pi-fold 1.0.4 → 3.0.0

package/extensions/lib/persistence.ts

@@ -20,13 +20,8 @@ import {
   ACTIVE_CONTEXT_POLICY,
   ACTIVE_CONTEXT_STATE_ENTRY,
   EXPAND_LEASE_GENERATIONS,
-  MAX_ADVISORY_DELIVERIES_PER_MILESTONE,
   MAX_EXPAND_LEASES,
-  MAX_LAST_CALL_TEXT_BYTES,
   MAX_PENDING_MARKS,
-  MAX_THRESHOLD_NOTICE_TEXT_BYTES,
-  MAX_THRESHOLD_NOTICES,
-  SURFACING_MAX_LEDGER_RECORDS,
 } from "./policy.ts";
 import type {
   ActiveContextCheckpointV2,
@@ -44,7 +39,6 @@ import type {
   MarkOrigin,
   PendingMark,
   PreparedFold,
-  SurfacingRecord,
 } from "./policy.ts";
 
 export const ACTIVE_FOLD_KEYS = [
@@ -58,13 +52,11 @@ export const PREPARED_FOLD_KEYS = [
 export const ACTIVE_STATE_KEYS = ["version", "sessionId", "revision", "folds", "expanded", "protected"] as const;
 export const FOLD_RECORD_REF_KEYS = ["id", "sha256"] as const;
 export const FOLD_RECORD_ENTRY_KEYS = ["version", "sessionId", "foldId", "recordSha256", "fold"] as const;
-export const SURFACING_RECORD_KEYS = ["id", "surfaced", "taken", "ordinal", "outcome"] as const;
-export const SURFACING_OUTCOMES = Object.freeze(["shown", "acted", "used", "ignored"] as const);
 export const PENDING_FOLD_MARK_KEYS = [
   "mark", "id", "kind", "parts", "brief", "briefProvenance", "origin", "ordinal",
 ] as const;
 export const PENDING_REFOLD_MARK_KEYS = ["mark", "id", "origin", "ordinal"] as const;
-export const MARK_ORIGINS = Object.freeze(["agent", "ladder"] as const);
+export const MARK_ORIGINS = Object.freeze(["agent", "ladder", "user"] as const);
 export const STATE_CHECKPOINT_V2_KEYS = [
   "version", "kind", "sessionId", "revision", "foldRefs", "expanded", "protected", "prepared", "stateSha256",
 ] as const;
@@ -83,28 +75,6 @@ export function validTokensSinceToolFold(value: unknown): value is number {
   return Number.isSafeInteger(value) && Number(value) >= 0;
 }
 
-export function validSurfacingRecord(value: unknown): value is SurfacingRecord {
-  if (!exactRecord(value, SURFACING_RECORD_KEYS)) return false;
-  const surfaced = ownValue(value, "surfaced");
-  const taken = ownValue(value, "taken");
-  return typeof ownValue(value, "id") === "string" && Boolean(ownValue(value, "id")) &&
-    Number.isSafeInteger(surfaced) && Number(surfaced) > 0 &&
-    Number.isSafeInteger(taken) && Number(taken) >= 0 && Number(taken) <= Number(surfaced) &&
-    Number.isSafeInteger(ownValue(value, "ordinal")) && Number(ownValue(value, "ordinal")) >= 0 &&
-    SURFACING_OUTCOMES.includes(ownValue(value, "outcome") as SurfacingRecord["outcome"]);
-}
-
-/** One record per fold: a duplicate id is a ledger that forgot an ignore. */
-export function parseSurfacingLog(value: unknown): SurfacingRecord[] {
-  const records = denseOwnArrayValues(value);
-  if (!records || records.length > SURFACING_MAX_LEDGER_RECORDS || !records.every(validSurfacingRecord) ||
-      new Set(records.map((record) => (record as SurfacingRecord).id)).size !== records.length) {
-    throw new Error("Invalid active-context surfacing ledger");
-  }
-  return clone(records) as SurfacingRecord[];
-}
-
-/** Stable identity of one pending mark: its phase plus the fold it names. */
 export function pendingMarkKey(mark: Pick<PendingMark, "mark" | "id">): string {
   return `${mark.mark}:${mark.id}`;
 }
@@ -121,23 +91,11 @@ export function validPendingMark(value: unknown): value is PendingMark {
   const kind = ownValue(value, "kind");
   const parts = denseOwnArrayValues(ownValue(value, "parts"));
   return (kind === "tool-result" || kind === "chapter" || kind === "consolidation") &&
-    Boolean(parts?.length) && parts!.length <= ACTIVE_CONTEXT_POLICY.maxFoldSourceRefs &&
-    parts!.every(validFoldPart) && structurallyValidBrief(ownValue(value, "brief")) &&
+    Boolean(parts?.length) && parts!.every(validFoldPart) && structurallyValidBrief(ownValue(value, "brief")) &&
     validProvenance(ownValue(value, "briefProvenance")) &&
     id === foldIdFor(kind as FoldKind, parts as FoldPart[]);
 }
 
-/**
- * Agent-corrected fold briefs, keyed by fold id. Bounded by the same brief cap a
- * supplied brief obeys, and refused for a fold that is not in the forest, exactly
- * like a pin or a refold mark naming a missing fold.
- */
-/**
- * A model brief written after the fold committed carries its generator with it, so an
- * override is either the bare corrected string the agent wrote or that string beside the
- * attribution. Two shapes, one map: the string form is what every state written before
- * the upgrade lane existed holds, and it must keep parsing and keep its exact digest.
- */
 export function briefOverrideText(override: unknown): string | null {
   if (typeof override === "string") return override;
   const brief = ownValue(override, "brief");
@@ -169,7 +127,6 @@ export function parseBriefOverrides(
   ) as Record<string, BriefOverride>;
 }
 
-/** The brief a fold PRESENTS: the agent's correction when it made one, else the record's. */
 export function foldBrief(
   fold: Pick<ActiveFold, "id" | "brief">,
   state: Pick<ActiveContextState, "briefs">,
@@ -177,11 +134,6 @@ export function foldBrief(
   return briefOverrideText(state.briefs?.[fold.id]) ?? fold.brief;
 }
 
