pi-fold 4.2.6 → 4.2.8

package/README.md

@@ -110,7 +110,7 @@ Four commands ship for the human: `/fold-status`, `/fold` (commit every staged m
 
 <picture>
   <source media="(prefers-color-scheme: dark)" srcset="https://raw.githubusercontent.com/shaneconner/fold/main/media/marks-and-commits-dark.svg">
-  <img alt="A completed unit becomes a pending mark that leaves the window and its cached prefix untouched. Marks repeat for free below maxTarget; at maxTarget one commit applies every standing mark in a single rewrite. From the brief, peek appends the exact bytes and expand restores them in place, both after verifying the SHA-256." src="https://raw.githubusercontent.com/shaneconner/fold/main/media/marks-and-commits-light.svg">
+  <img alt="A completed unit becomes a pending mark that leaves the window and its cached prefix untouched. Marks repeat for free below maxTarget; at maxTarget one commit applies every standing mark in a single rewrite. From the brief, peek appends verified history without thinking blocks and expand restores the original messages in place." src="https://raw.githubusercontent.com/shaneconner/fold/main/media/marks-and-commits-light.svg">
 </picture>
 
 A mark moves nothing. The moment a tool batch or chapter closes, the runtime cuts it into a pending mark, up to eight cuts per pass, stalest first. The mark lives in durable state outside the window, so the projection stays byte-identical and the cached prefix survives. Marks accumulate for free until one commit applies all of them in a single rewrite.
@@ -136,10 +136,12 @@ Every commit re-reads roughly `minTarget` of the budget uncached, so a shallower
 
 ### Peek and expand
 
-`peek` returns a fold's exact SHA-256-verified source as a tool result at any depth, with the ancestors still collapsed. It appends and never edits the prefix, so checking what a fold holds costs nothing a commit has to pay for. It takes `offset` and `bytes` for a bounded slice and reads any child fold by id, so a large fold has a narrow read.
+`peek` verifies a fold's original source against its SHA-256 references, then returns a history view as a tool result at any depth, with the ancestors still collapsed. Assistant thinking blocks and their opaque signatures are omitted before slicing; visible text, tool calls and tool results stay verbatim. It appends and never edits the prefix, so checking what a fold holds costs nothing a commit has to pay for. It takes `offset` and `bytes` within that view for a bounded slice and reads any child fold by id, so a large fold has a narrow read. The result reports `sourceFormat: "messages-without-thinking"` and `omittedThinkingBlocks`. Pi's stored transcript and exact `expand` restoration remain unchanged.
 
 A peek is ephemeral by default: the bytes ride the window until the model's next message, then their place holds a one-line placeholder and the reply that used them is the surviving trace. Peeking again is lossless and costs one append. The default follows what the agent chose: on the run measured for it, six of seven peeks asked for ephemeral at first exposure. `expand` is the commitment, restoring the source in place until the fold is refolded. Looking is not the same as taking.
 
+Anthropic documents [reasoning-extraction refusals](https://platform.claude.com/docs/en/build-with-claude/refusals-and-fallback#keep-reasoning-in-thinking-blocks). Omitting native thinking from history reads avoids replaying it as ordinary text, but does not guarantee that a provider will accept a request. Existing tool results can still contain previously printed transcript excerpts. A durable peek stays in later requests, and reloading makes an ephemeral peek durable. Fold does not automatically retry content-filter refusals or remove arbitrary transcript text.
+
 ### Clipping, pins and the compaction path
 
 Tool results get a second, lighter treatment at the same commit. Results in the oldest `toolFoldThreshold` share of the projected window, half of it by default, are clipped in view: the identifying head stays, the rest becomes a marker naming the entry id that peeks it back, and the stored bytes are untouched, so a later fold of that span still encodes the full result.

package/extensions/active-context.ts

@@ -4,6 +4,7 @@ import {
   objectRefKey,
   sha256Value,
   stableStringify,
+  type EvidenceRef,
 } from "./json.ts";
 import {
   contentText,
@@ -77,6 +78,7 @@ import type {
   ProviderMeasurementAnchor,
 } from "./lib/measurement.ts";
 import {
+  assignFoldParents,
   childFoldIds,
   clearPrepared,
   deriveFoldParents,
@@ -86,6 +88,8 @@ import {
   makeFoldRecordEntry,
   makeStateCheckpoint,
   makeStateDelta,
+  parseActiveContextState,
+  validateFoldForest,
   MAX_ACTIVE_FOLD_RECORDS,
   MAX_DELTAS_BETWEEN_CHECKPOINTS,
   materializeStatePersistence,
@@ -136,10 +140,12 @@ import type {
   ActiveContextSnapshot,
   ActiveContextState,
   ActiveContextThresholds,
+  ActiveFold,
   ActiveContextToolAction,
   BriefProvenance,
   FoldCandidate,
   FoldKind,
+  FoldPart,
   FoldRecordEntry,
   PreparedFold,
 } from "./lib/policy.ts";
@@ -445,6 +451,7 @@ export function registerActiveContext(pi: any, options: {
      *  session that never had any, which is what `persistedWireVersion` 0 also means and
      *  which legitimately writes the first checkpoint. See `persist`. */
     lineageUnreadable: false,
+    forkCheckpointPending: false,
     /** Deltas standing after the newest checkpoint in the branch. See
      *  `MAX_DELTAS_BETWEEN_CHECKPOINTS`: at the bound, `persist` writes a checkpoint instead
      *  of a delta, which is what keeps a load's replay bounded. */
@@ -574,6 +581,7 @@ export function registerActiveContext(pi: any, options: {
     wallEpisodeOpen: false,
     recoveryAttempts: 0,
     pendingRejection: null as { status: number; ordinal: number } | null,
+    restoreRevisionGap: false,
     lastRecovery: null as Record<string, unknown> | null,
     instrumentationQueue: Promise.resolve<void>(undefined),
   };
@@ -1184,6 +1192,146 @@ export function registerActiveContext(pi: any, options: {
     thresholds,
   }));
 
