pi-fold 1.0.4 → 3.0.0

package/extensions/lib/folding.ts

@@ -28,7 +28,6 @@ import {
   orderedRoots,
   refsInOrder,
   refsProtected,
-  toolRefsProtected,
 } from "./measurement.ts";
 import {
   childFoldIds,
@@ -53,8 +52,7 @@ import {
   MAX_FOLD_SPAN_CHARS,
   PEEK_DEFAULT_MAX_BYTES,
   PEEK_HEAD_SHARE,
-  STATUS_DIET_SUGGESTIONS,
-  zoneBytes,
+  STATUS_DIET_INDEX_ROWS,
 } from "./policy.ts";
 import type {
   ActiveContextSnapshot,
@@ -85,49 +83,29 @@ import {
 export function selectAutomaticChapter(
   snapshot: ActiveContextSnapshot,
   state: ActiveContextState,
-  maximumSourceRefs: number = snapshot.policy.maxFoldSourceRefs,
   claimed: ReadonlySet<string> = new Set<string>(),
 ): FoldCandidate | null {
-  // Every structurally closed unit is a candidate. What keeps a chapter off the newest
-  // material is `refsProtected` below -- the fresh byte tail and the agent's pins -- and
-  // what keeps it off the running excursion's own evidence is the guard adjudicated at
-  // the commit. There is no position filter here: a unit is composable or it is not.
   const units = chapterUnits(snapshot);
-  // An automatic chapter is raw material, always. Letting a chapter swallow placeholders
-  // once the root count reached `consolidateAfter` was the old approximation of
-  // consolidation, and the count law replaces it outright: a placeholder gets a parent
-  // when the count says it must, under a fold that says what it is, not as a side effect
-  // of which chapter happened to be composable that pass (Shane 2026-08-10).
   const allowedChildren = NO_FOLD_KINDS;
   for (let unitIndex = 0; unitIndex < units.length; unitIndex += 1) {
     const first = units[unitIndex];
     let best: FoldCandidate | null = null;
-    const turnStarts = new Set<number>();
     for (let endIndex = unitIndex; endIndex < units.length; endIndex += 1) {
       const unit = units[endIndex];
       if (endIndex > unitIndex && unit.start !== units[endIndex - 1].end) break;
-      turnStarts.add(unit.turnStart);
-      if (turnStarts.size > snapshot.policy.maxChapterTurns) break;
       const coherentSegment = endIndex > unitIndex || first.end - first.start > 1;
       if (!coherentSegment) continue;
       const parts = partsForRange(snapshot, state, first.start, unit.end - 1, allowedChildren);
       if (!parts || parts.some((part) => part.kind === "fold" && state.expanded.includes(part.foldId))) continue;
       const refs = candidateSourceRefs(parts, state);
-      if (refs.length > maximumSourceRefs) break;
       if (claimed.size && refs.some((ref) => claimed.has(objectRefKey(ref)))) continue;
       if (refsProtected(refs, state, snapshot)) continue;
       const size = bytes(encodedFoldSource(snapshot, state, parts, "chapter"));
-      // The chapter cap bounds what the rung COMPOSES, never what it may reclaim: a
-      // single closed unit that alone exceeds it is still accepted (rep 19: six status
-      // results, each above the cap, were exactly the mass nothing could fold).
-      if (size > snapshot.policy.maxChapterChars && endIndex > unitIndex) break;
-      // Bite-sized by construction. A multi-unit chapter never grows past the cap, so
-      // the ladder cannot build the 60kB fold whose tail hid the answer (rep 6); a
-      // SINGLE unit that alone exceeds it is still accepted, because there is no
-      // interior boundary to stop at and refusing would leave the biggest span in the
-      // window as the one thing nothing may reclaim.
       const biteSized = size <= MAX_FOLD_SPAN_CHARS || endIndex === unitIndex;
-      if (size >= snapshot.policy.minChapterChars && biteSized) best = { kind: "chapter", parts, sourceRefs: refs };
+      // ACCUMULATE UNTIL OVER, never cut to hit the number. The walk grows the span one
+      // whole unit at a time and records the first one that carries it past the floor,
+      // so a fold is always at least minFoldChars and always ends on a message boundary.
+      if (size >= snapshot.thresholds.minFoldChars && biteSized) best = { kind: "chapter", parts, sourceRefs: refs };
       if (size > MAX_FOLD_SPAN_CHARS) break;
     }
     if (best) return best;
@@ -135,26 +113,12 @@ export function selectAutomaticChapter(
   return null;
 }
 
-/**
- * ONE automatic selection law for stale material.
- *
- * There is no chapter rung and no consolidation rung any more, each with its own
- * trigger: automation proposes the stalest eligible SPAN, and what the span contains
- * decides the fold's kind. Raw narrative folds as a chapter; a parent the root count
- * requires folds as a consolidation. Nothing here is pressure-scaled: the epoch's own
- * commit trigger decides WHEN, and this decides WHAT.
- *
- * One candidate, because that is what a single inline rung can apply. The count law
- * itself is not rationed this way: the commit epoch takes EVERY group the count requires
- * in one pass, and this is the leftover route by which the stalest of them can also ride
- * an epoch's own rewrite.
- */
 export function selectAutomaticStaleSpan(
   snapshot: ActiveContextSnapshot,
   state: ActiveContextState,
   claimed: ReadonlySet<string> = new Set<string>(),
 ): FoldCandidate | null {
-  const chapter = selectAutomaticChapter(snapshot, state, snapshot.policy.maxFoldSourceRefs, claimed);
+  const chapter = selectAutomaticChapter(snapshot, state, claimed);
   const folds = selectAutomaticConsolidations(snapshot, state)[0] ?? null;
   if (!chapter || !folds) return chapter ?? folds;
   const at = (candidate: FoldCandidate): number =>
@@ -162,10 +126,6 @@ export function selectAutomaticStaleSpan(
   return at(folds) < at(chapter) ? folds : chapter;
 }
 