-/**
- * The provenance a fold PRESENTS. A fold RECORD is immutable, so a brief written after
- * the commit lives in the override map and its attribution travels with it; without this
- * lens a model-written upgrade would report the provenance of the brief it replaced.
- */
 export function foldProvenance(
   fold: Pick<ActiveFold, "id" | "provenance">,
   state: Pick<ActiveContextState, "briefs">,
@@ -218,7 +170,6 @@ export function validProvenance(value: unknown): value is BriefProvenance {
       (ownValue(value, "kind") === "supplied" || ownValue(value, "kind") === "deterministic")) return true;
   const hasDigest = Boolean(value && typeof value === "object" &&
     Object.prototype.hasOwnProperty.call(value, "launchContractDigest"));
-  // legacy provenance kind written by pre-release sessions; normalized to the model kind at presentation
   if (!exactRecord(value, ["kind", "provider", "model", "effort", ...(hasDigest ? ["launchContractDigest"] : [])]) ||
       (ownValue(value, "kind") !== "model" && ownValue(value, "kind") !== "luna") ||
       typeof ownValue(value, "provider") !== "string" || !ownValue(value, "provider") ||
@@ -258,7 +209,6 @@ export function validFoldShape(value: unknown): value is ActiveFold {
   return (kind === "tool-result" || kind === "chapter" || kind === "consolidation") &&
     typeof ownValue(value, "id") === "string" && Boolean(ownValue(value, "id")) &&
     (parentId === null || typeof parentId === "string") && Boolean(parts?.length) &&
-    parts!.length <= ACTIVE_CONTEXT_POLICY.maxFoldSourceRefs &&
     parts!.every(validFoldPart) && structurallyValidBrief(ownValue(value, "brief")) &&
     validProvenance(ownValue(value, "provenance")) && typeof sourceSha256 === "string" &&
     /^[a-f0-9]{64}$/.test(sourceSha256) && Number.isSafeInteger(ownValue(value, "sourceChars")) &&
@@ -281,11 +231,6 @@ export function foldMap(state: Pick<ActiveContextState, "folds">): Map<string, A
   return new Map(state.folds.map((fold) => [fold.id, fold]));
 }
 
-/**
- * The folds a span names as children. Read off the parts alone, so a PENDING fold mark
- * answers it too: a mark carries the id its committed fold will get, so the ids here are
- * exactly the folds that must already exist when this span applies.
- */
 export function childFoldIds(fold: Pick<ActiveFold, "parts">): string[] {
   return fold.parts.filter((part): part is Extract<FoldPart, { kind: "fold" }> => part.kind === "fold")
     .map((part) => part.foldId);
@@ -309,20 +254,6 @@ export function flattenFoldRefs(fold: ActiveFold, state: Pick<ActiveContextState
   return visit(fold);
 }
 
