pi-fold 4.2.5 → 4.2.7

package/extensions/active-context.ts

@@ -4,6 +4,7 @@ import {
   objectRefKey,
   sha256Value,
   stableStringify,
+  type EvidenceRef,
 } from "./json.ts";
 import {
   contentText,
@@ -77,6 +78,7 @@ import type {
   ProviderMeasurementAnchor,
 } from "./lib/measurement.ts";
 import {
+  assignFoldParents,
   childFoldIds,
   clearPrepared,
   deriveFoldParents,
@@ -86,6 +88,8 @@ import {
   makeFoldRecordEntry,
   makeStateCheckpoint,
   makeStateDelta,
+  parseActiveContextState,
+  validateFoldForest,
   MAX_ACTIVE_FOLD_RECORDS,
   MAX_DELTAS_BETWEEN_CHECKPOINTS,
   materializeStatePersistence,
@@ -136,10 +140,12 @@ import type {
   ActiveContextSnapshot,
   ActiveContextState,
   ActiveContextThresholds,
+  ActiveFold,
   ActiveContextToolAction,
   BriefProvenance,
   FoldCandidate,
   FoldKind,
+  FoldPart,
   FoldRecordEntry,
   PreparedFold,
 } from "./lib/policy.ts";
@@ -445,6 +451,7 @@ export function registerActiveContext(pi: any, options: {
      *  session that never had any, which is what `persistedWireVersion` 0 also means and
      *  which legitimately writes the first checkpoint. See `persist`. */
     lineageUnreadable: false,
+    forkCheckpointPending: false,
     /** Deltas standing after the newest checkpoint in the branch. See
      *  `MAX_DELTAS_BETWEEN_CHECKPOINTS`: at the bound, `persist` writes a checkpoint instead
      *  of a delta, which is what keeps a load's replay bounded. */
@@ -574,6 +581,7 @@ export function registerActiveContext(pi: any, options: {
     wallEpisodeOpen: false,
     recoveryAttempts: 0,
     pendingRejection: null as { status: number; ordinal: number } | null,
+    restoreRevisionGap: false,
     lastRecovery: null as Record<string, unknown> | null,
     instrumentationQueue: Promise.resolve<void>(undefined),
   };
@@ -1157,6 +1165,18 @@ export function registerActiveContext(pi: any, options: {
     }
   };
 
+  // WHAT PI'S CONTEXT EVENT WOULD HAND OVER, BEFORE ONE HAS ARRIVED (2026-10-05). Pi's
+  // ExtensionRunner.emitContext filters role "system" before any handler sees a message;
+  // buildSessionContext does not. A `/fold` before the first context event cut folds from
+  // the unfiltered view in session 01a10161: spans that crossed a system-prompt change
+  // looked broken, and that commit erased 739 of 920 folds.
+  const piContextMessages = (ctx: any): unknown[] | null => {
+    const messages = ctx.sessionManager.buildSessionContext?.()?.messages;
+    return Array.isArray(messages)
+      ? messages.filter((message: any) => message?.role !== "system")
+      : null;
+  };
+
   const snapshotForEvent = (ctx: any, messages: unknown[]): ActiveContextSnapshot =>
     timedDerivation(() => mapActiveContext({
     sessionId: ctx.sessionManager.getSessionId(),
@@ -1172,6 +1192,146 @@ export function registerActiveContext(pi: any, options: {
     thresholds,
   }));
 
+  const forkEntriesForSession = (entries: any[], sessionId: string): any[] => {
+    // A child checkpoint supersedes inherited records; keep child records and validate anything newer strictly.
