@compaction/cli 0.2.0 → 0.3.0

package/dist/core/policy-middleware.js

@@ -0,0 +1,919 @@
+import { randomUUID } from "node:crypto";
+import { calculateCost } from "./cost-calculator.js";
+import { contentHash } from "./content-hash.js";
+import { createStateCapsule } from "./state-capsule.js";
+import { DEFAULT_MODEL } from "./pricing.js";
+import { estimateTextTokens, estimateTraceTokens } from "./token-estimator.js";
+import { detectWaste } from "./waste-detector.js";
+import { createSkillInjectionCapsules, findSkillInjectionCompactionCandidates } from "./skill-injection-policy.js";
+import { COMPACTION_POLICY_NAME, SKILL_INJECTION_POLICY_NAME, SUPPORTED_COMPACTION_POLICY_NAMES, isSupportedCompactionPolicyName } from "./policy-types.js";
+// Re-export the public policy surface (now owned by ./policy-types.js) so existing engine
+// consumers that import these from policy-middleware keep working unchanged. The ALGORITHM stays
+// here; only the public-safe names/types moved to the public module to sever the public→engine
+// runtime import edge (open-core Phase 1a).
+export { COMPACTION_POLICY_NAME, SKILL_INJECTION_POLICY_NAME, SUPPORTED_COMPACTION_POLICY_NAMES, isSupportedCompactionPolicyName };
+const DEFAULT_MIN_DUPLICATE_TOKENS = 200;
+const DEFAULT_MIN_DUPLICATE_CHARACTERS = 800;
+function roundCurrency(value) {
+    return Number(value.toFixed(6));
+}
+function createTraceFromMessages(messages, model) {
+    const generatedAt = new Date().toISOString();
+    return {
+        id: `policy_middleware_messages_${randomUUID()}`,
+        title: "Policy middleware message payload",
+        artifactVersion: "agent-trace-v1",
+        source: "manual",
+        createdAt: generatedAt,
+        generatedAt,
+        model,
+        messages
+    };
+}
+function resolveTrace(input) {
+    if (input.trace) {
+        return input.trace;
+    }
+    if (input.messages) {
+        return createTraceFromMessages(input.messages, input.model ?? DEFAULT_MODEL);
+    }
+    throw new Error("applyCompactionPolicy requires either a trace or messages payload.");
+}
+function assertSupportedPolicy(policy) {
+    if (policy?.policyName && policy.policyName !== COMPACTION_POLICY_NAME) {
+        throw new Error(`Unsupported compaction policy: ${policy.policyName}`);
+    }
+}
+function meetsThresholds(content, thresholds) {
+    return estimateTextTokens(content) >= thresholds.minDuplicateTokens && content.length >= thresholds.minDuplicateCharacters;
+}
+function findRepeatCandidates(trace, thresholds) {
+    const messageById = new Map(trace.messages.map((message, index) => [message.id, { message, index }]));
+    const candidates = [];
+    for (const finding of detectWaste(trace, thresholds)) {
+        if (finding.category !== "repeated_tool_output") {
+            continue;
+        }
+        const [sourceMessageId, duplicateMessageId] = finding.messageIds;
+        const source = messageById.get(sourceMessageId);
+        const duplicate = messageById.get(duplicateMessageId);
+        if (!source || !duplicate) {
+            continue;
+        }
+        const duplicateTokens = finding.estimatedTokens;
+        candidates.push({
+            finding,
+            sourceMessage: source.message,
+            sourceIndex: source.index,
+            duplicateMessage: duplicate.message,
+            duplicateIndex: duplicate.index,
+            duplicateTokens
+        });
+    }
+    return candidates;
+}
+/**
+ * Input-compaction category 1 (`superseded_same_source_read`) candidates.
+ *
+ * For each category-1 finding from `detectWaste` (`messageIds[0]` = KEPT latest authoritative read;
+ * `messageIds[1..]` = earlier superseded reads), produce one `WholeMessageCompaction` per superseded
+ * earlier read. Reuses the EXACT recoverability model of the tool-output policy with NO fork: each
+ * superseded earlier read is compacted whole-message, and its source pointer references the EARLIER
+ * READ ITSELF (self-pointer) — whose raw content is RETAINED in the original trace. Self-pointing is
+ * the correct recoverability binding for supersession: the dropped earlier copy is byte-recoverable
+ * from the retained original at that pointer, and (source === the compacted position's own original)
+ * trivially satisfies safety-report.ts / `wholeMessagePointerCoversPosition` (pointer honesty +
+ * normalized-equal-to-itself). The LATEST authoritative read (`messageIds[0]`) is NEVER a candidate,
+ * so it stays in the compacted trace verbatim. The finding carried on each candidate is the SAME
+ * category-1 finding (so `candidateToFinding`/safety surfaces report the honest category).
+ */
+function findSupersededReadCandidates(trace, thresholds) {
+    const messageById = new Map(trace.messages.map((message, index) => [message.id, { message, index }]));
+    const candidates = [];
+    for (const finding of detectWaste(trace, thresholds)) {
+        if (finding.category !== "superseded_same_source_read") {
+            continue;
+        }
+        const [, ...supersededIds] = finding.messageIds;
+        for (const supersededId of supersededIds) {
+            const earlier = messageById.get(supersededId);
+            if (!earlier) {
+                continue;
+            }
+            // Defense-in-depth: re-assert the same thresholds the detector applied (the engine never
+            // compacts a span that does not independently clear the min-tokens/chars bar).
+            if (!meetsThresholds(earlier.message.content, thresholds)) {
+                continue;
+            }
+            candidates.push({
+                replacementMode: "whole_message",
+                // Self-pointer: source === the earlier superseded read itself (retained in the original
+                // trace), so the dropped copy is recoverable from the retained original at this pointer.
+                sourceMessage: earlier.message,
+                sourceIndex: earlier.index,
+                targetMessage: earlier.message,
+                targetIndex: earlier.index,
+                replacedTokens: estimateTextTokens(earlier.message.content),
+                // One whole-message finding per compacted earlier read (keeps the latest authoritative id
+                // [0] as the KEPT reference; this id is the compacted earlier read).