-/**
- * Which fold DIRECTLY owns each raw evidence key.
- *
- * One derivation, two readers (Shane 2026-08-11). The forest invariant below reads it to
- * reject a second owner, and the agent-facing candidate builder reads it BEFORE it builds
- * anything, so a span naming evidence some fold already holds comes back as a refusal
- * that names the owner instead of this invariant escaping the tool call as an exception.
- *
- * The two readings stay distinguishable because the input differs. Called on the folds
- * already in state it can only throw when the stored forest is itself corrupt, which no
- * agent input can produce: every state reaches storage through `validateFoldForest`.
- * Called on a forest that includes a candidate the caller just built, a duplicate means
- * the REQUEST collided with an existing fold, and that is the refusal case.
- */
 export function directFoldOwners(folds: readonly ActiveFold[]): Map<string, string> {
   const owner = new Map<string, string>();
   for (const fold of folds) {
@@ -351,18 +282,6 @@ export function validateFoldForest(folds: ActiveFold[]): ActiveFold[] {
         (!fold.parts.length || fold.parts.some((part) => part.kind !== "raw" || part.ref.role !== "toolResult"))) {
       throw new Error("Tool-result fold must own one validated assistant batch of tool results");
     }
-    // WHAT A PARENT IS, RE-DERIVED UNDER THE COUNT LAW (Shane 2026-08-10).
-    //
-    // Two shape rules stood here and both described the old approximation. "Only child
-    // folds" forbade the raw gaps between children, and a parent's span runs from its
-    // first child to its last one, so the gap material inside it is the parent's or the
-    // span is not a span. "Only chapter or consolidation children" forbade tool-result
-    // children, which was true while a bare tool batch nested through a chapter span;
-    // automatic chapters no longer take placeholders at any count, so that rule would
-    // now leave every tool fold as an obstacle no parent could ever reclaim.
-    //
-    // What survives is the one thing that makes a consolidation a consolidation: it
-    // groups folds. A parent with no child fold is a chapter wearing the wrong name.
     if (fold.kind === "consolidation" && !fold.parts.some((part) => part.kind === "fold")) {
       throw new Error("Consolidation folds must contain at least one child fold");
     }
@@ -401,29 +320,22 @@ export function parseActiveContextState(
   const hasTokensSinceToolFold = recordLike &&
     Object.prototype.hasOwnProperty.call(value, "tokensSinceToolFold");
   const hasLeases = recordLike && Object.prototype.hasOwnProperty.call(value, "leases");
-  const hasSurfacing = recordLike && Object.prototype.hasOwnProperty.call(value, "surfacing");
   const hasPendingMarks = recordLike && Object.prototype.hasOwnProperty.call(value, "pendingMarks");
-  // Accepted, never read, never written. `pinnedPeeks` pinned a peek result against
-  // per-projection reclamation, which was deleted after rep 22 measured it rewriting
-  // the prefix mid-window. State written before that cut still carries the key, and
-  // rejecting it here would suspend automatic management on upgrade.
   const hasPinnedPeeks = recordLike && Object.prototype.hasOwnProperty.call(value, "pinnedPeeks");
   const hasBriefs = recordLike && Object.prototype.hasOwnProperty.call(value, "briefs");
-  const hasRider = recordLike && Object.prototype.hasOwnProperty.call(value, "rider");
-  const hasLastCall = recordLike && Object.prototype.hasOwnProperty.call(value, "lastCall");
-  const hasNotices = recordLike && Object.prototype.hasOwnProperty.call(value, "notices");
+  // Read and dropped, never stored: see legacyRiderStateSha256. A v1 state has no digest
+  // to reproduce, so here the tolerance is the whole of it.
+  const hasLegacyRider = recordLike && Object.prototype.hasOwnProperty.call(value, "rider");
+  refuseRetiredStateFields(value);
   const extraKeys = [
     ...(hasPrepared ? ["prepared"] : []),
     ...(hasAdvisory ? ["advisory"] : []),
     ...(hasTokensSinceToolFold ? ["tokensSinceToolFold"] : []),
     ...(hasLeases ? ["leases"] : []),
-    ...(hasSurfacing ? ["surfacing"] : []),
     ...(hasPendingMarks ? ["pendingMarks"] : []),
     ...(hasPinnedPeeks ? ["pinnedPeeks"] : []),
     ...(hasBriefs ? ["briefs"] : []),
-    ...(hasRider ? ["rider"] : []),
-    ...(hasLastCall ? ["lastCall"] : []),
-    ...(hasNotices ? ["notices"] : []),
+    ...(hasLegacyRider ? ["rider"] : []),
   ];
   if (!exactRecord(value, [...ACTIVE_STATE_KEYS, ...extraKeys])) throw new Error("Invalid active-context state keys");
   const folds = denseOwnArrayValues(ownValue(value, "folds"));
@@ -445,29 +357,16 @@ export function parseActiveContextState(
   if (hasAdvisory && !validAdvisoryState(ownValue(value, "advisory"))) {
     throw new Error("Invalid active-context advisory state");
   }
-  if (hasRider && !validRiderState(ownValue(value, "rider"))) {
-    throw new Error("Invalid active-context rider state");
-  }
-  if (hasLastCall && !validLastCallState(ownValue(value, "lastCall"))) {
-    throw new Error("Invalid active-context last-call state");
-  }
-  if (hasNotices && !validNoticesState(ownValue(value, "notices"))) {
-    throw new Error("Invalid active-context notices state");
-  }
   if (hasTokensSinceToolFold && !validTokensSinceToolFold(ownValue(value, "tokensSinceToolFold"))) {
     throw new Error("Invalid active-context tool-fold cadence");
   }
   const leases = hasLeases ? parseLeases(ownValue(value, "leases"), ids) : {};
-  const surfacing = hasSurfacing ? parseSurfacingLog(ownValue(value, "surfacing")) : [];
   const marks = hasPendingMarks ? parsePendingMarks(ownValue(value, "pendingMarks")) : [];
   if (marks.some((mark) => mark.mark === "refold" && !ids.has(mark.id))) {
     throw new Error("Invalid active-context pending marks");
   }
   const briefs = hasBriefs ? parseBriefOverrides(ownValue(value, "briefs"), ids) : {};
   const source = clone(value) as unknown as ActiveContextState;
-  // Provenance normalization is presentation-only; never mutate a durable
-  // content-addressed fold record: changing its bytes causes the next re-persist
-  // to report a conflicting durable fold and suspend automatic management.
   return {
     version: 1,
     sessionId: source.sessionId,
@@ -479,17 +378,11 @@ export function parseActiveContextState(
       ? Number(ownValue(value, "tokensSinceToolFold"))
       : 0,
     leases,
-    // Omitted when empty so every state written before surfacing existed keeps its
-    // exact digest; the replay digest is order- and presence-sensitive by design.
-    ...(surfacing.length ? { surfacing } : {}),
     ...(marks.length ? { pendingMarks: marks } : {}),
     ...(Object.keys(briefs).length ? { briefs } : {}),
     ...(hasAdvisory
       ? { advisory: clone(source.advisory!) }
       : defaultAdvisory ? { advisory: { highWater: 0, delivered: {} } } : {}),
-    ...(hasRider ? { rider: clone(source.rider!) } : {}),
-    ...(hasLastCall ? { lastCall: clone(source.lastCall!) } : {}),
-    ...(hasNotices ? { notices: clone(source.notices!) } : {}),
     ...(hasPrepared ? { prepared: clone(source.prepared!) } : {}),
   };
 }
@@ -544,6 +437,29 @@ export function legacyCadenceOmittedStateSha256(state: ActiveContextState): stri
   return sha256Value(legacy);
 }
 
