid(ctx, capturedSessionId, capturedGeneration)) return;
+      // Per span, not per call. A batch is one request and many answers, so one span that
+      // could not be cured is one fold keeping its deterministic brief while its neighbours
+      // take theirs; the whole call failing on it would be the coverage problem batching
+      // exists to solve, wearing a different hat.
+      entry.members.forEach((member, at) => {
+        const written = generated.briefs[at];
+        if (!written) {
+          upgrades.failed.add(member.foldId);
+          upgrades.failures += 1;
+          upgrades.lastError = boundReceiptText(
+            `span ${at + 1} of ${entry.members.length}: ${generated.complaints[0] ?? "no brief"}`,
+            240, "brief upgrade",
+          );
+          return;
+        }
+        upgrades.ready.push({
+          foldId: member.foldId,
+          sourceSha256: member.sourceSha256,
+          brief: written.brief,
+          provenance: written.provenance,
+        });
+      });
+      upgrades.cures += generated.cured;
+    })().catch((error) => {
+      if (controller.signal.aborted) return;
+      // LOUD, and once, for every fold the call carried. They keep their deterministic
+      // briefs, the failure is counted onto the next commit record, and none of them is
+      // ever sent again: a generator that fails on a span fails on it again, and a retry
+      // loop would spend the session's provider calls proving that.
+      for (const member of entry.members) upgrades.failed.add(member.foldId);
+      upgrades.failures += 1;
+      upgrades.lastError = boundReceiptText(
+        error instanceof Error ? error.message : String(error), 240, "brief upgrade",
+      );
+    }).finally(() => {
+      clearTimeout(timeout);
+      for (const member of entry.members) {
+        if (upgrades.running.get(member.foldId) === slot) upgrades.running.delete(member.foldId);
+      }
+      // A finished call starts the next one, so the drain rate is the generator's latency
+      // rather than however often a ladder pass happens to look. Still between
+      // boundaries: nothing here touches the projection, and the generation check is the
+      // same fence `cancelBriefUpgrades` is called behind, so a session that moved on
+      // cannot be restarted by a call that outlived it.
+      if (!lifecycle.shuttingDown && lifecycle.generation === capturedGeneration) {
+        resumeBriefUpgrades(snapshot, ctx);
+      }
+    });
+    return true;
+  };
+
+  /**
+   * Fill the in-flight slots from the queue. The bound is a constant, not a pace: the
+   * lane starts everything it is allowed to start the moment there is work, because a
+   * fold whose brief is written late is a fold the session read deterministic in the
+   * meantime.
+   */
+  const startBriefUpgrades = (snapshot: ActiveContextSnapshot, ctx: any): void => {
+    while (startBriefUpgrade(snapshot, ctx)) { /* Bounded by the in-flight constant. */ }
+  };
+
+  /**
+   * Take up the waiting parents, then fill the slots.
+   *
+   * A deferred parent was waiting on the lane, so the lane finishing is the news, not the
+   * next commit. Boundaries are where briefs APPLY; hanging the retry on them too would
+   * leave a session that stops folding holding parents whose children were briefed long
+   * ago, and the last group the ladder built is exactly the one a session ends beside.
+   */
+  const resumeBriefUpgrades = (snapshot: ActiveContextSnapshot, ctx: any): void => {
+    if (upgrades.deferred.size && persistence.state) {
+      queueBriefUpgrades(snapshot, persistence.state, []);
+    }
+    startBriefUpgrades(snapshot, ctx);
+  };
+
+  const cancelBriefUpgrades = (): void => {
+    for (const slot of upgrades.running.values()) slot.controller.abort();
+    upgrades.running.clear();
+    upgrades.queue = [];
+    upgrades.ready = [];
+    upgrades.deferred.clear();
+  };
+
+  /**
+   * Apply finished upgrades INSIDE the commit's own mutation.
+   *
+   * Called between `commitPendingMarks` and the byte accounting, so an upgraded brief is
+   * part of what this commit is measured to have done rather than a rewrite nobody
+   * charged for. Nothing else may call this: an upgrade that finishes between boundaries
+   * waits, however long the wait is.
+   *
+   * Identity is revalidated the way `preparedFoldError` revalidates a prepared fold. A
+   * fold that was expanded, reclaimed, re-briefed by the agent, or rebuilt over a
+   * different span is a different object than the one the generator read, and its upgrade
+   * is DROPPED rather than deferred.
+   *
+   * It lands in the brief OVERRIDE map, the same channel the agent's own `rebrief` uses,
+   * and carries its generator beside the text. A fold record is content-addressed and
+   * immutable: rewriting one in place reports a conflicting durable fold at the next
+   * persist and suspends automatic management, which is precisely why the override map
+   * exists.
+   *
+   * EVERY finished brief lands, and there is no per-boundary cap. A prefix cache is
+   * invalidated from the FIRST byte that differs, so the commit's mutation point is the
+   * position of the earliest fold it upgrades and every later upgrade in the same commit
+   * sits inside a suffix that break already re-sent: the second and third upgrade on one
+   * boundary cost nothing the first did not already cost. Holding one back does not save
+   * that cost, it defers the same break to a later commit and pays it there on top of
+   * whatever that commit does. What bounds the count is the work that can be outstanding,
+   * MAX_BRIEF_UPGRADE_QUEUE waiting plus MAX_BRIEF_UPGRADES_IN_FLIGHT running, and the
+   * boundary that clears them.
+   */
+  const applyBriefUpgrades = (): string[] => {
+    if (!upgrades.ready.length || !persistence.state) return [];
+    const applied: string[] = [];
+    for (const entry of upgrades.ready) {
+      const state = persistence.state;
+      const fold = state.folds.find((item) => item.id === entry.foldId);
+      if (!fold || fold.sourceSha256 !== entry.sourceSha256 ||
+          foldProvenance(fold, state).kind !== "deterministic" ||
+          state.expanded.includes(fold.id) || state.briefs?.[fold.id] !== undefined) continue;
+      persistence.state = {
+        ...state,
+        briefs: {
+          ...(state.briefs ?? {}),
+          [fold.id]: { brief: entry.brief, provenance: clone(entry.provenance) },
+        },
+      };
+      applied.push(fold.id);
+    }
+    upgrades.ready = [];
+    return applied;
+  };
+
   const commitDeterministicCandidate = async (
     snapshot: ActiveContextSnapshot,
     candidate: FoldCandidate,
     brief: string,
   ): Promise<string> => {
+    const stateBeforeCommit = persistence.state!;
     const preparedFold = await prepareFold({
       candidate,
       snapshot,
-      state: persistence.state!,
+      state: stateBeforeCommit,
       generation: lifecycle.generation,
       brief,
       briefProvenance: "deterministic",
@@ -1886,9 +2818,10 @@ export function registerActiveContext(pi: any, options: {
     persistence.state = commitPreparedFold({
       prepared: preparedFold,
       snapshot,
-      state: persistence.state!,
+      state: stateBeforeCommit,
       generation: lifecycle.generation,
     });
+    queueBriefUpgrades(snapshot, stateBeforeCommit, [preparedFold.id]);
     return preparedFold.id;
   };
 
@@ -1913,7 +2846,7 @@ export function registerActiveContext(pi: any, options: {
       state: baseState,
       generation: generationAtStart,
       brief: input.brief,
-      summarize: options.summarizeContextSpan,
+      summarize: observedSummarize,
       ctx: input.ctx,
       signal: input.signal,
     });
@@ -1952,36 +2885,77 @@ export function registerActiveContext(pi: any, options: {
     return Math.max(COMMIT_RECLAIM_FLOOR_SHARE, inflow > 0 ? inflow / window : 0);
   };
 
-  const atOrAboveBackstop = (snapshot: ActiveContextSnapshot, ratio: number | null): boolean =>
-    typeof ratio === "number" && Number.isFinite(ratio) && ratio >= snapshot.policy.refoldRatio;
+  const atOrAboveBackstop = (snapshot: ActiveContextSnapshot, ratio: number | null): boolean => {
+    const occupancy = budgetOccupancy(snapshot, ratio);
+    return occupancy !== null && occupancy >= snapshot.policy.refoldRatio;
+  };
 
   /**
-   * A snapshot whose FRESH tail is narrowed.
+   * THE OUTPUT WALL.
+   *
+   * A declared serving budget has already netted out the reservation the answer needs,
+   * so the runtime treats the whole budget as spendable and fences only when it is
+   * spent. That fence is the input one, and the input is not what fails first. The host
+   * derives the answer's ceiling per request as its DESCRIPTOR window less its own
+   * estimate of the projection less a fixed safety margin, so filling the declared
+   * budget to the brim leaves the answer exactly the reservation and nothing else.
    *
-   * Raising the top-up target does nothing once the eligible mass is exhausted, and at
-   * high occupancy that is exactly the state: measured 2026-08-06 (rep13), the big
-   * stale mass was already folded and what remained was the fresh tail and the newest
-   * payloads, so six commits of two to four folds carried the window from 340k to 370k
-   * and into a provider rejection. Depth therefore means reaching into the fresh tail,
-   * not asking harder for evidence that is not there.
+   * Which is a fence that fires after the wire, the same defect the transmission fence
+   * was given a forward look to fix in rep 13. The commit trigger never got one.
+   * Measured 2026-08-12 (sol-20260812 rep 1): occupancy walked 218,713 -> 236,595 over
+   * twelve ordinals against a 251,520 budget with no commit, and the request built after
+   * the last measurement was served 16 output tokens and aborted. Every number was known
+   * to the runtime; nothing was weighing the request that had not been built yet.
    *
-   * The newest complete turn stays protected and so does everything the current-turn
-   * guard covers: this narrows freshness, it does not abolish it.
+   * So the trigger carries what the transmission fence already carries: one worst recent
+   * inflow step. With no measured inflow this is exactly the old `used > budget`
+   * condition, which is the state it degrades to on a session's first turns.
    */
-  const DEEPENED_FRESH_TURNS = 1;
-  const DEEPENED_FRESH_BYTES_SHARE = 0.25;
-
-  const deepenedFreshnessSnapshot = (snapshot: ActiveContextSnapshot): ActiveContextSnapshot => {
-    const policy = {
-      ...snapshot.policy,
-      freshTurns: Math.min(snapshot.policy.freshTurns, DEEPENED_FRESH_TURNS),
-      freshBytes: Math.floor(snapshot.policy.freshBytes * DEEPENED_FRESH_BYTES_SHARE),
+  const outputWallDue = (snapshot: ActiveContextSnapshot): boolean => {
+    const capacity = servingCapacity(snapshot.contextWindow);
+    if (capacity.usedTokens === null || !(capacity.budgetTokens > 0)) return false;
+    // THE EARLY ZONE ONLY, so this is strictly additive.
+    //
+    // Past the budget the pre-existing overflow paths already own the emergency: the
+    // commit-path exemption, the last-call gate and the fence all read `used > budget`
+    // and have since before this existed. A second trigger in that territory changes the
+    // cadence of sessions that were already being handled, and gate 107 measured what
+    // that costs: a fixture parked at 88,000 against an 83,616 budget put four generator
+    // calls in flight against a bound of two. So the wall speaks only where nothing spoke
+    // before, in the band one inflow step wide below the budget.
+    if (capacity.usedTokens > capacity.budgetTokens) return false;
+    return capacity.usedTokens + expectedWallInflowTokens() > capacity.budgetTokens;
+  };
+
+  /**
+   * What the gated round did, measured against the arming snapshot. Pins and unpins
+   * are read from the stream itself (context.protect records after the exposure); the
+   * call and mark deltas are clamped at zero because contextCalls is process-local and
+   * a reload inside a round must not report a negative response.
+   */
+  const lastCallAttribution = (
+    lastCall: NonNullable<ActiveContextState["lastCall"]>,
+    agentMarksNow: number,
+  ): { responded: boolean; context_calls: number; marks_added: number; protects: number; unprotects: number } => {
+    const contextCalls = Math.max(0, curation.contextCalls - lastCall.contextCalls);
+    const protectRecords = instrumentation.ledger.events.filter((record) =>
+      record.seq > lastCall.exposure && record.kind === "context.protect");
+    const protects = protectRecords.filter((record) => record.protect === true).length;
+    return {
+      responded: contextCalls > 0,
+      context_calls: contextCalls,
+      marks_added: Math.max(0, agentMarksNow - lastCall.agentMarks),
+      protects,
+      unprotects: protectRecords.length - protects,
     };
-    const toolProtectedIndices = toolFreshIndices(snapshot.messages, snapshot.completeTurns, policy);
-    // Unmapped messages are protected in every snapshot: nothing can fold what the
-    // durable branch cannot name.
-    for (const item of snapshot.mapped) if (!item.ref) toolProtectedIndices.add(item.index);
-    return { ...snapshot, toolProtectedIndices };
+  };
+
+  const clearLastCall = (): void => {
+    if (!persistence.state?.lastCall) return;
+    const next = { ...persistence.state };
+    delete next.lastCall;
+    persistence.state = next;
+    curation.lastCallDelivery = null;
   };
 
   const runCommitEpoch = async (
@@ -1993,44 +2967,85 @@ export function registerActiveContext(pi: any, options: {
      * over-budget reduction forces the fence so nothing survivable is held back.
      */
     waiverRatio: number | null = measurements.latestRatio,
+    /**
+     * A user asked for this commit. It outranks the two ECONOMIC guards -- the reclaim
+     * floor and the one-mutation-per-handoff budget -- because those exist to spend the
+     * session's rewrites well and the user just said where to spend one. It outranks
+     * nothing else: freshness, pins, exactness and the provider fence are unchanged.
+     */
+    userRequested = false,
   ): Promise<Record<string, unknown> | null> => {
     const ordinal = markOrdinal(snapshot);
     let state = persistence.state!;
     let peekAdded = 0;
     let topUpAdded = 0;
-    let deepened = false;
-    let deepenedMarks = 0;
-    let preDeepenShare: number | null = null;
-    // The snapshot the commit adjudicates against: the deepened one narrows freshness
-    // so the marks the deep top-up just made are not refused as fresh.
-    let commitSnapshot = snapshot;
+    let consolidationAdded = 0;
+    let closingAdded = 0;
     for (const mark of ephemeralPeekMarks({ snapshot, state, ordinal })) {
       const addition = addPendingMark(state, mark);
       if (addition.added) { state = addition.state; peekAdded += 1; }
     }
+    // THE COUNT LAW RUNS AT EVERY COMMIT EPOCH, BEFORE ANYTHING ELSE PROPOSES.
+    //
+    // The number of parents the eligible-root count owes is arithmetic, not a judgment
+    // about pressure, so it is not the top-up's to make and not the user commit's to
+    // skip: at any point the count allows k groups, k parents form. Running first is
+    // what makes the rest coherent -- the groups claim their children before the top-up
+    // reads the claim set, so nothing proposes a span over a fold a parent is taking.
+    for (const mark of consolidationMarks({ snapshot, state, ordinal })) {
+      const addition = addPendingMark(state, mark);
+      if (addition.added) { state = addition.state; consolidationAdded += 1; }
+    }
     const guarded = currentTurnRefKeys(snapshot);
-    // At the fence everything unpinned is fair game, INCLUDING the top-up's reach: a
-    // session whose only foldable evidence is the open excursion has nothing else to
-    // propose, and excluding it there leaves the commit with nothing to apply at the
-    // exact moment reduction is the only thing keeping the request sendable.