-/**
- * What the commit epoch proposes: a completed read-only tool batch if one is stale, and
- * otherwise the stalest span the one law composes. This is the whole automatic path.
- */
 export function selectAutomaticSpan(
   snapshot: ActiveContextSnapshot,
   state: ActiveContextState,
@@ -185,14 +145,6 @@ export type AutomaticRungSelection =
 
 export interface AutomaticRungSelectionOptions {
   toolOnly?: boolean;
-  summarizerAvailable?: boolean;
-  failedPreparationIds?: ReadonlySet<string>;
-  /**
-   * Evidence and folds already spoken for by something that is not yet a fold, i.e.
-   * a pending epoch mark. Excluding them makes each eligible turn select NEW stale
-   * content instead of re-selecting the batch a mark already covers, which is the
-   * only way marks accumulate below the commit threshold.
-   */
   claimed?: ReadonlySet<string>;
   claimedFoldIds?: ReadonlySet<string>;
 }
@@ -216,7 +168,7 @@ export function selectAutomaticRung(
   const claimedFoldIds = options.claimedFoldIds ?? new Set<string>();
   if (!options.toolOnly && state.prepared) {
     if (!Number.isFinite(ratio) || ratio < hardFenceRatio(snapshot)) return null;
-    const candidate = selectAutomaticChapter(snapshot, state, snapshot.policy.maxFoldSourceRefs, claimed);
+    const candidate = selectAutomaticChapter(snapshot, state, claimed);
     return candidate ? { kind: "prepared-chapter", candidate } : null;
   }
   const tool = selectAutomaticToolBatch(snapshot, state, claimed)[0] ?? null;
@@ -224,24 +176,12 @@ export function selectAutomaticRung(
   if (options.toolOnly || !Number.isFinite(ratio)) return null;
   const refold = selectAutomaticRefold(snapshot, state, claimedFoldIds);
   if (refold) return { kind: "refold", foldId: refold };
-  // One law decides the span; only the CHAPTER kind still has a preparation path in
-  // front of it, because only a chapter brief is worth a model call.
   const span = selectAutomaticStaleSpan(snapshot, state, claimed);
   if (span?.kind === "consolidation") return { kind: "consolidation", candidate: span };
   const chapter = span;
   if (!chapter) return null;
-  const preparationFailed = options.failedPreparationIds?.has(
-    automaticPreparationId(chapter, state),
-  ) ?? false;
-  if (ratio >= hardFenceRatio(snapshot)) {
-    return !options.summarizerAvailable || preparationFailed
-      ? { kind: "chapter", candidate: chapter }
-      : { kind: "chapter-prepare", candidate: chapter };
-  }
-  if ((options.summarizerAvailable && ratio >= snapshot.policy.warmRatio) ||
-      ((!options.summarizerAvailable || preparationFailed) && ratio >= snapshot.policy.prepareRatio)) {
-    return { kind: "chapter-prepare", candidate: chapter };
-  }
+  if (ratio >= hardFenceRatio(snapshot)) return { kind: "chapter", candidate: chapter };
+  if (ratio >= snapshot.policy.prepareRatio) return { kind: "chapter-prepare", candidate: chapter };
   return null;
 }
 
@@ -250,12 +190,10 @@ export function foldCandidatesDetail(
   state: ActiveContextState,
   ratio: number | null,
   options: {
-    summarizerAvailable?: boolean;
     generation?: number;
     measurementFresh?: boolean;
     automaticFailure?: boolean;
     preparing?: boolean;
-    failedPreparationIds?: ReadonlySet<string>;
   } = {},
 ): Record<string, unknown> {
   const measuredRatio = ratio !== null && Number.isFinite(ratio) ? ratio : Number.NaN;
@@ -264,10 +202,7 @@ export function foldCandidatesDetail(
   const staleSpan = selectAutomaticStaleSpan(snapshot, state);
   const consolidation = staleSpan?.kind === "consolidation" ? staleSpan : null;
   const chapter = staleSpan?.kind === "chapter" ? staleSpan : null;
-  const selection = selectAutomaticRung(snapshot, state, measuredRatio, {
-    summarizerAvailable: options.summarizerAvailable,
-    failedPreparationIds: options.failedPreparationIds,
-  });
+  const selection = selectAutomaticRung(snapshot, state, measuredRatio);
   let wouldFireNow: string | null = null;
   let blockedBy: string | null = null;
   if (options.measurementFresh === false) blockedBy = "measurement-stale";
@@ -296,9 +231,6 @@ export function foldCandidatesDetail(
     } : null,
     wouldFireNow,
     blockedBy,
-    // The one position that still cuts anything, plus the count law read as the
-    // arithmetic it is: the roots it counts, the width it divides by, and how many
-    // parents that count owes right now.
     zones: {
       freshBoundary: snapshot.freshBoundary,
       budgetTokens: snapshot.budgetTokens,
@@ -369,25 +301,6 @@ export function encodedFoldSource(
   }));
 }
 
-/**
- * What a generator reads to brief a PARENT: its children at depth one.
- *
- * `encodedFoldSource` renders a parent's children through `renderFold`, which yields their
- * placeholders, so a parent's source was the children's briefs. Briefing that produces a
- * summary of summaries, and by the second rung the material itself is three descriptions
- * away. So each child is opened here instead: its own brief for orientation, then its
- * contents, with ITS children left as placeholders. Depth one is the whole rule. It bounds
- * the read at one level per rung whatever the ladder's height, and it is the same view an
- * agent gets from expanding the parent, so a brief written from it describes what expanding
- * would actually return.
- *
- * When the opened children do not fit, the LARGEST collapses back to brief-only first, and
- * again until the rest fit. Size is what decides, not position: dropping in span order
- * would spend the whole budget on an early giant and close every child behind it, while
- * taking the giant out first buys back the most room for the fewest subjects lost. A
- * collapsed child still appears, in span order, carrying its brief and saying it is
- * collapsed, so the generator can tell a child it read from a child it only heard about.
- */
 export function consolidationSourceText(
   snapshot: ActiveContextSnapshot,
   state: ActiveContextState,
@@ -417,8 +330,6 @@ export function consolidationSourceText(
       ? { collapsed: "brief only: this child did not fit expanded" }
       : { contents: entry.messages }),
   })));
-  // Largest first, and only as many as the budget forces: each collapse is a subject the
-  // brief must describe from one sentence instead of from its contents.
   const bySize = entries
     .filter((entry) => entry.foldId !== null)
     .map((entry) => ({ index: entry.index, size: bytes(entry.messages) }))
@@ -459,17 +370,6 @@ export function boundedOrientation(
   return { beforeRefs: before, beforeText, afterRefs: after.refs, afterText: after.text };
 }
 
