@sema-agent/core 5.59.0 → 5.60.0

package/dist/core/governance-codes.d.ts

@@ -93,7 +93,7 @@ export type NoticeAudience = "user" | "operator";
  * src/ for notice mint shapes and names any code that is minted but unregistered, or registered but
  * no longer minted.
  */
-export declare const ENGINE_NOTICE_CODES: readonly ["config.env_timeout_discarded", "config.materialize_env_discarded", "config.models_swapped", "config.read_face_deployment_clamped", "config.tool_model_gate_removed", "config.tool_model_gate_unknown_class", "config.tool_model_gate_env_invalid", "delegation.transcript_integrity", "mcp.revocation_probe_failed", "workflow.governance_key_stripped", "memory.session_polluted", "memory.harvest_quarantined", "memory.delegation_static_mark_waived", "memory.hold_opened", "memory.hold_released", "memory.hold_disposed", "memory.consolidation_recommended", "memory.consolidation_committed", "memory.consolidation_conflict", "memory.consolidation_incomplete", "memory.consolidation_refused", "route.fallback_to_primary", "route.base_url_changed_key_unchanged", "task.user_steer_undrained", "task.user_followup_undrained", "task.injection_priority_unimplemented", "tool_result.offload_put_failed"];
+export declare const ENGINE_NOTICE_CODES: readonly ["config.autocompact_window_clamped", "config.env_timeout_discarded", "config.materialize_env_discarded", "config.models_swapped", "config.read_face_deployment_clamped", "config.tool_model_gate_removed", "config.tool_model_gate_unknown_class", "config.tool_model_gate_env_invalid", "delegation.transcript_integrity", "mcp.revocation_probe_failed", "workflow.governance_key_stripped", "memory.session_polluted", "memory.harvest_quarantined", "memory.delegation_static_mark_waived", "memory.content_class_declared", "memory.hold_opened", "memory.hold_released", "memory.hold_disposed", "memory.consolidation_recommended", "memory.consolidation_committed", "memory.consolidation_conflict", "memory.consolidation_incomplete", "memory.consolidation_refused", "route.fallback_to_primary", "route.base_url_changed_key_unchanged", "task.user_steer_undrained", "task.user_followup_undrained", "task.injection_priority_unimplemented", "tool_result.offload_put_failed"];
 /** A code this engine mints (see {@link ENGINE_NOTICE_CODES}). NOT the type of
  *  `EngineNotice.code`, which stays `string` — a host forwarding its own notices through the same
  *  sink is a supported shape, and narrowing that field would break it. */

package/dist/core/governance-codes.js

@@ -17,6 +17,7 @@ export const NON_GOVERNANCE_MEMORY_CODES = new Set([
     "memory.session_polluted",
     "memory.harvest_quarantined",
     "memory.delegation_static_mark_waived",
+    "memory.content_class_declared",
     "memory.consolidation_driver_superseded",
     "memory.challenge_sweep_failed",
     "memory.lineage_settle_failed",
@@ -85,6 +86,7 @@ export const RULE_SYNC_DROP_CODES = {
     server_rejected: "local-quarantined",
 };
 export const ENGINE_NOTICE_CODES = [
+    "config.autocompact_window_clamped",
     "config.env_timeout_discarded",
     "config.materialize_env_discarded",
     "config.models_swapped",
@@ -98,6 +100,7 @@ export const ENGINE_NOTICE_CODES = [
     "memory.session_polluted",
     "memory.harvest_quarantined",
     "memory.delegation_static_mark_waived",
+    "memory.content_class_declared",
     "memory.hold_opened",
     "memory.hold_released",
     "memory.hold_disposed",
@@ -122,6 +125,7 @@ const NOTICE_AUDIENCE_TABLE = {
     "memory.hold_disposed": "user",
     "task.user_steer_undrained": "user",
     "task.user_followup_undrained": "user",
+    "config.autocompact_window_clamped": "operator",
     "config.env_timeout_discarded": "operator",
     "config.materialize_env_discarded": "operator",
     "config.models_swapped": "operator",
@@ -132,6 +136,7 @@ const NOTICE_AUDIENCE_TABLE = {
     "delegation.transcript_integrity": "operator",
     "mcp.revocation_probe_failed": "operator",
     "workflow.governance_key_stripped": "operator",
+    "memory.content_class_declared": "operator",
     "memory.consolidation_recommended": "operator",
     "memory.consolidation_committed": "operator",
     "memory.consolidation_conflict": "operator",