-    const fenceLevel = typeof waiverRatio === "number" && Number.isFinite(waiverRatio) &&
-      waiverRatio >= hardFenceRatio(snapshot);
+    // THE GUARD IS ADJUDICATED AT COMMIT, NEVER AT PROPOSAL.
+    //
+    // `guarded` is every tool result since the last terminal assistant message. When no
+    // turn has ever closed, `currentTurnBoundary` is -1 and that set is the WHOLE
+    // window. Handing it to `topUpMarks` as `excludeRefKeys` therefore proposed nothing
+    // at all on that shape, so `guardWaiverCount` below counted zero guarded marks and
+    // the waiver it exists to grant could never fire. Measured 2026-08-10
+    // (luna-20260810 pifold rep 2): 274,173 tokens of unmarked stale spans, zero marks
+    // proposed, zero commits, two provider rejections.
+    //
+    // So the top-up proposes freely and `commitPendingMarks({ guardCurrentTurn: true,
+    // guardWaiver })` decides. That is the only place the guard has ever had a waiver,
+    // and one adjudicator is why the starvation case is reachable at all.
+    //
+    // Wedge absorption keeps the exclusion (below): it grows a mark backward over a
+    // gap without any waiver of its own, so the guard there has no second chance.
+    // THE CLASS LAW IS UNCONDITIONAL.
+    //
+    // There was a fence-only snapshot here: at high occupancy it narrowed the fresh
+    // tail to a quarter and extended the automatic reach over the middle, so a reduction
+    // that had to make a rejected request sendable had mass to reach. That existed
+    // because the runtime had exactly one answer to a provider rejection, folding
+    // harder, and folding harder inside a positional region runs out of legal material.
+    // The rollback lane is the answer now: an overflow rolls the leaf back past the
+    // request that failed and the ordinary commit runs on the shorter window. So the
+    // law holds in EVERY snapshot at every occupancy -- membership decides what folds,
+    // the fresh tail never folds, pins are exempt -- and there is one set of rules to
+    // reason about instead of two.
     // The thermostat. Firing at the trigger line and folding down to the target line is
     // what makes event SPACING structural rather than hoped for.
     const capacity = servingCapacity(snapshot.contextWindow);
     const usedTokens = capacity.usedTokens;
     const budgetTokens = capacity.budgetTokens;
-    // THE SAFETY EXEMPTION, NARROWED.
+    // THE UNTRANSMISSIBILITY EXEMPTION, NARROWED.
     //
-    // The hard fence is a RATIO prediction. Standing near it is not the same as being
-    // unable to send, and treating the two alike handed the fence path a standing
-    // waiver from both economy guards. Measured 2026-08-07 (rep 17): fence-path
+    // A request whose projection exceeds the provider input budget is rejected outright,
+    // so recovery must produce a window that fits. The hard fence, though, is a RATIO
+    // prediction. Standing near it is not the same as being unable to send, and treating
+    // the two alike handed the fence path a standing waiver from both economy guards. Measured 2026-08-07 (rep 17): fence-path
     // window-pressure commits fired at eligible-freed shares as low as 0.018, under the
     // 0.02 floor the guided path honors, and re-fired inside a single ordinal. So only
     // two states outrank the economy: the overflow recovery lane, which runs because a
     // request already did not fit, and an occupancy genuinely past the serving budget,
     // where the next request aborts unless something moves. Everything else defers.
-    const overflowExempt = curation.recoveryAttempts > 0 ||
+    // The output wall deliberately does NOT join this list. It decides WHEN the one
+    // structural mutation of a handoff fires, not how many fire: exempting it here let a
+    // window parked one inflow step under the budget rebuild its prefix on every pass,
+    // which is the cost the mutation budget exists to refuse and what gate 58 caught.
+    const overflowExempt = userRequested || curation.recoveryAttempts > 0 ||
       (usedTokens !== null && budgetTokens > 0 && usedTokens > budgetTokens);
     // ONE STRUCTURAL MUTATION PER HANDOFF.
     //
@@ -2040,8 +3055,9 @@ export function registerActiveContext(pi: any, options: {
     // still CROWDED (inside the fence margin, but transmissible), and committed again.
     // The second commit bought margin the next pass would have bought anyway and cost a
     // whole second prefix rewrite. So a second commit in the same handoff defers unless
-    // the request is genuinely untransmittable: the fence and the recovery lane are
-    // safety, and safety outranks the budget.
+    // the request is genuinely untransmittable: a request whose projection exceeds the
+    // provider input budget is rejected outright, so recovery must produce a window that
+    // fits, and the fence and the recovery lane spend the budget to get one.
     if (instrumentation.mutationsSinceHandoff > 0 && !overflowExempt) {
       emit("context.commit", {
         trigger,
@@ -2053,11 +3069,16 @@ export function registerActiveContext(pi: any, options: {
       });
       return null;
     }
-    const hysteresisShare = usedTokens === null || snapshot.contextWindow <= 0
+    // THE HYSTERESIS, AND THE WHOLE FREEING TARGET.
+    //
+    // How deep this event cuts is one subtraction on one denominator: what is used,
+    // less where the thermostat wants to land, over the serving budget. The separate
+    // 0.40 floor is gone -- it was a share of the WINDOW under a share of the BUDGET,
+    // so it never once bound (the hysteresis share at these thresholds bottoms out at
+    // 0.405 of window), and a floor that cannot fire is a number that only drifts.
+    const freeingTarget = usedTokens === null || budgetTokens <= 0
       ? 0
-      : Math.max(0, (usedTokens - CURATION_TARGET_OCCUPANCY_SHARE * budgetTokens) /
-        snapshot.contextWindow);
-    const freeingTarget = Math.max(EPOCH_COMMIT_TARGET_WINDOW_SHARE, hysteresisShare);
+      : Math.max(0, (usedTokens - thresholds.minTarget * budgetTokens) / budgetTokens);
     if (topUp) {
       // Measuring top-up progress against ELIGIBLE mass is what keeps the pressure
       // backstop working under a peek-heavy agent: pinned and retained marks are mass
@@ -2066,41 +3087,35 @@ export function registerActiveContext(pi: any, options: {
         snapshot,
         state,
         ordinal,
-        excludeRefKeys: fenceLevel ? new Set<string>() : guarded,
         eligibleOnly: true,
-        // The fence tops up until there is nothing left to propose: a reduction that
-        // stops at the ordinary target can leave the request still untransmittable.
-        targetShare: fenceLevel ? 1 : freeingTarget,
+        targetShare: freeingTarget,
       })) {
         const addition = addPendingMark(state, mark);
         if (addition.added) { state = addition.state; topUpAdded += 1; }
       }
-      // High-occupancy depth. Near the top of the window a commit that frees less than
-      // one turn of inflow does not reduce anything: it pays a full prefix rewrite,
-      // gives back less than the next stage adds, and the window ratchets UP through
-      // commit after commit. Measured 2026-08-06 (rep13): once the big stale mass was
-      // folded, six commits of two to four folds each carried the window from 340k to
-      // 370k and into a provider rejection, with the backstop firing the whole way.
-      // So a commit at or above the backstop that has not reached one inflow step
-      // reaches further, into everything eligible, instead of billing a rewrite for
-      // crumbs.
-      preDeepenShare = markAccounting(snapshot, state).eligibleFreedWindowShare;
-      // Deepen whenever the ordinary reach fell short of the thermostat's target too:
-      // an event that does not reach the lower line is an event that re-fires soon.
-      const shallow = preDeepenShare < Math.max(commitDepthFloorShare(snapshot), freeingTarget);
-      if (fenceLevel || (shallow && atOrAboveBackstop(snapshot, waiverRatio))) {
-        deepened = true;
-        commitSnapshot = deepenedFreshnessSnapshot(snapshot);
+      // DEPTH, inside the zones.
+      //
+      // Near the top of the window a commit that frees less than one turn of inflow
+      // does not reduce anything: it pays a full prefix rewrite, gives back less than
+      // the next stage adds, and the window ratchets UP through commit after commit.
+      // Measured 2026-08-06 (rep13): once the big stale mass was folded, six commits of
+      // two to four folds each carried the window from 340k to 370k and into a provider
+      // rejection, with the backstop firing the whole way. So a commit at or above the
+      // backstop that has not reached one inflow step tops up against everything
+      // ELIGIBLE instead of billing a rewrite for crumbs. Eligible is the operative
+      // word: this reaches harder inside what the class law admits, never outside it.
+      const reachedShare = markAccounting(snapshot, state).eligibleFreedBudgetShare;
+      const shallow = reachedShare < Math.max(commitDepthFloorShare(snapshot), freeingTarget);
+      if (shallow && atOrAboveBackstop(snapshot, waiverRatio)) {
         for (const mark of topUpMarks({
-          snapshot: commitSnapshot,
+          snapshot,
           state,
           ordinal,
-          excludeRefKeys: fenceLevel ? new Set<string>() : guarded,
           eligibleOnly: true,
           targetShare: 1,
         })) {
           const addition = addPendingMark(state, mark);
-          if (addition.added) { state = addition.state; topUpAdded += 1; deepenedMarks += 1; }
+          if (addition.added) { state = addition.state; topUpAdded += 1; }
         }
       }
     }
@@ -2111,18 +3126,44 @@ export function registerActiveContext(pi: any, options: {
       snapshot,
       state,
       charsPerToken: projectionCharsPerToken(),
-      excludeRefKeys: fenceLevel ? new Set<string>() : guarded,
+      excludeRefKeys: guarded,
     });
     state = wedges.state;
     const accounting = markAccounting(snapshot, state);
-    if (!accounting.pending) return null;
+    // A COMMIT PASS THAT FINDS NOTHING SAYS SO.
+    //
+    // This was a bare `return null`, and it is how the rep-2 starvation stayed invisible
+    // for 25 stages: the last call announced 274,173 tokens of unmarked stale spans, the
+    // pass that answered it proposed nothing, and the stream carried no record that a
+    // commit had even been attempted. Every other deferral on this path already names
+    // itself; this one is the same shape with the reason that matters, and it reports
+    // the remainder beside the emptiness so the contradiction -- mass on the table, no
+    // proposal -- is readable on one record instead of inferred across two.
+    //
+    // Stream record, not a `context.receipt`: receipts are window carriers, and a pass
+    // that changed nothing must not add bytes to the projection to announce it.
+    if (!accounting.pending) {
+      const remainder = unmarkedRemainder(snapshot, state, projectionCharsPerToken());
+      emit("context.commit", {
+        trigger,
+        deferred: true,
+        reason: "nothing-proposable",
+        applied_marks: 0,
+        pending_marks: 0,
+        unmarked_stale_spans: remainder.spans,
+        unmarked_stale_tokens: remainder.tokens,
+        window_tokens: snapshot.contextWindow,
+      });
+      return null;
+    }
     // The reclaim floor. One structural mutation per model call is the budget, so a
     // commit that would free crumbs spends the whole budget on nothing: it defers and
-    // the marks accumulate. Safety outranks economics, so genuine overflow -- the
-    // recovery lane, or an occupancy already past the serving budget -- fires
+    // the marks accumulate. A request whose projection exceeds the provider input budget
+    // is rejected outright, so recovery must produce a window that fits: genuine overflow
+    // -- the recovery lane, or an occupancy already past the serving budget -- fires
     // regardless of what it frees. Standing at the fence RATIO does not.
     if (!overflowExempt &&
-        accounting.eligibleFreedWindowShare < COMMIT_RECLAIM_FLOOR_SHARE) {
+        accounting.eligibleFreedBudgetShare < COMMIT_RECLAIM_FLOOR_SHARE) {
       persistence.state = state;
       emit("context.commit", {
         trigger,
@@ -2131,7 +3172,7 @@ export function registerActiveContext(pi: any, options: {
         applied_marks: 0,
         pending_marks: accounting.pending,
         eligible_marks: accounting.eligibleMarks,
-        eligible_freed_share: accounting.eligibleFreedWindowShare,
+        eligible_freed_share: accounting.eligibleFreedBudgetShare,
         reclaim_floor_share: COMMIT_RECLAIM_FLOOR_SHARE,
         window_tokens: snapshot.contextWindow,
       });
@@ -2140,51 +3181,101 @@ export function registerActiveContext(pi: any, options: {
     const bytesBefore = bytes(projectActiveContext(snapshot, state));
     // The guard protects an in-flight excursion, never at the cost of the session's
     // ability to send a request at all: above the pressure backstop the oldest guarded
-    // marks are released, and at the fence all of them are.
+    // marks are released. The guard is a protection with a WAIVER, which is why it
+    // survived the fence-snapshot deletion: one protection, one owner, one waiver.
     const guardWaiver = guardWaiverCount({
       snapshot,
       ratio: waiverRatio,
       guardedMarks: pendingMarks(state).filter((mark) =>
         markTouchesCurrentTurn(state, mark, guarded)).length,
-      // Against commitSnapshot, NOT snapshot. The starvation test decides whether the
-      // guard may be waived, so it has to ask the same question the commit will: does
-      // this epoch have work that does not touch the open turn? A DEEPENED epoch tops
-      // up marks that the un-deepened freshness policy still calls protected, so
-      // weighing them under the shallow snapshot reported zero applicable marks while
-      // the commit went on to apply two. The waiver then fired on a false starvation
-      // reading and released eight open-turn marks, six of which folded evidence the
-      // turn was still using. Two snapshots, two answers, and the one that decides the
-      // commit was not the one being asked.
+      // The starvation test asks the same question the commit will, against the same
+      // snapshot the commit adjudicates against: does this epoch have work that does
+      // not touch the open turn? Two snapshots gave two answers, and the one that
+      // decided the commit was not the one being asked. There is one snapshot now.
       otherApplicableMarks: pendingMarks(state).filter((mark) =>
         !markTouchesCurrentTurn(state, mark, guarded) &&
-        markEligibility(commitSnapshot, state, mark) === "eligible").length,
+        markEligibility(snapshot, state, mark) === "eligible").length,
     });
-    const result = await commitPendingMarks({
-      snapshot: commitSnapshot,
+    let result = await commitPendingMarks({
+      snapshot,
       state,
       generation: lifecycle.generation,
       retainIneligible: true,
       guardCurrentTurn: true,
       guardWaiver,
     });
+    // THE EPOCH CLOSES ITS OWN COUNT.
+    //
+    // The folds this commit just landed are eligible roots the moment they exist, and
+    // the law is about the count, not about which pass noticed it. Leaving them for the
+    // next epoch is what let the pile stand between commits: measured 2026-08-10 (PT-3),
+    // a commit that landed 26 tool folds left 32 visible roots up until the next band
+    // crossing four cycles later. So the epoch re-reads its own count and parents what
+    // it just made, inside the rewrite it has already paid for. No waiver here: a parent
+    // this round cannot apply is held by the ordinary guard and waits, exactly like any
+    // other fold. It converges because a parent is excluded from the count it came from.