+  const forkEntriesForSession = (entries: any[], sessionId: string): any[] => {
+    // A child checkpoint supersedes inherited records; keep child records and validate anything newer strictly.
+    const checkpointIndex = entries.findLastIndex((entry) => entry?.type === "custom" &&
+      entry.customType === stateEntryType && ownValue(entry.data, "sessionId") === sessionId &&
+      ownValue(entry.data, "version") === 2 && ownValue(entry.data, "kind") === "checkpoint");
+    if (checkpointIndex < 0) return entries;
+    const inheritedOwners = new Set(entries.slice(0, checkpointIndex).flatMap((entry) => {
+      if (entry?.type !== "custom" || entry.customType !== stateEntryType) return [];
+      const owner = ownValue(entry.data, "sessionId");
+      return typeof owner === "string" && owner !== sessionId ? [owner] : [];
+    }));
+    return entries.filter((entry, index) => {
+      if (entry?.type !== "custom" || entry.customType !== foldRecordEntryType || index >= checkpointIndex) return true;
+      const owner = ownValue(entry.data, "sessionId");
+      return owner === sessionId || typeof owner !== "string" || !inheritedOwners.has(owner);
+    });
+  };
+
+  const forkEntriesForOwner = (entries: any[], sessionId: string): any[] => entries.filter((entry) =>
+    entry?.type !== "custom" || entry.customType !== foldRecordEntryType ||
+    ownValue(entry.data, "sessionId") === sessionId,
+  );
+
+  const rebaseForkState = (
+    state: ActiveContextState,
+    snapshot: ActiveContextSnapshot,
+    sessionId: string,
+  ): ActiveContextState => {
+    const refsByEntryId = new Map<string, ActiveContextSnapshot["branchObjects"]>();
+    for (const item of snapshot.branchObjects) {
+      const refs = refsByEntryId.get(item.ref.entryId) ?? [];
+      refs.push(item);
+      refsByEntryId.set(item.ref.entryId, refs);
+    }
+    const rebaseRef = (ref: ActiveContextState["protected"][number]) => {
+      const matches = refsByEntryId.get(ref.entryId)?.filter((item) =>
+        item.ref.role === ref.role,
+      ) ?? [];
+      if (matches.length !== 1) {
+        throw new Error(`Inherited active-context evidence ${ref.entryId} is missing or ambiguous in the fork branch`);
+      }
+      // Pi's entry identity locates the source; preserve its recorded digest so the
+      // runtime can report content drift instead of silently erasing its provenance.
+      return { ...clone(ref), sessionId };
+    };
+    const rebaseParts = (parts: FoldPart[], resolveFoldId: (id: string) => string): FoldPart[] =>
+      parts.map((part) => {
+        if (part.kind === "raw") return { kind: "raw", ref: rebaseRef(part.ref) };
+        return { kind: "fold", foldId: resolveFoldId(part.foldId) };
+      });
+    const sourceFolds = new Map(state.folds.map((fold) => [fold.id, fold]));
+    const rebasedFolds = new Map<string, { fold: ActiveFold; refs: EvidenceRef[] }>();
+    const visiting = new Set<string>();
+    const rebaseFold = (id: string): { fold: ActiveFold; refs: EvidenceRef[] } => {
+      const existing = rebasedFolds.get(id);
+      if (existing) return existing;
+      const source = sourceFolds.get(id);
+      if (!source) throw new Error(`Inherited active-context fold ${id} is missing`);
+      if (visiting.has(id)) throw new Error(`Inherited active-context fold cycle at ${id}`);
+      visiting.add(id);
+      const parts = rebaseParts(source.parts, (foldId) => rebaseFold(foldId).fold.id);
+      const refs = source.parts.flatMap((part) => {