+                finding: {
+                    category: "superseded_same_source_read",
+                    messageIds: [finding.messageIds[0], supersededId],
+                    summary: finding.summary,
+                    estimatedTokens: estimateTextTokens(earlier.message.content)
+                }
+            });
+        }
+    }
+    return candidates;
+}
+function findEligibleSourcePayloads(messages, thresholds) {
+    return messages.flatMap((message, index) => {
+        if (message.role !== "tool" || !meetsThresholds(message.content, thresholds)) {
+            return [];
+        }
+        return [
+            {
+                sourceMessage: message,
+                sourceIndex: index,
+                sourceTokens: estimateTextTokens(message.content)
+            }
+        ];
+    });
+}
+function isEmbeddedTargetRole(role) {
+    return role === "user" || role === "assistant" || role === "system";
+}
+function rangesOverlap(first, second) {
+    return first.start < second.end && second.start < first.end;
+}
+function findNonOverlappingOccurrences(content, payload, occupiedRanges) {
+    const ranges = [];
+    let searchFrom = 0;
+    while (searchFrom < content.length) {
+        const start = content.indexOf(payload, searchFrom);
+        if (start === -1) {
+            break;
+        }
+        const range = { start, end: start + payload.length };
+        if (!occupiedRanges.some((occupiedRange) => rangesOverlap(range, occupiedRange))) {
+            ranges.push(range);
+        }
+        searchFrom = range.end;
+    }
+    return ranges;
+}
+function compareEmbeddedSourcePriority(first, second) {
+    const lengthDelta = second.sourceMessage.content.length - first.sourceMessage.content.length;
+    if (lengthDelta !== 0) {
+        return lengthDelta;
+    }
+    return first.sourceIndex - second.sourceIndex;
+}
+function findEmbeddedCandidates(trace, thresholds) {
+    const sourcePayloads = findEligibleSourcePayloads(trace.messages, thresholds);
+    const candidates = [];
+    for (const [targetIndex, targetMessage] of trace.messages.entries()) {
+        if (!isEmbeddedTargetRole(targetMessage.role)) {
+            continue;
+        }
+        const occupiedRanges = [];
+        const targetOccurrences = [];
+        const eligiblePriorSources = sourcePayloads
+            .filter((sourcePayload) => sourcePayload.sourceIndex < targetIndex)
+            .sort(compareEmbeddedSourcePriority);
+        for (const sourcePayload of eligiblePriorSources) {
+            const ranges = findNonOverlappingOccurrences(targetMessage.content, sourcePayload.sourceMessage.content, occupiedRanges);
+            for (const range of ranges) {
+                occupiedRanges.push(range);
+                targetOccurrences.push({
+                    sourceMessage: sourcePayload.sourceMessage,
+                    sourceIndex: sourcePayload.sourceIndex,
+                    sourceTokens: sourcePayload.sourceTokens,
+                    range
+                });
+            }
+        }
+        const occurrencesBySourceId = new Map();
+        for (const occurrence of targetOccurrences) {
+            const existing = occurrencesBySourceId.get(occurrence.sourceMessage.id) ?? [];
+            existing.push(occurrence);
+            occurrencesBySourceId.set(occurrence.sourceMessage.id, existing);
+        }
+        for (const sourcePayload of eligiblePriorSources) {
+            const occurrences = occurrencesBySourceId.get(sourcePayload.sourceMessage.id);
+            if (!occurrences) {
+                continue;
+            }
+            candidates.push({
+                sourceMessage: sourcePayload.sourceMessage,
+                sourceIndex: sourcePayload.sourceIndex,
+                targetMessage,
+                targetIndex,
+                sourceTokens: sourcePayload.sourceTokens,
+                replacedRanges: occurrences.map((occurrence) => occurrence.range).sort((first, second) => first.start - second.start)
+            });
+        }
+    }
+    return candidates;
+}
+function createSourcePointer(trace, message, messageIndex) {
+    return {
+        traceId: trace.id,
+        messageId: message.id,
+        messageIndex,
+        contentSha256: contentHash(message.content)
+    };
+}
+function sourceExcerptPreview(content) {
+    const normalized = content.trim().replace(/\s+/g, " ");
+    return normalized.length > 160 ? `${normalized.slice(0, 157)}...` : normalized;
+}
+function createCapsuleText(sourcePointer, sourceMessage, replacedTokens, isSuperseded = false) {
+    // Honest wording per category: category 1 compacts an EARLIER superseded read (self-pointer to the
+    // retained earlier copy), not a duplicate of a kept first copy.
+    const whatWasCompacted = isSuperseded
+        ? `Superseded earlier ${sourceMessage.toolName ?? "tool"} read from the same source was compacted before this model call (a later read of the same source is authoritative and is retained verbatim).`
+        : `Repeated ${sourceMessage.toolName ?? "tool"} output was compacted before this model call.`;
+    return [
+        `[state capsule: ${COMPACTION_POLICY_NAME}]`,
+        whatWasCompacted,
+        `Raw source pointer: trace=${sourcePointer.traceId} message=${sourcePointer.messageId} index=${sourcePointer.messageIndex} sha256=${sourcePointer.contentSha256}.`,
+        `The original payload is retained locally at that pointer for audit and replay.`,
+        `Estimated raw ${isSuperseded ? "superseded" : "duplicate"} input tokens replaced: ${replacedTokens}.`
+    ].join("\n");
+}
+function candidateToFinding(candidate) {
+    if (candidate.replacementMode === "whole_message") {
+        return candidate.finding;
+    }
+    return {
+        category: "repeated_tool_output",
+        messageIds: [candidate.sourceMessage.id, candidate.targetMessage.id],
+        summary: `Embedded ${candidate.sourceMessage.toolName ?? "tool"} output from ${candidate.sourceMessage.id} compacted inside ${candidate.targetMessage.id}.`,
+        estimatedTokens: candidate.replacedTokens
+    };
+}
+function createCapsules(trace, candidates) {
+    const baseCapsule = createStateCapsule(trace, candidates.map(candidateToFinding));
+    return candidates.map((candidate, index) => {
+        const sourcePointer = createSourcePointer(trace, candidate.sourceMessage, candidate.sourceIndex);
+        const isSuperseded = candidate.replacementMode === "whole_message" &&
+            candidate.finding.category === "superseded_same_source_read";
+        const capsule = {
+            id: `state_capsule_${index + 1}`,
+            policyName: COMPACTION_POLICY_NAME,
+            traceId: trace.id,
+            sourcePointer,
+            compactedMessageIds: [candidate.targetMessage.id],
+            replacementMode: candidate.replacementMode,
+            sourceExcerptPreview: sourceExcerptPreview(candidate.sourceMessage.content),
+            originalPayloadTokenCount: estimateTextTokens(candidate.sourceMessage.content),