+    for (let round = 0; round < EPOCH_CONSOLIDATION_ROUNDS; round += 1) {
+      let closing = result.state;
+      for (const mark of consolidationMarks({ snapshot, state: closing, ordinal })) {
+        const addition = addPendingMark(closing, mark);
+        if (addition.added) { closing = addition.state; closingAdded += 1; }
+      }
+      if (closing === result.state) break;
+      const closed = await commitPendingMarks({
+        snapshot,
+        state: closing,
+        generation: lifecycle.generation,
+        retainIneligible: true,
+        guardCurrentTurn: true,
+      });
+      if (!closed.applied.length) break;
+      // A mark the guard RETAINED is still pending, so the closing round sees it again
+      // and reports it again; only the terminal refusals accumulate, and the last round
+      // is the truth about what is still held.
+      result = {
+        ...closed,
+        applied: [...result.applied, ...closed.applied],
+        refused: [...result.refused.filter((mark) => !mark.retained), ...closed.refused],
+        waived: [...result.waived, ...closed.waived],
+      };
+    }
     persistence.state = result.state;
-    const bytesAfter = bytes(projectActiveContext(snapshot, result.state));
+    // The upgrade wedge: model briefs written since the last boundary replace their
+    // deterministic ones HERE, inside the mutation this commit already pays for, before
+    // anything measures what the commit did.
+    const upgradedFolds = applyBriefUpgrades();
+    const upgradeFailures = upgrades.failures;
+    const upgradeError = upgrades.lastError;
+    const upgradeCures = upgrades.cures;
+    upgrades.failures = 0;
+    upgrades.cures = 0;
+    upgrades.lastError = null;
+    const bytesAfter = bytes(projectActiveContext(snapshot, persistence.state));
     const freedBytes = Math.max(0, bytesBefore - bytesAfter);
+    // The cost of the agent's pins, measured at the moment it matters: mass this
+    // commit could not touch because protect holds it.
+    const pinHeld = protectedStaleMass(snapshot, result.state);
     const commitEvent = emit("context.commit", {
       trigger,
       deferred: false,
       reason: null,
-      eligible_freed_share: accounting.eligibleFreedWindowShare,
+      eligible_freed_share: accounting.eligibleFreedBudgetShare,
       reclaim_floor_share: COMMIT_RECLAIM_FLOOR_SHARE,
       // The two first-class dials: how much ONE event reclaims, and how long since the
       // last one. A trigger that frees too little re-fires immediately, and that shape
       // is only visible with both numbers on the same record.
       target_freed_share: freeingTarget,
-      hysteresis_target_share: hysteresisShare,
-      target_occupancy_share: CURATION_TARGET_OCCUPANCY_SHARE,
-      shortfall_share: Math.max(0, freeingTarget - accounting.eligibleFreedWindowShare),
+      hysteresis_target_share: freeingTarget,
+      target_occupancy_share: thresholds.minTarget,
+      shortfall_share: Math.max(0, freeingTarget - accounting.eligibleFreedBudgetShare),
       occupancy_tokens_before: usedTokens,
       budget_tokens: budgetTokens,
+      // The forward look, on the record beside the occupancy it was added to. A commit
+      // that fired because one more turn would have spent the answer's reservation reads
+      // differently from one that fired at the band top, and the difference is only
+      // legible with the allowance printed.
+      expected_inflow_tokens: expectedWallInflowTokens(),
+      output_wall: outputWallDue(snapshot),
       requests_since_previous: instrumentation.requests - instrumentation.lastMutationRequest,
       inflow_tokens_since_previous: usedTokens === null || instrumentation.lastMutationTokens === null
         ? null
@@ -2200,25 +3291,119 @@ export function registerActiveContext(pi: any, options: {
       ladder_marks: accounting.ladderMarks,
       peek_marks: peekAdded,
       topup_marks: topUpAdded,
-      deepened: deepened,
-      deepened_marks: deepenedMarks,
+      consolidation_marks: consolidationAdded,
+      closing_consolidation_marks: closingAdded,
       absorbed_wedges: wedges.absorbed.length,
+      // The upgrade is a mutation of a fold whose `context.fold` record was written at
+      // creation, so the stream would otherwise show a brief that silently changed. The
+      // count, the ids, and the failures ride the boundary that carried them.
+      brief_upgrades: upgradedFolds.length,
+      brief_upgrade_ids: upgradedFolds.join(","),
+      brief_upgrade_failures: upgradeFailures,
+      // Briefs that needed a second ask before they met the contract. Beside the failures
+      // rather than inside them: a cured brief is a brief that landed, and the two together
+      // are how the brief cap gets judged against something other than intuition.
+      brief_upgrade_cures: upgradeCures,
+      brief_upgrade_error: upgradeError,
+      // Everything still owed to a FOLD: queued, in flight, and (always zero once the
+      // wedge above ran) written but uncarried. In flight is counted because the lane
+      // holds several calls open and work nobody can see is work nobody bounds. Counted in
+      // folds rather than calls because a call now carries a whole commit's spans, and the
+      // question this answers is how many folds are still reading deterministic.
+      brief_upgrades_waiting: upgrades.ready.length + upgrades.running.size +
+        upgrades.queue.reduce((total, entry) => total + entry.members.length, 0),
+      // The same work in the unit the lane's two constants actually bound: calls, queued
+      // plus in flight. Reported beside the fold count so a backed-up lane cannot read as
+      // a busy one, or the reverse.
+      brief_upgrade_calls: upgrades.queue.length + new Set(upgrades.running.values()).size,
       freed_bytes: freedBytes,
       freed_tokens: estimatedTokens(freedBytes),
       rewrite_tokens: accounting.rewriteTokens,
       pinned_bytes: accounting.pinnedBytes,
       pinned_results: accounting.pinnedResults,
+      protected_stale_bytes: pinHeld.bytes,
+      protected_stale_refs: pinHeld.refs,
       window_tokens: snapshot.contextWindow,
     });
     instrumentation.mutationsSinceHandoff += 1;
     instrumentation.lastMutationRequest = instrumentation.requests;
     instrumentation.lastMutationTokens = usedTokens;
+    // THE RESPONSE ATTRIBUTION. Whatever the gated round did, or that it did nothing,
+    // is linked to the exposure it answered, and the exposure is consumed by the
+    // commit whatever its trigger: a fence or user commit landing mid-round is still
+    // the commit boundary the last-call announced. The carrier's disappearance rides
+    // this commit's own rewrite.
+    if (persistence.state.lastCall) {
+      const lastCall = persistence.state.lastCall;
+      const attribution = lastCallAttribution(lastCall, accounting.agentMarks);
+      emit("context.response", {
+        exposure_seq: lastCall.exposure,
+        commit_seq: commitEvent.seq,
+        trigger,
+        outcome: attribution.responded ? "responded" : "silent",
+        ...attribution,
+      });
+      clearLastCall();
+    }
+    // A commit that drops occupancy back under a waypoint re-arms its notice: the next
+    // upward crossing is a new event and earns a new one. The estimate is the same one
+    // the receipt reports: measured occupancy before, less what this commit freed.
+    if (persistence.state.notices && usedTokens !== null && budgetTokens > 0) {
+      const postOccupancy = Math.max(0, usedTokens - estimatedTokens(freedBytes)) / budgetTokens;
+      const fired = persistence.state.notices.fired.filter((share) => postOccupancy >= share);
+      if (fired.length !== persistence.state.notices.fired.length) {
+        persistence.state = { ...persistence.state, notices: { ...persistence.state.notices, fired } };
+      }
+    }
+    // The rider: at most ONE action prompt per fold epoch, composed from post-commit
+    // numbers, persisted as literal bytes, delivered beside the receipt inside the
+    // rewrite this commit already paid for. The epoch key is the commit event's own
+    // stream sequence: strictly monotone, one per applied commit, so refold-only
+    // epochs get their rider too and no two epochs can ever share a key. The next
+    // epoch REPLACES the text; nothing stacks.
+    const riderEpoch = commitEvent.seq;
+    if (persistence.state.rider?.epoch !== riderEpoch) {
+      const postAccounting = markAccounting(snapshot, persistence.state);
+      const remainder = unmarkedRemainder(snapshot, persistence.state, projectionCharsPerToken());
+      const pinnedMass = explicitProtectedMass(snapshot, persistence.state);
+      const pinnedShare = budgetTokens > 0
+        ? estimatedTokens(pinnedMass.bytes) / budgetTokens
+        : 0;
+      const riderText = contextRiderText({
+        toolName,
+        brandNoun,
+        suggestion: deliverSurfacing(snapshot, "rider"),
+        pendingAgentMarks: postAccounting.agentMarks,
+        eligibleMarks: postAccounting.eligibleMarks,
+        freedTokens: postAccounting.freedTokens,
+        eligibleFreedTokens: postAccounting.eligibleFreedTokens,
+        anchors: remainder.candidates.slice(0, 3).map((candidate) => candidate.id),
+        pinnedShare,
+        maxPinnedShare: MAX_PINNED_SHARE,
+      });
+      persistence.state = { ...persistence.state, rider: { epoch: riderEpoch, text: riderText } };
+      emit("context.rider", {
+        epoch: riderEpoch,
+        chars: riderText.length,
+        anchors: Math.min(3, remainder.candidates.length),
+        pending_agent_marks: postAccounting.agentMarks,
+        eligible_marks: postAccounting.eligibleMarks,
+        pinned_share: pinnedShare,
+        max_pinned_share: MAX_PINNED_SHARE,
+      });
+    }
     let foldedToolResults = 0;
     let foldedSpans = 0;
     for (const applied of result.applied) {
       const fold = persistence.state.folds.find((item) => item.id === applied.foldId);
       if (fold?.kind === "tool-result") foldedToolResults += 1;
       else foldedSpans += 1;
+      // A reclaimed peek copy names what it copied. Derived from the transcript rather
+      // than carried on the mark, so the pointer is the same whichever mechanism claimed
+      // the copy: the exposure's reclaim marking, the commit's, or the doorless ladder.
+      const peekedSources = fold?.kind === "tool-result"
+        ? peekedSourceFoldIds(snapshot, flattenFoldRefs(fold, persistence.state))
+        : null;
       emit("context.fold", {
         commit_seq: commitEvent.seq,
         fold_id: applied.foldId,
@@ -2227,15 +3412,20 @@ export function registerActiveContext(pi: any, options: {
         mark_id: applied.id,
         fold_kind: fold?.kind ?? applied.mark,
         origin: applied.origin,
+        peek_of: peekedSources ? peekedSources.join(",") : null,
         source_chars: fold?.sourceChars ?? 0,
         placeholder_chars: fold?.placeholderChars ?? 0,
-        brief_provenance: fold ? normalizeLegacyProvenance(fold.provenance).kind : null,
+        brief_provenance: fold ? foldProvenance(fold, persistence.state).kind : null,
       });
     }
+    // Queued AFTER the applications above, so no fold can be committed and upgraded on
+    // one boundary: the generator has not run yet, and the wait is the mechanism.
+    queueBriefUpgrades(snapshot, state, result.applied.map((applied) => applied.foldId));
     for (const wedge of wedges.absorbed) {
       emit("context.absorb", {
         commit_seq: commitEvent.seq,
         into_fold_id: wedge.intoMarkId,
+        from_mark_id: wedge.fromMarkId,
         start_id: wedge.startId,
         end_id: wedge.endId,
         entries: wedge.entries,
@@ -2254,8 +3444,10 @@ export function registerActiveContext(pi: any, options: {
       ladderMarks: accounting.ladderMarks,
       peekMarks: peekAdded,
       topUpMarks: topUpAdded,
-      deepenedTarget: deepened,
-      deepenedMarks,
+      consolidationMarks: consolidationAdded,
+      // Parents formed over the folds THIS commit landed. They were never in
+      // `pendingMarks`, so an epoch's arithmetic is applied = pending + closing.
+      closingMarks: closingAdded,
       absorbedWedges: wedges.absorbed.length,
       absorbed: wedges.absorbed,
       // What the commit actually folded, the way an agent counts it, so the receipt can
@@ -2263,7 +3455,6 @@ export function registerActiveContext(pi: any, options: {
       foldedSpans,
       foldedToolResults,
       occupancyTokensBefore: usedTokens,
-      preDeepenFreedShare: preDeepenShare,
       depthFloorShare: commitDepthFloorShare(snapshot),
       reclaimFloorShare: COMMIT_RECLAIM_FLOOR_SHARE,
       guardWaived: result.waived.length > 0,
@@ -2273,19 +3464,21 @@ export function registerActiveContext(pi: any, options: {
       deferredMarks: result.retained.length,
       pinnedBytes: accounting.pinnedBytes,
       pinnedResults: accounting.pinnedResults,
+      protectedStaleBytes: pinHeld.bytes,
+      protectedStaleRefs: pinHeld.refs,
       retainedMarks: result.retained.length,
       currentTurnRetained: result.retained.filter((mark) =>
         markTouchesCurrentTurn(state, mark, guarded)).length,
       eligibleMarks: accounting.eligibleMarks,
       estimatedRewriteTokens: accounting.rewriteTokens,
       estimatedFreedTokens: accounting.freedTokens,
-      freedWindowShare: accounting.freedWindowShare,
+      freedBudgetShare: accounting.freedBudgetShare,
       sourceBytesSaved: freedBytes,
-      actualFreedWindowShare: snapshot.contextWindow > 0
-        ? estimatedTokens(freedBytes) / snapshot.contextWindow
+      actualFreedBudgetShare: snapshot.budgetTokens > 0
+        ? estimatedTokens(freedBytes) / snapshot.budgetTokens
         : 0,
-      targetWindowShare: freeingTarget,
-      hysteresisTargetShare: hysteresisShare,
+      targetBudgetShare: freeingTarget,
+      hysteresisTargetShare: freeingTarget,
       requestsSincePreviousCommit: instrumentation.requests - instrumentation.lastMutationRequest,
       instrumentation: ledgerSummary(instrumentation.ledger),
     };
@@ -2311,12 +3504,78 @@ export function registerActiveContext(pi: any, options: {
    * that would free nothing, and the hysteresis stops a plateau from reading as a
    * stream of events. What is gone is only the announcement in front of it.
    */
-  const curationCommitDue = (snapshot: ActiveContextSnapshot): boolean => {
+  /**
+   * THE trigger, with its one piece of hysteresis.
+   *
+   * Occupancy at or above maxTarget, and then the reopen latch: a window that is still
+   * full because the last commit could not reach the target is the SAME event, not a
+   * new one, so a second commit waits for at least a reclaim floor of genuinely new
+   * eligible mass. Without it a parked window fires a commit per pass and every one of
+   * them rebuilds the prefix for crumbs.
+   */
+  const commitTriggerDue = (snapshot: ActiveContextSnapshot, ratio: number | null): boolean => {
     if (!persistence.state) return false;
-    if (!curationTriggerFires(measuredCurationSignals(snapshot))) return false;
+    // The output wall outranks the quiet-runtime line rather than sitting under it. A
+    // window one inflow step from spending the answer's whole reservation is past
+    // economising, and the band top is not the thing it is about to cross.
+    //
+    // ONE COMMIT PER CROSSING, NOT ONE PER PASS. The wall is a level, and a window that
+    // sits on it sits there for many passes: releasing the reopen latch on each of them
+    // fires a commit per pass, which is the prefix-rewrite churn the latch exists to
+    // prevent and which the quiet cadence is built around. Measured on gate 52's fixture:
+    // the first wall commit applied 44 marks and correctly retained all ten of the open
+    // turn, and the two that followed it applied nothing, rewrote the prefix anyway, and
+    // dragged the guard's starvation waiver in on a session that had just made progress.