+        if (part.kind === "raw") return [rebaseRef(part.ref)];
+        return rebaseFold(part.foldId).refs;
+      });
+      const fold: ActiveFold = {
+        ...source,
+        id: foldIdFor(source.kind, parts),
+        parentId: null,
+        parts,
+        sourceSha256: sha256Value(refs),
+      };
+      const rebased = { fold, refs };
+      visiting.delete(id);
+      rebasedFolds.set(id, rebased);
+      return rebased;
+    };
+    const folds = assignFoldParents(state.folds.map((fold) => rebaseFold(fold.id).fold));
+    const rebasedFoldId = (id: string): string => {
+      const rebased = rebasedFolds.get(id);
+      if (!rebased) throw new Error(`Inherited active-context state references missing fold ${id}`);
+      return rebased.fold.id;
+    };
+    let rebased: ActiveContextState;
+    try {
+      const expanded = state.expanded.map(rebasedFoldId);
+      const leases = Object.fromEntries(Object.entries(state.leases).map(([id, value]) => [rebasedFoldId(id), value]));
+      const briefs = Object.fromEntries(Object.entries(state.briefs ?? {}).map(([id, brief]) => [rebasedFoldId(id), brief]));
+      const pendingMarks = (state.pendingMarks ?? []).map((mark) => {
+        if (mark.mark === "refold") return { ...mark, id: rebasedFoldId(mark.id) };
+        const parts = rebaseParts(mark.parts, rebasedFoldId);
+        return { ...mark, id: foldIdFor(mark.kind, parts), parts };
+      });
+      rebased = clearPrepared({
+        ...state,
+        sessionId,
+        folds,
+        expanded,
+        protected: state.protected.map(rebaseRef),
+        leases,
+        ...(state.pendingMarks ? { pendingMarks } : {}),
+        ...(state.briefs ? { briefs } : {}),
+      });
+    } catch (error) {
+      // Keep forest errors ahead of curation errors without validating successful rebases twice.
+      validateFoldForest(folds);
+      throw error;
+    }
+    return parseActiveContextState(rebased, sessionId);
+  };
+
+  const prepareForkRecovery = (
+    ctx: any,
+    branchEntries: any[],
+    sessionId: string,
+    restoredMessages: unknown,
+    restoreError: unknown,
+  ): { inherited: MaterializedStatePersistence; snapshot: ActiveContextSnapshot } => {
+    const inheritedStateEntry = branchEntries.findLast((entry) =>
+      entry?.type === "custom" && entry.customType === stateEntryType,
+    );
+    const inheritedSessionId = ownValue(inheritedStateEntry?.data, "sessionId");
+    if (typeof inheritedSessionId !== "string" || !inheritedSessionId || inheritedSessionId === sessionId) {
+      throw new Error("No distinct inherited session ID is available for fork recovery", { cause: restoreError });
+    }
+    const inherited = materializeStatePersistence(
+      forkEntriesForOwner(branchEntries, inheritedSessionId),
+      inheritedSessionId,
+      stateEntryType,
+      foldRecordEntryType,
+    );
+    if (!Array.isArray(restoredMessages)) {
+      throw new Error("Pi did not provide the fork branch messages needed to rebase active-context state", {
+        cause: restoreError,
+      });
+    }
+    const snapshot = snapshotForEvent(ctx, restoredMessages);
+    return { inherited, snapshot };
+  };
+
   const authoritativeSnapshotFor = (ctx: any): ActiveContextSnapshot => {
     const sessionId = ctx.sessionManager.getSessionId();
     if (!lifecycle.latestSnapshot || lifecycle.latestSnapshot.sessionId !== sessionId) {
@@ -1251,7 +1399,7 @@ export function registerActiveContext(pi: any, options: {
     model: measurement.model,
   });
 