+            text: createCapsuleText(sourcePointer, candidate.sourceMessage, candidate.replacedTokens, isSuperseded),
+            retainedFacts: baseCapsule.retainedFacts,
+            openQuestions: baseCapsule.openQuestions,
+            safetyNotes: [
+                ...baseCapsule.safetyNotes,
+                isSuperseded
+                    ? `Raw superseded earlier read remains available at trace ${sourcePointer.traceId} message ${sourcePointer.messageId}.`
+                    : `Raw repeated output remains available at trace ${sourcePointer.traceId} message ${sourcePointer.messageId}.`,
+                isSuperseded
+                    ? `Only the superseded earlier read message ${candidate.targetMessage.id} was replaced with a state capsule; the later authoritative read of the same source is retained verbatim.`
+                    : `Only ${candidate.replacementMode === "whole_message" ? "duplicate tool output message" : "embedded payload in message"} ${candidate.targetMessage.id} was replaced with a state capsule.`
+            ]
+        };
+        if (candidate.replacementMode === "embedded_payload") {
+            capsule.replacedRanges = candidate.replacedRanges;
+            capsule.replacedContentSha256 = candidate.replacedContentSha256;
+        }
+        return capsule;
+    });
+}
+function createCompactionMetadata(capsule, messageId) {
+    const metadata = {
+        policyName: capsule.policyName,
+        capsuleId: capsule.id,
+        rawSourcePointer: capsule.sourcePointer,
+        compactedMessageId: messageId,
+        replacementMode: capsule.replacementMode
+    };
+    if (capsule.replacementMode === "embedded_payload") {
+        metadata.replacedRanges = capsule.replacedRanges ?? [];
+        metadata.replacedContentSha256 = capsule.replacedContentSha256 ?? "";
+    }
+    if (capsule.skillInjectionProvenance) {
+        metadata.skillInjectionProvenance = capsule.skillInjectionProvenance;
+    }
+    return metadata;
+}
+function compactMessages(messages, candidates, capsules, skillInjectionCapsules = []) {
+    const wholeMessageCapsuleById = new Map();
+    const embeddedByTargetId = new Map();
+    for (const [index, candidate] of candidates.entries()) {
+        const capsule = capsules[index];
+        if (candidate.replacementMode === "whole_message") {
+            wholeMessageCapsuleById.set(candidate.targetMessage.id, capsule);
+            continue;
+        }
+        const existing = embeddedByTargetId.get(candidate.targetMessage.id) ?? [];
+        existing.push({ candidate, capsule });
+        embeddedByTargetId.set(candidate.targetMessage.id, existing);
+    }
+    // Sequential composition (design §Q1): skill-injection capsules are also `whole_message`
+    // and operate on a DISJOINT message set (role:user injections vs role:tool outputs), so they
+    // simply add to the same whole-message replacement map. Order is independent.
+    for (const capsule of skillInjectionCapsules) {
+        for (const compactedId of capsule.compactedMessageIds) {
+            wholeMessageCapsuleById.set(compactedId, capsule);
+        }
+    }
+    return messages.map((message) => {
+        const wholeMessageCapsule = wholeMessageCapsuleById.get(message.id);
+        if (wholeMessageCapsule) {
+            return {
+                ...message,
+                content: wholeMessageCapsule.text,
+                metadata: {
+                    ...message.metadata,
+                    compaction: createCompactionMetadata(wholeMessageCapsule, message.id)
+                }
+            };
+        }
+        const embeddedReplacements = embeddedByTargetId.get(message.id);
+        if (!embeddedReplacements) {
+            return { ...message, metadata: message.metadata ? { ...message.metadata } : undefined };
+        }
+        const occurrences = embeddedReplacements
+            .flatMap(({ candidate, capsule }) => candidate.replacedRanges.map((range) => ({ range, capsule })))
+            .sort((first, second) => first.range.start - second.range.start);
+        let content = "";
+        let cursor = 0;
+        for (const occurrence of occurrences) {
+            content += message.content.slice(cursor, occurrence.range.start);
+            content += occurrence.capsule.text;
+            cursor = occurrence.range.end;
+        }
+        content += message.content.slice(cursor);
+        const replacementMetadata = embeddedReplacements.map(({ capsule }) => createCompactionMetadata(capsule, message.id));
+        const [firstReplacementMetadata] = replacementMetadata;
+        return {
+            ...message,
+            content,
+            metadata: {
+                ...message.metadata,
+                compaction: replacementMetadata.length === 1
+                    ? firstReplacementMetadata
+                    : {
+                        ...firstReplacementMetadata,
+                        replacements: replacementMetadata
+                    }
+            }
+        };
+    });
+}
+function collectSafetyNotes(toolOutputCapsules, skillInjectionCapsules = []) {
+    if (toolOutputCapsules.length === 0 && skillInjectionCapsules.length === 0) {
+        return [
+            "No repeated large tool output met the policy thresholds; no payload content was replaced.",
+            "The middleware is deterministic and local; no provider API was called."
+        ];
+    }
+    const notes = [];
+    if (toolOutputCapsules.length > 0) {
+        notes.push(`Applied ${COMPACTION_POLICY_NAME} to ${toolOutputCapsules.length} repeated tool output replacement(s).`);
+    }
+    if (skillInjectionCapsules.length > 0) {
+        notes.push(`Applied ${SKILL_INJECTION_POLICY_NAME} (approval-gated) to ${skillInjectionCapsules.length} byte-identical same-skill skill-injection replacement(s).`);
+    }
+    notes.push("Raw payloads are preserved by source pointer for audit and replay.", "The middleware is deterministic and local; no provider API was called.");
+    return notes;
+}
+function collectCompactedMessageIds(capsules) {
+    return Array.from(new Set(capsules.flatMap((capsule) => capsule.compactedMessageIds)));
+}
+/**
+ * Error thrown when the provenance-completeness write-time invariant is violated.
+ * See `docs/ops/provenance-completeness-invariant.md`.
+ */
+export class ProvenanceCompletenessError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = "ProvenanceCompletenessError";
+    }
+}
+function isResolvableSourcePointer(pointer) {
+    return (typeof pointer?.traceId === "string" &&
+        typeof pointer.messageId === "string" &&
+        typeof pointer.messageIndex === "number" &&
+        typeof pointer.contentSha256 === "string" &&
+        pointer.contentSha256.length > 0);
+}
+/**
+ * Whole-message dedup equivalence — MUST match `normalizeContent` in waste-detector.ts (the
+ * signature `detectWaste` keys whole-message duplicates by) and `sourceExcerptPreview` here.