+    const checkpointIndex = entries.findLastIndex((entry) => entry?.type === "custom" &&
+      entry.customType === stateEntryType && ownValue(entry.data, "sessionId") === sessionId &&
+      ownValue(entry.data, "version") === 2 && ownValue(entry.data, "kind") === "checkpoint");
+    if (checkpointIndex < 0) return entries;
+    const inheritedOwners = new Set(entries.slice(0, checkpointIndex).flatMap((entry) => {
+      if (entry?.type !== "custom" || entry.customType !== stateEntryType) return [];
+      const owner = ownValue(entry.data, "sessionId");
+      return typeof owner === "string" && owner !== sessionId ? [owner] : [];
+    }));
+    return entries.filter((entry, index) => {
+      if (entry?.type !== "custom" || entry.customType !== foldRecordEntryType || index >= checkpointIndex) return true;
+      const owner = ownValue(entry.data, "sessionId");
+      return owner === sessionId || typeof owner !== "string" || !inheritedOwners.has(owner);
+    });
+  };
+
+  const forkEntriesForOwner = (entries: any[], sessionId: string): any[] => entries.filter((entry) =>
+    entry?.type !== "custom" || entry.customType !== foldRecordEntryType ||
+    ownValue(entry.data, "sessionId") === sessionId,
+  );
+
+  const rebaseForkState = (
+    state: ActiveContextState,
+    snapshot: ActiveContextSnapshot,
+    sessionId: string,
+  ): ActiveContextState => {
+    const refsByEntryId = new Map<string, ActiveContextSnapshot["branchObjects"]>();
+    for (const item of snapshot.branchObjects) {
+      const refs = refsByEntryId.get(item.ref.entryId) ?? [];
+      refs.push(item);
+      refsByEntryId.set(item.ref.entryId, refs);
+    }
+    const rebaseRef = (ref: ActiveContextState["protected"][number]) => {
+      const matches = refsByEntryId.get(ref.entryId)?.filter((item) =>
+        item.ref.role === ref.role,
+      ) ?? [];
+      if (matches.length !== 1) {
+        throw new Error(`Inherited active-context evidence ${ref.entryId} is missing or ambiguous in the fork branch`);
+      }
+      // Pi's entry identity locates the source; preserve its recorded digest so the
+      // runtime can report content drift instead of silently erasing its provenance.
+      return { ...clone(ref), sessionId };
+    };
+    const rebaseParts = (parts: FoldPart[], resolveFoldId: (id: string) => string): FoldPart[] =>
+      parts.map((part) => {
+        if (part.kind === "raw") return { kind: "raw", ref: rebaseRef(part.ref) };
+        return { kind: "fold", foldId: resolveFoldId(part.foldId) };
+      });
+    const sourceFolds = new Map(state.folds.map((fold) => [fold.id, fold]));
+    const rebasedFolds = new Map<string, { fold: ActiveFold; refs: EvidenceRef[] }>();
+    const visiting = new Set<string>();
+    const rebaseFold = (id: string): { fold: ActiveFold; refs: EvidenceRef[] } => {
+      const existing = rebasedFolds.get(id);
+      if (existing) return existing;
+      const source = sourceFolds.get(id);
+      if (!source) throw new Error(`Inherited active-context fold ${id} is missing`);
+      if (visiting.has(id)) throw new Error(`Inherited active-context fold cycle at ${id}`);
+      visiting.add(id);
+      const parts = rebaseParts(source.parts, (foldId) => rebaseFold(foldId).fold.id);
+      const refs = source.parts.flatMap((part) => {
+        if (part.kind === "raw") return [rebaseRef(part.ref)];
+        return rebaseFold(part.foldId).refs;
+      });
+      const fold: ActiveFold = {
+        ...source,
+        id: foldIdFor(source.kind, parts),
+        parentId: null,
+        parts,
+        sourceSha256: sha256Value(refs),
+      };
+      const rebased = { fold, refs };
+      visiting.delete(id);
+      rebasedFolds.set(id, rebased);
+      return rebased;
+    };
+    const folds = assignFoldParents(state.folds.map((fold) => rebaseFold(fold.id).fold));
+    const rebasedFoldId = (id: string): string => {
+      const rebased = rebasedFolds.get(id);
+      if (!rebased) throw new Error(`Inherited active-context state references missing fold ${id}`);
+      return rebased.fold.id;
+    };
+    let rebased: ActiveContextState;
+    try {
+      const expanded = state.expanded.map(rebasedFoldId);
+      const leases = Object.fromEntries(Object.entries(state.leases).map(([id, value]) => [rebasedFoldId(id), value]));
+      const briefs = Object.fromEntries(Object.entries(state.briefs ?? {}).map(([id, brief]) => [rebasedFoldId(id), brief]));
+      const pendingMarks = (state.pendingMarks ?? []).map((mark) => {
+        if (mark.mark === "refold") return { ...mark, id: rebasedFoldId(mark.id) };
+        const parts = rebaseParts(mark.parts, rebasedFoldId);
+        return { ...mark, id: foldIdFor(mark.kind, parts), parts };
+      });
+      rebased = clearPrepared({
+        ...state,
+        sessionId,
+        folds,
+        expanded,
+        protected: state.protected.map(rebaseRef),
+        leases,
+        ...(state.pendingMarks ? { pendingMarks } : {}),
+        ...(state.briefs ? { briefs } : {}),
+      });
+    } catch (error) {
+      // Keep forest errors ahead of curation errors without validating successful rebases twice.