package/dist/core/locked-config.d.ts

@@ -1,4 +1,4 @@
-import type { RunnerDeps, TaskSpec } from "./types.js";
+import type { McpServerSpec, RunnerDeps, TaskSpec } from "./types.js";
 import type { ToolPolicy } from "./tool-policy.js";
 /** The closed set of administratively lockable configuration keys. Adding a member is a deliberate
  *  edit HERE (tsc forces the registry row), never a free-form string. */
@@ -38,9 +38,12 @@ export interface LockedConfig {
 export interface LockedPreflight {
     /** The validated lock set (empty when the deployment declares none). */
     lockedKeys: ReadonlySet<LockedKey>;
-    /** Effective MCP server list for this task: `spec.mcp` when the key is unlocked; with `mcp`
-     *  locked a spec-supplied value has already been refused, so this is always `undefined` (core has
-     *  no deployment-level MCP seat — a locked deployment mounts no task-supplied servers). */
+    /** Effective MCP server list for this task: a validated, frozen SNAPSHOT of `spec.mcp` when the
+     *  key is unlocked (see {@link snapshotAndValidateMcpEntries} — the content-class declaration is read once
+     *  and judged here, so no mint site downstream can be handed a different value than the door
+     *  approved); with `mcp` locked a spec-supplied value has already been refused, so this is always
+     *  `undefined` (core has no deployment-level MCP seat — a locked deployment mounts no
+     *  task-supplied servers). */
     mcp: TaskSpec["mcp"];
     /** Effective caller tool policy: the same `spec.toolPolicy ?? deps.toolPolicy` slot the gate has
      *  always enforced, resolved ONCE here. With `toolPolicy` locked, the deployment's own
@@ -61,6 +64,35 @@ export interface LockedPreflight {
  * then fails the first prepare instead of silently guarding nothing).
  */
 export declare function resolveLockedKeys(config: LockedConfig | undefined): ReadonlySet<LockedKey>;
+/**
+ * design/378 — turn a caller-owned MCP entry list into FROZEN PLAIN DATA, reading every own property
+ * exactly once.
+ *
+ * WHY A COPY. `McpServerSpec.contentOrigin` decides whether a server's tools mark the session's
+ * memory, and the entry objects travel a long way: the preparation door validates them, then
+ * `materializeMcpTools` connects them, then every mid-task refresh re-reads the same object. A value
+ * read off a LIVE object is only true for as long as the object holds still, and the fail-open
+ * direction is the reachable one — so both boundaries consume data instead.
+ *
+ * The read discipline is the load-bearing part, and it is why this is a spread rather than
+ * "read the property, then copy the object": a getter answering ALTERNATING LEGAL values would
+ * satisfy any number of re-reads (`"external"` to a validator, `"local"` to a mint site), and no
+ * vocabulary guard anywhere has purchase on a legal value. One spread evaluates every own property
+ * EXACTLY ONCE and materializes the result as plain data; every later reader — validator, connect,
+ * refresh — then sees the same byte. Frozen so nothing downstream rewrites it.
+ *
+ * Boundary, stated: the copy is one level deep — nested option objects (transport, headers, env,
+ * toolAxes) stay shared with the caller's entry exactly as before, because the axis this owns is the
+ * content class; readers of the nested shapes normalize their own values (the transport DISCRIMINATOR
+ * is derived, never echoed raw). Own ENUMERABLE properties only: an entry whose fields live on a
+ * prototype was never the plain configuration record this type describes, and its absent class reads
+ * fail-closed like any other absence.
+ *
+ * Exported because the SECOND boundary needs the identical guarantee: `materializeMcpTools` is public
+ * and a library caller reaches it without passing any door, so it snapshots its own input through
+ * this same function (idempotent over an already-frozen entry). One spelling, both entrances.
+ */
+export declare function snapshotMcpEntries(entries: readonly McpServerSpec[]): McpServerSpec[];
 /**
  * The single preflight resolver: validate the lock declaration, refuse a spec that tries to occupy
  * a locked slot (`config.locked_key`, two-state — the whole prepare is rejected, nothing is