+ * `detectWaste` selects a later tool output as a duplicate of a retained copy when their
+ * NORMALIZED content is equal (whitespace collapsed), NOT when their raw bytes are equal. The
+ * provenance guard's whole-message binding therefore MUST use this same equivalence, or it would
+ * reject honest compactions where the retained/canonical copy and the compacted later copy are
+ * normalized-equal but raw-different (e.g. a re-read file with different whitespace) — a copy that
+ * the shipped recoverability check in safety-report.ts ACCEPTS (it resolves the pointer to the
+ * canonical source and matches the pointer hash against THAT source, never against the later
+ * copy's own raw bytes). The guard must never be stricter than the shipped recoverability semantics.
+ */
+function normalizeDedupContent(content) {
+    return content.trim().replace(/\s+/g, " ");
+}
+/**
+ * Resolve a source pointer to its referenced ORIGINAL message, mirroring safety-report.ts's
+ * `findOriginalMessage`: prefer the message at `messageIndex` when its id matches, else fall back
+ * to the first message with the pointer's id. Returns undefined when no original messages are
+ * available or the pointer resolves to nothing (so the caller fails closed).
+ */
+function resolveSourceByPointer(pointer, originalMessages) {
+    if (!originalMessages) {
+        return undefined;
+    }
+    const atIndex = originalMessages[pointer.messageIndex];
+    if (atIndex?.id === pointer.messageId) {
+        return atIndex;
+    }
+    return originalMessages.find((message) => message.id === pointer.messageId);
+}
+/**
+ * Does a whole-message source pointer LEGITIMATELY cover `positionOriginalContent` under the SAME
+ * equivalence the writer/dedup and safety-report use? Two conditions, mirroring safety-report.ts's
+ * recoverability check exactly:
+ *   (a) POINTER HONESTY: the pointer resolves to a real original message whose raw content hashes to
+ *       `pointer.contentSha256` (safety-report's `pointersWithPayloadMismatch` check). A pointer
+ *       that lies about what it points at cannot cover anything.
+ *   (b) DEDUP EQUIVALENCE: the resolved canonical/source content is NORMALIZED-equal to the changed
+ *       position's own original payload — i.e. the position's original is recoverable from the
+ *       canonical copy the pointer references under the dedup's normalized equivalence.
+ * This is the per-occurrence binding for whole-message compactions. It PASSES the honest
+ * whitespace-variant duplicate (normalized-equal canonical + later copy) and FAILS a malicious
+ * occurrence substitution (the displaced position's original is normalized-DIFFERENT from the
+ * canonical content the surviving pointer references). It is never stricter than safety-report.ts.
+ */
+function wholeMessagePointerCoversPosition(pointer, positionOriginalContent, originalMessages) {
+    const source = resolveSourceByPointer(pointer, originalMessages);
+    if (!source) {
+        return false;
+    }
+    if (contentHash(source.content) !== pointer.contentSha256) {
+        return false; // pointer is not honest about the source it references
+    }
+    return normalizeDedupContent(source.content) === normalizeDedupContent(positionOriginalContent);
+}
+/**
+ * Read the `metadata.compaction` provenance entries carried by a compacted message.
+ * Mirrors `readCompactionMetadata` in safety-report.ts: a multi-replacement message
+ * carries its per-replacement entries under `replacements`; otherwise the single entry.
+ */
+function readMessageCompactionMetadata(message) {
+    const metadata = message.metadata?.compaction;
+    if (!metadata) {
+        return [];
+    }
+    if (Array.isArray(metadata.replacements) && metadata.replacements.length > 0) {
+        return metadata.replacements;
+    }
+    return [metadata];
+}
+/**
+ * Does this capsule genuinely cover the original content at a changed position carrying the
+ * capsule's id — under the SAME equivalence the writer/dedup and safety-report use? This is the
+ * per-occurrence BINDING that distinguishes a capsule which legitimately covers THIS occurrence's
+ * original payload from one that merely shares the (non-unique) message id (Codex P2, PR #280),
+ * WITHOUT being stricter than the shipped recoverability semantics (Codex P1 follow-up, PR #282).
+ *
+ *  - WHOLE-MESSAGE capsule: `detectWaste` selects the compacted later copy as a duplicate of the
+ *    retained canonical copy when their NORMALIZED content is equal (whitespace collapsed) — NOT
+ *    when their raw bytes are equal. The capsule's `sourcePointer` references that CANONICAL copy
+ *    (its `contentSha256` hashes the canonical copy's raw bytes, not the later copy's). So the
+ *    binding is: the pointer resolves to a real canonical source whose raw content hashes to the
+ *    pointer (pointer honesty), AND that canonical content is NORMALIZED-equal to the changed
+ *    position's own original payload (the dedup equivalence). This is exactly what safety-report.ts
+ *    proves recoverable (`wholeMessagePointerCoversPosition`); a raw-hash-equality binding would
+ *    FALSE-REJECT an honest whitespace-variant duplicate that safety-report accepts.
+ *  - EMBEDDED-PAYLOAD capsule: embedded sources are matched by RAW `indexOf` against the target's
+ *    original content (`findNonOverlappingOccurrences`), so the replaced sub-range is byte-identical
+ *    to the source payload. SOME replaced sub-range of P_orig must therefore hash to
+ *    `sourcePointer.contentSha256` (equivalently `replacedContentSha256`). No normalization gap
+ *    exists here, so the raw sub-range hash check is correct and not over-strict.
+ *
+ * Honest runs match 1:1; a duplicated/mis-bound capsule whose canonical source is normalized-
+ * DIFFERENT from the displaced occurrence's original does not satisfy this for that occurrence.
+ */
+function capsuleCoversOriginalContent(capsule, originalContent, originalMessages) {
+    const expectedHash = capsule.sourcePointer.contentSha256;
+    if (typeof expectedHash !== "string" || expectedHash.length === 0) {
+        return false;
+    }
+    if (capsule.replacementMode === "embedded_payload") {
+        const ranges = capsule.replacedRanges ?? [];
+        return ranges.some((range) => {
+            if (range.start < 0 || range.end > originalContent.length || range.start >= range.end) {
+                return false;
+            }
+            return contentHash(originalContent.slice(range.start, range.end)) === expectedHash;
+        });
+    }
+    // whole_message (the default / shipped tool-output policy and skill-injection capsules): bind by
+    // the dedup's NORMALIZED equivalence against the resolved canonical source, mirroring
+    // safety-report.ts recoverability — never stricter than the shipped semantics.
+    return wholeMessagePointerCoversPosition(capsule.sourcePointer, originalContent, originalMessages);
+}
+/**
+ * Compare the original trace messages against the writer's compacted output POSITIONALLY over
+ * `max(original.length, compacted.length)` positions, classifying every divergent position.
