@orkestrel/agent 0.0.36 → 0.0.38

package/dist/src/core/index.d.cts

@@ -2458,6 +2458,17 @@ export declare function buildLedgerCut(steps: ReadonlyArray<LedgerLine | string>
  */
 export declare function buildLedgerIndex(registry: LedgerRegistry): LedgerIndex;
 
+/**
+ * Encodes a sentence's record placement without comparing rendered text.
+ * @param line - The record key, title, source, and zero-based sentence index
+ * @returns The serialized placement identity
+ * @example
+ * ```ts
+ * buildLedgerLineKey({ key: 'rules', title: 'Rules', source: 'one', sentence: 0 })
+ * ```
+ */
+export declare function buildLedgerLineKey(line: Pick<LedgerOccurrence, 'key' | 'title' | 'source' | 'sentence'>): string;
+
 /**
  * Derives complete source identities, first occurrences, and local references from the actual lines of the records.
  * @param messages - Original messages whose indexed sentences establish completeness
@@ -2574,17 +2585,17 @@ export declare function buildRecapMessage(section: Section): Message;
  * Projects the owner records and the rules record from a conversation's messages.
  *
  * @remarks
- * Each line is a sentence of a live message, verbatim except that a sentence that opens with a pronoun opens with its party and a colon. A message is live when it is a user message,
- * or a tool message whose finding is the last finding of its call, and the input neither excludes it nor
- * files it quiet or replaced. A finding with an undefined `result` still replaces the earlier
- * finding of the same call, so the earlier result leaves every record.
+ * Each line is a sentence of a live message, verbatim except that a sentence that opens with a
+ * pronoun opens with its party and a colon. {@link collectLive} retains user messages and the
+ * earliest finding in each call identity's last run of identical text, subject to exclusions,
+ * quiet classification, and supersessions. An undefined result still replaces the earlier finding.
  *
  * A live message joins the owner records its entities name, directly or through a linked lookup
  * argument. A message that names no owner joins where its earlier side of an amendment pair joins,
  * or on the rules record when it is filed as a rule or a correction, and is an orphan otherwise.
  *
- * Every live sentence is retained. Accepted direct edges are listed in `amendments`. An amending message
- * that is itself superseded retains its accepted edge without restoring its text.
+ * Every live sentence is retained. Accepted edges are listed in `amendments`. An amender that is
+ * superseded points to its newest live successor, or retains its endpoint when none exists.
  *
  * A sentence that opens with a pronoun takes the party named in the sentence before it. The reading
  * trusts capitals, so a capitalized word that is no person, such as a carrier named mid-sentence,
@@ -2836,13 +2847,13 @@ export declare class Classifier implements ClassifierInterface {
     /**
      * Reads the category a message is filed under.
      * @param id - The message id
-     * @returns The assigned category, the recorded category at the cutoff, or `undefined`
+     * @returns The assigned category, the recorded category at the cutoff, or `undefined`; a quiet winner suppressed by the user literal floor remains undecided
      */
     category(id: string): LedgerCategory | undefined;
     /**
      * Reports whether a message files under a quiet category.
      * @param id - The message id
-     * @returns True if the assigned or recorded category is quiet; false otherwise.
+     * @returns True if the assigned category is quiet or the recorded quiet weight reaches the cutoff, except for a user message carrying an id or number; false otherwise
      */
     quiet(id: string): boolean;
     /**
@@ -2899,14 +2910,14 @@ export declare interface ClassifierInterface {
      */
     classify(requests: ReadonlySet<string>, signal: AbortSignal): Promise<ClassifierResult>;
     /**
-     * Returns the category a message is filed under, or undefined when no category reaches its cutoff.
+     * Returns the assigned or recorded category, or undefined when no category reaches its cutoff or the user literal floor suppresses a quiet winner.
      *
      * @param id - The id of the message
      * @returns The category, or undefined
      */
     category(id: string): LedgerCategory | undefined;
     /**
-     * Returns true if the message is filed as quiet; false otherwise.
+     * Returns true for a quiet assignment or a recorded quiet weight at the cutoff, except for a user message carrying an id or number; false otherwise.
      *
      * @param id - The id of the message
      * @returns True if the message is quiet; false otherwise.
@@ -3009,17 +3020,18 @@ export declare interface CodedErrorOptions {
 }
 
