pi-fold 3.1.0 → 4.0.0

package/extensions/active-context.ts

@@ -46,6 +46,7 @@ import {
   explicitProtectedMass,
   budgetOccupancy,
   hardFenceRatio,
+  imageMass,
   latestProviderContextMeasurement,
   orderedRoots,
   parseNativeCompactionCompletion,
@@ -105,6 +106,7 @@ import {
   resolveThresholds,
   servingBudgetTokens,
   ESTIMATED_BYTES_PER_TOKEN,
+  IMAGE_ESTIMATED_TOKENS,
   entryTypeNamespace,
   MAX_FOLD_SPAN_CHARS,
   DEFAULT_TOOL_FOLD_THRESHOLD,
@@ -116,10 +118,6 @@ import {
   RETIRED_TOOL_ACTIONS,
   AUTO_FOLD_BLACKLIST_DEFAULT,
   USER_RESCUE_MAX_SOURCE_CHARS,
-  MEMORY_BODY_CHARS,
-  MEMORY_KEY_CHARS,
-  MEMORY_KEYS_MAX,
-  WORKING_MEMORY_TOOL_ACTIONS,
 } from "./lib/policy.ts";
 import type {
   ActiveContextSnapshot,
@@ -140,7 +138,7 @@ import {
 import {
   contextReceipt,
   foldNoticeText,
-  memoryTocText,
+  foldStatusText,
   receiptBlockText,
   withReceipt,
 } from "./lib/curation.ts";
@@ -247,13 +245,6 @@ export function registerActiveContext(pi: any, options: {
    *  agent to improve a brief. Either way the agent verbs stay on the tool, so an agent
    *  that finds a fold can still annotate what it reads. */
   postFoldNotice?: boolean;
-  /** THE WORKING MEMORY (Shane, 2026-08-26): a session-scoped ordered dictionary the
-   *  agent maintains beside the fold index. `remember` writes or removes an entry,
-   *  `recall` reads bodies on demand, and the projection carries one table of contents
-   *  that refreshes at each commit. Off when absent: the digest channel earned its
-   *  place in a measured gap (running tallies lost 0/6 against native's 6/6 while the
-   *  index won everything else), and it must stay separable from the index it is not. */
-  workingMemory?: boolean;
 }): {
   projectionCandidates: (ctx: any) => Array<Record<string, unknown>>;
 } {
@@ -268,11 +259,6 @@ export function registerActiveContext(pi: any, options: {
       "carrier inviting the agent to improve it");
   }
   const postFoldNotice = options.postFoldNotice ?? false;
-  if (options.workingMemory !== undefined && typeof options.workingMemory !== "boolean") {
-    throw new Error("workingMemory must be a boolean: it enables the session-scoped " +
-      "working-memory dictionary and its two actions, remember and recall");
-  }
-  const workingMemory = options.workingMemory === true;
   const toolFoldThreshold = options.toolFoldThreshold ?? DEFAULT_TOOL_FOLD_THRESHOLD;
   if (typeof toolFoldThreshold !== "number" || !Number.isFinite(toolFoldThreshold) ||
       toolFoldThreshold < 0 || toolFoldThreshold >= 1) {
@@ -345,7 +331,6 @@ export function registerActiveContext(pi: any, options: {
   const milestoneProjectionType = `${entryTypePrefix}-milestone`;
   const advisoryProjectionType = `${entryTypePrefix}-advisory`;
   const foldNoticeProjectionType = `${entryTypePrefix}-fold-notice`;
-  const memoryTocProjectionType = `${entryTypePrefix}-memory-toc`;
   const receiptProjectionType = `${entryTypePrefix}-receipts`;
   const curationProjectionType = `${entryTypePrefix}-curation`;
   const entryNamespace = entryTypeNamespace(entryTypePrefix);
@@ -353,9 +338,7 @@ export function registerActiveContext(pi: any, options: {
   const nativeReceiptEntryType = `${entryNamespace}-native-compaction-receipt`;
   const contextEventEntryType = `${entryNamespace}-context-event`;
   const nativeDecisionEntryType = `${entryNamespace}-native-compaction-decision`;
-  const allowedToolActions: readonly ActiveContextToolAction[] = workingMemory
-    ? [...ACTIVE_CONTEXT_TOOL_ACTIONS, ...WORKING_MEMORY_TOOL_ACTIONS]
-    : ACTIVE_CONTEXT_TOOL_ACTIONS;
+  const allowedToolActions: readonly ActiveContextToolAction[] = ACTIVE_CONTEXT_TOOL_ACTIONS;
   const allowedToolActionSet = new Set<string>(allowedToolActions);
 
   type AutomaticFailureState = {
@@ -401,6 +384,7 @@ export function registerActiveContext(pi: any, options: {
     lastProviderMeasurement: null as ProviderContextMeasurement | null,
     descriptorWindow: null as number | null,
     lastProjectedChars: null as number | null,
+    lastProjectedImages: 0,
     projectionCalibrations: [] as Array<{ chars: number; tokens: number }>,
     lastProjectedEstimate: null as number | null,
     lastProjectedEstimateCalibrated: false,
@@ -409,6 +393,10 @@ export function registerActiveContext(pi: any, options: {
     projectionAnchor: null as {
       tokens: number;
       chars: number;
+      /** `chars` less the base64 of any image, which is what the delta is taken on. */
+      textChars: number;
+      /** Images inside the anchored prefix, each worth IMAGE_ESTIMATED_TOKENS. */
+      images: number;
       head: string;
       messageSha256: string;
       sessionId: string;
@@ -428,6 +416,10 @@ export function registerActiveContext(pi: any, options: {
     ledger: emptyLedger(),
     previousDigests: null as string[] | null,
     previousText: null as string | null,
+    // The image mass of `previousText`, kept beside it because the provider anchor is
+    // built from that text and has no access to the array it came from.