+    // So the crossing is the event. While the wall stays due the ordinary hysteresis
+    // decides, which is what makes a second commit wait for genuinely new foldable mass.
+    const wall = outputWallDue(snapshot);
+    if (!wall) curation.wallEpisodeOpen = false;
+    if (!wall && !epochCommitDue(snapshot, ratio)) return false;
+    measuredCurationSignals(snapshot);
+    if (wall && !curation.wallEpisodeOpen) {
+      curation.wallEpisodeOpen = true;
+      curation.reopenBaselineShare = null;
+      return true;
+    }
+    // The latch is an ECONOMY rule, and the fence is not latched: a request whose
+    // projection exceeds the provider input budget is rejected outright, so recovery
+    // must produce a window that fits.
+    // A request that does not fit gets its commit whether or not the previous one left
+    // new eligible mass behind; holding it back would be spending the session's
+    // transmissibility to save a prefix rewrite.
+    if (typeof ratio === "number" && Number.isFinite(ratio) && ratio >= hardFenceRatio(snapshot)) {
+      curation.reopenBaselineShare = null;
+      return true;
+    }
     if (curation.reopenBaselineShare !== null) {
-      const eligibleShare = markAccounting(snapshot, persistence.state).eligibleFreedWindowShare;
-      if (eligibleShare - curation.reopenBaselineShare < COMMIT_RECLAIM_FLOOR_SHARE) return false;
+      const eligibleShare = markAccounting(snapshot, persistence.state).eligibleFreedBudgetShare;
+      if (eligibleShare - curation.reopenBaselineShare < COMMIT_RECLAIM_FLOOR_SHARE) {
+        // A HOLD THAT SAYS SO.
+        //
+        // This was a bare `return false`, and it is the last silent deferral on the
+        // commit path: every other one names itself and reports its numbers. In
+        // sol-20260812 rep 1 the trigger was due for twelve straight ordinals while
+        // occupancy climbed to 94 percent of budget, and the stream carries no record of
+        // what held it, so the stall can be proven but not explained. Emitted on every
+        // held pass rather than once per episode: under-reporting is the defect being
+        // fixed, the record is a stream record that never reaches the projection, and
+        // the volume is bounded by passes above the band top.
+        const capacity = servingCapacity(snapshot.contextWindow);
+        emit("context.commit", {
+          trigger: "band-top",
+          deferred: true,
+          reason: "reopen-latch",
+          applied_marks: 0,
+          eligible_freed_share: eligibleShare,
+          reopen_baseline_share: curation.reopenBaselineShare,
+          reclaim_floor_share: COMMIT_RECLAIM_FLOOR_SHARE,
+          occupancy_tokens: capacity.usedTokens,
+          expected_inflow_tokens: expectedWallInflowTokens(),
+          budget_tokens: capacity.budgetTokens,
+          window_tokens: snapshot.contextWindow,
+        });
+        return false;
+      }
       curation.reopenBaselineShare = null;
     }
     return true;
@@ -2332,7 +3591,7 @@ export function registerActiveContext(pi: any, options: {
     if (curation.reopenBaselineShare === null) return;
     const capacity = servingCapacity(lifecycle.latestSnapshot?.contextWindow ?? null);
     if (capacity.usedTokens === null || capacity.budgetTokens <= 0) return;
-    if (capacity.usedTokens / capacity.budgetTokens < CURATION_OCCUPANCY_SHARE) {
+    if (capacity.usedTokens / capacity.budgetTokens < thresholds.maxTarget) {
       curation.reopenBaselineShare = null;
     }
   };
@@ -2373,26 +3632,250 @@ export function registerActiveContext(pi: any, options: {
       splitFromChars: Number(action.splitFromChars ?? 0),
       absorbedWedges: Number(epoch?.absorbedWedges ?? 0),
       recovered: curation.recoveryAttempts > 0,
-      note: epoch && Number(epoch.deepenedMarks ?? 0) > 0
-        ? `The commit reached into the fresh tail for ${epoch.deepenedMarks} further span(s), because a ` +
-          "shallower commit would have freed less than one turn of inflow."
-        : null,
+      protectedBytes: Number(epoch?.protectedStaleBytes ?? 0),
+      note: null,
     }));
   };
 
+  /**
+   * Threshold notices, evaluated on every pass the ladder runs on. One waypoint fires
+   * once per upward crossing of the measured occupancy; delivery is an append-once
+   * carrier plus its stream record, and re-arming belongs to the commit that drops
+   * occupancy back under the line. Default on; `guidance.thresholdNotices: false`
+   * registers the runtime with the waypoints silent.
+   */
+  const deliverThresholdNotices = (snapshot: ActiveContextSnapshot): boolean => {
+    if (!guidance.thresholdNotices || !persistence.state) return false;
+    const capacity = servingCapacity(snapshot.contextWindow);
+    if (capacity.usedTokens === null || capacity.budgetTokens <= 0) return false;
+    const occupancy = capacity.usedTokens / capacity.budgetTokens;
+    const current = persistence.state.notices ?? { fired: [], ring: [] };
+    let fired = current.fired;
+    let ring = current.ring;
+    let changed = false;
+    for (const share of THRESHOLD_NOTICE_SHARES) {
+      if (occupancy < share || fired.includes(share)) continue;
+      const text = thresholdNoticeText({
+        share,
+        occupancyTokens: capacity.usedTokens,
+        budgetTokens: capacity.budgetTokens,
+        maxTarget: thresholds.maxTarget,
+        toolName,
+        brandNoun,
+      });
+      fired = [...fired, share];
+      ring = [...ring, { share, ordinal: markOrdinal(snapshot), text }];
+      if (ring.length > MAX_THRESHOLD_NOTICES) ring = ring.slice(ring.length - MAX_THRESHOLD_NOTICES);
+      changed = true;
+      emit("context.notice", {
+        share,
+        occupancy,
+        occupancy_tokens: capacity.usedTokens,
+        budget_tokens: capacity.budgetTokens,
+        max_target: thresholds.maxTarget,
+        chars: text.length,
+      });
+    }
+    if (changed) persistence.state = { ...persistence.state, notices: { fired, ring } };
+    return changed;
+  };
+
+  /**
+   * The same selection, read rather than delivered: what the next carrier WOULD say,
+   * with the ledger that decides whether it says anything at all.
+   */
+  const statusSurfacing = (snapshot: ActiveContextSnapshot): Record<string, unknown> => {
+    const ledger = persistence.state ? surfacingLedger(persistence.state) : [];
+    if (!persistence.state) return { slate: [], line: null, ledger, silenced: [] };
+    const selection = selectSurfacingSlate({
+      state: persistence.state,
+      snapshot,
+      toolName,
+      ordinal: markOrdinal(snapshot),
+    });
+    return {
+      slate: selection.slate.map((suggestion) => ({
+        id: suggestion.id,
+        route: suggestion.route,
+        contentScore: suggestion.contentScore,
+        briefScore: suggestion.briefScore,
+        margin: suggestion.margin,
+        slot: suggestion.slot,
+      })),
+      line: surfacingSlateText({ slate: selection.slate, queryTerms: selection.queryTerms, brandNoun }),
+      considered: selection.considered,
+      divergent: selection.divergent,
+      suppressed: selection.suppressed,
+      intentTerms: selection.queryTerms.size,
+      contentHit: SURFACING_CONTENT_HIT,
+      briefHit: SURFACING_BRIEF_HIT,
+      divergenceMargin: SURFACING_DIVERGENCE_MARGIN,
+      slateSize: SURFACING_SLATE_SIZE,
+      silenced: [...surfacingSilenced(ledger)],
+      ledger,
+    };
+  };
+
+  /**
+   * THE SURFACING SLATE, delivered.
+   *
+   * The agent cannot peek a fold it does not know to want, so one line names the fold
+   * whose stored content matches the task in hand when its brief does not. Where it
+   * lands is the whole economics: only carriers that ride a rewrite the runtime is
+   * already paying for (the pre-commit last call and the post-commit rider) plus the
+   * on-demand status surface, which the agent asked for. The per-request ephemeral
+   * carrier stays dead; it cost 21.9% of every input token in rep 21 and nothing else
+   * about this build changes that verdict.
+   *
+   * One suggestion per delivery point, and most delivery points get none. Every
+   * delivery first resolves whatever offers have run out of window, so the ignore that
+   * silences a fold is recorded before the next selection reads the ledger.
+   */
+  const deliverSurfacing = (snapshot: ActiveContextSnapshot, carrier: string): string | null => {
+    if (!persistence.state) return null;
+    const ordinal = markOrdinal(snapshot);
+    const resolved = resolveSurfacing({ state: persistence.state, snapshot, ordinal });
+    persistence.state = resolved.state;
+    for (const transition of resolved.transitions) {
+      emit("context.outcome", {
+        fold_id: transition.id,
+        from_outcome: transition.from,
+        outcome: transition.to,
+        outcome_ordinal: transition.ordinal,
+        window_ordinals: SURFACING_OUTCOME_WINDOW_ORDINALS,
+      });
+    }
+    const selection = selectSurfacingSlate({ state: persistence.state, snapshot, toolName, ordinal });
+    const suggestion = selection.slate[0];
+    if (!suggestion) return null;
+    const text = surfacingSlateText({
+      slate: selection.slate,
+      queryTerms: selection.queryTerms,
+      brandNoun,
+    });
+    if (!text) return null;
+    persistence.state = issueSurfacing(persistence.state, suggestion.id, ordinal);
+    emit("context.suggestion", {
+      carrier,
+      fold_id: suggestion.id,
+      content_score: suggestion.contentScore,
+      brief_score: suggestion.briefScore,
+      margin: suggestion.margin,
+      content_hit: SURFACING_CONTENT_HIT,
+      brief_hit: SURFACING_BRIEF_HIT,
+      divergence_margin: SURFACING_DIVERGENCE_MARGIN,
+      slot: suggestion.slot,
+      slate_size: SURFACING_SLATE_SIZE,
+      fold_depth: suggestion.depth,
+      considered: selection.considered,
+      divergent: selection.divergent,
+      suppressed: selection.suppressed,
+      intent_terms: selection.queryTerms.size,
+      chars: text.length,
+    });
+    return text;
+  };
+
+  /**
+   * THE PRE-COMMIT LAST-CALL GATE. When the band-top trigger fires, the commit defers
+   * exactly one gated round behind one exposure of the ruled prompt; then it proceeds
+   * with whatever marks exist. A request whose projection exceeds the provider input
+   * budget is rejected outright, so recovery must produce a window that fits: fence
+   * pressure, the recovery lane, or an occupancy already past the serving budget
+   * commit NOW, and the user
+   * command never reaches this gate because explicit intent is its own answer. The
+   * round is measured from DELIVERY: the commit proceeds only on a context pass whose
+   * ordinal is past the pass that rendered the exposure, which is exactly one agent
+   * response between prompt and rewrite.
+   */
+  const lastCallVerdict = (
+    snapshot: ActiveContextSnapshot,
+    pressure: number | null,
+    phase: string,
+  ): "expose" | "hold" | "proceed" => {
+    const state = persistence.state!;
+    const capacity = servingCapacity(snapshot.contextWindow);
+    const fenceLevel = typeof pressure === "number" && Number.isFinite(pressure) &&
+      pressure >= hardFenceRatio(snapshot);
+    // The output wall deliberately does NOT proceed here. It buys the crossing one inflow
+    // step of lead, and the gated round is what that lead is for: the agent still gets its
+    // one bounded turn to curate before a rewrite, which is a contract the wall has no
+    // business cancelling. If the round overruns and occupancy passes the budget outright,
+    // the condition below is what proceeds, on the pass that builds the next request.
+    const overBudget = capacity.usedTokens !== null && capacity.budgetTokens > 0 &&
+      capacity.usedTokens > capacity.budgetTokens;
+    if (fenceLevel || overBudget || curation.recoveryAttempts > 0 || curation.pendingRejection) {
+      return "proceed";
+    }
+    if (!state.lastCall) return "expose";
+    if (phase !== "context") return "hold";
+    const delivery = curation.lastCallDelivery;
+    if (!delivery || delivery.exposure !== state.lastCall.exposure) return "hold";
+    return markOrdinal(snapshot) > delivery.ordinal ? "proceed" : "hold";
+  };
+
+  const exposeLastCall = (snapshot: ActiveContextSnapshot): void => {
+    if (!persistence.state) return;
+    // THE PEEK RECLAIM IS MARKED HERE, NOT ONLY AT THE COMMIT.
+    //
+    // A peek copy is reclaimed at the next commit by contract, and a contract the agent
+    // cannot see until after it executes is not one it can veto. The exposure is the one
+    // bounded round before the rewrite, so minting the reclaim marks now puts the pending
+    // disposal in front of the agent while a pin still changes the outcome: a pinned mark
+    // waits instead of applying, and lifting the pin hands the copy to a later commit.
+    const exposureOrdinal = markOrdinal(snapshot);
+    let peekReclaims = 0;
+    for (const mark of ephemeralPeekMarks({ snapshot, state: persistence.state, ordinal: exposureOrdinal })) {
+      const addition = addPendingMark(persistence.state, mark);
+      if (addition.added) { persistence.state = addition.state; peekReclaims += 1; }
+    }
+    const signals = measuredCurationSignals(snapshot);
+    const remainder = unmarkedRemainder(snapshot, persistence.state, projectionCharsPerToken());
+    const accounting = markAccounting(snapshot, persistence.state);
+    const text = lastCallText({
+      signals,
+      unmarked: { spans: remainder.spans, tokens: remainder.tokens },
+      pendingMarks: accounting.pending,
+      peekReclaims,
+      suggestion: deliverSurfacing(snapshot, "lastcall"),
+      toolName,
+      brandNoun,
+    });
+    const record = emit("context.lastcall", {
+      occupancy: signals.occupancy,
+      max_target: thresholds.maxTarget,
+      occupancy_tokens: signals.occupancyTokens,
+      budget_tokens: signals.budgetTokens,
+      unmarked_stale_spans: remainder.spans,
+      unmarked_stale_tokens: remainder.tokens,
+      pending_marks: accounting.pending,
+      pending_agent_marks: accounting.agentMarks,
+      peek_marks: peekReclaims,
+      chars: text.length,
+    });
+    persistence.state = {
+      ...persistence.state,
+      lastCall: {
+        exposure: record.seq,
+        ordinal: markOrdinal(snapshot),
+        contextCalls: curation.contextCalls,
+        agentMarks: accounting.agentMarks,
+        text,
+      },
+    };
+  };
+
   const applyAutomaticRung = async (
     snapshot: ActiveContextSnapshot,
     ratio: number,
     rungOptions: {
-      waiveToolCadence?: boolean;
       toolOnly?: boolean;
       waiverRatio?: number;
-      announcing?: boolean;
     } = {},
+    phase = "context",
   ): Promise<Record<string, unknown> | null> => {
     if (!persistence.state || ladder.automaticFailure || ladder.preparing) return null;
     const rungSelectionOptions = {
-      waiveToolCadence: rungOptions.waiveToolCadence,
       toolOnly: rungOptions.toolOnly,
       summarizerAvailable: Boolean(options.summarizeContextSpan),
       failedPreparationIds: ladder.failedPreparations,
@@ -2433,59 +3916,98 @@ export function registerActiveContext(pi: any, options: {
     };
     let epoch: Record<string, unknown> | null = null;
     let inlineRungs = true;
-    if (epochScheduling) {
-      // QUIET RUNTIME. A commit is an epoch transition: it rewrites the projection, and
-      // every rewrite risks the whole prefix cache, so the cadence has to be the fewest
-      // commits that still keep the window inside its budget.