 /**
- * Collects accepted direct amendments of live messages.
+ * Collects accepted amendments of live messages, following superseded amenders to live successors.
  *
  * @remarks
  * An accepted edge relates an earlier live message to an amender without claiming which sentences
- * changed. An amender takes effect while live and retains its edge after another message supersedes
- * it, without restoring the superseded text. An excluded or quiet user or tool message has no effect.
+ * changed. A superseded amender points to its newest reachable live successor in conversation order,
+ * with cycles guarded and duplicate endpoints removed. With no live successor, its endpoint stays.
+ * This never restores superseded text. An excluded or quiet user or tool message has no effect.
  *
  * @param input - The exclusions and classification to read
  * @param byId - The messages by id
  * @param live - The live message ids from {@link collectLive}
- * @returns The distinct accepted direct edges in conversation order
+ * @returns The distinct accepted edges in conversation order
  *
  * @example
  * ```ts
@@ -3067,15 +3079,54 @@ export declare function collectExchanges(messages: readonly Message[]): Readonly
  */
 export declare function collectImageData(files: readonly FileInterface[]): readonly string[];
 
+/**
+ * Captures source bytes and direct amendment edges for a held window.
+ * @param messages - Current stored messages
+ * @param sources - Requests, replies, and record sources the window holds
+ * @param amendments - Accepted direct amendment edges from the current projection
+ * @returns Source and edge identities for stale detection
+ * @example
+ * ```ts
+ * collectLedgerEvidence([], new Set(), []).messages.size // 0
+ * ```
+ */
+export declare function collectLedgerEvidence(messages: readonly Message[], sources: ReadonlySet<string>, amendments: readonly LedgerAmendment[]): LedgerEvidence;
+
+/**
+ * Collects the record's sentence receipts not already held by a window.
+ * @param record - The selected record with its original sentence identities
+ * @param held - Placement identities already rendered in the window
+ * @returns The remaining sentences with their record placement
+ * @example
+ * ```ts
+ * collectLedgerLines({ key: 'rules', title: 'Rules', members: [], lines: [] }, new Set()) // []
+ * ```
+ */
+export declare function collectLedgerLines(record: LedgerRecord, held: ReadonlySet<string>): readonly LedgerOccurrence[];
+
+/**
+ * Selects each marked request's unambiguous final call-free reply.
+ * @param messages - Stored conversation messages in order
+ * @param requests - Marked request ids delimiting reply intervals
+ * @param notes - Ledger notes that separate answer passes
+ * @returns Eligible final replies keyed by request id
+ * @example
+ * ```ts
+ * collectLedgerReplies([], new Set(), new Set()).size // 0
+ * ```
+ */
+export declare function collectLedgerReplies(messages: readonly Message[], requests: ReadonlySet<string>, notes: ReadonlySet<string>): ReadonlyMap<string, Message>;
+
 /**
  * Collects the ids of the live messages in conversation order.
  *
  * @remarks
- * A message is live when it is a user message, or a tool message whose finding is the last finding of its
- * call, and the input neither excludes it nor files it quiet or replaced. A finding replaces any
- * earlier finding of the same call, an empty one included, so an empty lookup leaves the earlier
- * result out of every record. A finding with no canonical identity stays live as its own source
- * and participates in no replacement.
+ * A message is live when it is a user message or the first unsuperseded finding in its canonical
+ * call identity's last run of identical text, and the input neither excludes it nor files it quiet
+ * or superseded. When the whole run is superseded, its first finding reaches that final filter.
+ * Different text or an undefined result replaces the earlier run, so an empty lookup leaves the
+ * earlier result out of every record. A thrown lookup leaves the earlier result live. A finding
+ * with no canonical identity participates in no replacement.
  *
  * @param input - The messages, findings, and classification to read
  * @returns The live message ids
@@ -3115,6 +3166,22 @@ export declare function collectNames(text: string): readonly string[];
  */
 export declare function collectProjectionIds(projection: LedgerProjection): ReadonlySet<string>;
 
+/**
+ * Collects stored messages eligible to open the recall offer.
+ * @remarks
+ * Notes and findings without a result do not open the offer. User statements, including quiet
+ * statements available through recall's word route, can open it; this helper does not filter results.
+ * @param input - The messages, findings, and classification
+ * @param requests - The marked request ids
+ * @param notes - The annotation ids to exclude
+ * @returns User statements, lookup findings with results, marked requests, and nonblank call-free replies
+ * @example
+ * ```ts
+ * collectRecallMessages(input, new Set(), new Set()) // eligible stored messages
+ * ```
+ */
+export declare function collectRecallMessages(input: LedgerProjectionInput, requests: ReadonlySet<string>, notes: ReadonlySet<string>): readonly Message[];
+
 /**
  * Collects the ids and the owner names the lookup findings named.
  *
@@ -5282,12 +5349,19 @@ export declare function createThinkSplitter(): ThinkSplitterInterface;
  * Cuts entries to a room and names how many it left out.
  *
  * @remarks
- * The cut keeps at least one entry. When it leaves entries out, its last line reads
+ * By default the cut keeps at least one entry. With `first: false`, it keeps whole entries only
+ * when the joined result, tool framing, and omission line fit, and considers later entries after
+ * an oversized group. When it leaves some entries out, its last line reads
  * `N older items not shown; name a narrower topic to narrow the recall`, which
- * {@link matchesCutLine} recognizes.
+ * {@link matchesCutLine} recognizes. Pass `more` when the entries aren't in age order, so the line
+ * doesn't claim an omitted entry is older than a kept one. A fitted cut also uses `more` when it
+ * skips an entry before a kept one. With no kept entry it reads
+ * `N older items didn't fit in this request; answer from the messages you can see`.
  *
  * @param entries - The entries in the order they are kept
  * @param room - The estimate units the joined entries can take
+ * @param kind - What the cut line calls an omitted entry. Default: `older`
+ * @param first - If `true`, keeps the first entry regardless of room; if `false`, fits every entry and the omission line. Default: `true`
  * @returns The kept entries followed by the cut line when any were left out, joined by newlines
  *
  * @example
@@ -5295,7 +5369,7 @@ export declare function createThinkSplitter(): ThinkSplitterInterface;
  * cutListing(['first entry', 'second entry'], 1) // 'first entry\n1 older item not shown; name a narrower topic to narrow the recall'
  * ```
  */
-export declare function cutListing(entries: readonly string[], room: number): string;
+export declare function cutListing(entries: readonly string[], room: number, kind?: 'older' | 'more', first?: boolean): string;
 