+    previousImages: 0,
+    previousImageChars: 0,
     lastChange: "append" as ProjectionChange,
     lastPreservedShare: null as number | null,
     sinceHandoff: [] as Array<{
@@ -491,9 +483,6 @@ export function registerActiveContext(pi: any, options: {
   };
 
   const advisory = {
-    hardFenceNoticeKey: null as string | null,
-    hardFenceReleaseSessionId: null as string | null,
-    hardFenceReleasedProjectionKeys: new Set<string>(),
   };
 
   // EPHEMERAL PEEK (Build 4b): tool call ids whose peek asked for one-read
@@ -632,15 +621,43 @@ export function registerActiveContext(pi: any, options: {
     lifecycle.generation === expectedGeneration && persistence.state?.sessionId === sessionId &&
     (!ctx || contextSessionMatches(ctx, sessionId));
 
+  /**
+   * THE ONE LINE THAT IS ALWAYS ON SCREEN, so it answers the question a person actually
+   * has: how full am I, and is anything about to happen.
+   *
+   * It used to read `pi_fold_context folds: 3 · provider 187234/272000`. That led with the
+   * AGENT TOOL'S NAME, which a person cannot call and does not care about, and then spent
+   * its remaining width on two raw counts they would have to divide themselves. The brand
+   * leads now, occupancy is a percentage of the serving budget, and the commit point is
+   * named only when it is close enough to matter.
+   */
   const updateStatus = (ctx: any): void => {
     try {
       const roots = persistence.state && lifecycle.latestSnapshot ? orderedRoots(persistence.state, lifecycle.latestSnapshot).length : 0;
-      const prepared = persistence.state?.prepared ? " · brief ready" : ladder.preparing ? " · briefing" : "";
-      const usage = measurements.lastProviderMeasurement
-        ? ` · provider ${measurements.lastProviderMeasurement.tokens}/${measurements.lastProviderMeasurement.contextWindow}`
-        : " · provider usage unmeasured";
-      const suspended = ladder.automaticFailure ? " · automatic suspended" : "";
-      ctx.ui?.setStatus?.(entryTypePrefix, `${toolName} folds: ${roots}${prepared}${usage}${suspended}`);
+      const staged = persistence.state ? pendingMarks(persistence.state).length : 0;
+      const capacity = currentCapacity(ctx);
+      const used = measurements.lastProviderMeasurement?.tokens ?? null;
+      const share = used !== null && capacity.budgetTokens > 0 ? used / capacity.budgetTokens : null;
+      const parts: string[] = [];
+      // FAILURE LEADS. This line is cut to whatever width the host gives it, so the last
+      // segment is the first one a narrow terminal removes, and folding having stopped is
+      // the one state on this line a person has to act on. It was appended last.
+      if (ladder.automaticFailure) parts.push("FOLDING STOPPED");
+      // Unmeasured is stated, never guessed: an estimate rendered as a fact is the habit
+      // that cost a live session, and this line is the most-read surface there is.
+      parts.push(share === null ? "not measured" : `${Math.round(share * 100)}% full`);
+      const trigger = lifecycle.latestSnapshot?.thresholds.maxTarget ?? null;
+      // WHEN, not just how full. "68% full" only answers the second question a reader has
+      // if they already remember where the trigger sits; naming it answers both.