-      //
-      // The economic eligible-share trigger is DELETED: it fired 164 commits from
-      // ordinal 17 in rep 15, each a fresh cache rebuild bought with marks that had not
-      // yet earned one. What remains is the two-signal curation trigger, which fired 10
-      // to 17 times across reps 17 and 20, over the pressure backstop.
-      //
-      // The trigger stays; only its ANNOUNCEMENT is gone. Nothing warns that a commit
-      // is coming and nothing waits for the agent to react, because a warning has to
-      // arrive before the event it warns about and therefore has to break a prefix
-      // nothing else was breaking. Deleting the trigger with the announcement was the
-      // wrong cut: it left the raw backstop alone in front of the window, and gate 58
-      // caught the projection overrunning its budget before anything reclaimed -- the
-      // rep 13 death. The runtime still decides early. It just no longer says so.
-      const backstopDue = epochCommitDue(snapshot, ratio);
-      // The trigger is evaluated on CONTEXT passes only. A commit is an epoch
-      // transition, and it belongs on the pass that builds the next projection rather
-      // than in the middle of a tool batch: firing it mid-batch makes a MARK rewrite
-      // the window, which is precisely the thing marking is supposed never to do.
-      const curationDue = !backstopDue && rungOptions.announcing === true &&
-        curationCommitDue(snapshot);
-      if (backstopDue || curationDue) {
+    // QUIET RUNTIME, AND THE ONE TRIGGER.
+    //
+    // A commit is an epoch transition: it rewrites the projection, every rewrite risks
+    // the whole prefix cache, so the cadence has to be the fewest commits that still
+    // keep the window inside its budget. Occupancy reaching maxTarget is the whole
+    // automatic condition. Below it the runtime is quiet and marks accumulate free;
+    // at it, one commit folds down toward minTarget, and the gap between the two lines
+    // is what makes the spacing of events structural rather than hoped for.
+    //
+    // Two other arms used to reach this line and both are deleted. The eligible-share
+    // arm fired 164 commits from ordinal 17 in rep 15 on marks that had not earned a
+    // rewrite, and it could fire below maxTarget, which is the quiet law it sat under.
+    // The stale-mass AND-condition guarded an ANNOUNCEMENT that no longer exists: a
+    // commit is never announced, so a commit with nothing eligible now applies nothing
+    // and reports it rather than being suppressed in advance.
+    //
+    // The trigger decides early and says nothing. Nothing warns that a commit is
+    // coming, because a warning has to arrive before the event it warns about and
+    // therefore has to break a prefix nothing else was breaking.
+    // Evaluated on EVERY pass the ladder runs on, which is where the pressure backstop
+    // always sat. Crossing the band top is a property of occupancy, not of which
+    // lifecycle hook happened to notice it, and a trigger that waits for the next
+    // projection pass is a window that keeps climbing while it waits.
+    const noticesChanged = deliverThresholdNotices(snapshot);
+    let lastCallChanged = false;
+    const commitDue = commitTriggerDue(snapshot, ratio);
+    if (commitDue) {
+      const verdict = lastCallVerdict(snapshot, rungOptions.waiverRatio ?? ratio, phase);
+      if (verdict === "expose") {
+        exposeLastCall(snapshot);
+        lastCallChanged = true;
+      } else if (verdict === "proceed") {
         epoch = await runCommitEpoch(
           snapshot,
-          backstopDue ? "window-pressure" : "curation-trigger",
+          "band-top",
           true,
           rungOptions.waiverRatio ?? ratio,
         );
-        // Latch the eligible share this commit left behind, so the next one waits for
-        // genuinely new foldable mass rather than for the same window to still be full.
-        if (persistence.state && (curationDue || curation.reopenBaselineShare !== null)) {
+        // Latch the eligible share this commit left behind, so the next crossing waits
+        // for genuinely new foldable mass rather than for the same window to still be
+        // full. The band top is a LINE, and a window parked on it is one event.
+        if (persistence.state) {
           curation.reopenBaselineShare =
-            markAccounting(snapshot, persistence.state).eligibleFreedWindowShare;
+            markAccounting(snapshot, persistence.state).eligibleFreedBudgetShare;
         }
       }
-      // An inline rung is free only INSIDE a rewrite the epoch already paid for. Below
-      // the threshold no commit ran, and an epoch that applied NOTHING -- every mark
-      // held back by an open turn or by ineligibility -- paid for no rewrite either,
-      // so folding inline there is a fresh single-fold rewrite of its own. Measured
-      // 2026-08-06 (rep 10): the current-turn guard retained all nine marks every turn
-      // while the inline rung folded one batch per turn anyway, 52 single-fold
-      // rewrites that left the prefix cache share at zero. Below a paid rewrite the
-      // ladder MARKS, so the decisions batch into the first commit that can apply them.
-      inlineRungs = Boolean(epoch) && Number(epoch?.appliedMarks ?? 0) > 0;
-      if (!inlineRungs) {
-        const marked = markLadderSelection();
-        if (marked) {
-          if (epoch) ladder.lastAutomaticAction = { ...marked, epoch };
-          return ladder.lastAutomaticAction;
-        }
+      // "hold": the exposure is out and the round is still the agent's. Marks keep
+      // accumulating below; nothing commits and nothing re-exposes.
+    } else if (persistence.state.lastCall) {
+      // The crossing died without its commit (a user rescue or expiry dropped
+      // occupancy back under the trigger), so the exposure lapses: attributed,
+      // cleared, and the next crossing is a fresh event with a fresh exposure.
+      const capacity = servingCapacity(snapshot.contextWindow);
+      if (capacity.usedTokens !== null && capacity.budgetTokens > 0 &&
+          capacity.usedTokens / capacity.budgetTokens < thresholds.maxTarget) {
+        const lastCall = persistence.state.lastCall;
+        const attribution = lastCallAttribution(
+          lastCall,
+          markAccounting(snapshot, persistence.state).agentMarks,
+        );
+        emit("context.response", {
+          exposure_seq: lastCall.exposure,
+          commit_seq: null,
+          trigger: null,
+          outcome: "lapsed",
+          ...attribution,
+        });
+        clearLastCall();
+        lastCallChanged = true;
+      }
+    }
+    // An inline rung is free only INSIDE a rewrite the epoch already paid for. Below
+    // the threshold no commit ran, and an epoch that applied NOTHING -- every mark
+    // held back by an open turn or by ineligibility -- paid for no rewrite either,
+    // so folding inline there is a fresh single-fold rewrite of its own. Measured
+    // 2026-08-06 (rep 10): the current-turn guard retained all nine marks every turn
+    // while the inline rung folded one batch per turn anyway, 52 single-fold
+    // rewrites that left the prefix cache share at zero. Below a paid rewrite the
+    // ladder MARKS, so the decisions batch into the first commit that can apply them.
+    inlineRungs = Boolean(epoch) && Number(epoch?.appliedMarks ?? 0) > 0;
+    if (!inlineRungs) {
+      const marked = markLadderSelection();
+      if (marked) {
+        if (epoch) ladder.lastAutomaticAction = { ...marked, epoch };
+        return ladder.lastAutomaticAction;
+      }
+      // A carrier change is durable state even when no mark and no epoch moved: the
+      // exposure and the notices must survive a reload, so the pass returns an action
+      // for the transaction to persist. Never a receipt: a carrier reports itself.
+      if (!epoch && (lastCallChanged || noticesChanged)) {
+        ladder.lastAutomaticAction = { kind: "carrier", foldIds: [], sourceIds: [], sourceBytesSaved: 0 };
+        return ladder.lastAutomaticAction;
       }
     }
     // Evidence a pending mark already covers is not the inline rung's to fold: a mark
@@ -2501,16 +4023,14 @@ export function registerActiveContext(pi: any, options: {
     // quiet cadence started landing a commit on the same context pass, which is what
     // turns the inline rung on in the first place.
     const selection = inlineRungs
-      ? selectAutomaticRung(snapshot, persistence.state, ratio, epochScheduling
-        ? {
-          ...rungSelectionOptions,
-          claimed: new Set([
-            ...claimedRefKeys(persistence.state),
-            ...currentTurnRefKeys(snapshot),
-          ]),
-          claimedFoldIds: markedFoldIds(persistence.state),
-        }
-        : rungSelectionOptions)
+      ? selectAutomaticRung(snapshot, persistence.state, ratio, {
+        ...rungSelectionOptions,
+        claimed: new Set([
+          ...claimedRefKeys(persistence.state),
+          ...currentTurnRefKeys(snapshot),
+        ]),
+        claimedFoldIds: markedFoldIds(persistence.state),
+      })
       : null;
     // Above the commit threshold we are already inside the epoch's rewrite turn, so
     // every rung applies inline: the extra rung costs at most one more invalidation
@@ -2631,10 +4151,8 @@ export function registerActiveContext(pi: any, options: {
     ctx: any,
     phase: string,
     rungOptions: {
-      waiveToolCadence?: boolean;
       toolOnly?: boolean;
       waiverRatio?: number;
-      announcing?: boolean;
     } = {},
   ): Promise<Record<string, unknown> | null> => {
     if (!persistence.state || !measurements.lastProviderMeasurement ||
@@ -2653,7 +4171,7 @@ export function registerActiveContext(pi: any, options: {
     const transientAtEntry = captureTransient();
     let action: Record<string, unknown> | null = null;
     try {
-      action = await applyAutomaticRung(snapshot, ratio, rungOptions);
+      action = await applyAutomaticRung(snapshot, ratio, rungOptions, phase);
       if (action) await persist(ctx);
       if (action) ladder.boundaryFailure = null;
       return action;
@@ -2681,14 +4199,21 @@ export function registerActiveContext(pi: any, options: {
     ctx: any,
     phase: string,
     rungOptions: {
-      waiveToolCadence?: boolean;
       toolOnly?: boolean;
       waiverRatio?: number;
-      announcing?: boolean;
     } = {},
   ): Promise<Record<string, unknown> | null> => {
-    const operation = ladder.actionQueue.then(() =>
-      runAutomaticRungTransaction(snapshot, ratio, ctx, phase, rungOptions));
+    const operation = ladder.actionQueue.then(async () => {
+      const action = await runAutomaticRungTransaction(snapshot, ratio, ctx, phase, rungOptions);
+      // Where the generator is started from a pass: after the transaction, so the calls
+      // sit BETWEEN boundaries. Folds queued by the commit this pass just made are
+      // briefed now and land on the next commit, which is the whole shape of the lane.
+      // Afterwards each finishing call starts the next, so this is the lane's ignition
+      // rather than its pace. Parents waiting on their children are taken up here too:
+      // a pass is the other place we know the lane may have room.
+      resumeBriefUpgrades(snapshot, ctx);
+      return action;
+    });
     ladder.actionQueue = operation.catch(() => undefined);
     return operation;
   };
@@ -2700,40 +4225,6 @@ export function registerActiveContext(pi: any, options: {
       return [];
     }
   };
-  options.setProjectionProvider?.(projectionCandidates);
-
-  /**
-   * The suggestion-source hook. The built-in fold-brief source registers through this
-   * same call, so an external memory system's items reach the identical carrier,
-   * budget, ranking, and accept/reject log; pi-fold owns the channel, not the content.
-   */
-  const registerSuggestionSource: SuggestionSourceRegistrar = (source: SuggestionSource) => {
-    if (!source || typeof source !== "object" || typeof source.id !== "string" || !source.id ||
-        typeof source.candidates !== "function") {
-      throw new Error("A suggestion source needs a nonempty id and a candidates function");
-    }
-    if (surfacing.sources.some((registered) => registered.id === source.id)) {
-      throw new Error(`Suggestion source '${source.id}' is already registered`);
-    }
-    surfacing.sources.push(source);
-    return {
-      unregister: () => {
-        surfacing.sources = surfacing.sources.filter((registered) => registered !== source);
-      },
-      accepted: (id: string) => {
-        if (!persistence.state || typeof id !== "string" || !id) return;
-        // In-memory only: the next persisted state carries it. Reporting an outcome
-        // must never write a durable entry of its own.
-        persistence.state = acceptSurfacingSuggestion(
-          persistence.state,
-          id,
-          lifecycle.latestSnapshot ? surfacingOrdinal(lifecycle.latestSnapshot) : 0,
-        );
-      },
-    };
-  };
-  options.setSuggestionSourceRegistrar?.(registerSuggestionSource);
-
   // A same-session start/tree reload is a projection-generation mutation.
   // Queue it behind every context authority → preparation → commit →
   // projection transaction, then serialize the actual load with the action
@@ -2784,6 +4275,7 @@ export function registerActiveContext(pi: any, options: {
   pi.on("session_start", async (_event: unknown, ctx: any) => {
     await safeLifecycleLoad(ctx, "session-start");
     recordResolvedCapacity(ctx);
+    await armRollbackLane(ctx);
   });
   pi.on("session_tree", async (_event: unknown, ctx: any) => { await safeLifecycleLoad(ctx, "session-tree"); });
   pi.on("session_compact", async (event: Record<string, unknown>, ctx: any) => {
@@ -2831,9 +4323,15 @@ export function registerActiveContext(pi: any, options: {
   const attributionChanged = async (_event: unknown, ctx: any): Promise<void> => {
     lifecycle.generation += 1;
     cancelPreparation();
+    cancelBriefUpgrades();
     if (persistence.state?.prepared) persistence.state = clearPrepared(persistence.state);
     measurements.latestRatio = null;
     measurements.lastProviderMeasurement = null;
+    measurements.wallInflowSteps.length = 0;
+    // A different model or thinking level is a different tokenizer, so counts taken
+    // under the old one describe nothing here. The generation the anchor carries would
+    // already refuse it; dropping it releases the projection text it held as well.
+    measurements.projectionAnchor = null;
     nativeCompaction.lastThresholdDecision = null;
     updateStatus(ctx);
   };
@@ -2904,6 +4402,10 @@ export function registerActiveContext(pi: any, options: {
           // Calibrate BEFORE the new measurement becomes the previous one: the inflow
           // step is the difference between them.
           noteProjectionCalibration(observedMeasurement);
+          // Anchor before this pass builds anything: `previousText` is still the
+          // projection the provider just counted, and the projection built below is the
+          // one that either extends it or does not.
+          noteProviderProjectionAnchor(observedMeasurement);
           measurements.lastProviderMeasurement = observedMeasurement;
           startPreparation(snapshot, measurements.latestRatio, ctx);
           if (!ladder.automaticFailure && measurements.latestRatio >= hardFenceRatio(snapshot) && ladder.preparing) {
@@ -2913,9 +4415,9 @@ export function registerActiveContext(pi: any, options: {
               return { messages: event.messages };
             }
           }
-          if (selectAutomaticToolForRung(snapshot, persistence.state, measurements.latestRatio)) mutationAttempted = true;
+          if (selectAutomaticToolBatch(snapshot, persistence.state)[0]) mutationAttempted = true;
           const action = await attemptAutomaticRung(
-            snapshot, measurements.latestRatio, ctx, "context", { announcing: true },
+            snapshot, measurements.latestRatio, ctx, "context",
           );
           if (action) {
             mutationAttempted = true;
@@ -2951,8 +4453,11 @@ export function registerActiveContext(pi: any, options: {
       // already-large session out of calibrating at all: its first projection aborts
       // under the uncalibrated constant, so nothing is ever sent, so nothing ever
       // measures the ratio, so it aborts forever.