package/dist/core/locked-config.js

@@ -1,3 +1,5 @@
+import { isToolContentOrigin, TOOL_CONTENT_ORIGINS } from "./memory-engine/content-origin.js";
+import { inlineUntrusted } from "./untrusted-text.js";
 export const LOCKED_KEY_REGISTRY = {
     mcp: { specFields: ["mcp"] },
     toolPolicy: { specFields: ["toolPolicy", "basePolicyForResumeEdit"] },
@@ -23,6 +25,37 @@ export function resolveLockedKeys(config) {
     }
     return keys;
 }
+export function snapshotMcpEntries(entries) {
+    return entries.map((entry) => Object.freeze({ ...entry }));
+}
+function describeDeclared(value) {
+    try {
+        return JSON.stringify(value) ?? String(value);
+    }
+    catch {
+        try {
+            return String(value);
+        }
+        catch {
+            return `[unrepresentable ${typeof value}]`;
+        }
+    }
+}
+function snapshotAndValidateMcpEntries(entries) {
+    const copies = snapshotMcpEntries(entries);
+    for (const copy of copies) {
+        const declared = copy.contentOrigin;
+        if (declared !== undefined && !isToolContentOrigin(declared)) {
+            throw codedError("config.mcp_content_class", `MCP server ${inlineUntrusted(typeof copy.name === "string" ? JSON.stringify(copy.name) : describeDeclared(copy.name), 80)} declares contentOrigin ` +
+                `${inlineUntrusted(describeDeclared(declared), 80)}, which is not one of ` +
+                `${TOOL_CONTENT_ORIGINS.map((v) => `"${v}"`).join(" | ")}. The declaration decides whether this server's tools ` +
+                `mark the session's memory externally exposed — a value this engine cannot read is refused at the door rather ` +
+                `than folded to a class, because folding it would let a deployment believe a declaration is in force while every ` +
+                `call keeps writing a one-way durable mark.`);
+        }
+    }
+    return copies;
+}
 export function preflightLockedConfig(spec, deps) {
     const lockedKeys = resolveLockedKeys(deps.lockedConfig);
     for (const key of lockedKeys) {
@@ -36,7 +69,7 @@ export function preflightLockedConfig(spec, deps) {
     }
     return {
         lockedKeys,
-        mcp: lockedKeys.has("mcp") ? undefined : spec.mcp,
+        mcp: lockedKeys.has("mcp") || spec.mcp === undefined ? undefined : snapshotAndValidateMcpEntries(spec.mcp),
         toolPolicy: lockedKeys.has("toolPolicy") ? deps.toolPolicy : (spec.toolPolicy ?? deps.toolPolicy),
         basePolicyForResumeEdit: lockedKeys.has("toolPolicy") ? deps.basePolicyForResumeEdit : (spec.basePolicyForResumeEdit ?? deps.basePolicyForResumeEdit),
     };