+      //
+      // NOT WHILE STOPPED, though: the line rendered "COMMIT DUE" and "FOLDING STOPPED"
+      // in one breath, promising the thing it was announcing would not happen.
+      if (share !== null && trigger !== null && !ladder.automaticFailure) {
+        parts.push(share >= trigger ? "COMMIT DUE" : `commit at ${Math.round(trigger * 100)}%`);
+      }
+      if (staged > 0) parts.push(`${staged} staged`);
+      if (roots > 0) parts.push(`${roots} fold${roots === 1 ? "" : "s"}`);
+      ctx.ui?.setStatus?.(entryTypePrefix, `${brandNoun} ${parts.join(" · ")}`);
     } catch { }
   };
 
@@ -779,6 +796,8 @@ export function registerActiveContext(pi: any, options: {
     instrumentation.ledger = emptyLedger();
     instrumentation.previousDigests = null;
     instrumentation.previousText = null;
+    instrumentation.previousImages = 0;
+    instrumentation.previousImageChars = 0;
     instrumentation.requests = 0;
     instrumentation.lastMutationRequest = 0;
     instrumentation.lastMutationTokens = null;
@@ -793,16 +812,11 @@ export function registerActiveContext(pi: any, options: {
     curation.lastRecovery = null;
     ladder.lastAutomaticAction = null;
     ladder.automaticFailure = null;
-    advisory.hardFenceNoticeKey = null;
     measurements.providerMeasurementReceipts.clear();
     measurements.providerMeasurementRevisionByMessageSha.clear();
     measurements.providerMeasurementByMessageSha.clear();
     measurements.providerMeasurementAnchorByMessageSha.clear();
     const sessionId = ctx.sessionManager.getSessionId();
-    if (advisory.hardFenceReleaseSessionId !== sessionId) {
-      advisory.hardFenceReleaseSessionId = sessionId;
-      advisory.hardFenceReleasedProjectionKeys.clear();
-    }
     let restored: ActiveContextState | null = null;
     let restoreError: unknown = null;
     let restoredPersistence: MaterializedStatePersistence | null = null;
@@ -1318,53 +1332,6 @@ export function registerActiveContext(pi: any, options: {
     safeNotify(ctx, `Automatic context management suspended: ${message}`, "warning");
   };
 
-  const abortUnsafeHardContext = (
-    snapshot: ActiveContextSnapshot | null,
-    ctx: any,
-    allowUnmeasuredRevisionRelease = false,
-  ): boolean => {
-    if (measurements.latestRatio === null || measurements.latestRatio < hardFenceRatio(snapshot ?? undefined, ctx) || !persistence.state) return false;
-    const measuredRevision = measurements.lastProviderMeasurement
-      ? measurements.providerMeasurementRevisionByMessageSha.get(measurements.lastProviderMeasurement.messageSha256)
-      : undefined;
-    if (allowUnmeasuredRevisionRelease && !ladder.automaticFailure &&
-        measuredRevision !== undefined && measurements.lastProviderMeasurement &&
-        !durableProviderMeasurementMatches(measurements.lastProviderMeasurement)) {
-      const releaseKey = sha256Value({
-        sessionId: persistence.state.sessionId,
-        topologySha256: topologySha256(persistence.state),
-        protectionSha256: protectionSha256(persistence.state),
-        measuredRevision,
-        providerMessageSha256: measurements.lastProviderMeasurement?.messageSha256 ?? null,
-      });
-      if (!advisory.hardFenceReleasedProjectionKeys.has(releaseKey) &&
-          advisory.hardFenceReleasedProjectionKeys.size < 4_096) {
-        advisory.hardFenceReleasedProjectionKeys.add(releaseKey);
-        return false;
-      }
-    }
-    const key = ladder.automaticFailure?.key ?? sha256Value({
-      sessionId: snapshot?.sessionId ?? persistence.state.sessionId,
-      revision: persistence.state.revision,
-      providerMessageSha256: measurements.lastProviderMeasurement?.messageSha256 ?? null,
-      phase: "hard-provider-fence",
-    });
-    ladder.pendingContextNote = `Provider context reached the hard ${brandNoun} fence without a newly committed lossless fold. ` +
-      "The provider request was aborted before transmission; run /compact or make an explicit bounded context fold.";
-    if (advisory.hardFenceNoticeKey !== key) {
-      advisory.hardFenceNoticeKey = key;
-      safeNotify(
-        ctx,
-        "Provider request aborted at the hard context fence; run /compact or make an explicit bounded context fold.",
-        "error",
-      );
-    }
-    if (typeof ctx.abort !== "function") {
-      throw new Error(`Pi hard-fence abort capability is unavailable at ratio ${measurements.latestRatio}`);
-    }
-    ctx.abort();
-    return true;
-  };
 
   const PROJECTION_CALIBRATION_MIN_CHARS = 20_000;
   const PROJECTION_CALIBRATION_MIN_TOKENS = 5_000;
@@ -1385,6 +1352,12 @@ export function registerActiveContext(pi: any, options: {
     }
     const chars = measurements.lastProjectedChars;
     if (chars === null || chars < PROJECTION_CALIBRATION_MIN_CHARS) return;
+    // NEVER LEARN THE RATIO FROM A WINDOW HOLDING AN IMAGE. chars/token is a fact about
+    // prose; a projection carrying base64 has a far higher true ratio, and because
+    // projectionCharsPerToken takes the MINIMUM over the window such a sample is either
+    // discarded (leaving the over-read in place) or, once images dominate, poisons the
+    // ratio for the text around them. The clean rule is to calibrate on text alone.