-  const load = (ctx: any, preserveThresholdDecision = false): void => {
+  const load = (ctx: any, preserveThresholdDecision = false, forkedSessionHint = false): void => {
     lifecycle.generation += 1;
     lifecycle.shuttingDown = false;
     cancelPreparation();
@@ -1291,6 +1439,7 @@ export function registerActiveContext(pi: any, options: {
     curation.contextCalls = 0;
     curation.recoveryAttempts = 0;
     curation.pendingRejection = null;
+    curation.restoreRevisionGap = false;
     curation.lastRecovery = null;
     ladder.lastAutomaticAction = null;
     ladder.automaticFailure = null;
@@ -1299,14 +1448,19 @@ export function registerActiveContext(pi: any, options: {
     measurements.providerMeasurementByMessageSha.clear();
     measurements.providerMeasurementAnchorByMessageSha.clear();
     const sessionId = ctx.sessionManager.getSessionId();
+    const forkedSession = forkedSessionHint || Boolean(ctx.sessionManager.getHeader?.()?.parentSession);
     let restored: ActiveContextState | null = null;
     let restoreError: unknown = null;
     let restoredPersistence: MaterializedStatePersistence | null = null;
     let measurementRestoreError: unknown = null;
+    let forkBaseline = false;
+    let startupSnapshot: ActiveContextSnapshot | null = null;
+    let aheadReceiptRevision: number | null = null;
     const branchEntries = [...ctx.sessionManager.getBranch()];
+    const restoredMessages = piContextMessages(ctx);
     try {
       restoredPersistence = materializeStatePersistence(
-        branchEntries,
+        forkedSession ? forkEntriesForSession(branchEntries, sessionId) : branchEntries,
         sessionId,
         stateEntryType,
         foldRecordEntryType,
@@ -1314,10 +1468,28 @@ export function registerActiveContext(pi: any, options: {
       restored = restoredPersistence.state;
     } catch (error) {
       restoreError = error;
+      if (forkedSession) {
+        try {
+          const recovery = prepareForkRecovery(ctx, branchEntries, sessionId, restoredMessages, error);
+          startupSnapshot = recovery.snapshot;
+          restored = rebaseForkState(recovery.inherited.state, startupSnapshot, sessionId);
+          restoredPersistence = recovery.inherited;
+          forkBaseline = true;
+          restoreError = null;
+        } catch (forkError) {
+          restoreError = forkError;
+        }
+      }
     }
     for (const entry of branchEntries) {
       if (entry?.type !== "custom") continue;
       if (entry.customType !== providerMeasurementEntryType) continue;
+      const receiptSessionId = ownValue(entry.data, "sessionId");
+      if (forkedSession && typeof receiptSessionId === "string" && receiptSessionId !== sessionId) {
+        try { parseProviderContextMeasurementReceipt(entry.data, receiptSessionId); }
+        catch (error) { measurementRestoreError = error; }
+        continue;
+      }
       try {
         const receipt = parseProviderContextMeasurementReceipt(entry.data, sessionId);
         const boundRevision = measurements.providerMeasurementRevisionByMessageSha.get(receipt.messageSha256);
@@ -1330,6 +1502,12 @@ export function registerActiveContext(pi: any, options: {
           throw new Error("One provider response has conflicting durable measurement receipts");
         }
         measurements.providerMeasurementByMessageSha.set(receipt.messageSha256, receipt);
+        if (restoreError === null && receipt.projectionRevision > (restored?.revision ?? 0)) {
+          aheadReceiptRevision = Math.max(aheadReceiptRevision ?? 0, receipt.projectionRevision);
+          // This receipt describes a projection whose state is absent from this branch.
+          // Keep the original receipt, but never anchor the restored window to it.
+          continue;
+        }
         const fingerprint = restoredPersistence?.projectionFingerprints.get(receipt.projectionRevision);
         if (fingerprint) {
           measurements.providerMeasurementAnchorByMessageSha.set(receipt.messageSha256, {
@@ -1348,6 +1526,12 @@ export function registerActiveContext(pi: any, options: {
       }
     }
     const durableRestored = restored ?? emptyActiveContextState(sessionId);
+    if (restoreError === null && aheadReceiptRevision !== null) {
+      curation.restoreRevisionGap = true;
+      safeNotify(ctx, `A provider receipt names revision ${aheadReceiptRevision}, ahead of the restored ` +
+        `${brandNoun} ledger at revision ${durableRestored.revision}. Existing folds and raw history are retained; ` +
+        "the next context pass will rebuild eligible folds from that history. Missing ledger changes cannot be replayed.", "warning");
+    }
     persistence.state = durableRestored.prepared ? clearPrepared(durableRestored) : clone(durableRestored);
     // AN UNREADABLE LINEAGE IS NOT AN EMPTY ONE (2026-09-07). `persistedWireVersion` reads
     // 0 for both, and `persist` writes a CHECKPOINT whenever it is not 2, so a restore that
@@ -1360,23 +1544,25 @@ export function registerActiveContext(pi: any, options: {
     // the same ids with drifted bytes, 48 of 85 ids left conflicting. The two states are
     // told apart here, once, rather than at each of `persist`'s callers.
     persistence.lineageUnreadable = restoreError !== null;
-    persistence.persistedWireVersion = restoredPersistence?.wireVersion ?? 0;
-    persistence.deltasSinceCheckpoint = restoredPersistence?.deltasSinceCheckpoint ?? 0;
-    persistence.persistedFoldRecords = restoredPersistence?.records ?? new Map<string, FoldRecordEntry>();
-    persistence.persistedStateSha256 = restoredPersistence?.stateSha256 ?? semanticStateSha256(durableRestored);
-    const restoredMessages = piContextMessages(ctx);
+    const persistedRestore = forkBaseline ? null : restoredPersistence;