 /**
  * Backs a {@link ConversationStoreInterface} with one table of the `databases` layer — a
@@ -5608,6 +5682,19 @@ export declare function describeSnapshotRefusal(noun: string, id: unknown, fault
 /** Matches the logprob decoding failure `invalid or duplicate top logprob token`, which the ledger holds for the ledger's life. */
 export declare const DETERMINISTIC_JUDGE_ERROR: RegExp;
 
+/**
+ * Digests held messages, lookup call context, stored copies, and sentence receipts using canonical text.
+ * This non-cryptographic checksum detects host edits and makes no security claim.
+ * @param exchanges - The stored exchange entries
+ * @param messages - The conversation holding their messages
+ * @returns The hexadecimal checksum, or undefined when a required message is absent or canonical encoding fails
+ * @example
+ * ```ts
+ * digestLedgerWindow([], []) // a deterministic hexadecimal checksum
+ * ```
+ */
+export declare function digestLedgerWindow(exchanges: readonly LedgerExchangeSnapshot[], messages: readonly Message[]): string | undefined;
+
 /**
  * Estimates the context-token footprint of a batch of messages — each message's content plus
  * {@link import('./constants.js').MESSAGE_TOKEN_OVERHEAD}, a tool-call JSON estimate, a thinking estimate, and
@@ -5874,8 +5961,9 @@ export declare function freezeJSON(value: unknown): unknown;
  * has left.
  *
  * @remarks
- * `observe` rescales from the first call of each finished request with the overhead cost taken out,
- * and keeps that request's calls for the marginal rate and the longest final completion for the reply
+ * `observe` rescales from the first call only when `spared` is absent, zero, or at least `overhead`,
+ * with `max(0, overhead - spared)` taken out. A partially spared call keeps the existing scale.
+ * It keeps that request's calls for the marginal rate and the longest final completion for the reply
  * reserve after subtracting its thinking. `overhead` never changes after construction.
  * {@link GaugeOptions} defines the measured use, reply reserve, and recall-room formulas.
  * {@link LedgerOptions} defines the ledger's plan budget and recall close rule.
@@ -5921,7 +6009,10 @@ export declare class Gauge implements GaugeInterface {
  * @remarks
  * `estimate` is the `estimateMessages` estimate of the call's messages. `prompt` and `completion`
  * are the tokens the provider reported, absent when it reported none. `tools` is the count of tool
- * definitions the call advertised.
+ * definitions the call advertised. `spared` is the tokens of definitions it did not advertise;
+ * estimated use subtracts it from overhead, floored at 0. Omission means 0. Observation rescales
+ * only with exact overhead: `spared` absent or zero retains all overhead, and `spared` at or above
+ * overhead retains none. A partially spared first call keeps the prior scale.
  * `thinking` estimates the completion tokens spent on thinking from its share of the generated
  * characters, rounded to the nearest integer and capped at `completion`. With replay `'none'`,
  * the measured call uses `prompt + completion - thinking`; other policies retain the whole
@@ -5929,6 +6020,8 @@ export declare class Gauge implements GaugeInterface {
  */
 export declare interface GaugeCall {
     readonly estimate: number;
+    /** Tokens spared by tool definitions this call did not advertise. Default: 0. */
+    readonly spared?: number;
     readonly prompt?: number;
     readonly completion?: number;
     readonly thinking?: number;
@@ -5999,11 +6092,16 @@ export declare interface GaugeInterface extends LedgerGauge {
  * nonnegative safe integer less than `capacity`; construction throws `LedgerError` with code
  * `'CAPACITY'` otherwise. `replay` names the thinking the next request carries. Default: `'none'`.