+/**
+ * THE DIGEST A RIDER-ERA BUILD WROTE, reproduced without the subsystem.
+ *
+ * `semanticStateSha256` hashes the materialized state object, and `stableStringify` walks
+ * own keys in INSERTION order, so a field that is gone changes the digest even though it
+ * changed nothing else. The rider sat immediately before `prepared` in the materialized
+ * literal, and last when there was no prepared, so that is where it goes back for the one
+ * moment it is needed. It joins the two legacy derivations already here, which exist for
+ * exactly this reason: a state stays verifiable across the build that stopped writing it.
+ *
+ * Consulted ONLY when the wire actually carried a rider, so a current state whose digest
+ * has genuinely drifted still fails rather than finding a second way to pass.
+ */
+export function legacyRiderStateSha256(state: ActiveContextState, rider: unknown): string {
+  const legacy: Record<string, unknown> = {};
+  for (const [key, value] of Object.entries(state)) {
+    if (key === "prepared") legacy.rider = rider;
+    legacy[key] = value;
+  }
+  if (!Object.prototype.hasOwnProperty.call(legacy, "rider")) legacy.rider = rider;
+  return sha256Value(legacy);
+}
+
 export function legacyReplayOrderStateSha256(state: ActiveContextState): string {
   return sha256Value({
     version: state.version,
@@ -562,7 +478,6 @@ export function sameStateProjection(left: ActiveContextState, right: ActiveConte
     const normalizedState = { ...clone(value), revision: 0 } as Partial<ActiveContextState>;
     if (normalizedState.tokensSinceToolFold === 0) delete normalizedState.tokensSinceToolFold;
     if (normalizedState.leases && Object.keys(normalizedState.leases).length === 0) delete normalizedState.leases;
-    if (normalizedState.surfacing && normalizedState.surfacing.length === 0) delete normalizedState.surfacing;
     if (normalizedState.pendingMarks && normalizedState.pendingMarks.length === 0) delete normalizedState.pendingMarks;
     if (normalizedState.briefs && !Object.keys(normalizedState.briefs).length) delete normalizedState.briefs;
     return normalizedState;
@@ -605,23 +520,15 @@ export function validateV2ProjectionFields(
   advisoryValue: unknown,
   tokensSinceToolFoldValue: unknown,
   leasesValue: unknown,
-  surfacingValue?: unknown,
   pendingMarksValue?: unknown,
   briefsValue?: unknown,
-  riderValue?: unknown,
-  lastCallValue?: unknown,
-  noticesValue?: unknown,
 ): {
   expanded: string[];
   protected: EvidenceRef[];
   prepared?: PreparedFold;
   advisory?: NonNullable<ActiveContextState["advisory"]>;
-  rider?: NonNullable<ActiveContextState["rider"]>;
-  lastCall?: NonNullable<ActiveContextState["lastCall"]>;
-  notices?: NonNullable<ActiveContextState["notices"]>;
   tokensSinceToolFold: number;
   leases: Record<string, number>;
-  surfacing: SurfacingRecord[];
   pendingMarks: PendingMark[];
   briefs: Record<string, string>;
 } {
@@ -637,20 +544,10 @@ export function validateV2ProjectionFields(
   if (advisoryValue !== undefined && !validAdvisoryState(advisoryValue)) {
     throw new Error("Invalid active-context v2 advisory state");
   }
-  if (riderValue !== undefined && !validRiderState(riderValue)) {
-    throw new Error("Invalid active-context v2 rider state");
-  }
-  if (lastCallValue !== undefined && !validLastCallState(lastCallValue)) {
-    throw new Error("Invalid active-context v2 last-call state");
-  }
-  if (noticesValue !== undefined && !validNoticesState(noticesValue)) {
-    throw new Error("Invalid active-context v2 notices state");
-  }
   if (tokensSinceToolFoldValue !== undefined && !validTokensSinceToolFold(tokensSinceToolFoldValue)) {
     throw new Error("Invalid active-context v2 tool-fold cadence");
   }
   const leases = leasesValue === undefined ? {} : parseLeases(leasesValue);
-  const surfacing = surfacingValue === undefined ? [] : parseSurfacingLog(surfacingValue);
   const pendingMarks = pendingMarksValue === undefined ? [] : parsePendingMarks(pendingMarksValue);
   const briefs = briefsValue === undefined ? {} : parseBriefOverrides(briefsValue);
   return {
@@ -660,18 +557,8 @@ export function validateV2ProjectionFields(
     ...(advisoryValue === undefined ? {} : {
       advisory: clone(advisoryValue) as NonNullable<ActiveContextState["advisory"]>,
     }),
-    ...(riderValue === undefined ? {} : {
-      rider: clone(riderValue) as NonNullable<ActiveContextState["rider"]>,
-    }),
-    ...(lastCallValue === undefined ? {} : {
-      lastCall: clone(lastCallValue) as NonNullable<ActiveContextState["lastCall"]>,
-    }),
-    ...(noticesValue === undefined ? {} : {
-      notices: clone(noticesValue) as NonNullable<ActiveContextState["notices"]>,
-    }),
     tokensSinceToolFold: tokensSinceToolFoldValue === undefined ? 0 : Number(tokensSinceToolFoldValue),
     leases,
-    surfacing,
     pendingMarks,
     briefs,
   };
@@ -685,35 +572,37 @@ export function parseActiveContextStateV2(value: unknown, sessionId: string): Ac
     Object.prototype.hasOwnProperty.call(value, "tokensSinceToolFold"));
   const hasLeases = Boolean(value && typeof value === "object" &&
     Object.prototype.hasOwnProperty.call(value, "leases"));
-  const hasSurfacing = Boolean(value && typeof value === "object" &&
-    Object.prototype.hasOwnProperty.call(value, "surfacing"));
   const hasPendingMarks = Boolean(value && typeof value === "object" &&
     Object.prototype.hasOwnProperty.call(value, "pendingMarks"));
-  // Accepted, never read, never written. `pinnedPeeks` pinned a peek result against
-  // per-projection reclamation, which was deleted after rep 22 measured it rewriting
-  // the prefix mid-window. State written before that cut still carries the key, and
-  // rejecting it here would suspend automatic management on upgrade.
+  const hasAddPendingMarks = Boolean(value && typeof value === "object" &&
+    Object.prototype.hasOwnProperty.call(value, "addPendingMarks"));
+  const hasPendingMarkOrder = Boolean(value && typeof value === "object" &&
+    Object.prototype.hasOwnProperty.call(value, "pendingMarkOrder"));
   const hasPinnedPeeks = Boolean(value && typeof value === "object" &&
     Object.prototype.hasOwnProperty.call(value, "pinnedPeeks"));