-      measurements.lastProjectedChars = bytes(projected);
-      measurements.lastProjectedEstimate = projectedTokenEstimate(projected);
+      const reading = projectedTokenReading(projected);
+      measurements.lastProjectedChars = reading.chars;
+      measurements.lastProjectedEstimate = reading.tokens;
+      measurements.lastProjectedEstimateBasis = reading.basis;
+      measurements.lastProjectedSizeTokens = Math.ceil(reading.chars / projectionCharsPerToken());
       measurements.lastProjectedEstimateCalibrated = measurements.projectionCalibrations.length > 0;
       // An aborted request still returns the PROJECTION. Handing back the raw branch
       // instead makes the aborted turn the largest message list the session ever
@@ -3015,6 +4520,7 @@ export function registerActiveContext(pi: any, options: {
     // inflow that is now behind us, and the cap resets for the next one.
     curation.recoveryAttempts = 0;
     curation.pendingRejection = null;
+    noteWallInflow(measurement);
     measurements.lastProviderMeasurement = measurement;
     measurements.latestRatio = measuredRatio;
     let snapshot: ActiveContextSnapshot;
@@ -3045,6 +4551,7 @@ export function registerActiveContext(pi: any, options: {
     beginMutationPass();
     try {
       const message = ownValue(event, "message");
+      noteOverflowAtMessageEnd(message, ctx);
       instrumentation.requests += 1;
       const observation = observeCacheUsage(instrumentation.ledger, {
         usage: ownValue(message, "usage"),
@@ -3089,58 +4596,17 @@ export function registerActiveContext(pi: any, options: {
       try { updateStatus(ctx); } catch { /* The provider loop must keep running. */ }
     }
   });
-  /**
-   * A provider rejection is ground truth that the last request did not fit, and it
-   * mutates nothing durable: no assistant message lands, and the projection is rebuilt
-   * from the branch on the next request. So it is recorded, not fatal -- the next
-   * context pass folds at fence pressure and rebuilds the request rather than dying.
-   * A 429 is a rate limit, not an overflow, and is deliberately not recovered from.
+  /*
+   * There was an `after_provider_response` handler here that treated `status >= 400` as
+   * the rejection signal. It could never fire on the case it was written for. Every
+   * provider adapter calls `onResponse` exactly once and only AFTER the request promise
+   * resolves, so a 4xx rejects the promise and control never reaches that call at all
+   * (verified across all seven adapters in pi-ai 0.83.0). `pendingRejection` was
+   * therefore never set in production and the recovery branch of the projection budget
+   * never ran. It is set by the rollback lane now, from an event that does fire.
    */
-  pi.on("after_provider_response", (event: Record<string, unknown>) => {
-    const status = ownValue(event, "status");
-    if (typeof status !== "number" || status < 400 || status === 429) return;
-    if (curation.recoveryAttempts >= OVERFLOW_RECOVERY_MAX_ATTEMPTS) return;
-    curation.pendingRejection = { status, ordinal: currentOrdinal() };
-  });
-  pi.on("tool_call", (event: Record<string, unknown>, ctx: any) => {
-    const calledTool = ownValue(event, "toolName");
-    if (lifecycle.shuttingDown || lifecycle.blockingToolHarvestedThisTurn || lifecycle.blockingToolHarvestQueuedThisTurn ||
-        typeof calledTool !== "string" || !blockingTools.has(calledTool)) return;
-    lifecycle.blockingToolHarvestQueuedThisTurn = true;
-    beginMutationPass();
-    const operation = ladder.actionQueue.then(async () => {
-      try {
-        if (!persistence.state || measurements.latestRatio === null || !measurements.lastProviderMeasurement || ladder.automaticFailure ||
-            !durableProviderMeasurementMatches(measurements.lastProviderMeasurement)) return null;
-        cancelPreparation();
-        let snapshot: ActiveContextSnapshot;
-        try { snapshot = authoritativeSnapshotFor(ctx); }
-        catch { return null; }
-        const candidate = selectAutomaticToolForRung(snapshot, persistence.state, measurements.latestRatio, true);
-        if (!candidate) {
-          lifecycle.blockingToolHarvestedThisTurn = true;
-          return null;
-        }
-        const action = await runAutomaticRungTransaction(
-          snapshot,
-          measurements.latestRatio,
-          ctx,
-          "tool-call",
-          { waiveToolCadence: true, toolOnly: true },
-        );
-        if (action) lifecycle.blockingToolHarvestedThisTurn = true;
-        return action;
-      } finally {
-        lifecycle.blockingToolHarvestQueuedThisTurn = false;
-        try { updateStatus(ctx); } catch { /* A blocking tool call must never wait on presentation. */ }
-      }
-    });
-    ladder.actionQueue = operation.catch(() => undefined);
-  });
   pi.on("turn_end", async (_event: unknown, ctx: any) => {
     beginMutationPass();
-    lifecycle.blockingToolHarvestedThisTurn = false;
-    lifecycle.blockingToolHarvestQueuedThisTurn = false;
     if (lifecycle.shuttingDown || !persistence.state || !persistence.persisted) return;
     const stateAtEntry = clone(persistence.state);
     const persistedAtEntry = persistence.persisted;
@@ -3170,8 +4636,287 @@ export function registerActiveContext(pi: any, options: {
     return ownValue(preparation, "userWantsSummary") === true ? { cancel: true } : undefined;
   });
 
+  /**
+   * pi's own overflow classifier, borrowed rather than re-implemented.
+   *
+   * `isContextOverflow` owns the provider-message patterns AND the silent cases (usage
+   * past the window with a clean stop, the truncating `length` stop). Re-stating that
+   * pattern set here would drift on the first provider that reworded its 400. The
+   * bare specifier is tried first, for a deployment where pi-ai is hoisted; the second
+   * form reaches pi's own nested copy, which is where a default install puts it.
+   */
+  const resolveOverflowClassifier = async (): Promise<void> => {
+    if (rollback.classifier || rollback.classifierSource === "unresolved") return;
+    const host = "@earendil-works/pi-coding-agent";
+    const marker = `/${host}/`;
+    const specifiers = ["@earendil-works/pi-ai/compat"];
+    try {
+      const entry = import.meta.resolve(host);
+      const at = entry.lastIndexOf(marker);
+      if (at >= 0) {
+        specifiers.push(`${entry.slice(0, at + marker.length)}node_modules/@earendil-works/pi-ai/dist/compat.js`);
+      }
+    } catch { /* An unresolvable host is the same answer as an unresolvable classifier. */ }
+    for (const specifier of specifiers) {
+      try {
+        const module = await import(specifier) as Record<string, unknown>;
+        if (typeof module.isContextOverflow === "function") {
+          rollback.classifier = module.isContextOverflow as (message: unknown, contextWindow: number) => boolean;
+          rollback.classifierSource = specifier;
+          return;
+        }
+      } catch { /* Try the next form; the last failure is the answer. */ }
+    }
+    rollback.classifierSource = "unresolved";
+  };
+
+  const armRollbackLane = async (ctx: any): Promise<void> => {
+    const probes = probeRollbackSurfaces(ctx?.sessionManager);
+    rollback.probes = probes;
+    rollback.armed = probes.armed;
+    await resolveOverflowClassifier();
+    if (!probes.armed) {
+      safeNotify(
+        ctx,
+        `${brandNoun} overflow rollback is DISARMED for this session (${probes.failures.join("; ")}). ` +
+        "An input-overflow rejection will abort the request instead of rolling the session back.",
+        "warning",
+      );
+    }
+  };
+
+  /**
+   * The disarmed answer, and the only one: say so on the record and leave the session
+   * behaving exactly as it did before the lane existed.
+   */
+  const refuseRollback = (reason: string, trigger: string, ctx: any): void => {
+    emit("context.rollback", {
+      trigger,
+      armed: false,
+      disarm_reason: reason,
+      error_entry_id: null,
+      old_leaf_id: null,
+      new_leaf_id: null,
+      entries_abandoned: 0,
+      occupancy_tokens_before: measurements.lastProviderMeasurement?.tokens ?? null,
+      tokens_rolled_back: 0,
+      replayed: false,
+      replay_skip_reason: "lane-disarmed",
+      notice_chars: 0,
+      attempt_ordinal: rollback.attempts,
+      probes_passed: rollback.probes ? rollback.probes.failures.length === 0 : false,
+    });
+    safeNotify(
+      ctx,
+      `${brandNoun} could not roll back after a provider input-overflow rejection: ${reason}. ` +
+      "The request was not retried.",
+      "error",
+    );
+  };
+
+  /**
+   * The fallback trigger, and the honest limit of it.
+   *
+   * `session_before_compact` never fires for a deployment that turned auto-compaction
+   * off, so the primary trigger is deaf there. This is the second detector: pi's own
+   * classifier over the assistant message at `message_end`, which is where the error
+   * message first becomes visible. It records the episode and, if no compaction event
+   * claims it, reports it.
+   *
+   * It does NOT roll back, and the reason is mechanical rather than cautious. The
+   * pre-strip this lane depends on happens INSIDE `_checkCompaction`, which is exactly
+   * the code an auto-compaction-disabled deployment never reaches, so on this path
+   * agent state still carries the oversized window plus the error message. A bare
+   * `branch()` there would leave the tree and agent state disagreeing, which is the
+   * failure mode the whole design exists to avoid. Held, and reported as held.
+   */
+  const noteOverflowAtMessageEnd = (message: unknown, ctx: any): void => {
+    if (!rollback.classifier || !message || typeof message !== "object") return;
+    const window = budgetWindowFor(ctx) ?? DEFAULT_CONTEXT_WINDOW;
+    let overflow = false;
+    try { overflow = rollback.classifier(message, window) === true; }
+    catch { return; }
+    if (!overflow) return;
+    rollback.pendingOverflow = { at: currentOrdinal(), entryId: null };
+  };
+
+  /**
+   * An overflow that no compaction event claimed: the auto-compaction-disabled shape.
+   * Loud, terminal, and never silent.
+   */
+  const reportUnclaimedOverflow = (ctx: any): void => {
+    if (!rollback.pendingOverflow) return;
+    rollback.pendingOverflow = null;
+    rollback.attempts += 1;
+    refuseRollback(
+      "the overflow arrived without a compaction event, so pi never stripped the failed message from agent " +
+      "state and a tree rollback would leave the tree and agent state disagreeing (auto-compaction is off)",
+      "message_end",
+      ctx,
+    );
+  };
+
+  /**
+   * ROLLBACK, COMMIT, REPLAY.
+   *
+   * pi has already stripped the trailing error message from agent state by the time
+   * this fires, so agent state IS the rolled-back window and all that remains is to
+   * move the session leaf to match. The label goes on FIRST, because a label appends at
+   * the current leaf and advances it, so applied after the branch it would mark the
+   * surviving path instead of the abandoned one.
+   *
+   * The commit deliberately does NOT happen here. The retried request runs its own
+   * `context` pass, and that pass folds and commits before the payload is built. A
+   * commit here would adjudicate a snapshot taken outside a projection pass and then be
+   * evaluated again by the retry, which is two mutations for one episode.
+   */
+  const rebuiltMessageCount = (manager: Record<string, any>): number | null => {
+    try {
+      const rebuilt = manager.buildSessionContext?.();
+      return Array.isArray(rebuilt?.messages) ? rebuilt.messages.length : null;
+    } catch { return null; }
+  };
+
+  const recoverFromOverflow = (event: Record<string, unknown>, ctx: any): void => {
+    rollback.attempts += 1;
+    rollback.pendingOverflow = null;
+    if (!rollback.armed) {
+      refuseRollback(
+        rollback.probes?.failures.join("; ") ?? "the rollback probes never ran",
+        "session_before_compact",
+        ctx,
+      );
+      return;
+    }
+    const shape = overflowEventShape(event);
+    if (!shape.ok) {
+      refuseRollback(`the overflow event is missing ${shape.missing.join(", ")}`, "session_before_compact", ctx);
+      return;
+    }
+    const branchEntries = ownValue(event, "branchEntries");
+    // Copied, not aliased. `getBranch()` hands back the live array and the branch call
+    // below truncates it in place, so a handler holding the original reference watches
+    // the entries it is still reasoning about disappear underneath it.
+    const entries = Array.isArray(branchEntries) ? [...branchEntries] : [];
+    const errorEntry = findOverflowErrorEntry(entries);
+    if (!errorEntry) {
+      refuseRollback("the rejected assistant entry is not the branch tail", "session_before_compact", ctx);
+      return;
+    }
+    const manager = ctx.sessionManager as Record<string, any>;
+    const oldLeafId = manager.getLeafId();
+    const sessionMessagesBefore = rebuiltMessageCount(manager);
+    const abandoned = entries.slice(errorEntry.index);
+    const rolledBackBytes = bytes(abandoned.flatMap((entry: any) => sessionEntryMessages(entry) ?? []));
+    // Lineage first. The abandoned path stays in the tree, and it says why it was left.
+    try {
+      manager.appendLabelChange(errorEntry.id, `${entryTypePrefix} overflow rollback`);
+    } catch (error) {
+      refuseRollback(`the lineage label failed (${String(error)})`, "session_before_compact", ctx);
+      return;
+    }
+    try {
+      if (errorEntry.parentId === null) manager.resetLeaf();
+      else manager.branch(errorEntry.parentId);
+    } catch (error) {
+      refuseRollback(`the branch failed (${String(error)})`, "session_before_compact", ctx);
+      return;
+    }
+    // The invariant, measured rather than assumed: the rolled-back window has to be
+    // exactly the failed entry shorter, or the retry sends something nobody built.
+    const errorEntryMessages = (sessionEntryMessages(entries[errorEntry.index]) ?? []).length;
+    const sessionMessagesAfter = rebuiltMessageCount(manager);
+    const holds = sessionMessagesBefore === null || sessionMessagesAfter === null ||
+      preStripHolds({ sessionMessagesBefore, sessionMessagesAfter, errorEntryMessages });
+    const unanswered = unansweredToolCalls(entries.slice(0, errorEntry.index));
+    let replaySkipReason: string | null = null;
+    if (!holds) {
+      replaySkipReason = `the rolled-back window came back ${sessionMessagesAfter} messages against the ` +
+        `${(sessionMessagesBefore ?? 0) - errorEntryMessages} the rollback should have left`;
+    } else if (unanswered.length) {
+      replaySkipReason = `the rolled-back tail leaves ${unanswered.length} tool call(s) unanswered, and a user ` +
+        "turn after an unsatisfied tool call is a malformed transcript for every provider";
+    }
+    const occupancyBefore = measurements.lastProviderMeasurement?.tokens ?? null;
+    const notice = rollbackNoticeText({
+      brandNoun,
+      toolName,
+      tokensRolledBack: estimatedTokens(rolledBackBytes),
+      entriesAbandoned: abandoned.length,
+      replayed: replaySkipReason === null,
+      replaySkipReason,
+    });
+    // Exactly ONE steered message. Steering drains one at a time at the top of the
+    // retried loop, so a second would be silently held to a turn that never comes.