  * Measured use is `prompt + completion - (thinking ?? 0)` for `'none'`, and `prompt + completion`
- * otherwise; absent completion counts as 0. Without prompt usage, use is `overhead + scale * estimate`.
+ * otherwise; absent completion counts as 0. Without prompt usage, use is
+ * `max(0, overhead - (spared ?? 0)) + scale * estimate`.
  * Capacity left is `max(0, capacity - used)`. The reply reserve adds recall uniform at the marginal
  * rate to the largest observed reply's `completion - (thinking ?? 0)` for every policy.
- * Without a positive reply observation, it prices the longest reply text at that rate. Recall room is
- * `max(0, (remainder - predict - reserve) / 2 / rate)`; recall closes at `remainder - predict < 2 * reserve`.
+ * Without a positive reply observation, it prices the longest reply text at that rate. The room formula
+ * `max(0, (remainder - predict - reserve) / 2 / rate)` is the planning forecast. The ledger's runtime
+ * recall instead fits results below `capacity - predict`, anchoring the prefix to reported usage
+ * and pricing additions at the larger of the marginal rate and the request's measured rate, with
+ * `LEDGER_SCALE_DRIFT` headroom. The measured rate subtracts overhead only where `observe` would
+ * rescale; partially spared calls retain the marginal rate. Missing usage uses an estimate.
  */
 export declare interface GaugeOptions extends LedgerGauge {
     readonly capacity: number;
@@ -6046,6 +6144,23 @@ export declare function handleAgentQueueJob(registry: AgentRegistryInterface, pa
  */
 export declare function hasCalls(message: Pick<Message, 'calls'>): boolean;
 
+/**
+ * Checks whether an eligible earlier message is absent from the prompt or incompletely covered.
+ * A successful finding is held when a finding with the same canonical identity and text is fully received.
+ * @param input - The messages, findings, and classification
+ * @param request - The current request id; only messages before it count
+ * @param requests - The marked request ids
+ * @param notes - The annotation ids to exclude
+ * @param messages - The seed tail and held exchange messages; lookup stubs retain their rendered text
+ * @param lines - The receipts held by the window and the request copy together
+ * @returns True if an eligible earlier message is absent or only partly covered; false otherwise
+ * @example
+ * ```ts
+ * hasHiddenRecall(input, request.id, requests, notes, tail, lines) // whether to offer recall
+ * ```
+ */
+export declare function hasHiddenRecall(input: LedgerProjectionInput, request: string, requests: ReadonlySet<string>, notes: ReadonlySet<string>, messages: readonly Message[], lines: readonly LedgerReceipt[]): boolean;
+
 /**
  * Identifies a lookup finding for projection by its tool name and normalized arguments.
  *
@@ -6721,6 +6836,8 @@ export declare function isLedgerQuestion(value: unknown): value is LedgerQuestio
  * guard is structural: it admits a conversation holding a stored `system` role
  * or a repeated id, which `requireConversationSnapshot` and the `Conversation` constructor then
  * refuse as the stored-data check a ledger's hydrate runs.
+ * A present `window` must be nonempty and exactly shaped. This guard does not audit its references
+ * or sentence ranges. Hydration discards the window when its digest disagrees or cannot be computed.
  *
  * @param value - The value to inspect, such as a parsed checkpoint
  * @returns True if the value has the shape of a ledger snapshot whose marked ids name messages of its own conversation; false otherwise
@@ -6733,6 +6850,17 @@ export declare function isLedgerQuestion(value: unknown): value is LedgerQuestio
  */
 export declare function isLedgerSnapshot(value: unknown): value is LedgerSnapshot;
 