   const hasBriefs = Boolean(value && typeof value === "object" &&
     Object.prototype.hasOwnProperty.call(value, "briefs"));
-  const hasRider = Boolean(value && typeof value === "object" &&
+  const hasAddBriefs = Boolean(value && typeof value === "object" &&
+    Object.prototype.hasOwnProperty.call(value, "addBriefs"));
+  const hasRemoveBriefIds = Boolean(value && typeof value === "object" &&
+    Object.prototype.hasOwnProperty.call(value, "removeBriefIds"));
+  const hasLegacyRider = Boolean(value && typeof value === "object" &&
     Object.prototype.hasOwnProperty.call(value, "rider"));
-  const hasLastCall = Boolean(value && typeof value === "object" &&
-    Object.prototype.hasOwnProperty.call(value, "lastCall"));
-  const hasNotices = Boolean(value && typeof value === "object" &&
-    Object.prototype.hasOwnProperty.call(value, "notices"));
+  refuseRetiredStateFields(value);
   const optionalKeys = [
     ...(hasAdvisory ? ["advisory"] : []),
     ...(hasTokensSinceToolFold ? ["tokensSinceToolFold"] : []),
     ...(hasLeases ? ["leases"] : []),
-    ...(hasSurfacing ? ["surfacing"] : []),
     ...(hasPendingMarks ? ["pendingMarks"] : []),
+    ...(hasAddPendingMarks ? ["addPendingMarks"] : []),
+    ...(hasPendingMarkOrder ? ["pendingMarkOrder"] : []),
     ...(hasPinnedPeeks ? ["pinnedPeeks"] : []),
     ...(hasBriefs ? ["briefs"] : []),
-    ...(hasRider ? ["rider"] : []),
-    ...(hasLastCall ? ["lastCall"] : []),
-    ...(hasNotices ? ["notices"] : []),
+    ...(hasAddBriefs ? ["addBriefs"] : []),
+    ...(hasRemoveBriefIds ? ["removeBriefIds"] : []),
+    // Carried no further than the digest check in `materializeStatePersistence`, which is
+    // the only thing on a load that the rider's absence can change.
+    ...(hasLegacyRider ? ["rider"] : []),
   ];
   const checkpoint = kind === "checkpoint" &&
     exactRecord(value, [...STATE_CHECKPOINT_V2_KEYS, ...optionalKeys]);
@@ -728,8 +617,7 @@ export function parseActiveContextStateV2(value: unknown, sessionId: string): Ac
   validateV2ProjectionFields(
     ownValue(value, "expanded"), ownValue(value, "protected"), ownValue(value, "prepared"),
     ownValue(value, "advisory"), ownValue(value, "tokensSinceToolFold"), ownValue(value, "leases"),
-    ownValue(value, "surfacing"), ownValue(value, "pendingMarks"), ownValue(value, "briefs"),
-    ownValue(value, "rider"), ownValue(value, "lastCall"), ownValue(value, "notices"),
+    ownValue(value, "pendingMarks"), ownValue(value, "briefs"),
   );
   if (checkpoint) {
     const refs = denseOwnArrayValues(ownValue(value, "foldRefs"));
@@ -754,6 +642,36 @@ export function parseActiveContextStateV2(value: unknown, sessionId: string): Ac
     if (new Set(parsed.map((ref) => ref.id)).size !== parsed.length || new Set(removeIds).size !== removeIds.length) {
       throw new Error("Duplicate active-context delta change");
     }
+    if (hasAddBriefs) parseBriefOverrides(ownValue(value, "addBriefs"));
+    if (hasRemoveBriefIds) {
+      const removeBriefs = denseOwnArrayValues(ownValue(value, "removeBriefIds"));
+      if (!removeBriefs || removeBriefs.length > MAX_ACTIVE_FOLD_RECORDS ||
+          removeBriefs.some((id) => typeof id !== "string" || !id) ||
+          new Set(removeBriefs).size !== removeBriefs.length) {
+        throw new Error("Invalid active-context delta brief removals");
+      }
+    }
+    if (hasBriefs && (hasAddBriefs || hasRemoveBriefIds)) {
+      throw new Error("Active-context delta states the whole brief map and a change to it");
+    }
+    if (hasAddPendingMarks) parsePendingMarks(ownValue(value, "addPendingMarks"));
+    if (hasPendingMarkOrder) {
+      const order = denseOwnArrayValues(ownValue(value, "pendingMarkOrder"));
+      if (!order || order.length > MAX_PENDING_MARKS ||
+          order.some((key) => typeof key !== "string" || !key) ||
+          new Set(order).size !== order.length) {
+        throw new Error("Invalid active-context delta pending mark order");
+      }
+    }
+    // The order is what the replay is BUILT from, so additions without it name marks
+    // nothing will place. Refused rather than absorbed, because absorbing it would drop
+    // the marks silently and a dropped mark is evidence that never gets folded.
+    if (hasAddPendingMarks && !hasPendingMarkOrder) {
+      throw new Error("Active-context delta adds pending marks and states no order for them");
+    }
+    if (hasPendingMarks && (hasAddPendingMarks || hasPendingMarkOrder)) {
+      throw new Error("Active-context delta states the whole mark array and a change to it");
+    }
   }
   const parsed = clone(value) as unknown as ActiveContextStateWireV2;
   if (bytes(parsed) > MAX_ACTIVE_STATE_EVENT_BYTES) throw new Error("Active-context state event exceeds wire limit");
@@ -794,8 +712,7 @@ export function stateFromFoldRefs(
   wire: Pick<
     ActiveContextCheckpointV2,
     "sessionId" | "revision" | "expanded" | "protected" | "prepared" | "advisory" |
-      "tokensSinceToolFold" | "leases" | "surfacing" | "pendingMarks" | "briefs" | "rider" |
-      "lastCall" | "notices"
+      "tokensSinceToolFold" | "leases" | "pendingMarks" | "briefs"
   >,
   refs: FoldRecordRef[],
   records: Map<string, FoldRecordEntry>,
@@ -815,24 +732,37 @@ export function stateFromFoldRefs(
     protected: clone(wire.protected),
     tokensSinceToolFold: wire.tokensSinceToolFold ?? 0,
     leases: clone(wire.leases ?? {}),
-    ...(wire.surfacing?.length ? { surfacing: clone(wire.surfacing) } : {}),
     ...(wire.pendingMarks?.length ? { pendingMarks: clone(wire.pendingMarks) } : {}),
     ...(wire.briefs && Object.keys(wire.briefs).length ? { briefs: clone(wire.briefs) } : {}),
     ...(wire.advisory === undefined ? {} : { advisory: clone(wire.advisory) }),
-    ...(wire.rider === undefined ? {} : { rider: clone(wire.rider) }),
-    ...(wire.lastCall === undefined ? {} : { lastCall: clone(wire.lastCall) }),
-    ...(wire.notices === undefined ? {} : { notices: clone(wire.notices) }),
     ...(wire.prepared === null || wire.prepared === undefined ? {} : { prepared: clone(wire.prepared) }),
   };
   return parseActiveContextState(state, wire.sessionId, false);
 }
 