-/**
- * What is wrong with a generated brief, said in words its author can act on, or null.
- *
- * Length is a criterion we set, so a brief that misses it is answered rather than cut.
- * Truncating a long brief silently loses whatever the generator put last, which on a group
- * is the last children it covered; the cure is to hand the complaint back and let the
- * generator spend the budget itself. Coverage cannot be checked the same way: no test tells
- * whether a sentence stands for a child, so coverage is instructed in the request and
- * defended by the deterministic index underneath, and what is checked here is the pair of
- * failures that were silent before.
- */
 export function briefContractComplaint(
   brief: string,
   maxBriefChars: number,
@@ -488,240 +388,44 @@ export function briefContractComplaint(
   return null;
 }
 
-/**
- * One brief from the generator, with one chance to cure a criterion it missed.
- *
- * The no-retry rule this lane was built with holds for what it was written about: a
- * generator that fails on a span fails on it again, and looping would spend the session's
- * calls proving it. A contract complaint is the other case. The request stated a limit, the
- * answer missed it, and the complaint names exactly what to change, so the second ask is
- * new information rather than the same ask twice. It is bounded at one, and only a
- * complaint earns it: transport faults, timeouts and attribution drift still fail on the
- * first answer. Both attempts sit inside the caller's timeout, so a brief costs no more
- * wall clock than it did.
- */
-export async function generatedBrief(input: {
-  summarize: (request: Record<string, unknown>, ctx?: unknown) => Promise<Record<string, unknown>>;
-  request: Record<string, unknown>;
-  ctx?: unknown;
-  maxBriefChars: number;
-  toolName: string;
-}): Promise<{ brief: string; provenance: BriefProvenance; cured: boolean }> {
-  let complaint: string | null = null;
-  for (let attempt = 0; attempt < 2; attempt += 1) {
-    const result = await input.summarize(
-      complaint === null ? input.request : { ...input.request, cure: complaint },
-      input.ctx,
-    );
-    const brief = typeof result?.brief === "string" ? result.brief.trim() : "";
-    const provenance = generatorAttribution(result);
-    complaint = briefContractComplaint(brief, input.maxBriefChars, input.toolName);
-    if (complaint === null) return { brief, provenance, cured: attempt > 0 };
-  }
-  throw new Error(`Model context brief usefulness contract drift after one cure: ${complaint}`);
-}
-
-/**
- * Attribution is the harness's own wiring, not the generator's judgment, so it is never
- * handed back to be cured: a summarizer that cannot say which model wrote a brief is broken
- * in a way a second ask cannot mend. Shared by the single and batched paths so the two
- * cannot drift.
- */
-function generatorAttribution(result: Record<string, unknown> | null | undefined): BriefProvenance {
-  const digest = result?.launchContractDigest;
-  if (typeof result?.provider !== "string" || !result.provider ||
-      typeof result?.model !== "string" || !result.model ||
-      typeof result?.effort !== "string" || !result.effort || result.toolCalls !== 0 ||
-      (digest !== undefined && (typeof digest !== "string" || !/^[a-f0-9]{64}$/.test(digest)))) {
-    throw new Error("Model context brief attribution, zero-tool, or digest contract drift");
-  }
-  return {
-    kind: "model",
-    provider: result.provider,
-    model: result.model,
-    effort: result.effort,
-    ...(typeof digest === "string" ? { launchContractDigest: digest } : {}),
-  };
-}
-
-/**
- * Many briefs from one call, with one chance to cure the ones that missed.
- *
- * The lane used to send one request per fold, two at a time, which meant most folds never
- * reached a generator at all: the 2026-08-11 rep committed 87 folds and applied 14 model
- * briefs, the rest keeping the deterministic sentence because the queue was full. A commit
- * folds its spans together, so they are briefed together, and coverage stops competing with
- * throughput.
- *
- * The cure is per-span and the retry carries only the spans that failed, so one bad brief
- * does not make the model rewrite eleven good ones. A span still failing after its cure
- * keeps its deterministic brief and is named in the error, which is the same outcome a
- * single-span failure has always had; the difference is that its neighbours still land.
- */
-export async function generatedBriefs(input: {
-  summarize: (request: Record<string, unknown>, ctx?: unknown) => Promise<Record<string, unknown>>;
-  request: Record<string, unknown>;
-  spans: Array<Record<string, unknown>>;
-  ctx?: unknown;
-  maxBriefChars: number;
-  toolName: string;
-}): Promise<{
-  briefs: Array<{ brief: string; provenance: BriefProvenance } | null>;
-  cured: number;
-  complaints: string[];
-}> {
-  const settled = new Array<{ brief: string; provenance: BriefProvenance } | null>(input.spans.length)
-    .fill(null);
-  let pending = input.spans.map((span, index) => ({ span, index }));
-  let cured = 0;
-  let complaints: string[] = [];
-  for (let attempt = 0; attempt < 2 && pending.length; attempt += 1) {
-    const asked = pending;
-    const result = await input.summarize({
-      ...input.request,
-      spans: asked.map((item) => item.span),
-      ...(complaints.length
-        ? {
-          cure: asked.map((item, at) =>
-            `Brief ${at + 1}: ${complaints[at] ?? "did not meet the stated criteria."}`).join(" "),
-        }
-        : {}),
-    }, input.ctx);
-    const provenance = generatorAttribution(result);
-    const written = Array.isArray(result?.briefs) ? result.briefs : [];
-    const failed: typeof pending = [];
-    const next: string[] = [];
-    for (let at = 0; at < asked.length; at += 1) {
-      const brief = typeof written[at] === "string" ? (written[at] as string).trim() : "";
-      const complaint = briefContractComplaint(brief, input.maxBriefChars, input.toolName);
-      if (complaint === null) {
-        settled[asked[at].index] = { brief, provenance };
-        if (attempt > 0) cured += 1;
-        continue;
-      }
-      failed.push(asked[at]);
-      next.push(complaint);
-    }
-    pending = failed;
-    complaints = next;
-  }
-  return { briefs: settled, cured, complaints };
-}
-
 export async function prepareFold(input: {
   candidate: FoldCandidate;
   snapshot: ActiveContextSnapshot;
   state: ActiveContextState;
   generation: number;
   brief?: string;
-  /**
-   * Provenance for a supplied brief. A full record round-trips a brief whose
-   * generator already ran (a pending mark carrying a model brief); the string
-   * forms stay the shorthand for the two model-free kinds.
-   */
   briefProvenance?: "supplied" | "deterministic" | BriefProvenance;
-  summarize?: (request: Record<string, unknown>, ctx?: unknown) => Promise<Record<string, unknown>>;
-  onSummarizerFailure?: (error: unknown) => void;
   ctx?: unknown;
   signal?: AbortSignal;
   now?: () => number;
 }): Promise<PreparedFold> {
   const { candidate, snapshot, state } = input;
-  const protectedSource = candidate.kind === "tool-result"
-    ? toolRefsProtected(candidate.sourceRefs, state, snapshot)
-    : refsProtected(candidate.sourceRefs, state, snapshot);
-  if (!candidate.sourceRefs.length || candidate.sourceRefs.length > snapshot.policy.maxFoldSourceRefs ||
+  const protectedSource = refsProtected(candidate.sourceRefs, state, snapshot);
+  if (!candidate.sourceRefs.length ||
       refsInOrder(snapshot, candidate.sourceRefs) === null || protectedSource) {
     throw new Error("Fold source is not exact, stale, and unprotected");
   }
   const sourceText = encodedFoldSource(snapshot, state, candidate.parts, candidate.kind);
-  const groupChildren = candidate.parts.filter((part) => part.kind === "fold").length;
-  const readableSource = groupChildren
-    ? consolidationSourceText(snapshot, state, candidate.parts)
-    : sourceText;
   const orientation = boundedOrientation(snapshot, candidate.sourceRefs);
   const sourceSha256 = sha256Text(sourceText);
   const beforeSha256 = sha256Text(orientation.beforeText);
   const afterSha256 = sha256Text(orientation.afterText);
-  const candidateId = sha256Value({
-    kind: candidate.kind,
-    parts: candidate.parts.map(normalizedPart),
-    sourceSha256,
-    beforeSha256,
-    afterSha256,
-  });
 