+    const persistedState = forkBaseline ? emptyActiveContextState(sessionId) : durableRestored;
+    persistence.persistedWireVersion = persistedRestore?.wireVersion ?? 0;
+    persistence.deltasSinceCheckpoint = persistedRestore?.deltasSinceCheckpoint ?? 0;
+    persistence.persistedFoldRecords = persistedRestore?.records ?? new Map<string, FoldRecordEntry>();
+    persistence.persistedStateSha256 = persistedRestore?.stateSha256 ?? semanticStateSha256(persistedState);
+    persistence.persisted = clone(persistedState);
+    persistence.forkCheckpointPending = forkBaseline;
     measurements.lastProviderMeasurement = latestProviderContextMeasurement(
       Array.isArray(restoredMessages) ? restoredMessages : [],
       budgetWindowFor(ctx),
       ctx.model,
     );
     measurements.latestRatio = contextUsageRatio(measurements.lastProviderMeasurement);
-    persistence.persisted = clone(durableRestored);
     // Reuse Pi's own reconstructed messages, including custom messages and branch
     // selection. This is ONLY a view for the bar: do not populate latestSnapshot,
     // advance the frontier, persist a projection, or pretend a provider event occurred.
     if (typeof ctx.ui?.setWidget === "function" && Array.isArray(restoredMessages)) {
-      try { foldBar.startupSnapshot = snapshotForEvent(ctx, restoredMessages); }
+      try { foldBar.startupSnapshot = startupSnapshot ?? snapshotForEvent(ctx, restoredMessages); }
       catch { /* Keep the honest mapping fallback if the host cannot supply a view. */ }
     }
     // The warning names the CONSEQUENCE and not only the cause: "state was ignored" read as
@@ -1424,7 +1610,7 @@ export function registerActiveContext(pi: any, options: {
         next = persistenceProjection(next, projectionSnapshot);
       }
       next.folds = normalizeFoldsForPersistedRecords(next.folds, persistence.persistedFoldRecords);
-      if (sameStateProjection(next, persistence.persisted)) {
+      if (sameStateProjection(next, persistence.persisted) && !persistence.forkCheckpointPending) {
         if (arrivingFoldIds.length) {
           const lost = clone(persistence.state).folds.find((fold) => fold.id === arrivingFoldIds[0]);
           const lostRefs = lost ? flattenFoldRefs(lost, persistence.state) : [];
@@ -1503,6 +1689,7 @@ export function registerActiveContext(pi: any, options: {
       await pi.appendEntry(stateEntryType, wire);
       persistence.persisted = clone(next);
       persistence.persistedWireVersion = 2;
+      persistence.forkCheckpointPending = false;
       persistence.deltasSinceCheckpoint = wire.kind === "checkpoint" ? 0 : persistence.deltasSinceCheckpoint + 1;
       persistence.persistedStateSha256 = wire.stateSha256;
       persistence.state = lifecycle.shuttingDown ? null : clone(next);
@@ -2466,7 +2653,8 @@ export function registerActiveContext(pi: any, options: {
         recovered,
         note: measured.over
           ? `The rebuilt request is still ${measured.tokens} tokens against a ${measured.budgetTokens}-token ` +
-            "serving budget, so the run stops here rather than sending a request the provider will reject again."
+            "serving budget by our estimate. Available folds have been attempted; the retry is being sent, " +
+            "and the provider will determine whether it fits. Recovery is not yet established."
           : recovered
             ? "A rollback was required: the provider rejected the last request, which overfilled the serving " +
               `budget at ${rejectedTokens} estimated tokens against ${measured.budgetTokens}. This pass ` +
@@ -2843,7 +3031,7 @@ export function registerActiveContext(pi: any, options: {
       if (addition.added) { state = addition.state; consolidationAdded += 1; }
     }
     const capacity = servingCapacity(snapshot.contextWindow);
-    const usedTokens = capacity.usedTokens;
+    const usedTokens = curation.restoreRevisionGap ? null : capacity.usedTokens;
     const budgetTokens = capacity.budgetTokens;
     const overflowExempt = userRequested || curation.recoveryAttempts > 0 ||
       (usedTokens !== null && budgetTokens > 0 && usedTokens > budgetTokens);
@@ -3231,8 +3419,10 @@ export function registerActiveContext(pi: any, options: {
     phase: string,
     operation: () => Promise<Record<string, unknown> | null>,
   ): Promise<Record<string, unknown> | null> => {
-    if (!persistence.state || !measurements.lastProviderMeasurement ||
-        !durableProviderMeasurementMatches(measurements.lastProviderMeasurement)) return null;
+    const unmeasuredRecovery = phase === "restore-revision-gap" ||
+      (phase === "projection-budget" && curation.pendingRejection !== null && !measurements.lastProviderMeasurement);
+    if (!persistence.state || (!unmeasuredRecovery && (!measurements.lastProviderMeasurement ||
+        !durableProviderMeasurementMatches(measurements.lastProviderMeasurement)))) return null;
     if (ladder.automaticFailure) {
       ladder.automaticFailure.suppressedCallbacks = Math.min(
         Number.MAX_SAFE_INTEGER,
@@ -3292,10 +3482,11 @@ export function registerActiveContext(pi: any, options: {
       return [];
     }
   };
-  const enqueueLifecycleLoad = async (ctx: any): Promise<void> => {
+  const enqueueLifecycleLoad = async (ctx: any, forkedSessionHint = false): Promise<void> => {
     const operation = lifecycle.contextQueue.then(() => {
       const loadOperation = ladder.actionQueue.then(async () => {
-        load(ctx);
+        load(ctx, false, forkedSessionHint);
+        if (persistence.forkCheckpointPending) await persist(ctx);
         await recoverNativeReceipts(ctx);
       });
       ladder.actionQueue = loadOperation.catch(() => undefined);
@@ -3305,8 +3496,12 @@ export function registerActiveContext(pi: any, options: {
     await operation;
   };
 