+export interface ProjectionFingerprint {
+  topologySha256: string;
+  protectionSha256: string;
+}
+
+/**
+ * A REVISION'S FINGERPRINTS, COMPUTED WHEN ONE IS ASKED FOR.
+ *
+ * A `Map` satisfies this, which is what it was until 2026-08-13. The narrower shape is the
+ * point: the only reader takes ONE revision on the restore path, and the eager map hashed
+ * the fold forest twice for every revision the ledger ever held, on every materialization,
+ * including the ones that discard the map entirely.
+ */
+export interface ProjectionFingerprints {
+  get(revision: number): ProjectionFingerprint | undefined;
+}
+
 export interface MaterializedStatePersistence {
   state: ActiveContextState;
   wireVersion: 0 | 1 | 2;
   records: Map<string, FoldRecordEntry>;
   stateSha256: string;
-  projectionFingerprints: Map<number, { topologySha256: string; protectionSha256: string }>;
+  projectionFingerprints: ProjectionFingerprints;
 }
 
 export function materializeStatePersistence(
@@ -844,16 +774,49 @@ export function materializeStatePersistence(
   let state = emptyActiveContextState(sessionId);
   let wireVersion: 0 | 1 | 2 = 0;
   const records = new Map<string, FoldRecordEntry>();
-  const projectionFingerprints = new Map<number, { topologySha256: string; protectionSha256: string }>();
+  // WHAT A FINGERPRINT IS MADE OF, HELD BY REFERENCE UNTIL ONE IS ASKED FOR.
+  //
+  // Replaying a ledger hashed the whole fold forest twice per revision, and one revision is
+  // ever read, by one caller, on the restore path. `materializeActiveContextState` takes
+  // `.state` and drops the map, so every request on a folding session paid for hundreds of
+  // digests it could not reach. Profiled against sol-20260813-paired rep 1 at its full
+  // 1,276 entries, materialization was 98% of a derivation, and canonicalizing and hashing
+  // was 72% of that.
+  //
+  // Holding the fields costs no copy: `state` is REPLACED on every delta rather than
+  // mutated (see `stateFromFoldRefs` below), so a reference taken here keeps that
+  // revision's own values, and the fold objects inside are shared with `records`.
+  const fingerprintSources = new Map<number, Pick<ActiveContextState,
+    "folds" | "expanded" | "protected">>();
+  const fingerprintCache = new Map<number, ProjectionFingerprint>();
+  const projectionFingerprints: ProjectionFingerprints = {
+    get(revision: number): ProjectionFingerprint | undefined {
+      const cached = fingerprintCache.get(revision);
+      if (cached) return cached;
+      const source = fingerprintSources.get(revision);
+      if (!source) return undefined;
+      const computed = {
+        topologySha256: topologySha256(source),
+        protectionSha256: protectionSha256(source),
+      };
+      fingerprintCache.set(revision, computed);
+      return computed;
+    },
+  };
   let stateSha256 = semanticStateSha256(state);
+  // WHAT THE LAST ACCEPTED ENTRY ACTUALLY RECORDED, when that is not what this build
+  // would compute. A state accepted through one of the legacy derivations below was
+  // written by a build that hashed it differently, and the delta that follows it names
+  // its base by THAT digest, so a chain of them is unreadable unless the reading carries
+  // both: the modern digest for what this build writes next, and the written one for what
+  // the next entry will name. Null whenever they agree, which is every state this build
+  // wrote itself, so the chain check below is unchanged for them.
+  let writtenSha256: string | null = null;
   let stateStart = -1;
   let checkpointIndex = -1;
   let v2Seen = false;
   const rememberProjection = (): void => {
-    projectionFingerprints.set(state.revision, {
-      topologySha256: topologySha256(state),
-      protectionSha256: protectionSha256(state),
-    });
+    fingerprintSources.set(state.revision, state);
   };
   rememberProjection();
   for (let index = 0; index < entries.length; index += 1) {
@@ -901,7 +864,8 @@ export function materializeStatePersistence(
     if (wire.kind === "checkpoint") {
       state = stateFromFoldRefs(wire, wire.foldRefs, records);
     } else {
-      if (wireVersion === 0 || wire.baseRevision !== state.revision || wire.baseStateSha256 !== stateSha256 ||
+      if (wireVersion === 0 || wire.baseRevision !== state.revision ||
+          (wire.baseStateSha256 !== stateSha256 && wire.baseStateSha256 !== writtenSha256) ||
           wire.revision <= wire.baseRevision) {
         throw new Error("Broken active-context delta chain");
       }
@@ -916,20 +880,73 @@ export function materializeStatePersistence(
         if (existing) throw new Error(`Duplicate active-context delta addition ${ref.id}`);
         byId.set(ref.id, ref);
       }
-      state = stateFromFoldRefs(wire, [...byId.values()], records);
+      // A delta written before 2026-08-13 carries the whole brief map; a newer one carries
+      // only what changed. The presence of `briefs` is the discriminator, not a fallback:
+      // a wire that states the whole map is replayed as the whole map.
+      const briefs = wire.briefs !== undefined ? clone(wire.briefs) : { ...(state.briefs ?? {}) };
+      if (wire.briefs === undefined) {
+        for (const id of wire.removeBriefIds ?? []) {
+          if (!Object.prototype.hasOwnProperty.call(briefs, id)) {
+            throw new Error(`Unknown active-context brief removal ${id}`);
+          }
+          delete briefs[id];
+        }
+        for (const [id, brief] of Object.entries(wire.addBriefs ?? {})) {
+          if (Object.prototype.hasOwnProperty.call(briefs, id) &&
+              sha256Value(briefs[id]) === sha256Value(brief)) {
+            throw new Error(`Redundant active-context brief ${id}`);
+          }
+          briefs[id] = clone(brief);
+        }
+      }
+      // Same rule for the marks, but the discriminator is the ORDER's presence rather than
+      // the array's absence. A delta written before 2026-08-13 states the whole array when
+      // it has one and states nothing when it does not, so "no array" means "no marks"
+      // there; reading it as "keep the base's marks" would resurrect marks a sealed session
+      // had cleared. The order list is what a NEW delta's replay is built from, so a key it
+      // does not name is removed by not being named.
+      let marks: PendingMark[];
+      if (wire.pendingMarkOrder === undefined) {
+        marks = wire.pendingMarks !== undefined ? clone(wire.pendingMarks) : [];
+      } else {
+        const held = new Map((state.pendingMarks ?? []).map((mark) =>
+          [pendingMarkKey(mark), mark] as const));
+        for (const mark of wire.addPendingMarks ?? []) {
+          const key = pendingMarkKey(mark);