+/**
+ * Checks whether a value has the exact shape of a nonempty exchange window.
+ * @param value - The untrusted window
+ * @returns True if the window and its members are well shaped; false otherwise
+ * @example
+ * ```ts
+ * isLedgerWindowSnapshot({ digest: 'checksum', exchanges: [{ request: 'request', reply: 'reply', lines: [] }], amendments: [] }) // true
+ * ```
+ */
+export declare function isLedgerWindowSnapshot(value: unknown): value is LedgerWindowSnapshot;
+
 /**
  * Checks whether a value is a stored memo revision: a record with a string `id`, `name`,
  * `description`, and `content`, a finite `time`, and an optional `origin`.
@@ -7543,8 +7671,8 @@ export declare class Ledger implements LedgerInterface {
      */
     calibrate(signal: AbortSignal): Promise<LedgerGauge>;
     /**
-     * Serializes the conversation, the marked ids, and the gauge into a snapshot a later ledger hydrates from.
-     * @returns The snapshot, each id list in conversation order and `gauge` present after the ledger holds one
+     * Serializes the conversation, marked ids, gauge, and completed exchange window for a later ledger.
+     * @returns The snapshot, each id list in conversation order, with a gauge and window only when held
      * @throws {AgentError} Thrown when a request or calibration is active (code `'CONCURRENCY'`)
      */
     snapshot(): LedgerSnapshot;
@@ -7585,6 +7713,12 @@ export declare const LEDGER_OWNER_PREFIX = "owner:";
  */
 export declare const LEDGER_QUESTIONS: LedgerQuestion;
 
+/** Labels recalled conversation text by its origin. */
+export declare const LEDGER_RECALL_LABELS: Readonly<{
+    request: "Earlier request:";
+    reply: "Earlier reply:";
+}>;
+
 /** Names the key of the record that holds the rules no owner claims. */
 export declare const LEDGER_RULES_KEY = "rules";
 
@@ -7680,6 +7814,14 @@ export declare interface LedgerCorrectionOptions {
     readonly narrow?: boolean;
 }
 
+/** Carries a planned copy and its validity evidence to request settlement. */
+export declare interface LedgerDraft {
+    readonly copy: Message;
+    readonly lines: readonly LedgerOccurrence[];
+    readonly evidence: LedgerEvidence;
+    readonly window: readonly LedgerExchange[];
+}
+
 /**
  * Lists the registry ids and owner ids a text names.
  *
@@ -7742,6 +7884,27 @@ export declare type LedgerErrorCode =
 /** Reports filing wording that `isLedgerQuestion` refuses. */
 | 'QUESTION';
 
+/** Captures held message identities and the accepted edges used to validate their copies. */
+export declare interface LedgerEvidence {
+    readonly messages: ReadonlySet<string>;
+    readonly amendments: ReadonlyMap<string, LedgerAmendment>;
+}
+
+/** Carries a completed request copy, its stored reply, and the sentences the copy rendered. */
+export declare interface LedgerExchange {
+    readonly request: Message;
+    readonly reply: Message;
+    readonly lines: readonly LedgerOccurrence[];
+}
+
+/** Carries the sent request text, stored pair ids, and sentence placements of one exchange. */
+export declare interface LedgerExchangeSnapshot {
+    readonly request: string;
+    readonly copy?: string;
+    readonly reply: string;
+    readonly lines: readonly LedgerReceipt[];
+}
+
 /**
  * Carries the price of a prompt in tokens, measured against the model the ledger serves.
  *
@@ -7881,6 +8044,14 @@ export declare interface LedgerLine {
     readonly role: MessageRole;
 }
 
+/** Carries a recall result, its accepted whole groups, lookup line translations, and provider-turn position. */
+export declare interface LedgerListing {
+    readonly result: string;
+    readonly lines: ReadonlyMap<string, string>;
+    readonly groups: readonly string[];
+    readonly turn: number;
+}
+
 /**
  * Carries one application lookup: the tool the model calls and the handler that reads its results.
  *
@@ -7961,6 +8132,10 @@ export declare interface LedgerNote {
     readonly closure: string;
 }
 