+      validateFoldForest(folds);
+      throw error;
+    }
+    return parseActiveContextState(rebased, sessionId);
+  };
+
+  const prepareForkRecovery = (
+    ctx: any,
+    branchEntries: any[],
+    sessionId: string,
+    restoredMessages: unknown,
+    restoreError: unknown,
+  ): { inherited: MaterializedStatePersistence; snapshot: ActiveContextSnapshot } => {
+    const inheritedStateEntry = branchEntries.findLast((entry) =>
+      entry?.type === "custom" && entry.customType === stateEntryType,
+    );
+    const inheritedSessionId = ownValue(inheritedStateEntry?.data, "sessionId");
+    if (typeof inheritedSessionId !== "string" || !inheritedSessionId || inheritedSessionId === sessionId) {
+      throw new Error("No distinct inherited session ID is available for fork recovery", { cause: restoreError });
+    }
+    const inherited = materializeStatePersistence(
+      forkEntriesForOwner(branchEntries, inheritedSessionId),
+      inheritedSessionId,
+      stateEntryType,
+      foldRecordEntryType,
+    );
+    if (!Array.isArray(restoredMessages)) {
+      throw new Error("Pi did not provide the fork branch messages needed to rebase active-context state", {
+        cause: restoreError,
+      });
+    }
+    const snapshot = snapshotForEvent(ctx, restoredMessages);
+    return { inherited, snapshot };
+  };
+
   const authoritativeSnapshotFor = (ctx: any): ActiveContextSnapshot => {
     const sessionId = ctx.sessionManager.getSessionId();
     if (!lifecycle.latestSnapshot || lifecycle.latestSnapshot.sessionId !== sessionId) {
@@ -1239,7 +1399,7 @@ export function registerActiveContext(pi: any, options: {
     model: measurement.model,
   });
 
-  const load = (ctx: any, preserveThresholdDecision = false): void => {
+  const load = (ctx: any, preserveThresholdDecision = false, forkedSessionHint = false): void => {
     lifecycle.generation += 1;
     lifecycle.shuttingDown = false;
     cancelPreparation();
@@ -1279,6 +1439,7 @@ export function registerActiveContext(pi: any, options: {
     curation.contextCalls = 0;
     curation.recoveryAttempts = 0;
     curation.pendingRejection = null;
+    curation.restoreRevisionGap = false;
     curation.lastRecovery = null;
     ladder.lastAutomaticAction = null;
     ladder.automaticFailure = null;
@@ -1287,14 +1448,19 @@ export function registerActiveContext(pi: any, options: {
     measurements.providerMeasurementByMessageSha.clear();
     measurements.providerMeasurementAnchorByMessageSha.clear();
     const sessionId = ctx.sessionManager.getSessionId();
+    const forkedSession = forkedSessionHint || Boolean(ctx.sessionManager.getHeader?.()?.parentSession);
     let restored: ActiveContextState | null = null;
     let restoreError: unknown = null;
     let restoredPersistence: MaterializedStatePersistence | null = null;
     let measurementRestoreError: unknown = null;
+    let forkBaseline = false;
+    let startupSnapshot: ActiveContextSnapshot | null = null;
+    let aheadReceiptRevision: number | null = null;
     const branchEntries = [...ctx.sessionManager.getBranch()];
+    const restoredMessages = piContextMessages(ctx);
     try {
       restoredPersistence = materializeStatePersistence(
-        branchEntries,
+        forkedSession ? forkEntriesForSession(branchEntries, sessionId) : branchEntries,
         sessionId,
         stateEntryType,
         foldRecordEntryType,
@@ -1302,10 +1468,28 @@ export function registerActiveContext(pi: any, options: {
       restored = restoredPersistence.state;
     } catch (error) {
       restoreError = error;
+      if (forkedSession) {
+        try {
+          const recovery = prepareForkRecovery(ctx, branchEntries, sessionId, restoredMessages, error);
+          startupSnapshot = recovery.snapshot;
+          restored = rebaseForkState(recovery.inherited.state, startupSnapshot, sessionId);
+          restoredPersistence = recovery.inherited;
+          forkBaseline = true;
+          restoreError = null;
+        } catch (forkError) {
+          restoreError = forkError;
+        }
+      }
     }
     for (const entry of branchEntries) {
       if (entry?.type !== "custom") continue;
       if (entry.customType !== providerMeasurementEntryType) continue;
+      const receiptSessionId = ownValue(entry.data, "sessionId");