+          const standing = held.get(key);
+          if (standing && sha256Value(standing) === sha256Value(mark)) {
+            throw new Error(`Redundant active-context pending mark ${key}`);
+          }
+          held.set(key, clone(mark));
+        }
+        marks = wire.pendingMarkOrder.map((key) => {
+          const mark = held.get(key);
+          if (!mark) throw new Error(`Unknown active-context pending mark ${key}`);
+          return mark;
+        });
+      }
+      state = stateFromFoldRefs(
+        {
+          ...wire,
+          briefs: Object.keys(briefs).length ? briefs : undefined,
+          pendingMarks: marks.length ? marks : undefined,
+        },
+        [...byId.values()],
+        records,
+      );
     }
     const calculated = semanticStateSha256(state);
-    // Compatibility window: accept the current digest plus two legacy shapes: one
-    // omitted zero cadence/empty leases; the other used a different replay-property
-    // order. These shims keep already-written v2 events readable and can be removed
-    // at the next wire-version bump.
+    const legacyRider = (wire as { rider?: unknown }).rider;
     if (calculated !== wire.stateSha256 &&
         legacyCadenceOmittedStateSha256(state) !== wire.stateSha256 &&
-        legacyReplayOrderStateSha256(state) !== wire.stateSha256) {
+        legacyReplayOrderStateSha256(state) !== wire.stateSha256 &&
+        (legacyRider === undefined ||
+          legacyRiderStateSha256(state, legacyRider) !== wire.stateSha256)) {
       throw new Error("Active-context v2 state digest drift");
     }
     wireVersion = 2;
     stateSha256 = calculated;
+    writtenSha256 = wire.stateSha256 === calculated ? null : wire.stateSha256;
     rememberProjection();
   }
   return { state, wireVersion, records, stateSha256, projectionFingerprints };
@@ -970,13 +987,9 @@ export function makeStateCheckpoint(state: ActiveContextState): ActiveContextChe
     prepared: state.prepared ? clone(state.prepared) : null,
     tokensSinceToolFold: state.tokensSinceToolFold,
     leases: clone(state.leases),
-    ...(state.surfacing?.length ? { surfacing: clone(state.surfacing) } : {}),
     ...(state.pendingMarks?.length ? { pendingMarks: clone(state.pendingMarks) } : {}),
     ...(state.briefs && Object.keys(state.briefs).length ? { briefs: clone(state.briefs) } : {}),
     ...(state.advisory ? { advisory: clone(state.advisory) } : {}),
-    ...(state.rider ? { rider: clone(state.rider) } : {}),
-    ...(state.lastCall ? { lastCall: clone(state.lastCall) } : {}),
-    ...(state.notices ? { notices: clone(state.notices) } : {}),
     stateSha256: semanticStateSha256(state),
   }, state.sessionId) as ActiveContextCheckpointV2;
 }
@@ -996,6 +1009,40 @@ export function makeStateDelta(previous: ActiveContextState, next: ActiveContext
       throw new Error(`Active-context fold record changed for ${id}`);
     }
   }
+  // A delta carries the CHANGE, never a value its base already holds. The brief map used
+  // to ship whole on every write: 81% of all state bytes on sol-20260812 rep 9, 17.7 MB of
+  // it unchanged, which then made every later turn slower because the session file is what
+  // the runtime derives over.
+  const previousBriefs = previous.briefs ?? {};
+  const nextBriefs = next.briefs ?? {};
+  const addBriefs: Record<string, BriefOverride> = {};
+  for (const [id, brief] of Object.entries(nextBriefs)) {
+    if (!Object.prototype.hasOwnProperty.call(previousBriefs, id)) { addBriefs[id] = clone(brief); continue; }
+    if (sha256Value(previousBriefs[id]) !== sha256Value(brief)) addBriefs[id] = clone(brief);
+  }
+  const removeBriefIds = Object.keys(previousBriefs)
+    .filter((id) => !Object.prototype.hasOwnProperty.call(nextBriefs, id));
+  // The marks are the same rule one shape along, and the next largest field after the
+  // briefs: 2.55 MB of rep 9's 21.6 MB ledger, which a diff takes to 0.16 MB. They carry an
+  // ORDER as well as a membership, and appending after removing does not always reproduce
+  // it (four of that run's 309 writes), so the key order travels whole and states the
+  // removals with it. It is short next to the marks themselves, so there is no case to
+  // split and no branch that can pick the wrong one.
+  const previousMarks = previous.pendingMarks ?? [];
+  const nextMarks = next.pendingMarks ?? [];
+  const previousByKey = new Map(previousMarks.map((mark) => [pendingMarkKey(mark), mark] as const));
+  const addPendingMarks = nextMarks.filter((mark) => {
+    const held = previousByKey.get(pendingMarkKey(mark));
+    return !held || sha256Value(held) !== sha256Value(mark);
+  });
+  const marksTravel = previousMarks.length > 0 || nextMarks.length > 0;
+  // The rest travel whole and stay that way. Measured on the same run, the two that were
+  // worth a diff were 20.0 MB of the 21.6 MB ledger; what remained were bounded objects
+  // with their own caps rather than collections that grow with the epoch (the largest,
+  // the since-retired `notices`, was 0.93 MB). A diff for a capped
+  // value is a second encoding to keep honest for a few hundred kilobytes a session, and
+  // the reader's own compatibility rule is the part that is easy to get wrong: this build
+  // shipped one such bug and the gate caught it.
   return parseActiveContextStateV2({
     version: 2,
     kind: "delta",
@@ -1010,13 +1057,11 @@ export function makeStateDelta(previous: ActiveContextState, next: ActiveContext
     prepared: next.prepared ? clone(next.prepared) : null,
     tokensSinceToolFold: next.tokensSinceToolFold,
     leases: clone(next.leases),
-    ...(next.surfacing?.length ? { surfacing: clone(next.surfacing) } : {}),
-    ...(next.pendingMarks?.length ? { pendingMarks: clone(next.pendingMarks) } : {}),
-    ...(next.briefs && Object.keys(next.briefs).length ? { briefs: clone(next.briefs) } : {}),
+    ...(marksTravel ? { pendingMarkOrder: nextMarks.map(pendingMarkKey) } : {}),
+    ...(addPendingMarks.length ? { addPendingMarks: clone(addPendingMarks) } : {}),
+    ...(Object.keys(addBriefs).length ? { addBriefs } : {}),
+    ...(removeBriefIds.length ? { removeBriefIds } : {}),
     ...(next.advisory ? { advisory: clone(next.advisory) } : {}),
-    ...(next.rider ? { rider: clone(next.rider) } : {}),
-    ...(next.lastCall ? { lastCall: clone(next.lastCall) } : {}),
-    ...(next.notices ? { notices: clone(next.notices) } : {}),
     stateSha256: semanticStateSha256(next),
   }, next.sessionId) as ActiveContextDeltaV2;
 }
@@ -1029,49 +1074,48 @@ export function protectionSha256(state: Pick<ActiveContextState, "protected">):
   return sha256Value([...state.protected].sort((left, right) => objectRefKey(left).localeCompare(objectRefKey(right))));
 }
 