-  const safeLifecycleLoad = async (ctx: any, phase: "session-start" | "session-tree"): Promise<void> => {
-    try { await enqueueLifecycleLoad(ctx); }
+  const safeLifecycleLoad = async (
+    ctx: any,
+    phase: "session-start" | "session-tree",
+    forkedSessionHint = false,
+  ): Promise<void> => {
+    try { await enqueueLifecycleLoad(ctx, forkedSessionHint); }
     catch (error) {
       const sessionId = ctx.sessionManager.getSessionId();
       if (!persistence.state || persistence.state.sessionId !== sessionId) persistence.state = emptyActiveContextState(sessionId);
@@ -3328,12 +3523,14 @@ export function registerActiveContext(pi: any, options: {
     });
   };
 
-  pi.on("session_start", async (_event: unknown, ctx: any) => {
-    await safeLifecycleLoad(ctx, "session-start");
+  pi.on("session_start", async (event: unknown, ctx: any) => {
+    await safeLifecycleLoad(ctx, "session-start", ownValue(event, "reason") === "fork");
     recordResolvedCapacity(ctx);
     await armRollbackLane(ctx);
   });
-  pi.on("session_tree", async (_event: unknown, ctx: any) => { await safeLifecycleLoad(ctx, "session-tree"); });
+  pi.on("session_tree", async (_event: unknown, ctx: any) => {
+    await safeLifecycleLoad(ctx, "session-tree", Boolean(ctx.sessionManager.getHeader?.()?.parentSession));
+  });
   pi.on("session_compact", async (event: Record<string, unknown>, ctx: any) => {
     const reason = boundReceiptText(ownValue(event, "reason"), 64, "unknown");
     const decision = makeNativeDecision(
@@ -3508,6 +3705,15 @@ export function registerActiveContext(pi: any, options: {
       // neither of their inputs. What it changes is WHEN the agent learns a fold exists,
       // which is now while the material it covers is still in front of it.
       advanceFoldFrontier(snapshot);
+      if (curation.restoreRevisionGap && !ladder.automaticFailure) {
+        mutationAttempted = true;
+        const action = await attemptAutomaticCommit(snapshot, ctx, "restore-revision-gap", 1);
+        if (action) {
+          persistedSucceeded = true;
+          projected = projectWithAdvisory(snapshot);
+        }
+        curation.restoreRevisionGap = false;
+      }
       // BEFORE the fence, so an ordinary crossing is an ordinary commit and the fence is
       // left holding only the requests that genuinely will not fit.
       if (await enforceBandTop(snapshot, ctx)) {
@@ -3760,7 +3966,8 @@ export function registerActiveContext(pi: any, options: {
     rollback.attempts += 1;
     refuseRollback(
       "the overflow arrived without a compaction event, so pi never stripped the failed message from agent " +
-      "state and a tree rollback would leave the tree and agent state disagreeing (auto-compaction is off)",
+      "state and a tree rollback would leave the tree and agent state disagreeing (auto-compaction is off); " +
+      `use /${commandNames.fold} to commit eligible stale context, then retry explicitly`,
       "message_end",
       ctx,
     );
@@ -3828,7 +4035,7 @@ export function registerActiveContext(pi: any, options: {
         "turn after an unsatisfied tool call is a malformed transcript for every provider";
     }
     const occupancyBefore = measurements.lastProviderMeasurement?.tokens ?? null;
-    const notice = rollbackNoticeText({
+    let notice = rollbackNoticeText({
       brandNoun,
       toolName,
       tokensRolledBack: estimatedTokens(rolledBackBytes),
@@ -3852,7 +4059,13 @@ export function registerActiveContext(pi: any, options: {
         }
       }
     }
-    if (!replayed) safeNotify(ctx, notice, "warning");
+    if (!replayed) {
+      notice = rollbackNoticeText({
+        brandNoun, toolName, tokensRolledBack: estimatedTokens(rolledBackBytes),
+        entriesAbandoned: abandoned.length, replayed: false, replaySkipReason,
+      });
+      safeNotify(ctx, notice, "warning");
+    }
     const record = emit("context.rollback", {
       trigger: "session_before_compact",
       armed: true,
@@ -4839,14 +5052,19 @@ export function registerActiveContext(pi: any, options: {
         const occupancy = capacity.usedTokens !== null && capacity.budgetTokens > 0
           ? capacity.usedTokens / capacity.budgetTokens
           : null;
-        const topUp = occupancy !== null && occupancy >= thresholds.maxTarget;
+        const estimatedOccupancy = occupancy ?? (capacity.budgetTokens > 0
+          ? estimatedTokens(pricedBytes(projectActiveContext(snapshot, persistence.state!))) / capacity.budgetTokens
+          : 0);
+        const topUp = Boolean(curation.restoreRevisionGap) || estimatedOccupancy >= thresholds.maxTarget;
         const committed = await runCommitEpoch(snapshot, "user-command", topUp, measurements.latestRatio, true);
         // Until this lands the epoch's folds are in the event stream and nowhere else.
         // Swallowing the failure here announced a commit that does not exist and left the
         // session computing folds it would keep throwing away, which is the dead session
         // gate 122 was built for, reached through the user's own command instead.
-        try { await persist(ctx); }
-        catch (error) {
+        try {
+          await persist(ctx);
+          if (committed) curation.restoreRevisionGap = false;
+        } catch (error) {
           suspendAutomatic(error, "user-command", ctx);
           updateStatus(ctx);
           throw error;