+      if (forkedSession && typeof receiptSessionId === "string" && receiptSessionId !== sessionId) {
+        try { parseProviderContextMeasurementReceipt(entry.data, receiptSessionId); }
+        catch (error) { measurementRestoreError = error; }
+        continue;
+      }
       try {
         const receipt = parseProviderContextMeasurementReceipt(entry.data, sessionId);
         const boundRevision = measurements.providerMeasurementRevisionByMessageSha.get(receipt.messageSha256);
@@ -1318,6 +1502,12 @@ export function registerActiveContext(pi: any, options: {
           throw new Error("One provider response has conflicting durable measurement receipts");
         }
         measurements.providerMeasurementByMessageSha.set(receipt.messageSha256, receipt);
+        if (restoreError === null && receipt.projectionRevision > (restored?.revision ?? 0)) {
+          aheadReceiptRevision = Math.max(aheadReceiptRevision ?? 0, receipt.projectionRevision);
+          // This receipt describes a projection whose state is absent from this branch.
+          // Keep the original receipt, but never anchor the restored window to it.
+          continue;
+        }
         const fingerprint = restoredPersistence?.projectionFingerprints.get(receipt.projectionRevision);
         if (fingerprint) {
           measurements.providerMeasurementAnchorByMessageSha.set(receipt.messageSha256, {
@@ -1336,6 +1526,12 @@ export function registerActiveContext(pi: any, options: {
       }
     }
     const durableRestored = restored ?? emptyActiveContextState(sessionId);
+    if (restoreError === null && aheadReceiptRevision !== null) {
+      curation.restoreRevisionGap = true;
+      safeNotify(ctx, `A provider receipt names revision ${aheadReceiptRevision}, ahead of the restored ` +
+        `${brandNoun} ledger at revision ${durableRestored.revision}. Existing folds and raw history are retained; ` +
+        "the next context pass will rebuild eligible folds from that history. Missing ledger changes cannot be replayed.", "warning");
+    }
     persistence.state = durableRestored.prepared ? clearPrepared(durableRestored) : clone(durableRestored);
     // AN UNREADABLE LINEAGE IS NOT AN EMPTY ONE (2026-09-07). `persistedWireVersion` reads
     // 0 for both, and `persist` writes a CHECKPOINT whenever it is not 2, so a restore that
@@ -1348,23 +1544,25 @@ export function registerActiveContext(pi: any, options: {
     // the same ids with drifted bytes, 48 of 85 ids left conflicting. The two states are
     // told apart here, once, rather than at each of `persist`'s callers.
     persistence.lineageUnreadable = restoreError !== null;
-    persistence.persistedWireVersion = restoredPersistence?.wireVersion ?? 0;
-    persistence.deltasSinceCheckpoint = restoredPersistence?.deltasSinceCheckpoint ?? 0;
-    persistence.persistedFoldRecords = restoredPersistence?.records ?? new Map<string, FoldRecordEntry>();
-    persistence.persistedStateSha256 = restoredPersistence?.stateSha256 ?? semanticStateSha256(durableRestored);
-    const restoredMessages = ctx.sessionManager.buildSessionContext?.()?.messages;
+    const persistedRestore = forkBaseline ? null : restoredPersistence;
+    const persistedState = forkBaseline ? emptyActiveContextState(sessionId) : durableRestored;
+    persistence.persistedWireVersion = persistedRestore?.wireVersion ?? 0;
+    persistence.deltasSinceCheckpoint = persistedRestore?.deltasSinceCheckpoint ?? 0;
+    persistence.persistedFoldRecords = persistedRestore?.records ?? new Map<string, FoldRecordEntry>();
+    persistence.persistedStateSha256 = persistedRestore?.stateSha256 ?? semanticStateSha256(persistedState);
+    persistence.persisted = clone(persistedState);
+    persistence.forkCheckpointPending = forkBaseline;
     measurements.lastProviderMeasurement = latestProviderContextMeasurement(
       Array.isArray(restoredMessages) ? restoredMessages : [],
       budgetWindowFor(ctx),
       ctx.model,
     );
     measurements.latestRatio = contextUsageRatio(measurements.lastProviderMeasurement);
-    persistence.persisted = clone(durableRestored);
     // Reuse Pi's own reconstructed messages, including custom messages and branch
     // selection. This is ONLY a view for the bar: do not populate latestSnapshot,
     // advance the frontier, persist a projection, or pretend a provider event occurred.