-/**
- * The milestone vocabulary a persisted `advisory` state field may carry. The delivery
- * schedule that spent a per-milestone budget is deleted; this list stays because the
- * state field is written into every state and covered by the state digest, so sealed
- * runs have to keep parsing. It is its own literal now rather than the key set of the
- * deleted budget table.
- */
 export const ADVISORY_MILESTONES = Object.freeze(
   ["orientation", "notice", "tools", "chapters", "urgent"] as AdvisoryMilestone[],
 );
 
-/** The rider is LITERAL persisted bytes, so the bound is on the stored text itself. */
-export const MAX_RIDER_TEXT_BYTES = 4_096;
-
-export function validRiderState(value: unknown): value is NonNullable<ActiveContextState["rider"]> {
-  if (!exactRecord(value, ["epoch", "text"])) return false;
-  const epoch = ownValue(value, "epoch");
-  const text = ownValue(value, "text");
-  return Number.isSafeInteger(epoch) && Number(epoch) >= 0 &&
-    typeof text === "string" && text.length > 0 && text.length <= MAX_RIDER_TEXT_BYTES;
-}
-
-export function validLastCallState(value: unknown): value is NonNullable<ActiveContextState["lastCall"]> {
-  if (!exactRecord(value, ["exposure", "ordinal", "contextCalls", "agentMarks", "text"])) return false;
-  const text = ownValue(value, "text");
-  return ["exposure", "ordinal", "contextCalls", "agentMarks"].every((field) =>
-    Number.isSafeInteger(ownValue(value, field)) && Number(ownValue(value, field)) >= 0) &&
-    typeof text === "string" && text.length > 0 && text.length <= MAX_LAST_CALL_TEXT_BYTES;
-}
+/**
+ * THE RETIRED STATE FIELDS, REFUSED BY NAME.
+ *
+ * `lastCall` and `notices` were the occupancy thermostat's two announcements, and `rider`
+ * was the post-commit invitation to create marks, deleted 2026-08-23 with the curation
+ * redesign: the runtime cuts and the agent edits, so an invitation to create is a carrier
+ * with nothing left to invite. Nothing
+ * writes them any more and nothing reads them, so a durable state that still carries one
+ * was written by a build that had them, and the exact-record readers would reject it with
+ * "Invalid active-context state keys" -- true, and useless to whoever has to act on it.
+ *
+ * Refusing by name is the whole behaviour. Tolerating the field and dropping it is the
+ * silent path: it makes a version boundary look like a successful load, and the state
+ * that comes back is not the state that was written. Gate 17 already states the wire's
+ * policy in the other direction -- an older exact-record reader rejects newer fields, and
+ * a bump is explicit -- and this is that same policy read from the newer side.
+ *
+ * `rider` IS NOT ON THIS LIST, and the distinction is the whole point of the list. The
+ * refusal's own reason is "a state it cannot reproduce", so a field the build CAN
+ * reproduce is out of its scope: the rider was projection carrier text, it changed no
+ * fold, no ref and no brief, and the only thing it ever touched that survives a load is
+ * the state digest. So it is read, spent on the digest, and dropped, which is what
+ * `legacyRiderStateSha256` below is for. Retiring it by name instead made every state the
+ * sol-20260815-hidden campaign sealed unreadable and cost the hidden-mass result its 102
+ * attributed carriage rows, which is a high price for a field that carried no behaviour.
+ */
+const RETIRED_STATE_FIELDS: readonly string[] = Object.freeze(["lastCall", "notices", "surfacing"]);
 
-export function validNoticesState(value: unknown): value is NonNullable<ActiveContextState["notices"]> {
-  if (!exactRecord(value, ["fired", "ring"])) return false;
-  const fired = denseOwnArrayValues(ownValue(value, "fired"));
-  const ring = denseOwnArrayValues(ownValue(value, "ring"));
-  if (!fired || !ring || ring.length > MAX_THRESHOLD_NOTICES) return false;
-  if (fired.some((share) => typeof share !== "number" || !Number.isFinite(share) || share <= 0 || share >= 1) ||
-      new Set(fired).size !== fired.length) return false;
-  return ring.every((notice) => exactRecord(notice, ["share", "ordinal", "text"]) &&
-    typeof ownValue(notice, "share") === "number" && Number.isFinite(ownValue(notice, "share")) &&
-    Number(ownValue(notice, "share")) > 0 && Number(ownValue(notice, "share")) < 1 &&
-    Number.isSafeInteger(ownValue(notice, "ordinal")) && Number(ownValue(notice, "ordinal")) >= 0 &&
-    typeof ownValue(notice, "text") === "string" && String(ownValue(notice, "text")).length > 0 &&
-    String(ownValue(notice, "text")).length <= MAX_THRESHOLD_NOTICE_TEXT_BYTES);
+export function refuseRetiredStateFields(value: unknown): void {
+  if (!value || typeof value !== "object") return;
+  const carried = RETIRED_STATE_FIELDS.filter((field) =>
+    Object.prototype.hasOwnProperty.call(value, field));
+  if (!carried.length) return;
+  throw new Error(
+    `Active-context state carries the retired field(s) ${carried.join(", ")}: it was written ` +
+    "by a build that still carried the subsystem behind it. Nothing writes or reads them " +
+    "now, and this build will not load a state it cannot reproduce.",
+  );
 }
 
 export function validAdvisoryState(value: unknown): value is NonNullable<ActiveContextState["advisory"]> {
@@ -1094,6 +1138,5 @@ export function validAdvisoryState(value: unknown): value is NonNullable<ActiveC
   const delivered = ownValue(value, "delivered") as Record<string, unknown>;
   return Reflect.ownKeys(delivered).every((key) => typeof key === "string" &&
     ADVISORY_MILESTONES.includes(key as AdvisoryMilestone) &&
-    Number.isSafeInteger(ownValue(delivered, key)) && Number(ownValue(delivered, key)) >= 0 &&
-    Number(ownValue(delivered, key)) <= MAX_ADVISORY_DELIVERIES_PER_MILESTONE);
+    Number.isSafeInteger(ownValue(delivered, key)) && Number(ownValue(delivered, key)) >= 0);
 }