+/** Carries a rendered sentence with its record placement. */
+export declare interface LedgerOccurrence extends LedgerLine, LedgerReceipt {
+}
+
 /**
  * Configures a ledger: its judge and the wording and cutoffs it files with, the desk topics, the
  * context capacity, and the optional first-pass thinking, lookups, gauge, shares, snapshot, recall
@@ -7976,7 +8151,10 @@ export declare interface LedgerNote {
  * nonnegative safe integer less than `capacity`; construction throws `LedgerError` with code
  * `'CAPACITY'` otherwise. The plan budgets
  * `max(0, (capacity - predict) * share.prompt - overhead) / (1 + LEDGER_SCALE_DRIFT)`.
- * Recall closes when `remainder - predict < 2 * reserve`. `snapshot` hydrates the conversation and
+ * The plan retains its `remainder - predict < 2 * reserve` admission rule. Runtime recall fits whole
+ * results to measured remaining capacity at the larger of the gauge rate and the request's measured
+ * rate, allowing `LEDGER_SCALE_DRIFT` for new text. Lack of room omits results without closing recall.
+ * `snapshot` hydrates the conversation and
  * the marked ids a ledger's `snapshot()` returned; construction throws `LedgerError` with code
  * `'SNAPSHOT'` when `isLedgerSnapshot` refuses it, and `ConversationError` with code `'ROLE'` or
  * `'SNAPSHOT'` when its conversation holds a `system` message or repeats an id.
@@ -8091,6 +8269,14 @@ export declare interface LedgerRecallOptions {
     readonly limit?: number;
 }
 
+/** Identifies an original sentence at one record placement. */
+export declare interface LedgerReceipt {
+    readonly key: string;
+    readonly title: string;
+    readonly source: string;
+    readonly sentence: number;
+}
+
 /**
  * Carries one record: the live messages placed on one owner or on the rules, as lines.
  *
@@ -8107,6 +8293,12 @@ export declare interface LedgerRecord {
     readonly lines: readonly LedgerLine[];
 }
 
+/** Carries the answer note and the partial messages omitted from its prompt. */
+export declare interface LedgerRecovery {
+    readonly digest: string | undefined;
+    readonly omitted: ReadonlySet<string>;
+}
+
 /**
  * Carries the ids the ledger's lookups named and the owners among them.
  *
@@ -8138,6 +8330,12 @@ export declare interface LedgerRenderContext {
     readonly references: ReadonlyMap<string, string>;
 }
 
+/** Carries rendered record text and its sentences in emission order. */
+export declare interface LedgerRenderResult {
+    readonly text: string;
+    readonly lines: readonly LedgerOccurrence[];
+}
+
 /**
  * Holds what one ledger request keeps while it is served: its message, its filing attempts and
  * plan, the gauge calls of its passes, and its repeat and recall stops.
@@ -8179,6 +8377,10 @@ export declare class LedgerRequest implements LedgerRequestInterface {
      * @returns The planned selection, or undefined before one
      */
     get plan(): Selection | undefined;
+    get scope(): ScopeInterface | undefined;
+    apply(scope: ScopeInterface): void;
+    /** Returns the copy and receipts adopted by the last provider turn. */
+    get sent(): LedgerDraft | undefined;
     /**
      * Returns the selection the current pass's run adopted last.
      *
@@ -8217,11 +8419,13 @@ export declare class LedgerRequest implements LedgerRequestInterface {
     think(messages: readonly Message[]): void;
     fault(error: unknown): void;
     faulted(error: unknown): boolean;
-    file(attempts: readonly ClassifierAttempt[], plan?: Selection): void;
+    file(attempts: readonly ClassifierAttempt[], plan?: Selection, draft?: LedgerDraft): void;
     admit(name: string, args: Readonly<Record<string, unknown>>): void;
     recall(): void;
     close(): void;
-    list(result: string, lines: ReadonlyMap<string, string>): void;
+    list(result: string, lines: ReadonlyMap<string, string>, groups: readonly string[]): void;
+    /** Returns recall results with their accepted whole groups and provider-turn positions. */
+    get listings(): readonly LedgerListing[];
     lines(result: string): ReadonlyMap<string, string> | undefined;
 }
 