     if (typeof ctx.ui?.setWidget === "function" && Array.isArray(restoredMessages)) {
-      try { foldBar.startupSnapshot = snapshotForEvent(ctx, restoredMessages); }
+      try { foldBar.startupSnapshot = startupSnapshot ?? snapshotForEvent(ctx, restoredMessages); }
       catch { /* Keep the honest mapping fallback if the host cannot supply a view. */ }
     }
     // The warning names the CONSEQUENCE and not only the cause: "state was ignored" read as
@@ -1412,7 +1610,7 @@ export function registerActiveContext(pi: any, options: {
         next = persistenceProjection(next, projectionSnapshot);
       }
       next.folds = normalizeFoldsForPersistedRecords(next.folds, persistence.persistedFoldRecords);
-      if (sameStateProjection(next, persistence.persisted)) {
+      if (sameStateProjection(next, persistence.persisted) && !persistence.forkCheckpointPending) {
         if (arrivingFoldIds.length) {
           const lost = clone(persistence.state).folds.find((fold) => fold.id === arrivingFoldIds[0]);
           const lostRefs = lost ? flattenFoldRefs(lost, persistence.state) : [];
@@ -1491,6 +1689,7 @@ export function registerActiveContext(pi: any, options: {
       await pi.appendEntry(stateEntryType, wire);
       persistence.persisted = clone(next);
       persistence.persistedWireVersion = 2;
+      persistence.forkCheckpointPending = false;
       persistence.deltasSinceCheckpoint = wire.kind === "checkpoint" ? 0 : persistence.deltasSinceCheckpoint + 1;
       persistence.persistedStateSha256 = wire.stateSha256;
       persistence.state = lifecycle.shuttingDown ? null : clone(next);
@@ -2454,7 +2653,8 @@ export function registerActiveContext(pi: any, options: {
         recovered,
         note: measured.over
           ? `The rebuilt request is still ${measured.tokens} tokens against a ${measured.budgetTokens}-token ` +
-            "serving budget, so the run stops here rather than sending a request the provider will reject again."
+            "serving budget by our estimate. Available folds have been attempted; the retry is being sent, " +
+            "and the provider will determine whether it fits. Recovery is not yet established."
           : recovered
             ? "A rollback was required: the provider rejected the last request, which overfilled the serving " +
               `budget at ${rejectedTokens} estimated tokens against ${measured.budgetTokens}. This pass ` +
@@ -2831,7 +3031,7 @@ export function registerActiveContext(pi: any, options: {
       if (addition.added) { state = addition.state; consolidationAdded += 1; }
     }
     const capacity = servingCapacity(snapshot.contextWindow);
-    const usedTokens = capacity.usedTokens;
+    const usedTokens = curation.restoreRevisionGap ? null : capacity.usedTokens;
     const budgetTokens = capacity.budgetTokens;
     const overflowExempt = userRequested || curation.recoveryAttempts > 0 ||
       (usedTokens !== null && budgetTokens > 0 && usedTokens > budgetTokens);
@@ -3219,8 +3419,10 @@ export function registerActiveContext(pi: any, options: {
     phase: string,
     operation: () => Promise<Record<string, unknown> | null>,
   ): Promise<Record<string, unknown> | null> => {
-    if (!persistence.state || !measurements.lastProviderMeasurement ||
-        !durableProviderMeasurementMatches(measurements.lastProviderMeasurement)) return null;
+    const unmeasuredRecovery = phase === "restore-revision-gap" ||
+      (phase === "projection-budget" && curation.pendingRejection !== null && !measurements.lastProviderMeasurement);