package/dist/core/mcp.js

@@ -14,6 +14,7 @@ import { truncateError } from "./tool-errors.js";
 import { delimitUntrusted, inlineUntrusted, sanitizeUntrustedText } from "./untrusted-text.js";
 import { discloseReminderShaped, observeReminderMarkEcho } from "./reminder-disclosure.js";
 import { withContentOrigin } from "./memory-engine/content-origin.js";
+import { snapshotMcpEntries } from "./locked-config.js";
 import { validateJsonSchemaShape } from "./runner/strict-output-schema.js";
 export const MCP_PREFIX = MCP_NAMESPACE.prefix;
 const MCP_OUTPUT_TOKENS_DEFAULT = 25_000;
@@ -753,8 +754,9 @@ export function mcpToolSchemaProblem(schema) {
     return undefined;
 }
 export async function materializeMcpTools(specs, principal, onElicit, imageResizer, reminderDisclosure, mcpRevocations) {
+    const entries = snapshotMcpEntries(specs);
     {
-        const collision = findNamespacePrefixCollision(MCP_NAMESPACE, specs.map((s) => s.name));
+        const collision = findNamespacePrefixCollision(MCP_NAMESPACE, entries.map((s) => s.name));
         if (collision) {
             const [a, b] = collision.peers;
             const e = new Error(a === b
@@ -801,11 +803,11 @@ export async function materializeMcpTools(specs, principal, onElicit, imageResiz
     const droppedTools = [];
     let disposing = false;
     const serverHandles = [];
-    const settled = await Promise.allSettled(specs.map((spec) => connectServer(spec, principal, onElicit, imageResizer, mcpDisclosure, isServerRevoked)));
+    const settled = await Promise.allSettled(entries.map((spec) => connectServer(spec, principal, onElicit, imageResizer, mcpDisclosure, isServerRevoked)));
     try {
-        for (let i = 0; i < specs.length; i++) {
+        for (let i = 0; i < entries.length; i++) {
             const r = settled[i];
-            const spec = specs[i];
+            const spec = entries[i];
             if (r.status === "fulfilled") {
                 const s = r.value;
                 clients.push(s.client);
@@ -1513,6 +1515,7 @@ async function connectServer(spec, principal, onElicit, imageResizer, reminderDi
     }
 }
 function intakeListedTools(listed, spec, client, health, imageResizer, reminderDisclosure, isServerRevoked) {
+    const declaredContentOrigin = spec.contentOrigin;
     const serverTools = [];
     const serverAxes = [];
     const dropped = [];
@@ -1576,7 +1579,7 @@ function intakeListedTools(listed, spec, client, health, imageResizer, reminderD
         const mcpToolMeta = t._meta;
         const mcpMaxResultSizeChars = resolveMcpDeclaredResultSize(mcpToolMeta);
         const mcpAlwaysLoad = mcpToolMeta?.["anthropic/alwaysLoad"] === true;
-        serverTools.push({
+        const mounted = {
             name: namespacedName,
             description: capMcpToolDescription(effectiveDescription ?? `MCP tool ${inlineUntrusted(sanitizeMcpModelFacingText(remoteName))} from ${spec.name}`),
             label: `${spec.name}:${remoteName}`,
@@ -1678,7 +1681,8 @@ function intakeListedTools(listed, spec, client, health, imageResizer, reminderD
                     return { content, details: { type: "mcp", structuredContent: sc }, terminate: false };
                 return { content, details: res, terminate: false };
             },
-        });
+        };
+        serverTools.push(declaredContentOrigin !== undefined ? withContentOrigin(mounted, declaredContentOrigin) : mounted);
     }
     return { serverTools, serverAxes, dropped, advisories };
 }