package/extensions/lib/folding.ts

@@ -1427,13 +1427,31 @@ export function peekFoldSource(input: {
 }): Record<string, unknown> {
   const fold = input.state.folds.find((item) => item.id === input.foldId);
   if (!fold) throw new Error(`Unknown active-context fold ${input.foldId}`);
-  const messages = foldStoredSpan({
+  const storedMessages = foldStoredSpan({
     foldId: input.foldId,
     state: input.state,
     entries: input.entries,
     sessionId: input.sessionId,
     projectEntry: input.projectEntry,
   });
+  // Verify the ORIGINAL messages first, then build the history read. Native
+  // reasoning and opaque signatures belong to the provider's assistant protocol,
+  // not to a JSON transcript replayed as ordinary tool-result text (issue #10).
+  // Only structural assistant blocks are removed: prose and tool output containing
+  // words such as "thinking" stay verbatim. Stored refs, hashes and expand are intact.
+  let omittedThinkingBlocks = 0;
+  const messages = storedMessages.map((message) => {
+    const content = ownValue(message, "content");
+    if (!isPlainRecord(message) || ownValue(message, "role") !== "assistant" ||
+        !Array.isArray(content)) return message;
+    const visible = content.filter((block) => {
+      const type = ownValue(block, "type");
+      if (type !== "thinking" && type !== "redacted_thinking") return true;
+      omittedThinkingBlocks += 1;
+      return false;
+    });
+    return visible.length === content.length ? message : { ...message, content: visible };
+  });
   const source = stableStringify(messages);
   const sourceBytes = bytes(source);
   const offset = Math.min(Math.max(0, input.offset ?? 0), sourceBytes);
@@ -1475,6 +1493,8 @@ export function peekFoldSource(input: {
     brief: foldBrief(fold, input.state),
     sourceCount: messages.length,
     sourceSha256: fold.sourceSha256,
+    sourceFormat: "messages-without-thinking",
+    omittedThinkingBlocks,
     sourceBytes,
     offset,
     returnedBytes,
@@ -1493,16 +1513,20 @@ export function peekFoldSource(input: {
       ? { wider: { action: "peek", id: fold.id, bytes: Math.min(sourceBytes, ACTIVE_CONTEXT_POLICY.maxSourceChars) } }
       : {}),
     lifetime: "these bytes stay in the window exactly as returned, like any other tool result, and " +
-      `nothing rewrites this result in place. It is a COPY of fold ${fold.id}'s stored source, so the ` +
+      `nothing rewrites this result in place. It is a COPY of fold ${fold.id}'s source view, so the ` +
       `next commit reclaims it behind a placeholder naming ${fold.id}; peek ${fold.id} again for the ` +
       "same verbatim bytes, or pin this result to keep the copy raw.",
     note: (truncated
-      ? `Bounded read: ${returnedBytes} of ${sourceBytes} exact source bytes, ${view.omittedBytes} omitted ` +
+      ? `Bounded read: ${returnedBytes} of ${sourceBytes} ${omittedThinkingBlocks ? "source view" : "exact source"} bytes, ${view.omittedBytes} omitted ` +
         `from the middle. Widen with bytes, page with offset, or expand ${fold.id} to restore it in place.`
       : children.length
-        ? `Complete stored span, one level: raw entries exactly, and ${children.length} child fold(s) still ` +
+        ? `Complete stored span, one level: raw entries ${omittedThinkingBlocks ? "with thinking blocks omitted" : "exactly"}, and ${children.length} child fold(s) still ` +
           "placeheld. Peek a child id to read its own span; the fold stayed collapsed and no projection changed."
-        : "Complete exact source; the fold stayed collapsed and no projection changed.") +
+        : `Complete ${omittedThinkingBlocks ? "source view" : "exact source"}; the fold stayed collapsed and no projection changed.`) +
+      (omittedThinkingBlocks
+        ? ` ${omittedThinkingBlocks} thinking blocks omitted from this read, including their opaque ` +
+          "signatures. The original messages remain unchanged for exact in-place restoration."
+        : "") +
       (catalog.omitted
         ? ` The nested index seats the shallowest ${index.length} of ${index.length + catalog.omitted} ` +
           "descendant briefs inside the byte budget; the deeper rows are one hop away by peeking a child id, " +