   let brief: string;
   let provenance: BriefProvenance;
   if (input.brief !== undefined) {
-    if (!usefulBrief(input.brief, snapshot.policy.maxBriefChars, snapshot.toolName)) {
-      throw new Error(`Supplied brief must be non-structural and at most ${snapshot.policy.maxBriefChars} characters`);
-    }
+    const complaint = briefContractComplaint(
+      input.brief.trim(), snapshot.policy.maxBriefChars, snapshot.toolName);
+    if (complaint !== null) throw new Error(`Supplied brief rejected. ${complaint}`);
     brief = input.brief.trim();
     provenance = typeof input.briefProvenance === "object"
       ? clone(input.briefProvenance)
       : { kind: input.briefProvenance ?? "supplied" };
   } else {
-    let modelBrief: { brief: string; provenance: BriefProvenance } | null = null;
-    if (input.summarize) {
-      const controller = new AbortController();
-      const relayAbort = (): void => controller.abort();
-      input.signal?.addEventListener("abort", relayAbort, { once: true });
-      let timeout: ReturnType<typeof setTimeout> | undefined;
-      try {
-        if (bytes(readableSource) > snapshot.policy.maxSourceChars) {
-          throw new Error("Fold source exceeds the bounded model-summary request");
-        }
-        const timed = new Promise<never>((_resolve, reject) => {
-          timeout = setTimeout(() => {
-            controller.abort();
-            reject(new Error(`Context brief exceeded ${snapshot.policy.briefTimeoutMs}ms`));
-          }, snapshot.policy.briefTimeoutMs);
-        });
-        const generated = await Promise.race([generatedBrief({
-          summarize: input.summarize,
-          request: {
-            candidateId,
-            sourceRefs: clone(candidate.sourceRefs),
-            // What the generator READS, which for a group is its children opened one level
-            // rather than the placeholders `sourceText` renders. The fold's own identity
-            // stays `sourceSha256` above: what a span IS does not change with how it is read.
-            sourceText: readableSource,
-            sourceSha256: sha256Text(readableSource),
-            children: groupChildren,
-            beforeRefs: clone(orientation.beforeRefs),
-            beforeText: orientation.beforeText,
-            beforeSha256,
-            afterRefs: clone(orientation.afterRefs),
-            afterText: orientation.afterText,
-            afterSha256,
-            maxBriefChars: snapshot.policy.maxBriefChars,
-            signal: controller.signal,
-          },
-          ctx: input.ctx,
-          maxBriefChars: snapshot.policy.maxBriefChars,
-          toolName: snapshot.toolName,
-        }), timed]);
-        modelBrief = { brief: generated.brief, provenance: generated.provenance };
-      } catch (error) {
-        if (input.signal?.aborted) throw error;
-        input.onSummarizerFailure?.(error);
-      } finally {
-        clearTimeout(timeout);
-        input.signal?.removeEventListener("abort", relayAbort);
-      }
-    }
-    if (modelBrief) {
-      brief = modelBrief.brief;
-      provenance = modelBrief.provenance;
-    } else {
-      // By kind, not by assumption: a group that loses its generator falls back to the
-      // index of its children, and only a chapter falls back to a chapter's brief.
-      brief = candidate.kind === "consolidation"
-        ? deterministicConsolidationBrief(candidate, state)
-        : deterministicChapterCandidateBrief(snapshot, candidate);
-      provenance = { kind: "deterministic" };
-    }
+    brief = candidate.kind === "consolidation"
+      ? deterministicConsolidationBrief(candidate, state, snapshot.toolName, snapshot)
+      : deterministicChapterCandidateBrief(snapshot, candidate);
+    provenance = { kind: "deterministic" };
   }
 