@@ -8238,6 +8442,12 @@ export declare class LedgerRequest implements LedgerRequestInterface {
  * thinking, until its pass observes the next call, and is final from then on.
  */
 export declare interface LedgerRequestInterface {
+    /** Holds the scope last applied by the ledger's plan, or undefined before one. */
+    readonly scope: ScopeInterface | undefined;
+    /** Records the scope applied by the ledger's plan for conditional restoration at settle. */
+    apply(scope: ScopeInterface): void;
+    /** Holds the copy and receipts adopted by the last provider turn, or undefined for a view fallback. */
+    readonly sent: LedgerDraft | undefined;
     /** Records an error the request's run reported through its `fault` event. */
     fault(error: unknown): void;
     /**
@@ -8310,8 +8520,9 @@ export declare interface LedgerRequestInterface {
      *
      * @param attempts - The selection's filing attempts, in asking order
      * @param plan - The planned selection, or undefined when planning failed
+     * @param draft - The copy and receipts eligible for adoption; omission discards that eligibility
      */
-    file(attempts: readonly ClassifierAttempt[], plan?: Selection): void;
+    file(attempts: readonly ClassifierAttempt[], plan?: Selection, draft?: LedgerDraft): void;
     /**
      * Admits one tool call of the request, compared by tool name and canonical arguments.
      *
@@ -8334,8 +8545,11 @@ export declare interface LedgerRequestInterface {
      *
      * @param result - The recall result text
      * @param lines - Each listed lookup line mapped to the first line of its stored content
+     * @param groups - The complete candidate groups, in listing order; only groups present in the result are retained
      */
-    list(result: string, lines: ReadonlyMap<string, string>): void;
+    list(result: string, lines: ReadonlyMap<string, string>, groups: readonly string[]): void;
+    /** Holds each recall result with its accepted groups and provider-turn position. */
+    readonly listings: readonly LedgerListing[];
     /**
      * Returns the stored first lines a recall result listed.
      *
@@ -8368,7 +8582,11 @@ export declare interface LedgerResult extends AgentResult {
  *
  * @remarks
  * `prompt` is a share of the ledger's `capacity`; the overhead tokens of the gauge come out of it
- * before the records and the tail take the rest. `tail` is a share of what remains for messages.
+ * before the records and the tail take the rest. `tail` bounds only the seed tail. The seed and
+ * records are planned before the completed-exchange window spends spare room. The full window
+ * with a delta copy, then its newest plain exchange with a full copy, then no exchange are priced
+ * in that order. Admission cannot close an otherwise open recall or displace a selected record
+ * line or seed message. A seed stub reads visibility across the window and the copy together.
  * Each share must be finite, greater than 0, and at most 1.
  */
 export declare interface LedgerShare {
@@ -8388,7 +8606,14 @@ export declare interface LedgerShare {
  * not carried, so a hydrated ledger sizes and closes `recall` from its fallback reserve until it
  * completes a request. A question a `strict: false` classifier held after a deterministic judge
  * failure is not carried, so a hydrated ledger asks it again. Hydrating a second ledger from one snapshot forks
- * it at the parent's frontier.
+ * it at the parent's frontier. `window`, when present, retains sent request copies, reply ids,
+ * sentence receipts, and accepted amendment edges. The next plan keeps the same conversation
+ * prefix when the live and hydrated reserves admit the same exchange rung. A rung between those
+ * reserves can differ because hydration carries no gauge observations; this moves the prefix,
+ * never the record coverage. A plain request omits `copy` because its content already lives in `conversation`.
+ * The required window `digest` checks canonical held messages, lookup call context, copies, and receipts. A mismatch drains
+ * the window and its evidence; a missing digest refuses the snapshot. An unencodable held message
+ * makes `snapshot()` omit the window. The checksum detects edits, not authenticity.
  */
 export declare interface LedgerSnapshot {
     readonly conversation: ConversationSnapshot;
@@ -8396,9 +8621,10 @@ export declare interface LedgerSnapshot {
     readonly notes: readonly string[];
     readonly failures: readonly string[];
     readonly gauge?: LedgerGauge;
+    readonly window?: LedgerWindowSnapshot;
 }
 
-/** Reads the faults of a refused ledger snapshot. */
+/** Reads structural faults of a ledger snapshot, including its optional held exchange window. */
 export declare const ledgerSnapshotContract: ContractInterface<Readonly<{
 conversation: Readonly<{
 id: string;
@@ -8558,6 +8784,25 @@ gauge?: Readonly<{
 scale: number;
 overhead: number;
 } & {}>;
+window?: Readonly<{
+digest: string;
+exchanges: readonly Readonly<{
+request: string;
+reply: string;
+lines: readonly Readonly<{
+key: string;
+title: string;
+source: string;
+sentence: number;
+} & {}>[];
+} & {
+copy?: string;
+}>[];
+amendments: readonly Readonly<{
+earlier: string;
+later: string;
+} & {}>[];
+} & {}>;
 }>>;
 