+    if (measurements.lastProjectedImages > 0) return;
     if (!Number.isFinite(measurement.tokens) || measurement.tokens < PROJECTION_CALIBRATION_MIN_TOKENS) return;
     if (measurements.lastProjectedEstimate !== null && measurements.lastProjectedEstimateCalibrated &&
         measurement.tokens > 0) {
@@ -1418,13 +1391,26 @@ export function registerActiveContext(pi: any, options: {
       return;
     }
     const chars = bytes(text);
-    if (!(measurement.tokens > 0) || chars / measurement.tokens < PROJECTION_CHARS_PER_TOKEN_FLOOR) {
+    // The anchor is differenced against TEXT characters, so it must store them. The mass
+    // belongs to the same `previousText` this anchor is built from, recorded by
+    // noteProjection when that text was produced.
+    const textChars = Math.max(0, chars - instrumentation.previousImageChars);
+    const images = instrumentation.previousImages;
+    // The floor test reads TEXT against tokens: an image-heavy projection has a raw ratio
+    // far above any prose floor and would sail through a test that is meant to reject a
+    // measurement the text cannot explain.
+    if (!(measurement.tokens > 0) ||
+        (measurement.tokens > images * IMAGE_ESTIMATED_TOKENS &&
+          textChars / (measurement.tokens - images * IMAGE_ESTIMATED_TOKENS) <
+            PROJECTION_CHARS_PER_TOKEN_FLOOR)) {
       measurements.projectionAnchor = null;
       return;
     }
     measurements.projectionAnchor = {
       tokens: measurement.tokens,
       chars,
+      textChars,
+      images,
       head: text.slice(0, -1),
       messageSha256: measurement.messageSha256,
       sessionId: persistence.state.sessionId,
@@ -1446,6 +1432,9 @@ export function registerActiveContext(pi: any, options: {
     tokens: number;
     basis: ProjectionReadingBasis;
     chars: number;
+    /** The image-corrected size of THIS projection, independent of any anchor. */
+    sizeTokens: number;
+    images: number;
     anchorTokens: number | null;
     deltaChars: number | null;
     text: string;
@@ -1453,21 +1442,34 @@ export function registerActiveContext(pi: any, options: {
     const text = serialized ?? stableStringify(projected);
     const chars = Buffer.byteLength(text, "utf8");
     const charsPerToken = projectionCharsPerToken();
-    const estimate = Math.ceil(chars / charsPerToken);
+    // AN IMAGE IS NOT TEXT (2026-08-28, see imageMass). Its base64 leaves the character
+    // count and comes back as a flat per-image cost, because dividing base64 by a ratio
+    // learned from prose read one screenshot as 110,000 tokens against a true 1,500 and
+    // aborted a session that was less than half full.
+    const mass = imageMass(projected);
+    const textChars = Math.max(0, chars - mass.base64Chars);
+    const imageTokens = mass.images * IMAGE_ESTIMATED_TOKENS;
+    const estimate = Math.ceil(textChars / charsPerToken) + imageTokens;
     const anchor = measurements.projectionAnchor;
     if (!anchor || anchor.generation !== lifecycle.generation ||
         anchor.sessionId !== persistence.state?.sessionId) {
-      return { tokens: estimate, basis: "unmeasured", chars, anchorTokens: null, deltaChars: null, text };
+      return { tokens: estimate, basis: "unmeasured", chars, sizeTokens: estimate, images: mass.images, anchorTokens: null, deltaChars: null, text };
     }
     const separator = text.length > anchor.head.length ? text[anchor.head.length] : "";
     if (!text.startsWith(anchor.head) || (separator !== "," && separator !== "]")) {
-      return { tokens: estimate, basis: "rewritten", chars, anchorTokens: anchor.tokens, deltaChars: null, text };
+      return { tokens: estimate, basis: "rewritten", chars, sizeTokens: estimate, images: mass.images, anchorTokens: anchor.tokens, deltaChars: null, text };
     }
-    const deltaChars = chars - anchor.chars;
+    // The delta is taken on TEXT characters and images separately, so an image arriving
+    // after the anchor costs its own flat price rather than its base64 length.