package/dist/core/memory-engine/content-origin.d.ts

@@ -22,13 +22,22 @@
  * does not, the default is EXTERNAL (fail-closed: unknown = external), overridable only through the
  * explicit `TaskSpec.memory.trustedTools` allowlist. A core-mounted built-in without a declaration
  * defaults local: core owns those definitions, and the fail-closed default exists for tools core
- * CANNOT vouch for, not for its own.
+ * CANNOT vouch for, not for its own. A declaration is honored only when it SPELLS a member of the
+ * closed vocabulary — an unreadable one is not a declaration.
+ *
+ * The three tier names are BOUNDARY-RELATIVE, not statements about topology: `"local"` means "does
+ * not bring content from outside the deployment's trust boundary", which a unix socket to another
+ * process the deployment itself runs satisfies and a loopback HTTP call to somebody else's service
+ * does not. Distance is not the axis; whose content it is, is.
  *
  * There is deliberately no "gate inactive" state: every mounted tool gets a class.
  */
 import type { ToolContentOrigin } from "../types.js";
 export interface ClassifyToolContentOriginInput {
-    /** The tool's own `contentOrigin` declaration (ToolSpec/AgentTool carry) — wins when present. */
+    /** The tool's own `contentOrigin` declaration (ToolSpec/AgentTool carry) — wins when present AND
+     *  a member of the closed vocabulary ({@link isToolContentOrigin}); a present non-member is the
+     *  unreadable-declaration case and classifies EXTERNAL. The annotation is intent, not a guarantee:
+     *  the property rides tool objects untyped. */
     declared?: ToolContentOrigin;
     /** True ⇔ the name belongs to a protocol namespace (mcp__/a2a__ …) — an external channel. */
     isProtocolTool: boolean;
@@ -37,6 +46,10 @@ export interface ClassifyToolContentOriginInput {
     /** True ⇔ `TaskSpec.memory.trustedTools` names this tool (explicit host exemption). */
     trusted: boolean;
 }
+/** The vocabulary in wire/message order — the one spelling list a refusal quotes back. */
+export declare const TOOL_CONTENT_ORIGINS: readonly ToolContentOrigin[];
+/** Runtime membership in the closed vocabulary. */
+export declare function isToolContentOrigin(value: unknown): value is ToolContentOrigin;
 export declare function classifyToolContentOrigin(input: ClassifyToolContentOriginInput): ToolContentOrigin;
 /**
  * Declare `origin` on a tool object built OUTSIDE `defineTool` — a raw AgentTool literal, which is
@@ -60,6 +73,15 @@ export interface AgentToolFace {
 export interface AgentPoolTool {
     name: string;
     aliases?: readonly string[];
+    /** The pool row's own declaration — a STATIC surface the deployment writes when it composes the
+     *  delegation tool, and the only class information this judgment has about the child's roster.
+     *
+     *  A per-entry MCP declaration (design/378, `McpServerSpec.contentOrigin`) does NOT reach here: the
+     *  pool is a declaration, not a live roster, and this judgment never sees the server entries. A
+     *  deployment that hands a declared server's `mcp__` tools to children MIRRORS the value onto the
+     *  matching pool rows; not mirroring it leaves them on the protocol arm, so the delegation reads
+     *  external and the parent over-marks — the safe direction, and the reason this is a documented
+     *  duty rather than a refusal. */
     contentOrigin?: ToolContentOrigin;
 }
 /**

package/dist/core/memory-engine/content-origin.js

@@ -1,6 +1,11 @@
+const TOOL_CONTENT_ORIGIN_SET = { external: true, execution: true, local: true };
+export const TOOL_CONTENT_ORIGINS = Object.keys(TOOL_CONTENT_ORIGIN_SET);
+export function isToolContentOrigin(value) {
+    return typeof value === "string" && Object.prototype.hasOwnProperty.call(TOOL_CONTENT_ORIGIN_SET, value);
+}
 export function classifyToolContentOrigin(input) {
     if (input.declared !== undefined)
-        return input.declared;
+        return isToolContentOrigin(input.declared) ? input.declared : "external";
     if (input.trusted)
         return "local";
     if (input.isProtocolTool)

package/dist/core/memory.d.ts

@@ -477,6 +477,16 @@ export interface NormalizedMemorySpec {
      * of the fail-closed `"external"` default. The explicit-config channel for a deployment whose custom
      * tools predate the {@link import("./types.js").ToolSpec.contentOrigin} declaration; it never
      * overrides a tool's OWN declaration. Normalized: trimmed, deduped, empties dropped.
+     *
+     * NOT the channel for MCP servers (design/378). A per-name entry here keys on the MINTED name — the
+     * host has to predict the namespacing and charset normalization — covers nothing a mid-task refresh
+     * adds, and says "exempt this undeclared tool" where the fact is "this whole server is mine".
+     * {@link import("./types.js").McpServerSpec.contentOrigin} states that fact at the entry, and being
+     * a DECLARATION it wins over this allowlist in both directions: a declared server's tools leave this
+     * list's reach entirely, an explicit `"external"` declaration included (that is the one way a
+     * deployment can pin a server's tools BEYOND this exemption). This list is not retired — it remains
+     * the in-register channel for undeclared HOST tools and for a deployment not ready to touch its
+     * server entries.
      */
     trustedTools?: string[];
     /**