   const id = foldIdFor(candidate.kind, candidate.parts);
@@ -869,13 +573,12 @@ export function preparedFoldError(input: {
   if (prepared.branchSha256 !== branchSha256(snapshot, [
     ...prepared.beforeRefs, ...prepared.sourceRefs, ...prepared.afterRefs,
   ])) return "branch drift";
-  const toolSource = prepared.fold.kind === "tool-result";
-  if (indices.some((index) => toolSource
-    ? snapshot.toolProtectedIndices.has(index)
-    : snapshot.protectedIndices.has(index))) return "fresh-tail drift";
-  if (toolSource
-    ? toolRefsProtected(prepared.sourceRefs, state, snapshot)
-    : refsProtected(prepared.sourceRefs, state, snapshot)) return "source became protected";
+  // One protected set now: an entry is unfoldable because its turn has not completed or
+  // because it carries no evidence ref, and both are validity, not recency. The branch on
+  // fold kind went with fresh-tail protection: it read `toolRefsProtected` on one side,
+  // and once that collapsed onto `refsProtected` both arms were the same call.
+  if (indices.some((index) => snapshot.protectedIndices.has(index))) return "protection drift";
+  if (refsProtected(prepared.sourceRefs, state, snapshot)) return "source became protected";
   if (Object.prototype.hasOwnProperty.call(input, "ratio")) {
     if (input.ratio === null || typeof input.ratio !== "number" || !Number.isFinite(input.ratio)) {
       return "current pressure unavailable";
@@ -910,9 +613,6 @@ export function commitPreparedFold(input: {
   if (error) throw new Error(`Prepared active-context fold discarded: ${error}`);
   const nested = stateWithNestedFold(input.state, input.prepared.fold);
   const next = clearPrepared({ ...nested, revision: input.state.revision + 1 });
-  // A fold is not committed unless its provider projection preserves every
-  // existing tool-call/output pair atomically. This keeps malformed provider
-  // context non-constructible even if a future selector regresses.
   projectActiveContext(input.snapshot, next);
   return next;
 }
@@ -975,12 +675,10 @@ export function protectEvidence(
   });
   const byKey = new Map(state.protected.map((ref) => [objectRefKey(ref), ref]));
   for (const ref of refs) protect ? byKey.set(objectRefKey(ref), ref) : byKey.delete(objectRefKey(ref));
-  // Atomic: the whole resolved set pins or nothing does. A partial pin that reports
-  // success would leave part of the requested span silently reclaimable.
   if (byKey.size > MAX_ACTIVE_PROTECTED) {
     throw new Error(
       `Protecting ${ids.join(", ")} would hold ${byKey.size} refs, over the ${MAX_ACTIVE_PROTECTED}-ref cap; ` +
-        "unprotect something first",
+        "unpin something first",
     );
   }
   return clearPrepared({
@@ -1031,9 +729,7 @@ export function renderFold(
   const refs = flattenFoldRefs(fold, state);
   const indices = refsInOrder(snapshot, refs);
   if (!indices) return null;
-  const mustReveal = state.expanded.includes(fold.id) || (fold.kind === "tool-result"
-    ? toolRefsProtected(refs, state, snapshot)
-    : refsProtected(refs, state, snapshot));
+  const mustReveal = state.expanded.includes(fold.id) || (refsProtected(refs, state, snapshot));
   if (!mustReveal) {
     const first = snapshot.messages[indices[0]] as Record<string, unknown>;
     const text = foldPlaceholder(fold, state, snapshot);
@@ -1105,13 +801,6 @@ export function assertProjectionPreservesToolLinkage(source: unknown[], projecte
   }
 }
 
-/**
- * Peek mass the ladder cannot take: results whose evidence the agent protected
- * outright. This is the number that made rep 7's starvation invisible. The mass sat
- * raw in the window, the ROI trigger's eligibility arithmetic could never reach its
- * threshold over it, and no accounting field said so while the window grew to 235k
- * tokens.
- */
 export function pinnedPeekMass(
   snapshot: ActiveContextSnapshot,
   state: ActiveContextState,
@@ -1170,13 +859,6 @@ export function projectActiveContext(
       index += 1;
     }
   }
-  // A peek result is APPEND-ONLY. It used to be rewritten in place once a model call
-  // had seen it, on the theory that the edit was tail-local; rep 22 disproved that.
-  // The result is only tail-local when it ARRIVES, and reclamation deliberately waits
-  // until a later assistant message exists, by which point the window has grown over
-  // it and the edit lands mid-prefix. Two peeks cost 100k fresh tokens that way. The
-  // duplicate bytes are still reclaimed, by the tool-fold rung at the next commit,
-  // which is the one moment a rewrite is already being paid for.
   assertProjectionPreservesToolLinkage(snapshot.messages, output);
   return output;
 }
@@ -1187,9 +869,7 @@ export function foldStatusRow(fold: ActiveFold, state: ActiveContextState, snaps
   const refs = flattenFoldRefs(fold, state);
   const allSourceIds = refs.map((ref) => ref.entryId);
   const sourceIds = allSourceIds.slice(0, 64);
-  const blocked = fold.kind === "tool-result"
-    ? toolRefsProtected(refs, state, snapshot)
-    : refsProtected(refs, state, snapshot);
+  const blocked = refsProtected(refs, state, snapshot);
   const projection = state.expanded.includes(fold.id) ? "expanded" : "folded";
   return {
     id: fold.id,
@@ -1205,9 +885,6 @@ export function foldStatusRow(fold: ActiveFold, state: ActiveContextState, snaps
     sourceCount: allSourceIds.length,
     sourceIdsTruncated: sourceIds.length < allSourceIds.length,
     sourceSha256: fold.sourceSha256,
-    // A paged row without the brief is a chronological id and nothing else: the
-    // agent that paged the tree to find WHICH fold holds something got the one
-    // field that answers it withheld, while the tree detail carried it all along.
     brief: foldBrief(fold, state),
     sourceChars: fold.sourceChars,
     actions: {
@@ -1216,12 +893,11 @@ export function foldStatusRow(fold: ActiveFold, state: ActiveContextState, snaps
         : { action: "refold", id: fold.id },
       expand: { action: "expand", id: fold.id },
       refold: { action: "refold", id: fold.id },
-      protect: { action: "protect", ids: [fold.id] },
+      pin: { action: "pin", ids: [fold.id] },
     },
   };
 }
 