+    if (!persistence.state || (!unmeasuredRecovery && (!measurements.lastProviderMeasurement ||
+        !durableProviderMeasurementMatches(measurements.lastProviderMeasurement)))) return null;
     if (ladder.automaticFailure) {
       ladder.automaticFailure.suppressedCallbacks = Math.min(
         Number.MAX_SAFE_INTEGER,
@@ -3280,10 +3482,11 @@ export function registerActiveContext(pi: any, options: {
       return [];
     }
   };
-  const enqueueLifecycleLoad = async (ctx: any): Promise<void> => {
+  const enqueueLifecycleLoad = async (ctx: any, forkedSessionHint = false): Promise<void> => {
     const operation = lifecycle.contextQueue.then(() => {
       const loadOperation = ladder.actionQueue.then(async () => {
-        load(ctx);
+        load(ctx, false, forkedSessionHint);
+        if (persistence.forkCheckpointPending) await persist(ctx);
         await recoverNativeReceipts(ctx);
       });
       ladder.actionQueue = loadOperation.catch(() => undefined);
@@ -3293,8 +3496,12 @@ export function registerActiveContext(pi: any, options: {
     await operation;
   };
 
-  const safeLifecycleLoad = async (ctx: any, phase: "session-start" | "session-tree"): Promise<void> => {
-    try { await enqueueLifecycleLoad(ctx); }
+  const safeLifecycleLoad = async (
+    ctx: any,
+    phase: "session-start" | "session-tree",
+    forkedSessionHint = false,
+  ): Promise<void> => {
+    try { await enqueueLifecycleLoad(ctx, forkedSessionHint); }
     catch (error) {
       const sessionId = ctx.sessionManager.getSessionId();
       if (!persistence.state || persistence.state.sessionId !== sessionId) persistence.state = emptyActiveContextState(sessionId);
@@ -3316,12 +3523,14 @@ export function registerActiveContext(pi: any, options: {
     });
   };
 
-  pi.on("session_start", async (_event: unknown, ctx: any) => {
-    await safeLifecycleLoad(ctx, "session-start");
+  pi.on("session_start", async (event: unknown, ctx: any) => {
+    await safeLifecycleLoad(ctx, "session-start", ownValue(event, "reason") === "fork");
     recordResolvedCapacity(ctx);
     await armRollbackLane(ctx);
   });
-  pi.on("session_tree", async (_event: unknown, ctx: any) => { await safeLifecycleLoad(ctx, "session-tree"); });
+  pi.on("session_tree", async (_event: unknown, ctx: any) => {
+    await safeLifecycleLoad(ctx, "session-tree", Boolean(ctx.sessionManager.getHeader?.()?.parentSession));
+  });
   pi.on("session_compact", async (event: Record<string, unknown>, ctx: any) => {
     const reason = boundReceiptText(ownValue(event, "reason"), 64, "unknown");
     const decision = makeNativeDecision(
@@ -3496,6 +3705,15 @@ export function registerActiveContext(pi: any, options: {
       // neither of their inputs. What it changes is WHEN the agent learns a fold exists,
       // which is now while the material it covers is still in front of it.
       advanceFoldFrontier(snapshot);
+      if (curation.restoreRevisionGap && !ladder.automaticFailure) {
+        mutationAttempted = true;
+        const action = await attemptAutomaticCommit(snapshot, ctx, "restore-revision-gap", 1);
+        if (action) {
+          persistedSucceeded = true;
+          projected = projectWithAdvisory(snapshot);
+        }
+        curation.restoreRevisionGap = false;
+      }
       // BEFORE the fence, so an ordinary crossing is an ordinary commit and the fence is
       // left holding only the requests that genuinely will not fit.