package/dist/core/park-selfcheck.js

@@ -70,6 +70,7 @@ function syntheticCheckpoint(scope) {
             toolName: "SelfCheck",
             args: { probe: true, nested: { depth: 2, list: [1, 2, 3] } },
             boundInputHash: boundInputHashOf({ probe: true, nested: { depth: 2, list: [1, 2, 3] } }),
+            hasBidiControls: true,
             batchToolCallIds: [`${scope}:call`],
             completedCallIds: [],
         },

package/dist/core/permission-rule-consent.js

@@ -1,5 +1,5 @@
 import { randomBytes } from "node:crypto";
-import { hasUnrenderableCharacters, parseAllowRuleText, ruleAdmitsCommand, segmentCoverageOf, suggestRulesForCommand, } from "./permission-rule-model.js";
+import { escapeForDisclosure, hasUnrenderableCharacters, parseAllowRuleText, ruleAdmitsCommand, segmentCoverageOf, suggestRulesForCommand, } from "./permission-rule-model.js";
 import { errText, sameRuleOwner, sameScope, writerOf } from "./permission-rule-store.js";
 export class InMemoryRuleApprovalRecordStore {
     rows = new Map();
@@ -115,7 +115,7 @@ function approvalRecordDamageOf(rec) {
         const seen = new Set();
         for (const member of members) {
             if (!Number.isInteger(member) || member < 0 || rec.candidates[member] === undefined) {
-                return `offer ${at} references candidate ${member}, which the record does not carry`;
+                return `offer ${at} references candidate ${escapeForDisclosure(member)}, which the record does not carry`;
             }
             const cand = rec.candidates[member];
             if (typeof cand !== "object" || cand === null || typeof cand.rule !== "string") {
@@ -138,10 +138,14 @@ function approvalRecordDamageOf(rec) {
                 }
             }
             else if (offer.segments !== undefined || offer.uncoveredSegments !== undefined) {
-                return `${rec.kind} batch offer ${at} must not carry segment metadata — there is no compound command behind it`;
+                return `${escapeForDisclosure(rec.kind)} batch offer ${at} must not carry segment metadata — there is no compound command behind it`;
             }
         }
     }
+    for (const [at] of rec.candidates.entries()) {
+        if (!claimed.has(at))
+            return `candidate ${at} belongs to no offer — every candidate row is claimed by exactly one offer`;
+    }
     return undefined;
 }
 export function ruleOffersOfRecord(rec) {
@@ -325,7 +329,7 @@ function checkEditedRuleText(text, command) {
     if (!ruleAdmitsCommand(parsed.rule, command)) {
         return {
             ok: false,
-            message: `the edited rule "${parsed.rule.rule}" does not admit the command that was decided ("${command}") — a card's edit may widen how much the rule covers, never move it to a different grant`,
+            message: `the edited rule "${parsed.rule.rule}" does not admit the command that was decided ("${escapeForDisclosure(command)}") — a card's edit may widen how much the rule covers, never move it to a different grant`,
         };
     }
     return { ok: true, canonicalRule: parsed.rule.rule };
@@ -342,7 +346,7 @@ export function precheckEditedRuleText(text, command) {
         throw e;
     }
     if (hasUnrenderableCharacters(command)) {
-        const e = new Error("precheckEditedRuleText takes a command this lane can read — one carrying control or format characters is not a command any card was drawn for, and the refusal line naming it would carry those bytes onto a display surface");
+        const e = new Error("precheckEditedRuleText takes a command this lane can read — one carrying control or format characters is refused at this preflight face (likelier a caller wiring fault than a card's command; the in-engine confirmation arm still judges such a card, with the command escaped on its refusal line)");
         e.code = "config.invalid_argument";
         throw e;
     }