+    const deltaChars = textChars - anchor.textChars;
+    const deltaImages = mass.images - anchor.images;
     return {
-      tokens: Math.max(0, anchor.tokens + Math.ceil(deltaChars / charsPerToken)),
+      tokens: Math.max(0, anchor.tokens + Math.ceil(deltaChars / charsPerToken) +
+        deltaImages * IMAGE_ESTIMATED_TOKENS),
       basis: "anchored",
       chars,
+      sizeTokens: estimate,
+      images: mass.images,
       anchorTokens: anchor.tokens,
       deltaChars,
       text,
@@ -1517,7 +1519,7 @@ export function registerActiveContext(pi: any, options: {
       : Number.POSITIVE_INFINITY;
     const reading = projectedTokenReading(projected, serialized);
     const tokens = reading.tokens;
-    const sizeTokens = Math.ceil(reading.chars / projectionCharsPerToken());
+    const sizeTokens = reading.sizeTokens;
     const marginTokens = Number.isFinite(budgetTokens)
       ? projectionMarginTokens(tokens, capacity.window)
       : 0;
@@ -1533,40 +1535,6 @@ export function registerActiveContext(pi: any, options: {
     };
   };
 
-  const abortOverBudgetProjection = (
-    tokens: number,
-    budgetTokens: number,
-    ctx: any,
-    recoveryAttempts = 0,
-  ): void => {
-    const key = sha256Value({
-      sessionId: persistence.state?.sessionId ?? null,
-      revision: persistence.state?.revision ?? null,
-      tokens,
-      budgetTokens,
-      phase: "projection-budget-fence",
-    });
-    ladder.pendingContextNote =
-      `The ${brandNoun} projection estimates ${tokens} tokens against a ${budgetTokens}-token serving budget` +
-      (recoveryAttempts
-        ? `, after ${recoveryAttempts} recovery attempt(s) that folded everything foldable. The remaining ` +
-          "inflow does not fit at any folding depth, which is an impossibility rather than a recoverable state."
-        : ".") +
-      " The provider request was aborted before transmission; run /compact or make an explicit bounded context fold.";
-    if (advisory.hardFenceNoticeKey !== key) {
-      advisory.hardFenceNoticeKey = key;
-      safeNotify(
-        ctx,
-        "Provider request aborted: the projection exceeds the serving budget. " +
-        "Run /compact or make an explicit bounded context fold.",
-        "error",
-      );
-    }
-    if (typeof ctx.abort !== "function") {
-      throw new Error(`Pi projection-budget abort capability is unavailable at ${tokens} estimated tokens`);
-    }
-    ctx.abort();
-  };
 
   // THE BAND TOP COMMITS ON ITS OWN (Shane, 2026-08-22).
   //
@@ -1731,41 +1699,6 @@ export function registerActiveContext(pi: any, options: {
     return projected;
   };
 
-  /**
-   * THE TABLE OF CONTENTS IS ONE COPY PER COMMIT (Shane, 2026-08-26). It is admitted
-   * once per frozen projection, exactly as the fold notice above, and that admission
-   * rule IS the refresh law: between commits the copy stays buried at its index, so a
-   * quiet pass moves no byte and costs no occupancy anchor, and the tool result of every
-   * `remember` carries the live key list in the meantime. A commit rewrites the
-   * projection, the freeze drops, the body filter strips the old copy, and the next pass
-   * seats a fresh one at the tail with the latest keys. Nothing here re-renders in
-   * place, because a carrier that moves on a quiet pass is the exact defect the fold
-   * notice's comment records.
