fold Part 3 · Ephemeral Retrieval
An agent re-sends every page it holds with every request, so a glance and a stare cost exactly the same. This part adds a read the agent can only look at once, watches a frontier model decide when to use it across a 65-minute session, and reports the cache defect that handing a page back turned out to expose. It also closes the campaign's accounting, where the cost gap turns out to sit on a provider price boundary rather than on a token count. The correction to our own first reading is here too, because it is the more useful half.
Scroll to explore
The Question
The window is rented space
Everything an agent reads takes up residence in its context window, and residence is not free. The agent re-sends every page it holds with every request, turn after turn, whether or not it ever looks at that page again. A glance and a stare cost the same. That pricing is why long sessions get slow and expensive, and it is why a folding runtime spends most of its effort deciding what stays.
fold folds finished stretches of a session behind short placeholders and keeps every byte on disk, addressed and hash-verified, so the agent can read any fold back on demand. Part 1 priced that against compaction and Part 2 measured what a summary throws away. Both were about the writing side. But a recovered page lands in the window like any other tool result and starts paying rent of its own: a ninety-kilobyte chapter re-sent with every request, long after the agent took the two lines it needed. This part is about the reading side.
So fold shipped a read with a shorter lease. The agent asks for a fold and passes one extra flag. The bytes arrive once, and the moment the agent replies, the runtime swaps the result for a single line holding its place, and the reply becomes the surviving trace. The fold itself is untouched, still exact, still recoverable. The question this part asks is what a model actually does with that, and what it costs.
One session's window, against the same session holding every read durably
The last sixty-one requests of the folding session. What it sent peaks at 234.8 thousand tokens; the same session holding every recovered page durably would have passed the 251.5 thousand serving budget as early as request 114. At request 157, which answered the withheld exam, the session sent 203.4 thousand tokens against a counterfactual 250.2 thousand, within 1,301 tokens of the budget. The widest gap between the two is at request 158, not at the answer: folding resets it as the session runs. Across requests 115 through 155 the two lines coincide exactly, which is a measured gap of zero rather than a missing reading: folding owed no rent there. Request 111 is absent from the sealed series and the line breaks rather than drawing through it.
The dashed line is a deterministic static counterfactual from the same sealed session, not a second run and not an estimate. The audit replays the session through the runtime's own projection code and recomputes, request by request, what the prompt would have been had each one-look read stayed, holding the model's conduct fixed. The gap is the rent the leases did not pay. At the answering request the counterfactual arrives within 1,301 tokens of the serving budget, which is the bound this campaign can actually state: not that the session would have failed, but that it would have had almost nothing left. Hover any request for both quantities. Served token counts from the sealed provider ledger.
The Lease
One look, and the bytes stay
Three design choices carry the mechanism. The bytes never leave the session, only the window: the fold stays intact, recoverable and foldable, so an ephemeral read removes cost rather than information. The marker that makes a read ephemeral lives in memory, so a session that crashes and restarts quietly keeps the read durable. The failure mode is a page that lingers, never a page that vanishes twice. And the give-back is one substitution at the tail, on the very next request, because the reply is what proves the read happened and is the surviving trace.
The rollout was one sentence of tool description, which is worth stating plainly because it is also the paper's main caveat about adoption. The sentence tells the agent that an ephemeral result rides only until its next message and that it should write down what matters before answering. The model demonstrably ignored the second half, which is a finding of its own and appears below. What the model chose freely was the lease, not the reading.
The surface has a version, and the campaign measured the first one. These runs tested an opt-in, whole-result peek. Since the campaign the default has flipped, so a read is ephemeral unless it asks to be durable, and the result is now budgeted rather than returned whole. Everything on this page describes the surface as it ran, and the shipped release is pi-fold 3.0.0 and later.
How long each page that bears on the answer stayed in the window
The durable read of chapter B, 96 kB, was visible across thirty-five consecutive requests and was still there when the exam was answered. The three one-look reads, chapter B at 97 kB, chapter C at 91 kB and chapter A at 58 kB, were each visible for exactly one request, and the last of them, chapter A, was still open when the exam was answered. Three earlier one-look reads from the same session are not drawn here, because none of them bears on the answering request; they are the first three bars of the next chart.
The same mechanism, two leases. The durable read at the top, 96 kB of chapter B, was taken during the final stage's probe wave while answering a routine recall question, and then rode 35 requests to the end of the session. The three below it are the chained one-look reads, 97 kB, 91 kB and 58 kB: each page arrived, was read, and left as the next one came, like reading in a room with one table. Hover any bar for its lease and its span. Spans from the repetition 7 ephemeral audit.
Adoption
It took the short lease, and it did not track what it held
In the session above, six of the model's seven reads chose the one-look lease. At the end of the assignment, facing a withheld exam over old material, it chose to chain three large reads back to back, each page leaving as the next arrived, and then wrote its answers. It did not have to: the chapter that carried the answers was already in view, which is the correction below. A second session on the repaired runtime, same plan and same withheld exam, read far more and chose the lease less often: forty-one peeks, twenty-three of them ephemeral. Two sessions of one model on one workload chose differently enough that neither number is an adoption rate, and the smaller share is worth as much as the larger one. What both show is that the choice was made freely from a one-line description.