-/** Every fold, nested ones included, in transcript order with each parent before its children. */
 export function orderedFoldTree(state: ActiveContextState, snapshot: ActiveContextSnapshot): ActiveFold[] {
   const byId = foldMap(state);
   const ordered: ActiveFold[] = [];
@@ -1260,12 +936,6 @@ export function foldTreeDetail(
   }));
 }
 
-/**
- * One compact row per collapsed fold: what is behind it, where its span starts and
- * ends, and the brief that carries whatever key material the fold captured. This is
- * the answer to "which fold has X" that agents were paying 56-83k chars per peek to
- * reconstruct, and it costs a line.
- */
 export function foldIndexRow(
   fold: ActiveFold,
   state: ActiveContextState,
@@ -1294,7 +964,6 @@ export function foldIndexRow(
   };
 }
 
-/** Every mapped source id to the fold that now holds it, so a lookup never needs a read. */
 export function foldSourceMap(
   state: ActiveContextState,
   snapshot: ActiveContextSnapshot,
@@ -1304,7 +973,6 @@ export function foldSourceMap(
   for (const fold of orderedFoldTree(state, snapshot)) {
     for (const ref of flattenFoldRefs(fold, state)) entries.push([ref.entryId, fold.id]);
   }
-  // Deepest wins: the innermost fold is the one that actually holds the source.
   const byEntry = new Map(entries);
   const all = [...byEntry.entries()];
   return { entries: all.slice(0, limit), total: all.length, truncated: all.length > limit };
@@ -1315,8 +983,7 @@ export function activeContextStatus(
   state: ActiveContextState,
   offset = 0,
   limit = 40,
-  maximumChapterSourceRefs = Number.MAX_SAFE_INTEGER,
-  statusOptions: { diet?: boolean; suggestions?: number } = {},
+  statusOptions: { diet?: boolean; indexRows?: number } = {},
 ): Record<string, unknown> {
   const roots = orderedRoots(state, snapshot).map((item) => item.fold.id);
   const ordered = orderedFoldTree(state, snapshot);
@@ -1330,26 +997,22 @@ export function activeContextStatus(
     stale: !snapshot.protectedIndices.has(item.index),
     protected: snapshot.protectedIndices.has(item.index) || protectedKeys.has(objectRefKey(item.ref)),
     staleToolResult: item.ref.role === "toolResult" &&
-      !snapshot.toolProtectedIndices.has(item.index) && !protectedKeys.has(objectRefKey(item.ref)) &&
+      !snapshot.protectedIndices.has(item.index) && !protectedKeys.has(objectRefKey(item.ref)) &&
       resultCall(snapshot, item.index, true) !== null,
   }] : []);
   const selectedObjects = objects.slice(offset, offset + limit);
-  const eligibleChapter = selectAutomaticChapter(snapshot, state, maximumChapterSourceRefs);
+  const eligibleChapter = selectAutomaticChapter(snapshot, state);
   const eligibleSourceIds = eligibleChapter?.sourceRefs.map((ref) => ref.entryId) ?? [];
   const eligibleEndpoints = eligibleSourceIds.length
     ? [...new Set([eligibleSourceIds[0], eligibleSourceIds.at(-1)!])]
     : [];
-  // The index that used to ride every status call grew from 12.6k to 86.5k chars in
-  // one measured session, injected on every request that asked for state. On the diet
-  // the default payload carries counts, the source map and the folds worth acting on;
-  // the full tree and the object list move behind an explicit paged query.
   const index = statusOptions.diet
     ? visibleCollapsedFolds(state, snapshot)
       .map((fold) => foldIndexRow(fold, state, snapshot))
       .sort((left, right) =>
         Number(right.reclaimableBytes) - Number(left.reclaimableBytes) ||
         String(left.id).localeCompare(String(right.id)))
-      .slice(0, statusOptions.suggestions ?? STATUS_DIET_SUGGESTIONS)
+      .slice(0, statusOptions.indexRows ?? STATUS_DIET_INDEX_ROWS)
     : null;
   const sourceMap = statusOptions.diet ? foldSourceMap(state, snapshot) : null;
   return {
@@ -1391,30 +1054,17 @@ export function activeContextStatus(
       endId: eligibleSourceIds.at(-1),
       action: { action: "fold", ids: eligibleEndpoints, brief: "<factual brief, at most 1000 characters>" },
     } : null,
-    rawTailMinimumBytes: zoneBytes(snapshot.thresholds.freshTail, snapshot.budgetTokens),
     currentTurnRequiresBoundary: false,
     actions: {
       status: { action: "status", offset, limit },
       fold: { action: "fold", ids: ["<source-or-fold-id>"], brief: "<optional factual brief, at most 1000 characters>" },
-      protect: { action: "protect", ids: ["<source-or-fold-id>"] },
+      pin: { action: "pin", ids: ["<source-or-fold-id>"] },
     },
   };
 }
 
-/** Room reserved for the one-line continuation marker a truncated page carries. */
 const STATUS_CONTINUATION_RESERVE_BYTES = 400;
 