+    let replayed = false;
+    if (replaySkipReason === null) {
+      if (typeof pi.sendMessage !== "function") {
+        replaySkipReason = "this pi build exposes no message verb, so the retry cannot be steered";
+      } else {
+        try {
+          pi.sendMessage(
+            { customType: `${entryTypePrefix}-overflow-recovery`, content: notice },
+            { deliverAs: "steer" },
+          );
+          replayed = true;
+        } catch (error) {
+          replaySkipReason = `the recovery notice could not be queued (${String(error)})`;
+        }
+      }
+    }
+    if (!replayed) safeNotify(ctx, notice, "warning");
+    const record = emit("context.rollback", {
+      trigger: "session_before_compact",
+      armed: true,
+      disarm_reason: null,
+      error_entry_id: errorEntry.id,
+      old_leaf_id: typeof oldLeafId === "string" ? oldLeafId : null,
+      new_leaf_id: errorEntry.parentId,
+      entries_abandoned: abandoned.length,
+      occupancy_tokens_before: occupancyBefore,
+      tokens_rolled_back: estimatedTokens(rolledBackBytes),
+      replayed,
+      replay_skip_reason: replaySkipReason,
+      notice_chars: notice.length,
+      attempt_ordinal: rollback.attempts,
+      probes_passed: true,
+    });
+    rollback.last = {
+      seq: record.seq,
+      errorEntryId: errorEntry.id,
+      newLeafId: errorEntry.parentId,
+      entriesAbandoned: abandoned.length,
+      tokensRolledBack: estimatedTokens(rolledBackBytes),
+      replayed,
+      replaySkipReason,
+      noticeChars: notice.length,
+      attemptOrdinal: rollback.attempts,
+    };
+    // The tree moved, so the mapping is rebuilt from it. THEN the fold is armed for the
+    // retried pass, in that order: a reload clears the recovery flags, and arming before
+    // it would hand the retry a cleared one. The guards are waived in that pass because
+    // a request that already did not fit has nothing left to economize.
+    load(ctx, true);
+    curation.pendingRejection = { status: 400, ordinal: currentOrdinal() };
+  };
+
   pi.on("session_before_compact", (event: Record<string, unknown>, ctx: any) => {
     const reason = ownValue(event, "reason");
+    // The overflow reason is a provider rejection pi is prepared to retry, and it is
+    // the rollback lane's trigger. Threshold and manual compaction are unchanged.
+    if (reason === "overflow" && ownValue(event, "willRetry") === true) {
+      nativeCompaction.lastThresholdDecision = {
+        handled: true,
+        retry: true,
+        reason: `provider input overflow; ${contextBrand(brandNoun)} rolled the session tree back instead`,
+        compactionReason: reason,
+        nativeCompactionCompleted: false,
+      };
+      try { recoverFromOverflow(event, ctx); }
+      catch (error) { suspendAutomatic(error, "overflow-rollback", ctx); }
+      try { updateStatus(ctx); } catch { /* Recovery must survive presentation failure. */ }
+      return { cancel: true };
+    }
     if (reason === "manual") {
       nativeCompaction.lastThresholdDecision = {
         handled: false,
@@ -3192,6 +4937,7 @@ export function registerActiveContext(pi: any, options: {
     return { cancel: true };
   });
   pi.on("agent_settled", async (_event: unknown, ctx: any) => {
+    reportUnclaimedOverflow(ctx);
     if (ladder.pendingManual && persistence.persisted && ladder.boundaryFailure === null) {
       cancelPreparation();
       persistence.state = clone(persistence.persisted);
@@ -3300,31 +5046,34 @@ export function registerActiveContext(pi: any, options: {
         pendingMarks: accounting.pending,
         eligibleMarks: accounting.eligibleMarks,
         retainedMarks: accounting.retainedMarks,
-        eligibleMarkedShare: accounting.eligibleFreedWindowShare,
-        markedShare: accounting.freedWindowShare,
+        eligibleMarkedShare: accounting.eligibleFreedBudgetShare,
+        markedShare: accounting.freedBudgetShare,
         available: true,
         automatic: {
           pressureRatio: measurements.latestRatio,
-          surfacing: {
-            rendered: false,
-            sources: surfacing.sources.map((source) => source.id),
-            log: clone(persistence.state.surfacing ?? []),
-          },
-          warningRatio: snapshot.policy.warningRatio,
-          toolFoldRatio: snapshot.policy.toolFoldRatio,
+          // Status is a READ of the slate, never a delivery of one. `status` is a
+          // read-only context action and the tool-batch safety scan is built on
+          // read-only actions not writing durable state, so asking must not issue a
+          // suggestion, spend the precision budget, or move a suppression counter. An
+          // agent that asks gets the answer; only the push carriers are metered.
+          surfacing: statusSurfacing(snapshot),
           refoldRatio: snapshot.policy.refoldRatio,
           chapterPrepareRatio: snapshot.policy.prepareRatio,
           hardFenceRatio: hardFenceRatio(snapshot),
-          responseReserve: Math.min(
-            ACTIVE_CONTEXT_POLICY.responseReserve,
-            Math.floor(snapshot.contextWindow * 0.1),
-          ),
+          // The declared policy, reported. No action reads it back as a setting.
+          thresholds: { ...snapshot.thresholds },
+          zones: {
+            freshBoundary: snapshot.freshBoundary,
+            budgetTokens: snapshot.budgetTokens,
+          },
+          // What THIS runtime withheld, which is nothing once the deployment declared an
+          // already-net budget. One number, from the same accounting the fence divides by.
+          responseReserve: currentCapacity(ctx).outputReservation,
           windowSource: snapshot.windowSource,
           capacity: {
             ...currentCapacity(ctx),
             bytesPerToken: projectionCharsPerToken(),
           },
-          consolidationRatio: snapshot.policy.consolidationRatio,
           providerMeasurement: measurements.lastProviderMeasurement ? {
             tokens: measurements.lastProviderMeasurement.tokens,
             contextWindow: measurements.lastProviderMeasurement.contextWindow,
@@ -3346,8 +5095,7 @@ export function registerActiveContext(pi: any, options: {
           lastAutomaticAction: ladder.lastAutomaticAction,
           overBudgetReduction: ladder.overBudgetReduction ? clone(ladder.overBudgetReduction) : null,
           curation: {
-            occupancyThreshold: CURATION_OCCUPANCY_SHARE,
-            staleToolThreshold: CURATION_STALE_TOOL_SHARE,
+            occupancyThreshold: thresholds.maxTarget,
             signals: curation.lastSignals ? { ...curation.lastSignals } : null,
             contextCalls: curation.contextCalls,
             receipts: curation.receipts.map((receipt) => ({ ...receipt })),
@@ -3357,28 +5105,34 @@ export function registerActiveContext(pi: any, options: {
             maxAttempts: OVERFLOW_RECOVERY_MAX_ATTEMPTS,
             pendingRejection: curation.pendingRejection ? { ...curation.pendingRejection } : null,
             last: curation.lastRecovery ? clone(curation.lastRecovery) : null,
+            rollback: {
+              armed: rollback.armed,
+              probeFailures: rollback.probes ? [...rollback.probes.failures] : null,
+              classifier: rollback.classifierSource,
+              attempts: rollback.attempts,
+              last: rollback.last ? clone(rollback.last) : null,
+            },
           },
           foldSpanCap: MAX_FOLD_SPAN_CHARS,
           projectionBudgetTokens: currentCapacity(ctx).budgetTokens,
           projectionCharsPerToken: projectionCharsPerToken(),
           projectionEstimatorErrorShare: estimatorErrorShare(),
           projectionExpectedInflowTokens: expectedInflowTokens(),
-          projectionMarginTokens: measurements.lastProjectedChars === null
-            ? null
-            : projectionMarginTokens(
-              Math.ceil(measurements.lastProjectedChars / projectionCharsPerToken()),
-              currentCapacity(ctx).window,
-            ),
-          projectionEstimatedTokens: measurements.lastProjectedChars === null
+          // What the fence actually weighed, not a second arithmetic over the same bytes:
+          // once occupancy is anchored, re-deriving it here from chars alone would report
+          // a number no decision was made on.
+          projectionMarginTokens: measurements.lastProjectedEstimate === null
             ? null
-            : Math.ceil(measurements.lastProjectedChars / projectionCharsPerToken()),
+            : projectionMarginTokens(measurements.lastProjectedEstimate, currentCapacity(ctx).window),
+          projectionEstimatedTokens: measurements.lastProjectedEstimate,
+          projectionEstimateBasis: measurements.lastProjectedEstimateBasis,
+          projectionAnchorTokens: measurements.projectionAnchor?.tokens ?? null,
           automaticSuspended: ladder.automaticFailure !== null,
           automaticFailure: ladder.automaticFailure ? clone(ladder.automaticFailure) : null,
           lastCompactionDecision: nativeCompaction.lastThresholdDecision,
           scheduling: schedulingStatus({
             snapshot,
             state: persistence.state,
-            mode: foldScheduling,
             ratio: measurements.latestRatio,
           }),
           nativeSummaries: "disabled",
@@ -3390,12 +5144,10 @@ export function registerActiveContext(pi: any, options: {
             // THE stream, as the durable entries carry it. One shape, one convention.
             events: clone(instrumentation.ledger.events),
           },
-          foldPeekResults,
           peek: {
             defaultMaxBytes: PEEK_DEFAULT_MAX_BYTES,
-            lifetime: "append-only",
+            lifetime: "append-only; the copy is reclaimed at the next commit unless pinned",
           },
-          freeHarvest: blockingTools.size === 0 ? "disabled" : "enabled",
           pressureSource: "last-successful-provider-response-only",
           postOverflowCallback: "blocked-while-stock-native-compaction-is-disabled",
           sameOperationRetry: false,
@@ -3414,12 +5166,12 @@ export function registerActiveContext(pi: any, options: {
         ...(detail === "tree" ? { tree: foldTreeDetail(snapshot, persistence.state).slice(statusOffset) } : {}),
       }, typeof detail === "string" ? detail : null, statusOffset));
     }
-    // Peeking or expanding a suggested fold is the accept signal, recorded for the
-    // retrieval build even though nothing suggests anything today. It stays ephemeral:
-    // the mark rides the next persisted state, never an entry of its own.
+    // Peeking or expanding a surfaced fold is the ACTED label, joined to the offer that
+    // named it. It stays ephemeral: the ledger rides the next persisted state, never an
+    // entry of its own, and the used/ignored grades land when the window closes.
     const noteSurfacingAccept = (id: string): void => {
       if (!persistence.state) return;
-      persistence.state = acceptSurfacingSuggestion(persistence.state, id, surfacingOrdinal(snapshot));
+      persistence.state = noteSurfacingAction(persistence.state, id, markOrdinal(snapshot));
     };
     if (action === "peek") {
       const id = String(params.id ?? "").trim();
@@ -3592,7 +5344,7 @@ export function registerActiveContext(pi: any, options: {
       // An expand with marks pending opens the commit epoch: the restore and the
       // batch of folds then cost one rewrite between them instead of two.
       let epochApplied: unknown[] = [];
-      if (epochScheduling && action === "expand" && pendingMarks(persistence.state).length) {
+      if (action === "expand" && pendingMarks(persistence.state).length) {
         const result = await commitPendingMarks({
           snapshot,
           state: persistence.state,
@@ -3637,12 +5389,39 @@ export function registerActiveContext(pi: any, options: {
     }
     if (action === "protect" || action === "unprotect") {
       const ids = stringIds(params.ids);
-      await persistManual(protectEvidence(snapshot, persistence.state, ids, action === "protect"), action, ctx);
+      const refsBefore = persistence.state.protected.length;
+      const nextProtection = protectEvidence(snapshot, persistence.state, ids, action === "protect");
+      if (action === "protect") {
+        // The pin ceiling: protect is a promise to hold bytes raw through every fold,
+        // and a promise with no mass bound can pin the window solid. The refusal is
+        // corrective, not denial: it names the cap and the release valve.
+        const capacity = servingCapacity(snapshot.contextWindow);
+        const prospectiveShare = capacity.budgetTokens > 0
+          ? estimatedTokens(explicitProtectedMass(snapshot, nextProtection).bytes) / capacity.budgetTokens
+          : 0;
+        if (prospectiveShare > MAX_PINNED_SHARE) {
+          throw new Error(
+            `protect refused: these pins would hold ${Math.round(prospectiveShare * 100)}% of the ` +
+            `working window raw, past the ${Math.round(MAX_PINNED_SHARE * 100)}% pinned-share cap. ` +
+            'Release earlier pins with {"action":"unprotect","ids":["<entry-id>"]} first; ' +
+            "folding keeps entries exactly recoverable without pinning them.");
+        }
+      }
+      await persistManual(nextProtection, action, ctx);
+      const refsAfter = persistence.state.protected.length;
+      emit("context.protect", {
+        protect: action === "protect",
+        ids: ids.join(","),
+        id_count: ids.length,
+        protected_refs_before: refsBefore,
+        protected_refs_after: refsAfter,
+      });
       updateStatus(ctx);
       return toolPayload({
         version: 1,
         action,
         ids,
+        protectedRefs: refsAfter,
         activation: "durable immediately; projected on the next model call in this same turn",
       });
     }
@@ -3714,172 +5493,135 @@ export function registerActiveContext(pi: any, options: {
         }
       }
       const corrections = resolved.flatMap((item) => item.corrections);
-      if (epochScheduling) {
-        // Resolve every brief now, while the source is in hand, so the commit epoch
-        // itself stays deterministic and free of provider calls. A span that is not
-        // eligible YET cannot go through preparation at all, so it takes the
-        // deterministic brief: the mark is a decision, and refusing to record it
-        // because the span is momentarily fresh is exactly the drop being fixed.
-        const marks: Array<Record<string, unknown>> = [];
-        let staged = persistence.state;
-        for (const item of resolved) {
-          const { candidate } = item;
-          // ACCEPT AND HOLD. A span that is still fresh or protected is not a refusal:
-          // the mark is a standing decision, it is recorded now, and it folds at the
-          // first commit after the span ages out. Refusal is reserved for a mark that
-          // cannot be constructed at all.
-          // A REPEATED DECISION IS INERT. The fold id is derived from the span, so a
-          // span the ladder already prepared carries that exact id in the forest
-          // already, and preparing it a second time throws "Prepared fold already
-          // exists" out of the tool call. Under the old cadence commits were frequent
-          // enough to drain prepared folds before a second decision could land on one;
-          // the quiet runtime commits far less often, so the collision became reachable
-          // in ordinary use -- the ladder marks a span, the agent then folds the same
-          // span, and the agent's call fails. Marking is a standing decision about a
-          // span, and deciding the same thing twice has to be a no-op.