The habit underneath is the more interesting part, and it is not flattering. The model does not track what it already holds. It chained three fresh reads over chapters whose parent was sitting in full view, and the tool text had explicitly told it to write down what mattered before answering, which it did not do. Held durably, that habit is rent on ninety kilobytes a page. Under a one-look lease it cost one look each. The flag did not make the model a better reader. It made the model's actual reading habits affordable.
The Correction
The book was open, and we had said it was closed
At first I believed something better about that session. By the time the model wrote its answers two of the three chained chapters were gone from its context, its replies during the chain had been bare tool calls, and several answers appeared to exist nowhere visible. The elimination landed on the model's own reasoning, which rides encrypted inside its messages and survives withdrawal. Working memory, demonstrated by accident. I was delighted for about a day.
Then the question went back through the runtime's own attribution lens, the instrument that reconstructs exactly what the model could see at any given request. It found one page still on the table: the durable read at the top of the chart above, taken during the final stage's probe wave for an unrelated question, never withdrawn and never folded. It carried every answer. The exam was open book, and the model had left the book open itself.
That correction is the second time this project's attribution lens has overturned a hand-built reading of a sealed session, and both failures had the same shape: an ad-hoc visibility check quietly assumed a state the runtime owns. The lens composes the runtime's own projection code, which removes the principal source of that drift, though it still needs an in-memory overlay for the ephemeral rule and no reconstruction rules out every provider-side transformation. Instruments that reuse the system under study as their own oracle are what let a small lab publish an exciting finding and then survive it.
The Defect
Giving a page back rewrote the whole prefix
The give-back is supposed to be the cheapest edit there is: one message replaced at the very end of the transcript, with the entire cached prefix beneath it untouched. On the wire it behaves exactly that way. Live probes against the same provider sent a temporary suffix, replaced it, and retained every one of the 3,840 measured stable-prefix cache tokens beneath it, in all three repetitions. A second probe, carrying a synthetic ephemeral payload, read its cache on every follow-up request. The wire does what the design assumes. This runtime did not, and the session paid for it. What follows is a defect in one runtime, not a property of the design.
The cause is a projection freeze. To hold the prefix stable the runtime keeps the previous projected array and reuses it whole whenever the transcript still begins the same way, appending only what is new. Receipts and advisory carriers accumulate inside that held array over a session. A withdrawal edits a message inside the held region, the equality check guarding the freeze fails, the projection is rebuilt from the transcript, and those accumulated carriers vanish from their buried positions and reappear at the tail. Divergence therefore lands on the first buried carrier rather than on the withdrawn page. A one-message tail edit rewrote the session's entire cached prefix.
The shipped gate had asserted visibility only, which is how this got past it. It now pins position: every buried carrier keeps its exact index and every message before the withdrawn one is byte-identical, with an assertion that at least one buried carrier exists above that index so the check cannot pass vacuously. That gate fails on the old runtime, which is the property that makes it worth having.
How much of the cacheable prefix survived each give-back
Before the repair, six give-backs: 45, 43 and 66 percent, then zero on each of the last three, median 22 percent. After the repair, twenty-three returned pages across fifteen give-back requests: twelve retained more than half, six retained ninety percent or more, three retained nothing, median 80 percent by request and 93 percent by returned page.
The measure is the share of what the previous request had made cacheable that the provider still served from cache at the give-back. It is the provider's own answer to whether the tail substitution disturbed the prefix, and unlike a raw cache rate it is not diluted by new material in the same request. Cache is served per request while a give-back is an event, and one reply can hand back several pages at once, so the repaired session's 23 returned pages sit on 15 distinct measurements; the chart uses the request as the unit, which is the one in which the observations are independent. Counted that way 12 of those fifteen kept more than half, with a median of 80 percent; counted per returned page the median is 93 percent, and the gap between the two is the weight the repeated requests were carrying. 3 of those fifteen still retained nothing, and this record does not say why. Hover any bar for its request. From the repetition 7 and repetition 8 audits.
The Repair
What one run after a fix can and cannot say
Carrying the substitution into the held array, instead of letting it invalidate the freeze, fixes the mechanism in a controlled fixture and moves divergence to the withdrawn page's own index where it belongs. The session on the right of the chart is the repetition the campaign owed: same frozen plan, same withheld exam, on a runtime carrying the repair. Its give-backs mostly hold their prefix, where the defective run's last three held none.
It is worth being precise about what that does not establish. It was run after the diagnosis, which makes it engineering validation rather than a preregistered replication. It is a different trajectory from the defective run in several ways at once: forty-one reads instead of seven, different give-back positions, and a second mechanism deleted between the two. The controlled fixture and the gate are what isolate the code-level repair. This session is whole-session corroboration that the repaired runtime holds its prefix through most give-backs. It is not a matched before-and-after, and the frequencies are not a causal estimate.