 /**
@@ -8678,6 +8923,24 @@ gauge: OptionalShape<ObjectShape<    {
 scale: NumberShape;
 overhead: NumberShape;
 }, boolean | ContractShape>>;
+window: OptionalShape<ObjectShape<    {
+digest: StringShape;
+exchanges: ArrayShape<ObjectShape<    {
+request: StringShape;
+copy: OptionalShape<StringShape>;
+reply: StringShape;
+lines: ArrayShape<ObjectShape<    {
+key: StringShape;
+title: StringShape;
+source: StringShape;
+sentence: NumberShape;
+}, boolean | ContractShape>>;
+}, boolean | ContractShape>>;
+amendments: ArrayShape<ObjectShape<    {
+earlier: StringShape;
+later: StringShape;
+}, boolean | ContractShape>>;
+}, boolean | ContractShape>>;
 }, boolean | ContractShape>;
 
 /**
@@ -8717,6 +8980,54 @@ export declare interface LedgerTopic {
     readonly requested?: boolean;
 }
 
+/** Reads structural faults of a serialized exchange window. */
+export declare const ledgerWindowContract: ContractInterface<Readonly<{
+digest: string;
+exchanges: readonly Readonly<{
+request: string;
+reply: string;
+lines: readonly Readonly<{
+key: string;
+title: string;
+source: string;
+sentence: number;
+} & {}>[];
+} & {
+copy?: string;
+}>[];
+amendments: readonly Readonly<{
+earlier: string;
+later: string;
+} & {}>[];
+} & {}>>;
+
+/** Describes the minimal serialized evidence of a nonempty exchange window. */
+export declare const ledgerWindowShape: ObjectShape<    {
+digest: StringShape;
+exchanges: ArrayShape<ObjectShape<    {
+request: StringShape;
+copy: OptionalShape<StringShape>;
+reply: StringShape;
+lines: ArrayShape<ObjectShape<    {
+key: StringShape;
+title: StringShape;
+source: StringShape;
+sentence: NumberShape;
+}, boolean | ContractShape>>;
+}, boolean | ContractShape>>;
+amendments: ArrayShape<ObjectShape<    {
+earlier: StringShape;
+later: StringShape;
+}, boolean | ContractShape>>;
+}, boolean | ContractShape>;
+
+/** Carries a nonempty exchange window, its message, copy, and receipt checksum, and its accepted edges. */
+export declare interface LedgerWindowSnapshot {
+    readonly digest: string;
+    readonly exchanges: readonly LedgerExchangeSnapshot[];
+    readonly amendments: readonly LedgerAmendment[];
+}
+
 /** Carries the lowercase words and non-opening capitalized names of a message. */
 export declare interface LedgerWordSet {
     readonly words: ReadonlySet<string>;
@@ -8842,6 +9153,18 @@ export declare function matchesJSON(left: unknown, right: unknown): boolean;
  */
 export declare function matchesJudgment(judgment: Judgment, question: JudgeQuestion, sources: readonly string[], state: string, model: string): boolean;
 
+/**
+ * Checks whether two successful findings carry the same text for the same canonical lookup.
+ * @param left - The finding to compare
+ * @param right - The candidate copy
+ * @returns True for the same finding or equal canonical identities and text; unkeyable findings match only themselves
+ * @example
+ * ```ts
+ * matchesLookup(finding, finding) // true when it has a result
+ * ```
+ */
+export declare function matchesLookup(left: LedgerLookupFinding, right: LedgerLookupFinding): boolean;
+
 /**
  * Bounds the decoded error excerpt's input in bytes — `2048`, the leading bytes of a non-OK
  * response body handed to the decoder before the read cancels the remainder, so a `ProviderError`
@@ -12204,6 +12527,7 @@ export declare type SystemOneEntry = JudgeEntry | null;
  *
  * @remarks
  * The caller supplies the server origin and model. Every question travels in one request.
+ * Wire keys are zero-based positions in question entry order; answers return under the caller's ids.
  * Server measures are ignored; the response model is preserved.
  * `headers` supplies authentication through the shared judge engine.
  * The example readings are those of the response Ollama 0.40.0 returned for that request on 2026-10-07.
@@ -12254,14 +12578,14 @@ export declare class SystemOneJudge extends AgentJudge {
     /** Identifies the System One protocol. */
     readonly name = "systemone";
     /**
-     * Projects the state and questions onto the System One request with the configured model.
+     * Projects the state and questions onto the System One request with the configured model and positional keys.
      *
      * @param request - The state and questions keyed by caller id
      * @returns The System One request body
      */
     encode(request: JudgeRequest): SystemOneRequest;
     /**
-     * Decodes requested System One answers and reports the server model and available usage.
+     * Decodes positional System One answers under caller ids and reports the server model and available usage.
      *
      * @param value - The parsed response body
      * @param request - The questions defining the expected answers