       if (await enforceBandTop(snapshot, ctx)) {
@@ -3748,7 +3966,8 @@ export function registerActiveContext(pi: any, options: {
     rollback.attempts += 1;
     refuseRollback(
       "the overflow arrived without a compaction event, so pi never stripped the failed message from agent " +
-      "state and a tree rollback would leave the tree and agent state disagreeing (auto-compaction is off)",
+      "state and a tree rollback would leave the tree and agent state disagreeing (auto-compaction is off); " +
+      `use /${commandNames.fold} to commit eligible stale context, then retry explicitly`,
       "message_end",
       ctx,
     );
@@ -3816,7 +4035,7 @@ export function registerActiveContext(pi: any, options: {
         "turn after an unsatisfied tool call is a malformed transcript for every provider";
     }
     const occupancyBefore = measurements.lastProviderMeasurement?.tokens ?? null;
-    const notice = rollbackNoticeText({
+    let notice = rollbackNoticeText({
       brandNoun,
       toolName,
       tokensRolledBack: estimatedTokens(rolledBackBytes),
@@ -3840,7 +4059,13 @@ export function registerActiveContext(pi: any, options: {
         }
       }
     }
-    if (!replayed) safeNotify(ctx, notice, "warning");
+    if (!replayed) {
+      notice = rollbackNoticeText({
+        brandNoun, toolName, tokensRolledBack: estimatedTokens(rolledBackBytes),
+        entriesAbandoned: abandoned.length, replayed: false, replaySkipReason,
+      });
+      safeNotify(ctx, notice, "warning");
+    }
     const record = emit("context.rollback", {
       trigger: "session_before_compact",
       armed: true,
@@ -3897,6 +4122,26 @@ export function registerActiveContext(pi: any, options: {
       try { updateStatus(ctx); } catch { }
       return undefined;
     }
+    // PI CHECKS BEFORE THE FIRST PROMPT, BEFORE ANY CONTEXT EVENT (2026-10-05). After a
+    // context_edit (Pi's own retry recovery writes one per failed attempt) Pi stops trusting
+    // the last provider count and estimates the whole raw transcript, folds unseen: 134% on
+    // session 01a10834, 260% on 01a10161. This used to throw for want of a snapshot, suspend
+    // folding and let native compaction run, which ran Pi out of memory on a 272MB session.
+    // The context event that follows projects and commits on the projection itself, so the
+    // boundary is cancelled and folding stays on.
+    const currentSnapshot = lifecycle.latestSnapshot;
+    if (!currentSnapshot || currentSnapshot.sessionId !== ctx.sessionManager.getSessionId()) {
+      nativeCompaction.lastThresholdDecision = {
+        handled: true,
+        retry: false,
+        reason: `${contextBrand(brandNoun)} blocked stock automatic compaction before the first context event; ` +
+          "the projection is measured when the request is built",
+        compactionReason: reason,
+        nativeCompactionCompleted: false,
+      };
+      try { updateStatus(ctx); } catch { }
+      return { cancel: true };
+    }
     let handoff: Record<string, unknown> | null = null;
     try {
       const snapshot = authoritativeSnapshotFor(ctx);
@@ -4794,7 +5039,7 @@ export function registerActiveContext(pi: any, options: {
       if (!persistence.state) persistence.state = emptyActiveContextState(ctx.sessionManager.getSessionId());
       const snapshot = lifecycle.latestSnapshot
         ? authoritativeSnapshotFor(ctx)
-        : snapshotForEvent(ctx, ctx.sessionManager.buildSessionContext().messages);
+        : snapshotForEvent(ctx, piContextMessages(ctx) ?? []);
       if (!lifecycle.latestSnapshot) lifecycle.latestSnapshot = snapshot;
       const divider = args.indexOf(" -- ");
       const selector = (divider >= 0 ? args.slice(0, divider) : args).trim();
@@ -4807,14 +5052,19 @@ export function registerActiveContext(pi: any, options: {
         const occupancy = capacity.usedTokens !== null && capacity.budgetTokens > 0
           ? capacity.usedTokens / capacity.budgetTokens
           : null;
-        const topUp = occupancy !== null && occupancy >= thresholds.maxTarget;
+        const estimatedOccupancy = occupancy ?? (capacity.budgetTokens > 0
+          ? estimatedTokens(pricedBytes(projectActiveContext(snapshot, persistence.state!))) / capacity.budgetTokens
+          : 0);
+        const topUp = Boolean(curation.restoreRevisionGap) || estimatedOccupancy >= thresholds.maxTarget;
         const committed = await runCommitEpoch(snapshot, "user-command", topUp, measurements.latestRatio, true);
         // Until this lands the epoch's folds are in the event stream and nowhere else.
         // Swallowing the failure here announced a commit that does not exist and left the
         // session computing folds it would keep throwing away, which is the dead session
         // gate 122 was built for, reached through the user's own command instead.