The Bill
The cost gap was a price line, not a token count
The lease is one answer to what a window costs. The price list is the other, and it is the same question asked at the bill instead of at the request: twelve graded runs, six folding and six native compacting, on the same sixty-four stage assignment. The folding arm billed $144.15 and the native compaction arm $278.32, and the reason turned out not to be the one I had been telling myself. I assumed volume: fold more, send fewer tokens, pay less.
The actual mechanism is a price line. This provider charges one rate below a boundary near the model's declared context window and a higher rate above it, where input prices double. The native compaction sessions ran at and past that boundary and crossed it on 333 of their 630 billed requests. The folding sessions never crossed it once, in 888. Take the surcharge out and the two arms sit within about twelve percent of each other. The billed totals above are the sealed accounting and say the rest.
The sharpest version of this is the cache rate, which points the wrong way. The native compaction arm held a token-weighted cached share above 0.95 in every run and the folding arm sat between 0.81 and 0.92, so the arm with the better cache rate is the arm with the larger bill. A cache hit is a discount on a token you chose to send again. It is a smaller discount than not crossing a price boundary at all.
Every billed request of the campaign, by how large its prompt was
All 1,518 billed requests, binned at ten thousand tokens. The folding arm's requests all fall below the price boundary, its largest bin at 250 thousand tokens. The native compaction arm's requests spread from near zero to 920 thousand, with 333 of 630 above the boundary where input prices double. Folding crossed it zero times in 888 requests.
One rule, drawn where the provider's own cost records say the price changes: no request at or above 272,210 tokens was ever billed at the base rate, and none at or below 271,964 was ever billed above it. The two distributions are the finding. A context runtime decides how large your requests are, and how large your requests are decides which side of the price list you are on. Hover any bin for both arms' counts. Prompt sizes from every graded run's hash-chained provider ledger; the crossing totals are asserted equal to the pricing audit's own.
What This Does Not Show
A retired exam, and the claims that survive it
This campaign also ran a scored recall exam, and I am retiring it rather than reporting it as a result. It was built to ask whether a session keeps what only its transcript knows, and it turned out to be an exam a compaction summary can transcribe, which is a fact about summaries rather than about memory. One compacting run makes the point by itself: it happened to write 52 of the plan's 56 seeded values into its own summary before compacting and then answered from them, where every other compacting run carried four, and the criterion that would have excluded that run fits all six. Two of the exam's four channels favour compaction and two favour folding. The paper prints all four and draws no directional recall conclusion, and the successor campaign rebuilt the instrument around material no summary transcribes.
The rest of the limits are ordinary, and every claim above rests on them. One provider, one workload, one repository, and one model for the campaign runs, with the live cache probes sent to a different one. The mechanism results rest on one session and the repair on one more, so adoption counts are case observations and not rates. The price tier is a property of one provider's price list on one date. What generalizes is that a runtime holding requests under a provider's long-context boundary can be worth more than a high cache rate, wherever such a boundary exists. And the arms were not symmetric in tooling: a line-reading limit meant the compacting arm could re-read what it had said but not what it had been shown, which the successor harness fixes and these runs did not have.
The Paper
Sealed, hashed, and recomputable
The full report is published as Ephemeral Retrieval, Zenodo, August 2026, DOI 10.5281/zenodo.22142454. The campaign is sealed under hash-pinned manifests: one frozen plan, twelve graded runs with hash-chained ledgers, a thirteenth sealed run carrying the repair, and every model-written byte captured. Every table cell and figure datum on this page and in the paper is derived by a checked-in builder reading those sealed artifacts, the figure data regenerates byte-identically, and verification scripts rebuild the derived products from the sealed evidence and refuse any drift between them. Four prose measurements are quoted from their own source records rather than rebuilt by that script, and the paper names each of them.
Citations
The trail behind this page
This paper. Shane Conner, "Ephemeral Retrieval: one-look reads under lossless context folding", Zenodo, August 2026. DOI: 10.5281/zenodo.22142454.
The line it sits in. Part 1, "pi-fold: Agent-Governed Lossless Context Folding", DOI: 10.5281/zenodo.21856873; Part 2, "pi-fold: Working Memory Under Context Shedding", DOI: 10.5281/zenodo.21980746; Part 4, "Rotation and Retention", DOI: 10.5281/zenodo.22142456.
The narrative version. Shane Conner, "Temporary Context: Permitting an Agent to Forget What It Just Read", Medium, August 2026: medium.com/@shane.conner/temporary-context-permitting-an-agent-to-forget-what-it-just-read.
fold. The runtime, its gate suite, and the experiment harness that produced every number above: github.com/shaneconner/fold. On npm as pi-fold, MIT licensed.
Pi. The coding agent this runtime lives inside: github.com/badlogic/pi-mono.
curl. The studied codebase, hash-pinned in the sealed plan: curl.se.