+ *
+ * This is the non-tautological "content changed" signal: it is derived from the real
+ * before/after payloads, INDEPENDENT of any state capsule or `compactedMessageIds` value.
+ * A message whose content was replaced is "changed" here regardless of whether a covering
+ * capsule exists for it — exactly the regression case (capsules dropped while content was still
+ * replaced) the capsule-derived trigger could not catch.
+ *
+ * Comparison is POSITIONAL, not id-keyed: the writer (`compactMessages`) emits the compacted
+ * messages as a 1:1 positional map of the original messages, and message ids are NOT unique
+ * (e.g. a Claude assistant turn with a text block + a tool_use block yields two messages that
+ * share the same id). Keying by id would collapse those distinct payloads and mis-report a
+ * change.
+ *
+ * Every position in `[0, max(original.length, compacted.length))` is classified against the
+ * honest-writer invariant — a COMPLETE 1:1 id-preserving positional map:
+ *  - BOTH present, SAME id, same content ⇒ unchanged.
+ *  - BOTH present, SAME id, differing content ⇒ CONTENT-CHANGED (covered if provenance exists).
+ *  - BOTH present, DIFFERING id ⇒ STRUCTURAL divergence. A compacted id at a position differs
+ *    from the original id there only if the writer dropped the original at that slot and inserted/
+ *    duplicated/substituted a different message — even at equal length. No capsule for the
+ *    DISPLACING id can recover the original it displaced, so this can carry no covering provenance.
+ *  - original present, compacted absent ⇒ DROPPED (structural divergence; cannot be covered).
+ *  - compacted present, original absent ⇒ ADDED (structural divergence; cannot be covered).
+ * This closes the whole positional-divergence class: any drop, add, swap, substitution, or
+ * duplication fails toward firing the guard, never toward a silent no-op. Honest runs (1:1
+ * in-place replacement that preserves each id at its position, equal length) produce zero
+ * structural divergences, so this stays a true no-op for them.
+ */
+function diffMessagesByContent(originalMessages, compactedMessages) {
+    const contentChangedPositions = [];
+    let structuralDivergences = 0;
+    const positions = Math.max(originalMessages.length, compactedMessages.length);
+    for (let index = 0; index < positions; index += 1) {
+        const original = originalMessages[index];
+        const compacted = compactedMessages[index];
+        if (original && compacted) {
+            if (compacted.id !== original.id) {
+                // Same-length (or in-range) position whose compacted id differs from the original id at
+                // that slot: the writer dropped the original here and inserted/duplicated/substituted a
+                // DIFFERENT message. This is NOT a coverable content change — a capsule/metadata for the
+                // displacing id sources from a different original (or none) and cannot make the displaced
+                // original recoverable. It is a STRUCTURAL divergence, failed closed before any id-based
+                // provenance check.
+                structuralDivergences += 1;
+                continue;
+            }
+            // Same id at the same position: a 1:1 id-preserving slot. A differing payload here is a
+            // real, coverable in-place content change (the honest writer's only allowed mutation).
+            // Record the POSITION (index + id), not just the id: ids are non-unique, so coverage must
+            // later be matched per occurrence/position, not collapsed by id.
+            if (compacted.content !== original.content) {
+                contentChangedPositions.push({ index, id: compacted.id });
+            }
+            continue;
+        }
+        // Exactly one side exists at this position: the original was DROPPED, or a message was
+        // ADDED. Either way there is no in-place counterpart that could carry covering provenance,
+        // so this is a structural divergence the guard must fail closed on.
+        structuralDivergences += 1;
+    }
+    return { contentChangedPositions, structuralDivergences };
+}
+/**
+ * Provenance-completeness write-boundary guard (design: docs/ops/provenance-completeness-invariant.md).
+ *
+ * Invariant: `compaction_changed_content ⟹ provenance_present`. The "content actually
+ * changed" trigger is derived by comparing each original message's payload against the final
+ * compacted payload (`diffMessagesByContent`) — NOT from `compactedMessageIds` collected
+ * from the capsules. Deriving the trigger from the capsules is tautological: if a regressed
+ * path drops/empties the capsule provenance while STILL replacing message content, the
+ * capsule-derived id set goes empty and the guard would no-op, missing exactly the
+ * changed-but-zero-provenance case it exists to reject. Comparing real content instead means a
+ * replaced message is "changed" regardless of whether any capsule exists for it.
+ *
+ * When content changed (by either real content change OR a capsule-claimed compacted id — the
+ * union, so no existing check is weakened), EVERY changed message id MUST have a covering state
+ * capsule, AND EVERY changed message MUST carry `metadata.compaction` with a resolvable
+ * `rawSourcePointer` + content hash (mirrors the required recoverability checks in
+ * safety-report.ts). On violation, FAIL CLOSED: throw, so a changed-but-zero/incomplete-provenance
+ * result can never be emitted as a silent no-op the eval harness cannot distinguish from a true no-op.
+ *
+ * The content-change comparison runs over `max(original.length, compacted.length)` positions
+ * (`diffMessagesByContent`) and enforces the COMPLETE honest-writer invariant: a 1:1 id-preserving
+ * positional map of original→compacted. A position with the SAME id whose content was replaced is a
+ * coverable change; ANYTHING that is not 1:1 id-preserving is a STRUCTURAL divergence that can carry
+ * no covering provenance and fails the guard closed — a DROPPED position (original present, compacted
+ * absent), an ADDED position (compacted present, original absent), AND a same-length position whose
+ * compacted id differs from the original id at that slot (a swap/substitution/duplication, i.e. one
+ * original dropped and a different id inserted at equal length). The last case is rejected BEFORE the
+ * id-based checks precisely because a capsule/metadata that exists for the DISPLACING id sources from
+ * a different original and can never make the displaced original recoverable. This closes the
+ * previously-missed cases where a regressed writer silently DROPS a message, or keeps the array length
+ * while substituting/duplicating an id, and the surviving capsules/ids happen to cover the wrong id.
+ *
+ * This is a NO-OP for every honest run: the shipped writer co-produces a covering capsule and
+ * `metadata.compaction` (with rawSourcePointer + contentSha256) for every compacted span, so
+ * every content-changed id is fully covered. The guard only fires on a regressed/malformed/
+ * hand-constructed path. `originalMessages` is optional for backward compatibility; when omitted,
+ * the guard falls back to the capsule-derived ids alone (the pre-hardening behavior).