package/dist/core/runner/prepare-config-doors.d.ts

@@ -22,6 +22,7 @@
 import { type BrainCallGuardrailRef } from "../../brain/timeout.js";
 import type { Model } from "../../internal/llm.js";
 import type { ThinkingLevel } from "../../internal/harness.js";
+import type { ContextEditMachine } from "../context-edit.js";
 import { type LockedPreflight } from "../locked-config.js";
 import { type ResolvedRole } from "../roles.js";
 import type { SessionStore } from "../session.js";
@@ -119,6 +120,13 @@ export interface PrepareConfigDoorsResult {
     /** owned — the resolved interaction posture (spec > spawning run > deployment); the
      *  AskUserQuestion mount and the child-ctx injection read this same value. */
     resolvedInteractionPosture: "interactive" | "headless" | undefined;
+    /** owned — the validated/resolved microCompact knob (design/374; {@link resolveMicroCompactKnob}
+     *  for the door + placement reasoning). The per-run state builder consumes exactly these values —
+     *  the deps bag is never re-read after this door. */
+    microCompactKnob: {
+        machine: ContextEditMachine;
+        clearOnRejection: boolean;
+    };
     /** owned — the resolved role; its `systemPrompt` seat is still read at prompt-input time. */
     resolvedRole: ResolvedRole;
     /** owned — the resolved main model (`resolvedRole.model`, re-exposed as the name every later
@@ -163,5 +171,18 @@ export interface PrepareConfigDoorsResult {
      *  the resolver's off states). */
     brainCallGuardrailMs: number | undefined;
 }
-/** The B-1 phase body — the config-doors slice, verbatim (see the module header for the contract). */
+/** design/374 — the microCompact knob door (坏值响亮度默认律, the sibling knob doors' form:
+ *  interactionPosture / toolModelGate / staleToolResultOffload). Placement is load-bearing (review
+ *  r3): it runs in THIS pre-first-await config-doors phase so a malformed declaration refuses
+ *  BEFORE any resource-bearing preparation — session acquisition, execution-env creation, the MCP
+ *  dial — whose external effects a late refusal's teardown cannot undo. SINGLE READ per seat, and
+ *  the CONTAINER is judged first (reviews r1/r2): an accessor-backed bag answering a legal value at
+ *  one read and junk at another must be caught by whichever read this door takes, and a
+ *  `microCompact: "cc"` / null / number / array bag makes both property reads answer undefined —
+ *  it must refuse exactly like a malformed field, never fold to the defaults. The RESOLVED values
+ *  returned here are immutable and are the state builder's ONLY source — nothing re-reads the bag. */
+export declare function resolveMicroCompactKnob(bag: RunnerDeps["microCompact"]): {
+    machine: ContextEditMachine;
+    clearOnRejection: boolean;
+};
 export declare function prepareConfigDoors(input: PrepareConfigDoorsInput): PrepareConfigDoorsResult;

package/dist/core/runner/prepare-config-doors.js

@@ -83,10 +83,45 @@ export function resolveModelPromptTraits(model, spec, internals) {
         fableMitigations: isFableFamilyModelId(model.id),
     };
 }
+function microCompactConfigError(field, value, legal) {
+    let shown;
+    try {
+        shown = JSON.stringify(value) ?? String(value);
+    }
+    catch {
+        try {
+            shown = String(value);
+        }
+        catch {
+            shown = `[unrepresentable ${typeof value}]`;
+        }
+    }
+    const seat = field === undefined ? "microCompact" : `microCompact.${field}`;
+    const e = new Error(`${seat} ${shown} is not ${legal} — an unevaluable declaration is refused loudly, ` +
+        `never folded to the default: a silently-ignored opt-in would run the pre-374 machine while the ` +
+        `deployment believes it opted in.`);
+    e.code = "config.microcompact_invalid";
+    return e;
+}
+export function resolveMicroCompactKnob(bag) {
+    if (bag !== undefined && (typeof bag !== "object" || bag === null || Array.isArray(bag))) {
+        throw microCompactConfigError(undefined, bag, "an object carrying optional machine/clearOnRejection keys");
+    }
+    const declaredMachine = bag?.machine;
+    if (declaredMachine !== undefined && declaredMachine !== "legacy" && declaredMachine !== "cc") {
+        throw microCompactConfigError("machine", declaredMachine, `"legacy" | "cc"`);
+    }
+    const declaredClearOnRejection = bag?.clearOnRejection;
+    if (declaredClearOnRejection !== undefined && typeof declaredClearOnRejection !== "boolean") {
+        throw microCompactConfigError("clearOnRejection", declaredClearOnRejection, "a boolean");
+    }
+    return { machine: declaredMachine ?? "legacy", clearOnRejection: declaredClearOnRejection === true };
+}
 export function prepareConfigDoors(input) {
     const { deps, sessions, resume, internals } = input;
     let spec = input.spec;
     assertRestoreGatedToolsValue(spec.restoreGatedTools);
+    const microCompactKnob = resolveMicroCompactKnob(deps.microCompact);
     const assertToolNameListValue = (value, seat) => {
         if (value === undefined)
             return;
@@ -318,6 +353,7 @@ export function prepareConfigDoors(input) {
         promptProfile,
         lockedPreflight,
         resolvedInteractionPosture,
+        microCompactKnob,
         resolvedRole,
         model,
         thinking,