package/extensions/lib/rollback.ts

@@ -152,11 +152,11 @@ export function rollbackNoticeText(input: {
 }): string {
   const head = "The provider rejected the last request because the context exceeded its input limit. " +
     `${input.brandNoun} rolled the session back past that request (${input.entriesAbandoned} entry(s), ` +
-    `about ${input.tokensRolledBack} tokens, kept in the tree as an abandoned branch) and folded the ` +
-    "stale window to make room.";
+    `about ${input.tokensRolledBack} tokens, kept in the tree as an abandoned branch).`;
   if (input.replayed) {
-    return `${head} The request is being reissued now, so continue the work you were doing; nothing was lost, ` +
-      `and the folded material is still readable through ${input.toolName}.`;
+    return `${head} The request is being reissued now. Its context pass will attempt to fold eligible stale ` +
+      "material; the recovery receipt will report the result. Original entries remain in the session tree, " +
+      `and folded material is still readable through ${input.toolName}.`;
   }
   return `${head} The request was NOT reissued: ${input.replaySkipReason ?? "the rolled-back tail is not replayable"}. ` +
     "Reissue the work yourself from the state you can see.";

package/extensions/lib/scheduling.ts

@@ -699,9 +699,12 @@ export function commitCoverage(input: {
   budgetTokens: number;
 }): CommitCoverage {
   const { snapshot, state, usedTokens, budgetTokens } = input;
-  const targetShare = usedTokens === null || !(budgetTokens > 0)
+  // Before the first response, or after a restore, an estimate can size a commit.
+  // It never decides whether the resulting request is allowed to reach the provider.
+  const occupancyTokens = usedTokens ?? estimatedTokens(pricedBytes(projectActiveContext(snapshot, state)));
+  const targetShare = !(budgetTokens > 0)
     ? 0
-    : Math.max(0, (usedTokens - snapshot.thresholds.minTarget * budgetTokens) / budgetTokens);
+    : Math.max(0, (occupancyTokens - snapshot.thresholds.minTarget * budgetTokens) / budgetTokens);
   const accounting = markAccounting(snapshot, state);
   const markedShare = accounting.eligibleFreedBudgetShare;
   const targetTokens = Math.round(targetShare * budgetTokens);

package/extensions/lib/tool-surface.ts

@@ -29,7 +29,7 @@ export function buildActiveContextTool(input: {
   handler: ToolHandler;
 }) {
   const peekGuidance = input.allowedActions.includes("peek")
-    ? ` Peek is the point read: it returns one fold's index view -- nested folds' briefs seated shallowest first inside the byte budget with the omitted rows counted, plus the head and tail of that fold's own span with the omitted middle stated -- for any fold id, ancestors still collapsed, changing nothing. It serves ONE level: raw entries come back exactly, folds nested inside stay placeheld, and peeking a child id you see there returns that child's own bytes, so anything folded is one hop away at any depth. It returns at most ${input.defaultPeekBytes} bytes unless you widen it with bytes, and it is EPHEMERAL by default: the bytes ride only until your next message, your reply then the surviving trace, so extract what your current task needs from them in that reply. Peeking again is lossless and costs one append, so a read you turn out to need twice is cheap; pass ephemeral false when you need the bytes standing across several turns. Expand is the durable in-place restoration.`
+    ? ` Peek is the point read: it returns one fold's index view -- nested folds' briefs seated shallowest first inside the byte budget with the omitted rows counted, plus the head and tail of that fold's own span with the omitted middle stated -- for any fold id, ancestors still collapsed, changing nothing. It serves ONE level: raw entries come back with thinking blocks and their signatures omitted, all other content unchanged, folds nested inside stay placeheld, and peeking a child id you see there returns that child's own bytes, so anything folded is one hop away at any depth. It returns at most ${input.defaultPeekBytes} bytes unless you widen it with bytes, and it is EPHEMERAL by default: the bytes ride only until your next message, your reply then the surviving trace, so extract what your current task needs from them in that reply. Peeking again is lossless and costs one append, so a read you turn out to need twice is cheap; pass ephemeral false when you need the bytes standing across several turns. Expand is the durable in-place restoration.`
     : "";
   const correctionGuidance = input.allowedActions.includes("reboundary")
     ? " Curation is correctable: reboundary with ids re-cuts a span into exactly one fold, which merges adjacent folds when the span covers several and splits one when the span sits inside it. Reboundary with a single id returns that fold's span to raw. A brief is written when you mark the span; a standing fold's brief is not rewritten, because rewriting it rewrites the projection at that fold's placeholder and costs the whole prefix cache from there on."
@@ -80,7 +80,7 @@ export function buildActiveContextTool(input: {
         bytes: {
           type: "integer",
           minimum: input.minPeekSliceBytes,
-          description: `Peek only: bytes of exact source to return, widening or narrowing the ${input.defaultPeekBytes}-byte default.`,
+          description: `Peek only: bytes of the source view to return, widening or narrowing the ${input.defaultPeekBytes}-byte default. Thinking blocks and their signatures are omitted before slicing.`,
         },
         limit: { type: "integer", minimum: 1, maximum: 100 },
         detail: { type: "string", enum: [...input.statusDetails] },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-fold",
-  "version": "4.2.6",
+  "version": "4.2.8",
   "description": "Lossless context folding for the Pi coding agent: only the oldest context changes; the fresh window stays untouched.",
   "keywords": [
     "pi-package",