+ *
+ * OCCURRENCE-AWARE COVERAGE — HASH BINDING (closes the shared-id residual, 2026-06-15). Message
+ * ids are NON-UNIQUE (a Claude turn's text + tool_use blocks share one id). A malformed
+ * same-length output can DROP one shared-id position and DUPLICATE the other into its slot: every
+ * position still has a matching id (the structural check passes, since both share the id), and the
+ * displaced position carries the duplicate's valid metadata, so an id-keyed coverage check is
+ * satisfied by a capsule belonging to a DIFFERENT occurrence while the displaced original stays
+ * unrecoverable. Merely COUNTING distinct covering capsules per id is ALSO insufficient (Codex P2,
+ * PR #280): a malformed output can keep BOTH shared-id capsules present (count satisfied) yet
+ * duplicate one occurrence's compacted message + metadata into the other's slot. To close this,
+ * when `originalMessages` is provided the coverage is matched per OCCURRENCE BY ORIGINAL-CONTENT
+ * HASH: each changed POSITION p (index + id, original payload P_orig) is bound to a DISTINCT,
+ * not-yet-consumed capsule whose `sourcePointer.contentSha256` hashes to the content that capsule
+ * replaced at p (whole P_orig for a whole-message capsule, a replaced sub-range of P_orig for an
+ * embedded one), AND p's OWN `metadata.compaction` pointer must hash to that same original. A
+ * shared-id duplication fails because the displaced slot's pointer hashes to a DIFFERENT
+ * occurrence's payload, not to its own original, so it FAILS CLOSED; an honest duplicate-id
+ * compaction (two messages sharing an id, each its own hash-correct capsule) still PASSES. The
+ * honest writer emits, per compacted target, exactly one capsule + metadata whose contentSha256 is
+ * that target's original payload hash, so every changed position binds 1:1 — a true no-op. (Binding
+ * is by original-content HASH, not by `sourcePointer.messageIndex`, which records the SOURCE payload
+ * index, not the changed/target position — an index match would break honest whole-message/embedded
+ * runs.)
+ */
+export function assertProvenanceCompleteness(compactedMessages, stateCapsules, compactedMessageIds, originalMessages) {
+    // Independent "content actually changed" signal: real before/after content comparison over
+    // max(original, compacted) positions, not derived from the capsules. This yields both the
+    // coverable content-changed POSITIONS (index + id, so shared ids do not collapse) and a count of
+    // STRUCTURAL divergences (dropped/added positions that can carry no covering provenance).
+    const divergence = originalMessages
+        ? diffMessagesByContent(originalMessages, compactedMessages)
+        : { contentChangedPositions: [], structuralDivergences: 0 };
+    // Structural divergence (anything that is NOT a 1:1 id-preserving positional map: a DROPPED
+    // position, an ADDED position, or a same-length position whose compacted id differs from the
+    // original id there) can never have covering provenance — a dropped message has no compacted
+    // message to carry metadata; an added/substituted/duplicated id sources from a different original
+    // (or none), so a capsule for that displacing id cannot recover the original it displaced. Fail
+    // closed before any id-based check: a structural anomaly can never be made recoverable by a
+    // capsule for a DIFFERENT id, and is exactly the malformed/truncated artifact this guard rejects.
+    if (divergence.structuralDivergences > 0) {
+        throw new ProvenanceCompletenessError(`Provenance-completeness violation: the compacted output diverges structurally from the original at ${divergence.structuralDivergences} position(s) (a message was dropped, added, or its id at that position was substituted/duplicated — i.e. not a 1:1 id-preserving positional map). Such positions can carry no covering provenance. Refusing to emit a changed-but-unrecoverable artifact.`);
+    }
+    // Deterministic trigger: nothing actually changed ⇒ true no-op ⇒ nothing to assert. (Content
+    // changed positions OR capsule-claimed ids; either is enough to require provenance.)
+    if (divergence.contentChangedPositions.length === 0 && new Set(compactedMessageIds).size === 0) {
+        return;
+    }
+    // Requirement 1 (occurrence-aware, HASH-BOUND). Counting distinct covering capsules per id is NOT
+    // sufficient (Codex P2, PR #280): a malformed same-length output can KEEP both shared-id capsules
+    // present (so the per-id distinct-capsule COUNT is satisfied) yet DUPLICATE one occurrence's
+    // compacted message + metadata into the other occurrence's slot — leaving that displaced
+    // occurrence's ORIGINAL payload unrecoverable, because no surviving capsule's sourcePointer hashes
+    // to that occurrence's original content. Counting capsules ≠ binding each changed occurrence to a
+    // capsule that actually covers THAT occurrence's original content.
+    //
+    // So instead of counting, MATCH: for each changed POSITION p (carrying id X, with original payload
+    // P_orig), consume a DISTINCT capsule covering id X whose source pointer's `contentSha256` equals
+    // the hash of the original content that capsule actually replaced AT p — the whole P_orig for a
+    // whole-message capsule, or the replaced payload sub-range of P_orig for an embedded capsule. A
+    // capsule consumed by one position cannot be reused by another (greedy 1:1 assignment). If any
+    // changed position has no distinct, hash-correct covering capsule → FAIL CLOSED.
+    //
+    // No-op for honest runs: the shipped writer emits, per changed position, exactly one capsule whose
+    // sourcePointer.contentSha256 = that position's original payload hash (whole-message: the duplicate
+    // is byte-identical to the source it points at; embedded: the capsule carries the replaced
+    // payload's hash and its replacedRanges locate that payload inside P_orig). So every changed
+    // position matches a distinct capsule 1:1. The shared-id duplication fails because position 0's
+    // ORIGINAL hash does not match the duplicated (occurrence-1) capsule, and occurrence 0's own
+    // capsule — even if still present — replaced occurrence-0 content the malformed slot no longer
+    // carries; the greedy match still binds it to position 0 by its correct original hash, so the
+    // failing signal is precisely the slot whose metadata points at the WRONG occurrence (Requirement
+    // 2 below catches that). Either way the malformed artifact is refused.
+    if (originalMessages) {
+        const consumedCapsules = new Set();
+        const positionsMissingCoverage = [];
+        for (const position of divergence.contentChangedPositions) {
+            const originalContent = originalMessages[position.index]?.content ?? "";
+            const match = stateCapsules.find((capsule) => !consumedCapsules.has(capsule) &&
+                new Set(capsule.compactedMessageIds).has(position.id) &&
+                capsuleCoversOriginalContent(capsule, originalContent, originalMessages));
+            if (match) {
+                consumedCapsules.add(match);
+            }
+            else {
+                positionsMissingCoverage.push(position);
+            }
+        }
+        if (positionsMissingCoverage.length > 0) {
+            throw new ProvenanceCompletenessError(`Provenance-completeness violation: content was compacted but ${positionsMissingCoverage.length} changed occurrence(s) have no DISTINCT covering state capsule whose source pointer hashes to that occurrence's original payload: ${positionsMissingCoverage
+                .map((position) => `${position.id}@${position.index}`)
+                .join(", ")}. Refusing to emit a changed-but-unrecoverable artifact.`);
+        }
+    }
+    // Requirement 1b (capsule-claimed-only ids — pre-hardening behavior PRESERVED). Ids claimed via
+    // `compactedMessageIds` that are NOT also content-changed positions (e.g. callers that pass only
+    // compactedMessageIds without original messages, like the stripped-metadata regression test) must
+    // still have ≥1 distinct covering capsule. Hash-binding cannot apply here (no original payload is
+    // available for those ids), so this keeps the prior id-keyed count check — no prior check weakened.