package/dist/core/runner/prepare-task.d.ts

@@ -20,6 +20,7 @@ import type { MemoryEngine } from "../memory-engine/engine.js";
 import { type GitStatusLaneRef } from "./git-status-frame.js";
 import { type ToolManifestRow } from "../../prompt-assembly/tool-catalog.js";
 import type { ToolDisclosureManifest } from "../trace.js";
+import { type ClearedProjectionLedger, type ContextEditMachine, type OccurrenceIndex } from "../context-edit.js";
 import type { TaskNotificationPayload } from "../task-notification.js";
 import { type CwdRef, type ReadFace } from "../../tools/fs/index.js";
 import { type WorkflowSizeGuideline } from "../../orchestration/workflow-size-guideline.js";
@@ -134,7 +135,6 @@ export declare function checkpointScopeOf(spec: {
 export { resolveCheckpointStore } from "../checkpoint-store.js";
 export { isFableFamilyModelId, resolveModelPromptTraits, resolveTaskLimits } from "./prepare-config-doors.js";
 export { rebaseWorkspacePath, rebaseWorkspacePathAcross } from "./prepare-workspace-restore.js";
-/** Everything the run loop needs, built once by {@link prepareTask} (task setup, isolated from the loop). */
 export interface Prepared {
     harness: AgentHarness;
     /** The CONCRETE built-in session (engine-internal: prepare constructs/acquires `StoredSession` itself,
@@ -876,6 +876,33 @@ export interface Prepared {
     trimPressureRef: {
         droppedMessages: boolean;
     };
+    /** design/374 slices 1b/2 — the microCompact machine state this run: the selected clearing
+     *  machine, the cleared-projection ledger (request-view application, durable decisions — see
+     *  `context-edit.ts`'s ledger note; per-run in-memory, so durable resume / `resumeAt` rebuilds
+     *  start EMPTY by construction), the last request's projection seat (what the provider actually
+     *  saw — the MC-R rejection arm computes its candidates and savings on THIS view, never on the
+     *  raw session rebuild), and the MC-R knob. Default machine "legacy" + MC-R off ⇒ the ledger
+     *  never gains an entry and every replay is a same-reference no-op (default bytes unchanged). */
+    microCompact: PreparedMicroCompact;
+}
+/** See {@link Prepared.microCompact}. */
+export interface PreparedMicroCompact {
+    machine: ContextEditMachine;
+    /** MC-R (design/374 §3.2): one-shot clear-and-retry on a provider input-too-long rejection.
+     *  Default false (X2: lands with the machinery, flips with slice 3). */
+    clearOnRejection: boolean;
+    ledger: ClearedProjectionLedger;
+    projectionRef: {
+        current?: {
+            /** The FINAL projected view of the last provider request (post trim/sweep). */
+            messages: AgentMessage[];
+            /** Occurrence coordinates of that view (object-identity first, unambiguous-group fallback). */
+            keyOf: OccurrenceIndex["keyOf"];
+        };
+    };
+    /** The same offload persist seat the frontier machine uses (write-once, idempotent), so MC-R
+     *  clears compose identical markers. Absent when no offload store is configured. */
+    offloadPersist?: (toolCallId: string, fullText: string) => string;
 }
 /**
  * WHICH tool call a committed durable park is holding this run — `undefined` when nothing parked, or