-          const alreadyPrepared = staged.folds.some((fold) =>
-            fold.id === foldIdFor(candidate.kind, candidate.parts));
-          const deferred = refsProtected(candidate.sourceRefs, staged, snapshot) ||
-            (candidate.kind === "tool-result" &&
-              toolRefsProtected(candidate.sourceRefs, staged, snapshot));
-          const briefed = !deferred && !alreadyPrepared
-            ? await prepareFold({
-              candidate,
-              snapshot,
-              state: staged,
-              generation: lifecycle.generation,
-              brief: item.brief,
-              summarize: options.summarizeContextSpan,
-              ctx,
-              signal,
-            })
-            : null;
-          const mark = foldMarkFor({
+      // Resolve every brief now, while the source is in hand, so the commit epoch
+      // itself stays deterministic and free of provider calls. A span that is not
+      // eligible YET cannot go through preparation at all, so it takes the
+      // deterministic brief: the mark is a decision, and refusing to record it
+      // because the span is momentarily fresh is exactly the drop being fixed.
+      const marks: Array<Record<string, unknown>> = [];
+      let staged = persistence.state;
+      for (const item of resolved) {
+        const { candidate } = item;
+        // ACCEPT AND HOLD. A span that is still fresh or protected is not a refusal:
+        // the mark is a standing decision, it is recorded now, and it folds at the
+        // first commit after the span ages out. Refusal is reserved for a mark that
+        // cannot be constructed at all.
+        // A REPEATED DECISION IS INERT. The fold id is derived from the span, so a
+        // span the ladder already prepared carries that exact id in the forest
+        // already, and preparing it a second time throws "Prepared fold already
+        // exists" out of the tool call. Under the old cadence commits were frequent
+        // enough to drain prepared folds before a second decision could land on one;
+        // the quiet runtime commits far less often, so the collision became reachable
+        // in ordinary use -- the ladder marks a span, the agent then folds the same
+        // span, and the agent's call fails. Marking is a standing decision about a
+        // span, and deciding the same thing twice has to be a no-op.
+        const alreadyPrepared = staged.folds.some((fold) =>
+          fold.id === foldIdFor(candidate.kind, candidate.parts));
+        const deferred = refsProtected(candidate.sourceRefs, staged, snapshot) ||
+          (candidate.kind === "tool-result" &&
+            toolRefsProtected(candidate.sourceRefs, staged, snapshot));
+        const briefed = !deferred && !alreadyPrepared
+          ? await prepareFold({
             candidate,
-            brief: briefed?.fold.brief ?? item.brief ?? ladderBrief(snapshot, staged, candidate),
-            briefProvenance: briefed?.fold.provenance ??
-              (item.brief ? { kind: "supplied" } : { kind: "deterministic" }),
-            origin: "agent",
-            ordinal: markOrdinal(snapshot),
-          });
-          const addition = addPendingMark(staged, mark);
-          if (!addition.added) {
-            marks.push({ id: mark.id, kind: mark.kind, ok: false, deferred: false, reason: addition.reason });
-            continue;
-          }
-          staged = addition.state;
-          marks.push({
-            id: mark.id,
-            kind: mark.kind,
-            ok: true,
-            deferred,
-            ...(deferred
-              ? {
-                scheduled: "the span is still in the fresh window; this mark is held and folds at the " +
-                  "first commit after it ages out",
-              }
-              : {}),
-            brief: mark.brief,
-            provenance: normalizeLegacyProvenance(mark.briefProvenance),
-          });
+            snapshot,
+            state: staged,
+            generation: lifecycle.generation,
+            brief: item.brief,
+            summarize: observedSummarize,
+            ctx,
+            signal,
+          })
+          : null;
+        const mark = foldMarkFor({
+          candidate,
+          brief: briefed?.fold.brief ?? item.brief ?? ladderBrief(snapshot, staged, candidate),
+          briefProvenance: briefed?.fold.provenance ??
+            (item.brief ? { kind: "supplied" } : { kind: "deterministic" }),
+          origin: "agent",
+          ordinal: markOrdinal(snapshot),
+        });
+        const addition = addPendingMark(staged, mark);
+        if (!addition.added) {
+          marks.push({ id: mark.id, kind: mark.kind, ok: false, deferred: false, reason: addition.reason });
+          continue;
         }
-        await persistManual(staged, action, ctx);
-        updateStatus(ctx);
-        const accounting = markAccounting(snapshot, persistence.state);
-        // MECHANISM 3. The projection is byte-frozen between fold events, so this reply
-        // is the only cache-free channel left: it carries the whole picture, not just
-        // an acknowledgement of the spans this call named.
-        const held = pendingMarks(persistence.state).map((mark) => ({
+        staged = addition.state;
+        marks.push({
           id: mark.id,
           kind: mark.kind,
-          tokens: estimatedTokens(markFreedBytes(snapshot, persistence.state!, mark)),
-        }));
-        const remainder = unmarkedRemainder(snapshot, persistence.state, projectionCharsPerToken());
-        // The single-span shape is the head of the batched one: one call carrying one
-        // span answers exactly as it always did, and a batch adds fields rather than
-        // replacing them.
-        const only = marks.length === 1 && marks[0].ok === true ? marks[0] : null;
-        return toolPayload({
-          version: 1,
-          action,
-          scheduling: "epoch",
-          ok: marks.some((mark) => mark.ok === true),
-          deferredMarks: marks.filter((mark) => mark.deferred === true).length,
-          ...(only
+          ok: true,
+          deferred,
+          ...(deferred
             ? {
-              id: only.id,
-              kind: only.kind,
-              brief: only.brief,
-              provenance: only.provenance,
-              deferred: only.deferred,
-              ...(only.scheduled ? { scheduled: only.scheduled } : {}),
+              scheduled: "the span is still in the fresh window; this mark is held and folds at the " +
+                "first commit after it ages out",
             }
             : {}),
-          marks,
-          // Never silently reinterpreted: a span the runtime moved says so, here.
-          corrections,
-          argumentsSha256: executionArgumentsSha256,
-          durableRevision: persistence.state.revision,
-          pendingMarks: accounting.pending,
-          eligibleMarks: accounting.eligibleMarks,
-          retainedMarks: accounting.retainedMarks,
-          estimatedFreedWindowShare: accounting.freedWindowShare,
-          estimatedEligibleWindowShare: accounting.eligibleFreedWindowShare,
-          estimatedRewriteTokens: accounting.rewriteTokens,
-          held,
-          heldNote: "held until it ages out or the next fold event",
-          unmarkedSpans: remainder.spans,
-          unmarkedTokens: remainder.tokens,
-          unmarkedShare: remainder.share,
-          unmarkedCandidates: remainder.candidates,
-          awareness: markAwarenessText({ held, remainder, toolName, brandNoun }),
-          activation: "accepted as pending marks; no context bytes moved, and nothing else in your " +
-            "context changed either. They apply together at the next commit epoch, which the runtime " +
-            "opens at the fold event. " +
-            "A mark over a still-fresh span is held, not refused: it is scheduled, and it folds at the " +
-            "first commit after that span ages out of the fresh window. " +
-            "Mark several spans in one call: this whole picture comes back with each one.",
-        });
-      }
-      const applied: Array<Record<string, unknown>> = [];
-      for (const item of resolved) {
-        const { preparedFold, nextState } = await prepareAndCommitExplicit({
-          snapshot,
-          candidate: item.candidate,
-          brief: item.brief,
-          ctx,
-          signal,
-        });
-        persistence.state = nextState;
-        applied.push({
-          id: preparedFold.id,
-          kind: preparedFold.fold.kind,
-          brief: preparedFold.fold.brief,
-          provenance: normalizeLegacyProvenance(preparedFold.fold.provenance),
-          expand: { action: "expand", id: preparedFold.id },
+          brief: mark.brief,
+          provenance: normalizeLegacyProvenance(mark.briefProvenance),
         });
       }
-      await persistManual(persistence.state, "fold", ctx);
+      await persistManual(staged, action, ctx);
       updateStatus(ctx);
-      const single = applied.length === 1 ? applied[0] : null;
+      const accounting = markAccounting(snapshot, persistence.state);
+      // MECHANISM 3. The projection is byte-frozen between fold events, so this reply
+      // is the only cache-free channel left: it carries the whole picture, not just
+      // an acknowledgement of the spans this call named.
+      const held = pendingMarks(persistence.state).map((mark) => ({
+        id: mark.id,
+        kind: mark.kind,
+        tokens: estimatedTokens(markFreedBytes(snapshot, persistence.state!, mark)),
+      }));
+      const remainder = unmarkedRemainder(snapshot, persistence.state, projectionCharsPerToken());
+      // The single-span shape is the head of the batched one: one call carrying one
+      // span answers exactly as it always did, and a batch adds fields rather than
+      // replacing them.
+      const only = marks.length === 1 && marks[0].ok === true ? marks[0] : null;
       return toolPayload({
         version: 1,
         action,
-        scheduling: "immediate",
-        ...(single
+        scheduling: "epoch",
+        ok: marks.some((mark) => mark.ok === true),
+        deferredMarks: marks.filter((mark) => mark.deferred === true).length,
+        ...(only
           ? {
-            id: single.id,
-            kind: single.kind,
-            brief: single.brief,
-            provenance: single.provenance,
-            expand: single.expand,
+            id: only.id,
+            kind: only.kind,
+            brief: only.brief,
+            provenance: only.provenance,
+            deferred: only.deferred,
+            ...(only.scheduled ? { scheduled: only.scheduled } : {}),
           }
           : {}),
-        folds: applied,
+        marks,
+        // Never silently reinterpreted: a span the runtime moved says so, here.
         corrections,
         argumentsSha256: executionArgumentsSha256,
         durableRevision: persistence.state.revision,
-        activation: "durable immediately; projected on the next model call in this same turn",
+        pendingMarks: accounting.pending,
+        eligibleMarks: accounting.eligibleMarks,
+        retainedMarks: accounting.retainedMarks,
+        estimatedFreedWindowShare: accounting.freedBudgetShare,
+        estimatedEligibleWindowShare: accounting.eligibleFreedBudgetShare,
+        estimatedRewriteTokens: accounting.rewriteTokens,
+        held,
+        heldNote: "held until it ages out or the next fold event",
+        unmarkedSpans: remainder.spans,
+        unmarkedTokens: remainder.tokens,
+        unmarkedShare: remainder.share,
+        unmarkedCandidates: remainder.candidates,
+        // The acknowledgement rides the tool result, so it PERSISTS in context the way
+        // every tool result does. Default on;
+        // `guidance.actionResponses: false` returns the accounting without the prose.
+        ...(guidance.actionResponses ? {
+          awareness: markAwarenessText({ held, remainder, toolName, brandNoun }),
+          activation: "accepted as pending marks; no context bytes moved, and nothing else in your " +
+            "context changed either. They apply together at the next commit epoch, which the runtime " +
+            "opens at the fold event. " +
+            "A mark over a still-fresh span is held, not refused: it is scheduled, and it folds at the " +
+            "first commit after that span ages out of the fresh window. " +
+            "Mark several spans in one call: this whole picture comes back with each one.",
+        } : {}),
       });
     }
     throw new Error(`Unknown ${toolName} action '${action}'`);
@@ -3899,7 +5641,7 @@ export function registerActiveContext(pi: any, options: {
   };
 
   const toolHandler = async (
-    _toolCallId: string,
+    toolCallId: string,
     params: Record<string, unknown>,
     signal: AbortSignal,
     _onUpdate: unknown,
@@ -3915,6 +5657,9 @@ export function registerActiveContext(pi: any, options: {
           action,
           ok,
           error,
+          // The join key against the worker's own tool-call log: one logical row per
+          // model-emitted invocation, matched by id and never by order or clock.
+          tool_call_id: toolCallId,
           marks_requested: requestedMarkCount(params),
           corrections_applied: corrections.length,
           arguments_sha256: sha256Value(params ?? {}),
@@ -3972,11 +5717,39 @@ export function registerActiveContext(pi: any, options: {
       if (!lifecycle.latestSnapshot) lifecycle.latestSnapshot = snapshot;
       const divider = args.indexOf(" -- ");
       const selector = (divider >= 0 ? args.slice(0, divider) : args).trim();
+      // THE USER COMMIT. One word, and the only commit verb any caller has: the model
+      // tool still has no commit action, because a verb the runtime is entitled to
+      // overrule is surface without function. A user is not overruled.
+      //
+      // Below maxTarget it applies the eligible marks in hand and stops -- no automatic
+      // top-up, because the user asked to bank the curation they made, not to have the
+      // runtime pick more. At or above maxTarget it is the ordinary event: the planner
+      // may top up toward minTarget. Neither path touches freshness, pins, exactness or
+      // the provider fence.
+      if (selector === "commit") {
+        const capacity = servingCapacity(snapshot.contextWindow);
+        const occupancy = capacity.usedTokens !== null && capacity.budgetTokens > 0
+          ? capacity.usedTokens / capacity.budgetTokens
+          : null;
+        const topUp = occupancy !== null && occupancy >= thresholds.maxTarget;
+        const committed = await runCommitEpoch(snapshot, "user-command", topUp, measurements.latestRatio, true);
+        try { await persist(ctx); } catch { /* The commit already reported its own outcome. */ }
+        updateStatus(ctx);
+        safeNotify(
+          ctx,
+          committed
+            ? `Committed ${ownValue(committed, "applied_marks") ?? 0} mark(s)${topUp ? " with automatic top-up" : ""}. ` +
+              "Exact source remains expandable."
+            : "Nothing eligible to commit: no pending mark is outside the fresh tail.",
+          "info",
+        );
+        return;
+      }
       const supplied = (divider >= 0 ? args.slice(divider + 4) : "").trim() || undefined;
       const ids = selector ? selector.replace(/\.\./g, " ").split(/[\s,]+/).filter(Boolean) : [];
       const candidate = ids.length
         ? manualFoldCandidate(snapshot, persistence.state!, ids)
-        : selectAutomaticChapter(snapshot, persistence.state!) ?? selectAutomaticToolBatch(snapshot, persistence.state!, 1)[0] ?? null;
+        : selectAutomaticChapter(snapshot, persistence.state!) ?? selectAutomaticToolBatch(snapshot, persistence.state!)[0] ?? null;
       if (!candidate) throw new Error("No exact stale rescue span is currently eligible");
       const stateBefore = persistence.state!;
       const persistedBefore = persistence.persisted ? clone(persistence.persisted) : null;
@@ -4027,7 +5800,7 @@ export function registerActiveContext(pi: any, options: {
     name: toolName,
     label: toolLabel,
     allowedActions: allowedToolActions,
-    fullSurface: allowedToolActions.length === defaultToolActions.length,
+    fullSurface: true,
     maxBriefChars: ACTIVE_CONTEXT_POLICY.maxBriefChars,
     statusDetails: ["fold_candidates", "tree", "folds", "objects"],
     minPeekSliceBytes: PEEK_MIN_SLICE_BYTES,
@@ -4049,6 +5822,7 @@ export function registerActiveContext(pi: any, options: {
     lifecycle.generation += 1;
     lifecycle.shuttingDown = true;
     cancelPreparation();
+    cancelBriefUpgrades();
     persistence.state = null;
     persistence.persisted = null;
     lifecycle.latestSnapshot = null;
@@ -4056,5 +5830,5 @@ export function registerActiveContext(pi: any, options: {
     try { ctx.ui?.setStatus?.(entryTypePrefix, undefined); } catch { /* Shutdown cannot be blocked by UI. */ }
   });
 
-  return { projectionCandidates, registerSuggestionSource };
+  return { projectionCandidates };
 }