+    const contentChangedIds = new Set(divergence.contentChangedPositions.map((position) => position.id));
+    const distinctCapsuleCountById = new Map();
+    for (const capsule of stateCapsules) {
+        for (const coveredId of new Set(capsule.compactedMessageIds)) {
+            distinctCapsuleCountById.set(coveredId, (distinctCapsuleCountById.get(coveredId) ?? 0) + 1);
+        }
+    }
+    const underCoveredIds = [...new Set(compactedMessageIds)]
+        .filter((messageId) => !contentChangedIds.has(messageId))
+        .filter((messageId) => (distinctCapsuleCountById.get(messageId) ?? 0) < 1)
+        .map((messageId) => `${messageId} (need 1, have ${distinctCapsuleCountById.get(messageId) ?? 0})`);
+    if (underCoveredIds.length > 0) {
+        throw new ProvenanceCompletenessError(`Provenance-completeness violation: content was compacted but ${underCoveredIds.length} compacted message id(s) have no covering state capsule for every changed occurrence: ${underCoveredIds.join(", ")}. Refusing to emit a changed-but-unrecoverable artifact.`);
+    }
+    // Requirement 2 (occurrence-aware): each changed POSITION's own compacted message object must
+    // carry resolvable metadata.compaction (rawSourcePointer + content hash) for its id — read
+    // positionally, not collapsed by id, so a displaced position cannot borrow a different
+    // occurrence's metadata. Capsule-claimed ids with no content-changed position are additionally
+    // checked by id (the pre-hardening behavior), so no prior check is weakened.
+    const metadataResolvesForId = (message, messageId) => {
+        if (!message) {
+            return false;
+        }
+        return readMessageCompactionMetadata(message).some((metadata) => {
+            const coveredId = metadata.compactedMessageId ?? message.id;
+            return coveredId === messageId && isResolvableSourcePointer(metadata.rawSourcePointer);
+        });
+    };
+    // For a CONTENT-CHANGED position, the metadata must additionally be BOUND to THAT position's
+    // ORIGINAL payload under the SAME equivalence the writer/dedup and safety-report use: some
+    // metadata entry for the position's id whose rawSourcePointer legitimately covers the content
+    // actually replaced at this position. This is the catch for Codex P2 (PR #280): when occurrence
+    // 1's compacted message + metadata is DUPLICATED into occurrence 0's slot, occurrence 0's slot
+    // carries occurrence 1's pointer (referencing occurrence 1's canonical payload), which is
+    // normalized-DIFFERENT from occurrence 0's ORIGINAL content — so even though both capsules are
+    // present (the count passes) and the displaced metadata is "resolvable" (the by-id check passes),
+    // the per-position binding fails and the artifact is refused.
+    //
+    // The whole-message branch binds by the dedup's NORMALIZED equivalence against the canonical
+    // source the pointer references (`wholeMessagePointerCoversPosition`), NOT by raw-hash equality of
+    // the position's own bytes — otherwise it would FALSE-REJECT an honest whitespace-variant
+    // duplicate that safety-report.ts accepts (Codex P1 follow-up, PR #282). The embedded branch keeps
+    // the raw sub-range hash (embedded sources are matched by raw indexOf, so there is no
+    // normalization gap). Honest runs are unaffected: each position's own metadata records a pointer
+    // to a canonical source that is normalized-equal to (the whole-message case) — or a raw sub-range
+    // of (the embedded case) — that position's original payload.
+    const metadataHashBindsToOriginal = (message, messageId, originalContent) => {
+        if (!message) {
+            return false;
+        }
+        return readMessageCompactionMetadata(message).some((metadata) => {
+            const coveredId = metadata.compactedMessageId ?? message.id;
+            if (coveredId !== messageId || !isResolvableSourcePointer(metadata.rawSourcePointer)) {
+                return false;
+            }
+            const pointer = metadata.rawSourcePointer;
+            if (metadata.replacementMode === "embedded_payload") {
+                const pointerHash = pointer.contentSha256;
+                const ranges = metadata.replacedRanges ?? [];
+                return ranges.some((range) => {
+                    if (range.start < 0 || range.end > originalContent.length || range.start >= range.end) {
+                        return false;
+                    }
+                    return contentHash(originalContent.slice(range.start, range.end)) === pointerHash;
+                });
+            }
+            // whole_message: the pointer's canonical source must be normalized-equal to this position's
+            // original payload (and the pointer must honestly hash that canonical source) — mirroring
+            // safety-report.ts recoverability, never stricter.
+            return wholeMessagePointerCoversPosition(pointer, originalContent, originalMessages);
+        });
+    };
+    const positionsMissingProvenance = divergence.contentChangedPositions.filter((position) => {
+        const message = compactedMessages[position.index];
+        if (!metadataResolvesForId(message, position.id)) {
+            return true;
+        }
+        if (!originalMessages) {
+            return false;
+        }
+        const originalContent = originalMessages[position.index]?.content ?? "";
+        return !metadataHashBindsToOriginal(message, position.id, originalContent);
+    });
+    // Capsule-claimed ids that are not also content-changed positions: fall back to id-keyed
+    // metadata resolution over all compacted messages (preserves the prior behavior for callers that
+    // pass compactedMessageIds without original messages, e.g. the stripped-metadata regression test).