-   */
-  const appendMemoryToc = (projected: unknown[], snapshot: ActiveContextSnapshot): unknown[] => {
-    if (!workingMemory) return projected;
-    if (!persistence.state) return projected;
-    const held = persistence.state.memory ?? [];
-    if (!held.length) return projected;
-    if (!carrierAdmitted("memory-toc")) return projected;
-    const entries = [...held].sort((left, right) => right.ordinal - left.ordinal);
-    const text = memoryTocText({
-      entries: entries.map((entry) => ({ key: entry.key, chars: entry.body.length })),
-      toolName,
-      brandNoun,
-    });
-    projected.push({
-      role: "custom",
-      customType: memoryTocProjectionType,
-      content: text,
-      display: false,
-      details: { source: activeContextSource(entryTypePrefix), ephemeral: true },
-      timestamp: typeof ownValue(snapshot.messages.at(-1), "timestamp") === "number"
-        ? ownValue(snapshot.messages.at(-1), "timestamp")
-        : 0,
-    });
-    return projected;
-  };
 
   const enforceBandTop = async (
     snapshot: ActiveContextSnapshot,
@@ -1805,10 +1738,10 @@ export function registerActiveContext(pi: any, options: {
     snapshot: ActiveContextSnapshot,
     projected: unknown[],
     ctx: any,
-  ): Promise<{ projected: unknown[]; aborted: boolean; text: string }> => {
+  ): Promise<{ projected: unknown[]; text: string }> => {
     let measured = projectionExceedsBudget(projected, ctx);
     const rejected = curation.pendingRejection !== null;
-    if (!measured.crowded && !rejected) return { projected, aborted: false, text: measured.text };
+    if (!measured.crowded && !rejected) return { projected, text: measured.text };
     const trigger = measured;
     let reduced = projected;
     let attempts = 0;
@@ -1912,11 +1845,24 @@ export function registerActiveContext(pi: any, options: {
       }));
       curation.pendingRejection = null;
     }
-    // `measured` is recomputed on `reduced` at every turn of the loop above, so its text is
-    // the serialization of the array both of these exits return.
-    if (!measured.over) return { projected: reduced, aborted: false, text: measured.text };
-    abortOverBudgetProjection(measured.tokens, measured.budgetTokens, ctx, attempts);
-    return { projected: reduced, aborted: true, text: measured.text };
+    // THE RUNTIME COMMITS AND TRANSMITS; ONLY THE PROVIDER REFUSES (Shane, 2026-08-28).
+    //
+    // This used to abort the request when the projection still read over budget after the
+    // loop. It was deleted because it let an ESTIMATE veto a request that ground truth
+    // would have accepted: a live session read 220,883 tokens where the provider counted
+    // 111,837, was refused before transmission, and could not be rescued, because the
+    // commit before the refusal had applied 28 marks and the next applied 0. The advice it
+    // printed, fold manually or run /compact, named the two things the mechanism had just
+    // proven it could not do.
+    //
+    // maxTarget is a TRIGGER meaning "commit now", not a bound meaning "refuse to
+    // proceed", and only the first is something an estimate can be right about. What
+    // remains is the loop above, which commits everything it can reach; the request then
+    // goes to the provider, and a genuine overflow is handled by the rejection path, which
+    // branches back, folds and retries on the provider's own count rather than ours.
+    // `measured` is recomputed on `reduced` at every turn of the loop, so its text is the
+    // serialization of the array this returns.
+    return { projected: reduced, text: measured.text };
   };
 
   const startPreparation = (snapshot: ActiveContextSnapshot, ratio: number | null, ctx: any): void => {
@@ -2071,7 +2017,7 @@ export function registerActiveContext(pi: any, options: {
       const customType = ownValue(message, "customType");
       return customType !== milestoneProjectionType && customType !== advisoryProjectionType &&
         customType !== receiptProjectionType && customType !== curationProjectionType &&
-        customType !== foldNoticeProjectionType && customType !== memoryTocProjectionType;
+        customType !== foldNoticeProjectionType;
     });
     const withdrawn = withdrawConsumedEphemeralPeeks(body);
     if (withdrawn.size && freeze.body) {
@@ -2099,7 +2045,6 @@ export function registerActiveContext(pi: any, options: {
     freeze.bodyText = bodyText;
     appendReceipts(projected, snapshot);
     appendFoldNotice(projected, snapshot);
-    appendMemoryToc(projected, snapshot);
     return holdFrozen(projected);
   };
   const noteProjection = (projected: unknown[], serialized?: string): void => {
@@ -2888,11 +2833,6 @@ export function registerActiveContext(pi: any, options: {
       try { projected = projectWithAdvisory(snapshot); }
       catch (error) {
         suspendAutomatic(error, "projection", ctx);
-        abortUnsafeHardContext(snapshot, ctx);
-        return { messages: event.messages };
-      }
-      if (abortUnsafeHardContext(snapshot, ctx, true)) {
-        updateStatus(ctx);
         return { messages: event.messages };
       }
       // THE FRONTIER CUTS FIRST, and it costs the projection nothing to do so: a pending
@@ -2908,7 +2848,6 @@ export function registerActiveContext(pi: any, options: {
         try { projected = projectWithAdvisory(snapshot); }
         catch (error) {
           suspendAutomatic(error, "projection", ctx);
-          abortUnsafeHardContext(snapshot, ctx);
           return { messages: event.messages };
         }
       }
@@ -2916,14 +2855,13 @@ export function registerActiveContext(pi: any, options: {
       projected = budgeted.projected;
       const reading = projectedTokenReading(projected, budgeted.text);
       measurements.lastProjectedChars = reading.chars;
+      measurements.lastProjectedImages = reading.images;
       measurements.lastProjectedEstimate = reading.tokens;
       measurements.lastProjectedEstimateBasis = reading.basis;
-      measurements.lastProjectedSizeTokens = Math.ceil(reading.chars / projectionCharsPerToken());
+      // The size is the reading's own image-corrected figure. Recomputing it from raw
+      // chars here is what fed base64 straight into the fence's own accounting.