-/**
- * Enforce the hard status page cap on one fully assembled status payload.
- *
- * Measured 2026-08-07 (rep 19): one status answer serialized to 526KB, 6.2x the
- * remaining headroom, and aborted the request. The paging affordance existed;
- * nothing forced it. This function is the force: every listing in the payload is
- * truncated at a unit boundary (whole rows, never mid-unit) until the serialized
- * page fits, and a one-line continuation marker names the next offset. Trim order
- * spends the diagnostics first and the listing the caller asked for last, and the
- * requested listing always keeps at least one unit so paging always progresses.
- */
 export function boundStatusPayload(
   payload: Record<string, unknown>,
   detail: string | null,
@@ -1426,9 +1076,6 @@ export function boundStatusPayload(
   const target = cap - STATUS_CONTINUATION_RESERVE_BYTES;
   const fits = (): boolean => size() <= target;
   const omitted: string[] = [];
-  // keepEnd keeps the NEWEST units of a time-ordered ledger; a paged listing keeps
-  // its head so the continuation offset is the next unread unit. Binary search for
-  // the largest keep that fits; a stage that cannot fit alone trims to its floor.
   const shrink = (owner: unknown, key: string, label: string, keepEnd = false, minKeep = 0): number => {
     if (!isPlainRecord(owner) || fits()) return 0;
     const original = ownValue(owner, key);
@@ -1452,16 +1099,22 @@ export function boundStatusPayload(
   };
   const automatic = ownValue(payload, "automatic");
   const instrumentation = isPlainRecord(automatic) ? ownValue(automatic, "instrumentation") : undefined;
-  const surfacing = isPlainRecord(automatic) ? ownValue(automatic, "surfacing") : undefined;
+  const lastAction = isPlainRecord(automatic) ? ownValue(automatic, "lastAutomaticAction") : undefined;
+  const lastEpoch = isPlainRecord(lastAction) ? ownValue(lastAction, "epoch") : undefined;
   shrink(instrumentation, "projectionRecords", "projection record(s)", true);
   shrink(instrumentation, "cacheObservations", "cache observation(s)", true);
   shrink(instrumentation, "events", "context event(s)", true);
-  shrink(surfacing, "log", "surfacing log row(s)", true);
   if (shrink(payload, "sourceMap", "source map row(s)") > 0) payload.sourceMapTruncated = true;
   shrink(payload, "topFolds", "top fold row(s)");
+  // The last epoch's receipt lists grow with commit depth (a deep epoch applies dozens
+  // of marks). They are the commit's own receipt, so they outlast
+  // every other diagnostic, but they still page away before any listing row the
+  // caller actually asked for: on the detail pages, where none of the diagnostics
+  // above exist, they are the mass that made one fold row miss the cap.
+  const receiptRowsDropped =
+    shrink(lastEpoch, "applied", "applied receipt row(s)", true) +
+    shrink(lastEpoch, "absorbed", "absorbed receipt row(s)", true) > 0;
   const rowLabel = (key: string): string => key === "folds" ? "fold row(s)" : key === "objects" ? "object row(s)" : "tree row(s)";
-  // The listing the caller asked for goes last and never below one unit. Its
-  // machine-readable next offset moves back to the first unit the page dropped.
   let continueAt: number | null = null;
   if (detail === "folds" || detail === "objects") {
     const rideKey = detail === "folds" ? "objects" : "folds";
@@ -1478,9 +1131,17 @@ export function boundStatusPayload(
     else payload.nextOffset = continueAt;
   }
   if (!omitted.length) return payload;
-  const resume = continueAt === null
-    ? "the full lists stay reachable through the paged status details"
+  // A dropped receipt row has no page: the epoch receipt is a record of the last
+  // action, not a listing, and claiming it "stays reachable" pointed the agent at
+  // a page that does not exist (2026-08-14 external review). The span-to-fold
+  // mapping it summarizes stays complete in the folds and tree details, so the
+  // continuation says exactly that instead.
+  const pageable = continueAt === null
+    ? "the fold, object and tree lists stay reachable through the paged status details"
     : `continue at ${JSON.stringify({ action: "status", detail, offset: continueAt })}`;
+  const resume = receiptRowsDropped
+    ? `${pageable}; the epoch receipt keeps only its newest rows and the trimmed rows have no page`
+    : (continueAt === null ? "the full lists stay reachable through the paged status details" : pageable);
   payload.continuation =
     `Status pages are bounded to ${cap} bytes; omitted ${omitted.join(", ")}; ${resume}.`;
   return payload;
@@ -1495,9 +1156,7 @@ export function visibleCollapsedFolds(
   const visit = (fold: ActiveFold): void => {
     const refs = flattenFoldRefs(fold, state);
     if (!foldInterval(fold, state, snapshot)) return;
-    const protectedSource = fold.kind === "tool-result"
-      ? toolRefsProtected(refs, state, snapshot)
-      : refsProtected(refs, state, snapshot);
+    const protectedSource = refsProtected(refs, state, snapshot);
     if (!state.expanded.includes(fold.id) && !protectedSource) {
       output.push(fold);
       return;
@@ -1559,7 +1218,6 @@ export interface FoldSourceRequest {
   projectEntry?: (entry: Record<string, unknown>) => unknown[];
 }
 
-/** One exact message per ref identity and digest, read off the immutable session entries. */
 function exactSessionMessages(input: FoldSourceRequest): Map<string, unknown> {
   const projectEntry = input.projectEntry ?? sessionEntryMessages;
   const exact = new Map<string, unknown>();
@@ -1586,13 +1244,6 @@ function exactMessageFor(
   return clone(message);
 }
 
-/**
- * One fold's ENTIRE original source, at every depth.
- *
- * This is the rescue read: restoration and the recovery audit both need the bytes as the
- * session first wrote them, with nothing standing in for anything. Retrieval inside a
- * session is the other function, and it serves one level.
- */
 export function recoverFoldMessages(input: FoldSourceRequest): unknown[] {
   const fold = input.state.folds.find((item) => item.id === input.foldId);
   if (!fold) throw new Error(`Unknown active-context fold ${input.foldId}`);
@@ -1600,7 +1251,6 @@ export function recoverFoldMessages(input: FoldSourceRequest): unknown[] {
   return flattenFoldRefs(fold, input.state).map((ref) => exactMessageFor(exact, ref, input.sessionId));
 }
 
-/** A child fold as its parent's stored span holds it: the placeholder, not the bytes under it. */
 export function storedChildPlaceholder(child: ActiveFold, state: ActiveContextState): Record<string, unknown> {
   return {
     placeholder: "fold",
@@ -1614,18 +1264,6 @@ export function storedChildPlaceholder(child: ActiveFold, state: ActiveContextSt
   };
 }
 