+    const contentChangedIdSet = new Set(divergence.contentChangedPositions.map((position) => position.id));
+    const idOnlyClaimedIds = [...new Set(compactedMessageIds)].filter((messageId) => !contentChangedIdSet.has(messageId));
+    const idOnlyMissingProvenance = idOnlyClaimedIds.filter((messageId) => !compactedMessages.some((message) => metadataResolvesForId(message, messageId)));
+    const missingProvenanceLabels = [
+        ...positionsMissingProvenance.map((position) => `${position.id}@${position.index}`),
+        ...idOnlyMissingProvenance
+    ];
+    if (missingProvenanceLabels.length > 0) {
+        throw new ProvenanceCompletenessError(`Provenance-completeness violation: content was compacted but ${missingProvenanceLabels.length} changed message(s) lack metadata.compaction with a resolvable rawSourcePointer + content hash: ${missingProvenanceLabels.join(", ")}. Refusing to emit a changed-but-unrecoverable artifact.`);
+    }
+}
+export function applyCompactionPolicy(input) {
+    assertSupportedPolicy(input.policy);
+    const trace = resolveTrace(input);
+    const thresholds = {
+        minDuplicateTokens: input.thresholds?.minDuplicateTokens ?? DEFAULT_MIN_DUPLICATE_TOKENS,
+        minDuplicateCharacters: input.thresholds?.minDuplicateCharacters ?? DEFAULT_MIN_DUPLICATE_CHARACTERS
+    };
+    const tokenEstimateBefore = estimateTraceTokens(trace);
+    const costEstimateBefore = calculateCost(trace.model, tokenEstimateBefore);
+    const repeatCandidates = findRepeatCandidates(trace, thresholds);
+    const embeddedCandidates = findEmbeddedCandidates(trace, thresholds);
+    // ADDITIVE input-compaction category 1 (superseded same-source reads). These are whole-message
+    // self-pointer compactions of EARLIER superseded reads; the latest authoritative read is never a
+    // candidate (stays verbatim). They reuse the identical capsule/recoverability machinery below.
+    // Conservative de-overlap: if a message is ALREADY a target of the identical-repeat or embedded
+    // policy (it matched some other identical output elsewhere), leave it to that policy — never
+    // double-compact the same position. This keeps the existing policy's behavior authoritative.
+    const alreadyTargetedIds = new Set([
+        ...repeatCandidates.map((candidate) => candidate.duplicateMessage.id),
+        ...embeddedCandidates.map((candidate) => candidate.targetMessage.id)
+    ]);
+    const supersededCandidates = findSupersededReadCandidates(trace, thresholds).filter((candidate) => !alreadyTargetedIds.has(candidate.targetMessage.id));
+    const candidates = [
+        ...repeatCandidates.map((candidate) => ({
+            replacementMode: "whole_message",
+            sourceMessage: candidate.sourceMessage,
+            sourceIndex: candidate.sourceIndex,
+            targetMessage: candidate.duplicateMessage,
+            targetIndex: candidate.duplicateIndex,
+            replacedTokens: candidate.duplicateTokens,
+            finding: candidate.finding
+        })),
+        ...supersededCandidates,
+        ...embeddedCandidates.map((candidate) => ({
+            replacementMode: "embedded_payload",
+            sourceMessage: candidate.sourceMessage,
+            sourceIndex: candidate.sourceIndex,
+            targetMessage: candidate.targetMessage,
+            targetIndex: candidate.targetIndex,
+            replacedTokens: candidate.sourceTokens * candidate.replacedRanges.length,
+            replacedRanges: candidate.replacedRanges,
+            replacedContentSha256: contentHash(candidate.sourceMessage.content)
+        }))
+    ].sort((first, second) => first.targetIndex - second.targetIndex || first.sourceIndex - second.sourceIndex);
+    const stateCapsules = createCapsules(trace, candidates);
+    // ── Sequential two-policy composition (design Open Question #1, resolved) ────────────────
+    // The two policies operate on DISJOINT message sets: `stale_tool_output_to_state_capsule`
+    // acts on role:tool messages; `repeated_skill_injection_to_state_capsule` acts on role:user
+    // skill injections. Because the sets are disjoint, sequential application with INDEPENDENT
+    // capsule sets is order-independent and needs no general policy registry — a contained,
+    // explicit two-policy composition. The skill-injection policy is APPROVAL-GATED: it runs only
+    // when `compactSkillInjections === true` (set on explicit approval). Default => compacts nothing.
+    const skillInjectionCandidates = input.compactSkillInjections === true
+        ? findSkillInjectionCompactionCandidates(trace)
+        : [];
+    const skillInjectionCapsules = skillInjectionCandidates.length > 0
+        ? createSkillInjectionCapsules(trace, skillInjectionCandidates, { retainedFacts: stateCapsules[0]?.retainedFacts ?? [], openQuestions: stateCapsules[0]?.openQuestions ?? [], safetyNotes: [] }, stateCapsules.length)
+        : [];
+    const compactedMessages = compactMessages(trace.messages, candidates, stateCapsules, skillInjectionCapsules);
+    const compactedTrace = {
+        ...trace,
+        id: `${trace.id}_policy_compacted`,
+        title: `${trace.title} (policy compacted)`,
+        messages: compactedMessages
+    };
+    const tokenEstimateAfter = estimateTraceTokens(compactedTrace);
+    const costEstimateAfter = calculateCost(compactedTrace.model, tokenEstimateAfter);
+    const tokensSaved = Math.max(0, tokenEstimateBefore.inputTokens - tokenEstimateAfter.inputTokens);
+    const savingsEstimate = Math.max(0, costEstimateBefore.totalCostUsd - costEstimateAfter.totalCostUsd);
+    const allCapsules = [...stateCapsules, ...skillInjectionCapsules];
+    const appliedPolicyNames = [
+        COMPACTION_POLICY_NAME,
+        ...(skillInjectionCapsules.length > 0 ? [SKILL_INJECTION_POLICY_NAME] : [])
+    ];
+    const compactedMessageIds = collectCompactedMessageIds(allCapsules);
+    // Provenance-completeness write-boundary guard (fail-closed). No-op for honest runs
+    // because the writer above co-produces capsule + metadata.compaction for every compacted
+    // span; only fires on a regressed/malformed path. See docs/ops/provenance-completeness-invariant.md.
+    assertProvenanceCompleteness(compactedMessages, allCapsules, compactedMessageIds, trace.messages);
+    return {
+        compactedTrace: input.trace ? compactedTrace : undefined,
+        compactedMessages,
+        stateCapsules: allCapsules,
+        compactedMessageIds,
+        tokenEstimateBefore,
+        tokenEstimateAfter,
+        tokensSaved,
+        costEstimateBefore,
+        costEstimateAfter,
+        savingsEstimate: roundCurrency(savingsEstimate),
+        appliedPolicyName: COMPACTION_POLICY_NAME,
+        appliedPolicyNames,
+        skillInjectionCapsules,
+        safetyNotes: collectSafetyNotes(stateCapsules, skillInjectionCapsules)
+    };
+}
+//# sourceMappingURL=policy-middleware.js.map