Context-MMU (write-time result admission)

← Claims index

• [SHIPPED] Result-admit gate: secret-shaped and prompt-injection/poison results are QUARANTINED (held out of context, paged to a stub pointer); oversize benign results page out to a <2KB pointer (TRANSFORM); byte-repeat pollution quarantined. Witness: ctxmmu tests (units 61–70), testdata/poison.json fixture (unit 68).
• [SHIPPED] Page-in is gated on an explicit witness Clear() (unit 67); pollution-rate counter (unit 66); shared content-addressed blob store with the vDSO (unit 64).
• [SHIPPED] normgate driver (ResultAdmitter rank 5, in front of ctxmmu): a normalize-and-rescan gate that closes the measured detection-evasion gap — strips zero-width/variation-selector/bidi, folds homoglyph/fullwidth, decodes base64/hex, de-separates letter runs, broadens the secret vocabulary (ASIA/AIza/github_pat_/JWT/Slack), and provenance-gates trusted-local reads to a retrievable Transform instead of a sealed Quarantine. Measured (cmd/ctxbench -chain): agent red-team evasions 0→20/24 caught; private real-transcript false positives 4→2 with 0 new FPs and 0 leaks; residual = pure-semantic paraphrase (needs a classifier/IFC seam, by design). Witness: normgate tests (6, green). Enabling it is one blank-import line in internal/registrations.
• [SIMULATED] headroom (Rust) page-out codec: the v0.1 default is pure-Go content-addressed page-out; the headroom backend is an optional labeled seam, not on the critical path (unit 69).
• [SHIPPED] Native context-compressor: terminal-control stripping + carriage-return redraw collapse (internal/headroom, the FAK_COMPRESSOR=native plugin folded at ResultAdmitter rank 8). The in-process, dependency-free compressor now removes the dominant token-waste in real agentic tool output that its JSON-minify + line-dedup passes missed: ANSI/escape sequences (SGR color, cursor moves, OSC titles, DCS/PM/APC strings) and bare C0/DEL control bytes (ansi-strip), plus in-place carriage-return “redraw” frames — a progress bar reduced to its final frame (cr-collapse). Both are LOSSLESS TO THE MODEL (it renders no color and never sees a progress bar’s intermediate frames), UTF-8-safe (a C0 control byte never appears inside a multi-byte rune), order-preserving, and reversible — the gate pins the pre-compression bytes in the shared CAS (the CCR promise), and the strip runs ONLY on benign results the gate already screened (ctxmmu.ScreenBytes before compress, after the normgate rank-5 rescan), so it can never hide an injection. NET-TRUE FENCE: these are large savings ON colorized / progress-bar output specifically (a 100-frame \r progress bar collapses by ≥0.80 in the witness), NOT a blanket ratio on all traffic, and a no-op never claims a codec (the transforms only ever remove bytes); the compressor stays DEFAULT-OFF (the build compresses nothing until FAK_COMPRESSOR=native selects it). Witness: go test ./internal/headroom (TestStripEscapeSequences, TestCollapseCarriageReturnRedraw, TestNativeStripsANSIColor, TestNativeCollapsesProgressBar, TestNativeControlComposesWithLineDedup, and TestGateStripsANSIAndPreservesOriginal — the gate-level reversible-CAS round-trip). [exposure: gated — DEFAULT-OFF: the build compresses nothing until FAK_COMPRESSOR=native selects the plugin]
• [SHIPPED] Native context-compressor: global (non-consecutive) duplicate-line folding (internal/headroom/fold.go, the line-fold codec). The dual of the existing consecutive run-collapse: a line that recurs SCATTERED across a tool result — the same warning per file, a stack frame echoed per failure — is folded to its FIRST occurrence (kept in place, order preserved) plus a … (×N more identical, elided) … recurrence marker, with the later copies elided. Real test / lint / build output is full of this waste the consecutive pass cannot see. Conservative floor: a line must recur ≥3× AND be ≥8 bytes (short structural lines like } / ok are left alone), and the codec only fires on a real net saving. Model-readable (the marker states the count), order-preserving, and reversible via the gate’s CAS — and, like every native transform, it runs ONLY on benign results the gate already screened, never on poison. NET-TRUE FENCE: a folded view drops the INTERLEAVING of the repeated line (a benign-result compression, not a structural rewrite of code under edit); the original is one demand-page away. Witness: go test ./internal/headroom (TestFoldsScatteredDuplicates, TestGlobalFoldKeepsFirstOccurrenceOrder, TestGlobalFoldSkipsShortLines, TestGlobalFoldBelowThresholdNoop, TestNativeFoldsScatteredViaCompress, TestGlobalFoldComposesWithConsecutive).
• [SHIPPED] The “when to compress” decision layer + bench witness (internal/headroom/policy.go, internal/headroom/bench.go, the fak headroom bench verb). fak’s value in context-savings is NOT the compressor (anyone can shrink bytes — or bridge an ML compressor) but the GATE deciding WHEN shrinking is worth doing, per result, at the admission boundary. The gate already encoded two “when NOT” rules — it never compresses a result the security gates would quarantine (compressing would HIDE an injection/secret from detection, the load-bearing rule) and every saving is reversible via the CAS (a wrong compress costs one demand-page, never a lost fact). This adds the third: a WORTH-IT floor — a real but marginal saving on a small result is left RAW (the model reads the verbatim bytes, no preserve-write or codec annotation spent), compressing only when the saving clears >= 256 bytes OR >= 15% over a 48-byte minimum (env-tunable FAK_HEADROOM_MIN_BYTES / _MIN_SAVED_BYTES / _MIN_SAVED_RATIO; conservative by default since the original is always preserved). The companion fak headroom bench [--via NAME] [--json] replays a built-in representative corpus (colorized test output, a \r progress bar, scattered warnings, pretty JSON, retry spam, a CRLF log, and an incompressible prose control) and reports the realized per-sample + aggregate savings — the no-model witness of WHERE compression pays (logs/progress large, unique prose ~0), so a headline ratio is never read as a blanket claim. --dir DIR / FILE... point the same bench at REAL captured tool output (the dogfood path) — measured over 44 real scratch task-output files it saved only 0.1% (most short/unique, the worth-it floor leaving them raw), the honest net-true finding that the win concentrates in large duplicate/colorized/progress output, NOT small command results — evidence for or against a default-on flip, on real data rather than a strawman. Witness: go test ./internal/headroom (TestWorthCompressing, TestWorthCompressingTunable, TestGateLeavesMarginalSavingRaw, TestGateTakesWorthItSaving, TestRunBenchNativeSavesAggregate, TestRunBenchNoopZero, TestBenchRender, TestGateDecisionStats); go run ./cmd/fak headroom bench. The gate also records the WHEN-NOT decision breakdown — considered == compressed + skipped(empty/poison/no-saving/not-worth) — in its Stats and fak headroom status, so the governance is auditable, not just the savings (the poison skip is the load-bearing one: a result the security gates would quarantine is never compressed/hidden). ACTIVATION: fak guard --compress turns the native compressor on for a local-agent session (equivalent to FAK_COMPRESSOR=native for that process; an explicit env value, incl. noop to opt out, always wins) — so the whole context-savings stack is reachable by a flag on the flagship fak guard -- claude path, not just an obscure env var, while the library default stays OFF (no global behavior change, no broad test churn). Witness: go test ./cmd/fak -run TestCompressActivates.