+      measurements.lastProjectedSizeTokens = reading.sizeTokens;
       measurements.lastProjectedEstimateCalibrated = measurements.projectionCalibrations.length > 0;
-      if (budgeted.aborted) {
-        updateStatus(ctx);
-        return { messages: projected };
-      }
       noteProjection(projected, budgeted.text);
       updateStatus(ctx);
       return { messages: projected };
@@ -2937,7 +2875,6 @@ export function registerActiveContext(pi: any, options: {
         if (!persistedSucceeded) ladder.boundaryFailure = lifecycle.latestSnapshotError;
         suspendAutomatic(error, persistedSucceeded ? "post-persist-projection" : "context", ctx);
       }
-      abortUnsafeHardContext(lifecycle.latestSnapshot, ctx);
       return { messages: event.messages };
     }
   };
@@ -4081,102 +4018,6 @@ export function registerActiveContext(pi: any, options: {
           "reaches it only when the commit folds this span. Nothing in your context moved.",
       });
     }
-    if (action === "remember") {
-      // THE DIGEST'S OWN CHANNEL. A working-memory write is durable state outside the
-      // projection, so like `brief` it moves no bytes and costs no prefix cache: the
-      // table of contents the projection carries refreshes at the next commit, and this
-      // result carries the live key list in the meantime.
-      const key = String(params.key ?? "").trim();
-      if (!key) throw new Error("remember needs a key");
-      if (key.length > MEMORY_KEY_CHARS) {
-        throw new Error(`Working-memory keys have a hard ${MEMORY_KEY_CHARS}-character ` +
-          "maximum: the key is a table-of-contents line, not the note. Put the detail " +
-          "in the body.");
-      }
-      const body = String(params.body ?? "").trim();
-      if (body.length > MEMORY_BODY_CHARS) {
-        throw new Error(`Working-memory bodies have a hard ${MEMORY_BODY_CHARS}-character ` +
-          `maximum and this one is ${body.length}. Split the entry, or keep the part ` +
-          "that changes and let the transcript carry the rest: folded material stays " +
-          "losslessly recoverable by peek.");
-      }
-      const held = persistence.state!.memory ?? [];
-      const existing = held.find((entry) => entry.key === key);
-      let nextMemory: WorkingMemoryEntry[];
-      if (!body) {
-        if (!existing) {
-          throw new Error(`No working-memory entry '${key}' to remove. ${held.length
-            ? `The keys are: ${held.map((entry) => entry.key).join(", ")}.`
-            : "Working memory is empty."}`);
-        }
-        nextMemory = held.filter((entry) => entry.key !== key);
-      } else {
-        if (!existing && held.length >= MEMORY_KEYS_MAX) {
-          throw new Error(`Working memory holds its maximum of ${MEMORY_KEYS_MAX} ` +
-            "entries. Merge two entries, or remove one whose facts no longer matter " +
-            `(${toolName} {"action":"remember","key":"<key>","body":""}), then write ` +
-            "this one.");
-        }
-        const ordinal = held.reduce((max, entry) => Math.max(max, entry.ordinal), 0) + 1;
-        nextMemory = existing
-          ? held.map((entry) => entry.key === key ? { key, body, ordinal } : entry)
-          : [...held, { key, body, ordinal }];
-      }
-      const nextState = {
-        ...persistence.state!,
-        revision: persistence.state!.revision + 1,
-        ...(nextMemory.length ? { memory: nextMemory } : {}),
-      };
-      if (!nextMemory.length) delete (nextState as Partial<ActiveContextState>).memory;
-      persistence.state = nextState;
-      await persistManual(nextState, ctx);
-      updateStatus(ctx);
-      const toc = [...nextMemory].sort((left, right) => right.ordinal - left.ordinal)
-        .map((entry) => ({ key: entry.key, chars: entry.body.length }));
-      return toolPayload({
-        version: 1,
-        action,
-        key,
-        ...(body ? { chars: body.length } : { removed: true }),
-        argumentsSha256: executionArgumentsSha256,
-        durableRevision: persistence.state!.revision,
-        entries: toc,
-        activation: body
-          ? "durable immediately, and it costs your window nothing: the body lives in " +
-            "state, this list is the live view, and the table of contents in your " +
-            "context refreshes at the next commit."
