fix(acr): token estimator discounts block-level HTML comments (M-BUG-6)

CLAUDE.md token estimates counted block-level <!-- --> HTML comments toward
always-loaded tokens, but CC strips them before injection (preserved only inside
code fences, per code.claude.com/docs/en/memory). Fix: new stripInjectedHtmlComments
+ effectiveMemoryBytes in active-config-reader; the CML cascade (walkClaudeMdCascade)
and token-hotspots now size CLAUDE.md from effective (stripped) bytes, while raw byte
figures stay honest. Block-level only — inline comments retained (conservative,
verified scope). Suite 1329/0 (+13). Frozen v5.0.0 snapshots untouched (no fixture
has <!--), no re-seed. Dogfood ~/.claude CLAUDE.md ~3386->3301 tok (~85 tok discount,
matches worklist prediction).

tests/lib/active-config-reader.test.mjs

@@ -5,6 +5,8 @@ import { mkdir, writeFile, rm, readFile } from 'node:fs/promises';
 import { tmpdir } from 'node:os';
 import {
   estimateTokens,
+  stripInjectedHtmlComments,
+  effectiveMemoryBytes,
   detectGitRoot,
   walkClaudeMdCascade,
   readClaudeJsonProjectSlice,
@@ -196,6 +198,85 @@ describe('estimateTokens', () => {
   });
 });
 
+// ─────────────────────────────────────────────────────────────────────────
+// stripInjectedHtmlComments / effectiveMemoryBytes (M-BUG-6)
+// Claude Code strips block-level HTML comments from a CLAUDE.md/memory file
+// before injecting it into context (code.claude.com/docs/en/memory), preserving
+// them only inside fenced code blocks. A byte-accurate token estimate must
+// discount them. Inline comments (text on the same line) are conservatively
+// retained — only block-level stripping is verified behavior.
+// ─────────────────────────────────────────────────────────────────────────
+
+describe('stripInjectedHtmlComments (M-BUG-6)', () => {
+  it('strips a single-line block-level comment outside code fences', () => {
+    const src = '# Title\n\n<!-- maintainer note: regenerate weekly -->\n\nBody text.\n';
+    const out = stripInjectedHtmlComments(src);
+    assert.ok(!out.includes('maintainer note'), 'comment text should be removed');
+    assert.ok(out.includes('# Title') && out.includes('Body text.'), 'surrounding content preserved');
+  });
+
+  it('strips a multi-line block comment outside fences', () => {
+    const src = 'A\n<!--\nline one\nline two\n-->\nB\n';
+    const out = stripInjectedHtmlComments(src);
+    assert.ok(!out.includes('line one') && !out.includes('line two'), 'all comment lines removed');
+    assert.ok(out.includes('A') && out.includes('B'), 'surrounding content preserved');
+  });
+
+  it('preserves an HTML comment inside a ``` fenced code block', () => {
+    const src = '# Title\n\n```html\n<!-- kept: this is example code -->\n```\n';
+    const out = stripInjectedHtmlComments(src);
+    assert.ok(out.includes('kept: this is example code'), 'fenced comment must be preserved (CC keeps it)');
+  });
+
+  it('preserves an HTML comment inside a ~~~ fenced code block', () => {
+    const src = '~~~\n<!-- kept tilde -->\n~~~\n';
+    const out = stripInjectedHtmlComments(src);
+    assert.ok(out.includes('kept tilde'), 'tilde-fenced comment must be preserved');
+  });
+
+  it('keeps inline comments (only block-level stripping is verified)', () => {
+    // Text on the same line as the comment → conservatively retained; the
+    // verified CC behavior covers block-level comments only (Verifiseringsplikt).
+    const src = 'Visible <!-- hidden --> tail\n';
+    assert.equal(stripInjectedHtmlComments(src), src);
+  });
+
+  it('returns content unchanged when there are no comments', () => {
+    const src = '# Plain\n\nNo comments here.\n';
+    assert.equal(stripInjectedHtmlComments(src), src);
+  });
+
+  it('handles empty and non-string input', () => {
+    assert.equal(stripInjectedHtmlComments(''), '');
+    assert.equal(stripInjectedHtmlComments(undefined), '');
+    assert.equal(stripInjectedHtmlComments(null), '');
+  });
+});
+
+describe('effectiveMemoryBytes (M-BUG-6)', () => {
+  it('discounts out-of-fence block comments from the byte count', () => {
+    const src = '# Title\n\n<!-- a fairly long maintainer note that costs real bytes -->\n\nBody.\n';
+    const raw = Buffer.byteLength(src, 'utf8');
+    const eff = effectiveMemoryBytes(src);
+    assert.ok(eff < raw, `effective (${eff}) should be below raw (${raw})`);
+  });
+
+  it('counts comments inside fences (CC keeps them)', () => {
+    const src = '```\n<!-- kept -->\n```\n';
+    assert.equal(effectiveMemoryBytes(src), Buffer.byteLength(src, 'utf8'));
+  });
+
+  it('equals raw bytes when no comments are present', () => {
+    const src = '# Plain markdown\n\nbody\n';
+    assert.equal(effectiveMemoryBytes(src), Buffer.byteLength(src, 'utf8'));
+  });
+
+  it('returns 0 for non-string input', () => {
+    assert.equal(effectiveMemoryBytes(undefined), 0);
+    assert.equal(effectiveMemoryBytes(null), 0);
+  });
+});
+
 // ─────────────────────────────────────────────────────────────────────────
 // detectGitRoot
 // ─────────────────────────────────────────────────────────────────────────
@@ -291,6 +372,23 @@ describe('walkClaudeMdCascade', () => {
     assert.equal(result.estimatedTokens, Math.ceil(result.totalBytes / 4));
   });
 
+  it('discounts block-level HTML comments from estimatedTokens (M-BUG-6)', async () => {
+    // CC strips block-level HTML comments before injection, so a CLAUDE.md
+    // padded with a maintainer-note comment must estimate FEWER tokens than its
+    // raw byte size would imply — totalBytes stays the honest on-disk figure.
+    const comment = `<!-- ${'maintainer note '.repeat(40)} -->`;
+    await writeFile(
+      join(fixture.root, 'CLAUDE.md'),
+      `# Project Instructions\n\n${comment}\n\nBuild with care.\n`,
+    );
+    const result = await walkClaudeMdCascade(fixture.root);
+    assert.ok(
+      result.estimatedTokens < Math.ceil(result.totalBytes / 4),
+      `expected discounted tokens (${result.estimatedTokens}) below raw heuristic ` +
+        `(${Math.ceil(result.totalBytes / 4)})`,
+    );
+  });
+
   it('handles missing user CLAUDE.md gracefully', async () => {
     // Remove user CLAUDE.md
     await rm(join(fixture.fakeHome, '.claude', 'CLAUDE.md'));