-        try { await persist(ctx); }
-        catch (error) {
+        try {
+          await persist(ctx);
+          if (committed) curation.restoreRevisionGap = false;
+        } catch (error) {
           suspendAutomatic(error, "user-command", ctx);
           updateStatus(ctx);
           throw error;
@@ -4904,7 +5154,7 @@ export function registerActiveContext(pi: any, options: {
     }
     const snapshot = lifecycle.latestSnapshot
       ? authoritativeSnapshotFor(ctx)
-      : snapshotForEvent(ctx, ctx.sessionManager.buildSessionContext().messages);
+      : snapshotForEvent(ctx, piContextMessages(ctx) ?? []);
     if (!lifecycle.latestSnapshot) lifecycle.latestSnapshot = snapshot;
     if (!persistence.state) throw new Error("The context window is empty; there is nothing to show yet");
 

package/extensions/lib/measurement.ts

@@ -69,8 +69,15 @@ export function contentDrifted(snapshot: ActiveContextSnapshot, ref: EvidenceRef
   return item !== null && item.ref!.sha256 !== ref.sha256;
 }
 
+// PI NEVER SHOWS AN EXTENSION ITS SYSTEM MESSAGES (2026-10-05). The context event filters
+// role "system" (ExtensionRunner.emitContext), so a system-prompt-change entry has no
+// place in the window and cannot break a span. Folds cut from a view that did include them
+// (a `/fold` before the first context event, session 01a10161) carry such refs; they are
+// skipped here rather than unseating the fold and, at the next commit, its whole subtree.
 export function refsInOrder(snapshot: ActiveContextSnapshot, refs: EvidenceRef[]): number[] | null {
-  const indices = refs.map((ref) => exactMapped(snapshot, ref)?.index ?? -1);
+  const placed = refs.filter((ref) => ref.role !== "system");
+  if (!placed.length) return null;
+  const indices = placed.map((ref) => exactMapped(snapshot, ref)?.index ?? -1);
   if (indices.some((index) => index < 0) || new Set(indices).size !== indices.length) return null;
   for (let index = 1; index < indices.length; index += 1) if (indices[index] !== indices[index - 1] + 1) return null;
   return indices;

package/extensions/lib/rollback.ts

@@ -152,11 +152,11 @@ export function rollbackNoticeText(input: {
 }): string {
   const head = "The provider rejected the last request because the context exceeded its input limit. " +
     `${input.brandNoun} rolled the session back past that request (${input.entriesAbandoned} entry(s), ` +
-    `about ${input.tokensRolledBack} tokens, kept in the tree as an abandoned branch) and folded the ` +
-    "stale window to make room.";
+    `about ${input.tokensRolledBack} tokens, kept in the tree as an abandoned branch).`;
   if (input.replayed) {
-    return `${head} The request is being reissued now, so continue the work you were doing; nothing was lost, ` +
-      `and the folded material is still readable through ${input.toolName}.`;
+    return `${head} The request is being reissued now. Its context pass will attempt to fold eligible stale ` +
+      "material; the recovery receipt will report the result. Original entries remain in the session tree, " +
+      `and folded material is still readable through ${input.toolName}.`;
   }
   return `${head} The request was NOT reissued: ${input.replaySkipReason ?? "the rolled-back tail is not replayable"}. ` +
     "Reissue the work yourself from the state you can see.";

package/extensions/lib/scheduling.ts

@@ -699,9 +699,12 @@ export function commitCoverage(input: {
   budgetTokens: number;
 }): CommitCoverage {
   const { snapshot, state, usedTokens, budgetTokens } = input;
-  const targetShare = usedTokens === null || !(budgetTokens > 0)
+  // Before the first response, or after a restore, an estimate can size a commit.
+  // It never decides whether the resulting request is allowed to reach the provider.
+  const occupancyTokens = usedTokens ?? estimatedTokens(pricedBytes(projectActiveContext(snapshot, state)));
+  const targetShare = !(budgetTokens > 0)
     ? 0
-    : Math.max(0, (usedTokens - snapshot.thresholds.minTarget * budgetTokens) / budgetTokens);
+    : Math.max(0, (occupancyTokens - snapshot.thresholds.minTarget * budgetTokens) / budgetTokens);
   const accounting = markAccounting(snapshot, state);
   const markedShare = accounting.eligibleFreedBudgetShare;
   const targetTokens = Math.round(targetShare * budgetTokens);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-fold",
-  "version": "4.2.5",
+  "version": "4.2.7",
   "description": "Lossless context folding for the Pi coding agent: only the oldest context changes; the fresh window stays untouched.",
   "keywords": [
     "pi-package",