-          : "removed. The table of contents in your context refreshes at the next commit.",
-      });
-    }
-    if (action === "recall") {
-      const held = persistence.state!.memory ?? [];
-      if (!held.length) {
-        throw new Error(`Working memory is empty. Write an entry with ${toolName} ` +
-          '{"action":"remember","key":"<key>","body":"..."}.');
-      }
-      const requested = params.keys === undefined && params.key === undefined
-        ? null
-        : (denseOwnArrayValues(params.keys) ?? [params.key ?? params.keys])
-          .map((value) => String(value ?? "").trim()).filter(Boolean);
-      const entries = [...held].sort((left, right) => right.ordinal - left.ordinal);
-      const chosen = requested === null
-        ? entries
-        : entries.filter((entry) => requested.includes(entry.key));
-      if (requested !== null) {
-        const missing = requested.filter((key) => !held.some((entry) => entry.key === key));
-        if (missing.length) {
-          throw new Error(`No working-memory entr${missing.length === 1 ? "y" : "ies"} ` +
-            `${missing.join(", ")}. The keys are: ` +
-            `${entries.map((entry) => entry.key).join(", ")}.`);
-        }
-      }
-      return toolPayload({
-        version: 1,
-        action,
-        argumentsSha256: executionArgumentsSha256,
-        entries: chosen.map((entry) => ({ key: entry.key, chars: entry.body.length, body: entry.body })),
-      });
-    }
     throw new Error(`Unknown ${toolName} action '${action}'`);
   };
   const toolHandler = async (
@@ -4232,12 +4073,24 @@ export function registerActiveContext(pi: any, options: {
     try {
       const snapshot = authoritativeSnapshotFor(ctx);
       const status = activeContextStatus(snapshot, persistence.state, 0, 40);
-      safeNotify(
-        ctx,
-        `Active context: ${status.totalFolds} fold(s), roots ${(status.roots as string[]).join(", ") || "none"}. ` +
-          `Use ${toolName} status for exact recursive actions.`,
-        "info",
-      );
+      const capacity = currentCapacity(ctx);
+      const staged = pendingMarks(persistence.state);
+      safeNotify(ctx, foldStatusText({
+        brand: brandNoun,
+        usedTokens: measurements.lastProviderMeasurement?.tokens ?? null,
+        budgetTokens: capacity.budgetTokens,
+        commitAtShare: snapshot.thresholds.maxTarget,
+        aimShare: snapshot.thresholds.minTarget,
+        roots: (status.roots as string[]).length,
+        totalFolds: Number(status.totalFolds ?? 0),
+        stagedMarks: staged.length,
+        stagedTokens: staged.reduce((total, mark) =>
+          total + estimatedTokens(markFreedBytes(snapshot, persistence.state!, mark)), 0),
+        pinned: persistence.state.protected.length,
+        suspended: ladder.automaticFailure?.message ?? null,
+        foldCommand: `/${commandNames.fold}`,
+        editorCommand: "/fold-editor",
+      }), "info");
     } catch (error) {
       safeNotify(ctx, `Active-context status unavailable; native Pi context is unchanged: ${String(error)}`, "warning");
     }
@@ -4377,12 +4230,15 @@ export function registerActiveContext(pi: any, options: {
         : null;
       const accounting = markAccounting(snapshot, state);
       return {
-        title: `pi-fold context editor · ${snapshot.sessionId.slice(0, 8)}`,
+        // NO SESSION ID. Eight hex characters of a value a person never types, on the
+        // title line of the surface, is the same defect the rows below it just lost.
+        title: `${brandNoun} window`,
         occupancy: {
           usedTokens: capacity.usedTokens,
           budgetTokens: capacity.budgetTokens,
           commitOccupancy: thresholds.maxTarget,
           commitDue: occupancy !== null && occupancy >= thresholds.maxTarget,
+          suspended: Boolean(ladder.automaticFailure),
         },
         blocks: buildFoldEditorData(snapshot, state, {
           foldRows: () => (state.folds ?? []).map((fold: any) => {