-/**
- * One fold's stored span, AS STORED: one level.
- *
- * A fold's span is what it took in, and what it took in was already whatever the window
- * held: raw entries, and placeholders for folds that were there first. So the honest read
- * of a parent is that same span, children still placeheld. Reading it as the original
- * bytes at every depth would hand back a whole session's transcript for one call and
- * undo the nesting the fold performed.
- *
- * The verbatim floor is untouched by this. A leaf's stored span IS its original bytes, so
- * the bytes are always exactly one peek away from any id the read hands back.
- */
 export function foldStoredSpan(input: FoldSourceRequest): unknown[] {
   const fold = input.state.folds.find((item) => item.id === input.foldId);
   if (!fold) throw new Error(`Unknown active-context fold ${input.foldId}`);
@@ -1639,21 +1277,12 @@ export function foldStoredSpan(input: FoldSourceRequest): unknown[] {
   });
 }
 
-/**
- * Ephemeral point read of one fold's stored span. It returns the same SHA-256-verified
- * span expansion restores, ONE level: raw entries verbatim, child folds still placeheld.
- * It is bounded for one model call and changes no projection: the fold stays collapsed and
- * the durable state is untouched. Any id in the result peeks in one hop, so the verbatim
- * floor is a hop away at every depth rather than a payload nobody asked for.
- */
 export function peekFoldSource(input: {
   foldId: string;
   state: ActiveContextState;
   entries: Array<Record<string, unknown>>;
   sessionId: string;
-  /** Explicit widening. Absent, a peek returns the bounded index view. */
   maximumBytes?: number;
-  /** Byte offset into the exact stored source; the narrowing half of admission control. */
   offset?: number;
   toolName?: string;
   projectEntry?: (entry: Record<string, unknown>) => unknown[];
@@ -1672,9 +1301,6 @@ export function peekFoldSource(input: {
   const offset = Math.min(Math.max(0, input.offset ?? 0), sourceBytes);
   const budget = input.maximumBytes ?? PEEK_DEFAULT_MAX_BYTES;
   const window = offset > 0 ? utf8Slice(source, offset) : source;
-  // Offset zero is the INDEX read and takes head AND tail, because chain keys and
-  // conclusions live at the end of a source and a head-only slice silently omits
-  // exactly that region. An explicit offset is paging and stays contiguous.
   const view = offset > 0
     ? { text: boundedUtf8(window, budget), omittedBytes: 0, contiguous: true }
     : boundedHeadTail(window, budget);
@@ -1685,8 +1311,6 @@ export function peekFoldSource(input: {
     : null;
   const truncated = view.omittedBytes > 0 || nextOffset !== null;
   const children = childFoldIds(fold);
-  // The index view: every nested fold's brief in FULL. A brief is the navigable unit,
-  // so truncating it is the one economy that costs the read its purpose.
   const index = descendantIndexRows(fold, input.state);
   return {
     version: 1,
@@ -1706,15 +1330,13 @@ export function peekFoldSource(input: {
     truncated,
     view: offset > 0 ? "slice" : (view.omittedBytes > 0 ? "index" : "complete"),
     ...(index.length ? { index } : {}),
-    // Narrower and WIDER reads that are always constructible, so a refusal or a
-    // truncation can name one.
     children,
     narrower: {
       ...(nextOffset === null ? {} : { slice: { action: "peek", id: fold.id, offset: nextOffset, bytes: returnedBytes } }),
       ...(children.length ? { child: { action: "peek", id: children[0] } } : {}),
     },
     ...(truncated
-      ? { wider: { action: "peek", id: fold.id, bytes: Math.min(sourceBytes, ACTIVE_CONTEXT_POLICY.maxChapterChars) } }
+      ? { wider: { action: "peek", id: fold.id, bytes: Math.min(sourceBytes, ACTIVE_CONTEXT_POLICY.maxSourceChars) } }
       : {}),
     lifetime: "these bytes stay in the window exactly as returned, like any other tool result, and " +
       `nothing rewrites this result in place. It is a COPY of fold ${fold.id}'s stored source, so the ` +
@@ -1728,17 +1350,13 @@ export function peekFoldSource(input: {
           "placeheld. Peek a child id to read its own span; the fold stayed collapsed and no projection changed."
         : "Complete exact source; the fold stayed collapsed and no projection changed.",
     source: returned,
-    // Serialized AFTER the source on purpose: a reader that just consumed a bounded slice
-    // decides its next action at the end of the payload, and a notice buried before ten
-    // thousand source bytes is a notice unread (measured: a run concluded a staged chain
-    // was finished because the chain key lived in the unshown tail of a truncated peek).
     ...(truncated
       ? {
         truncationReminder: `STOP: ${view.omittedBytes || sourceBytes - returnedBytes} of ${sourceBytes} ` +
           "bytes were NOT shown" +
           (view.omittedBytes ? " (the middle; the head and tail are both above)" : " (everything after this slice)") +
           `. Widen with {"action":"peek","id":"${fold.id}","bytes":${
-            Math.min(sourceBytes, ACTIVE_CONTEXT_POLICY.maxChapterChars)}}` +
+            Math.min(sourceBytes, ACTIVE_CONTEXT_POLICY.maxSourceChars)}}` +
           (nextOffset === null ? "" : ` or read on with {"action":"peek","id":"${fold.id}","offset":${nextOffset}}`) +
           ".",
       }
@@ -1746,16 +1364,10 @@ export function peekFoldSource(input: {
   };
 }
 
-/** The marker a head+tail view puts where the omitted middle was. */
 export function headTailMarker(omittedBytes: number): string {
   return omittedBytes > 0 ? `\n... [${omittedBytes} exact source bytes omitted] ...\n` : "";
 }
 
-/**
- * A bounded view that keeps the head AND the tail. A head-only bound drops exactly the
- * region a staged chain keeps its key in; the omitted size is stated where the reading
- * ends so "there is more" is never an inference.
- */
 export function boundedHeadTail(
   source: string,
   budget: number,
@@ -1776,7 +1388,6 @@ export function boundedHeadTail(
   };
 }
 
-/** Every descendant fold, in transcript order, with its brief in full. */
 export function descendantIndexRows(
   fold: ActiveFold,
   state: ActiveContextState,