@sema-agent/core 5.59.0 → 5.60.0

package/dist/core/runner/prepare-task.js

@@ -20,7 +20,7 @@ import { createSubagentWorktreeHelper, forkGovernanceDenial, resolveDelegationEn
 import { createAgentTranscriptTool, AGENT_TRANSCRIPT_TOOL_NAME } from "../../agents/agent-transcript-tool.js";
 import { createSendMessageTool, SEND_MESSAGE_TOOL_NAME } from "../../agents/send-message-tool.js";
 import { SubagentRetainLedger } from "../../agents/retain-ledger.js";
-import { askApproverIdentity, checkToolPolicyProjection, combinePolicies, constraintChainDigest, constraintChainEntryOf, isApprovalSettledBy, isAskDenyResolution, screenApproverAttribution, createTranscriptIntegrityPolicy, createUnverifiableDeletePolicy, describeThrown, refuseOutOfContractDecision, resolveAsk, toolPolicyNameSets, tryCloneArgs } from "../tool-policy.js";
+import { askApproverIdentity, carriesBidiControls, checkToolPolicyProjection, combinePolicies, constraintChainDigest, constraintChainEntryOf, isApprovalSettledBy, isAskDenyResolution, screenApproverAttribution, createTranscriptIntegrityPolicy, createUnverifiableDeletePolicy, describeThrown, refuseOutOfContractDecision, resolveAsk, toolPolicyNameSets, tryCloneArgs } from "../tool-policy.js";
 const PERSISTED_RULE_TOOL = "Bash";
 import { findAdmittingRule, segmentCoverageOf, suggestRulesForCommand } from "../permission-rule-model.js";
 import { ActiveSkillScope, createActiveSkillScopePolicy } from "./active-skill-scope.js";
@@ -70,7 +70,7 @@ import { resolveEpochAgainstBundled } from "../../prompt-assembly/epoch.js";
 import { artifactDeclarations } from "../../prompt-assembly/artifact.js";
 import { buildTurnPromptSnapshot } from "../../prompt-assembly/turn-snapshot.js";
 import { SEMA_DEFAULT_PACK } from "../../prompt-assembly/packs/sema-default.js";
-import { clearStaleToolResults, dropEmptyFailureAssistants, editBudget } from "../context-edit.js";
+import { clearStaleToolResults, createClearedProjectionLedger, dropEmptyFailureAssistants, editBudget, replayClearedProjection, resolveTriggerWindow, } from "../context-edit.js";
 import { capAggregateToolResults } from "../tool-result-budget.js";
 import { capAggregateMediaBytes, AGGREGATE_MEDIA_BUDGET_BYTES } from "../media-byte-cap.js";
 import { dropOrphanToolResults, guardBudget, insertTrimNotice, trimToBudget } from "../context-guard.js";
@@ -124,7 +124,7 @@ function warnCompactionWindowHazard(tracer, spec, model, compModel, hostTaskId)
     if (compModel === undefined)
         return;
     const compWindow = compModel.contextTokens ?? compModel.contextWindow;
-    const mainWindow = model.autoCompactTokens ?? model.contextTokens ?? model.contextWindow;
+    const mainWindow = resolveTriggerWindow(model).window;
     if (compWindow > 0 && mainWindow > 0 && compWindow < mainWindow) {
         const merged = { ...DEFAULT_COMPACTION_SETTINGS, ...spec.compaction };
         const sanitized = sanitizeCompactionSettings(merged, mainWindow);
@@ -195,6 +195,33 @@ function announceToolModelGate(onNotice, modelId, gate) {
         }
     }
 }
+function announceDeclaredMcpContentClasses(args) {
+    for (const entry of args.entries ?? []) {
+        const declaredClass = entry.contentOrigin;
+        if (declaredClass === undefined)
+            continue;
+        const server = inlineUntrusted(String(entry.name), 160);
+        const toolCount = args.statuses?.find((s) => s.name === entry.name)?.toolNames?.length ?? 0;
+        const resourceFaceCaveat = " (Not covered: the cross-server resource faces — ListMcpResourcesTool/ReadMcpResourceTool/ReadMcpResourceDirTool — stay externally classified and still mark.)";
+        const posture = declaredClass === "local"
+            ? `this server's mounted tools' invocations will not mark this session's memory as externally exposed.${resourceFaceCaveat}`
+            : declaredClass === "execution"
+                ? `this server's mounted tools' invocations will not mark this session's memory unless the execIsExternalContent strict upgrade is armed (currently: ${args.execIsExternalContent ? "armed" : "off"}).${resourceFaceCaveat}`
+                : "its tools stay externally classified and this declaration PINS that — the trustedTools allowlist no longer exempts them, and invocations mark this session's memory.";
+        deliverEngineNotice(args.onNotice, {
+            code: "memory.content_class_declared",
+            message: `MCP server "${server}" (${toolCount} tool(s) mounted) is declared ` +
+                `contentOrigin "${declaredClass}" by this deployment's configuration — ${posture}`,
+            detail: {
+                server,
+                contentOrigin: declaredClass,
+                toolCount,
+                ...(declaredClass === "execution" ? { execIsExternalContent: args.execIsExternalContent } : {}),
+                sessionId: args.sessionId,
+            },
+        });
+    }
+}
 export { __resetReadFaceClampAnnouncement } from "./prepare-hands-readface.js";
 const DEFAULT_MAX_SUSPENDS = 5;
 const ULTRA_REASONING_TIERS = new Set(["xhigh", "max"]);
@@ -242,6 +269,49 @@ class ParkRefusal extends Error {
 export { resolveCheckpointStore } from "../checkpoint-store.js";
 export { isFableFamilyModelId, resolveModelPromptTraits, resolveTaskLimits } from "./prepare-config-doors.js";
 export { rebaseWorkspacePath, rebaseWorkspacePathAcross } from "./prepare-workspace-restore.js";
+function buildMicroCompactState(deps, model, sessionId, offloadStore, knob) {
+    const triggerWindow = resolveTriggerWindow(model);
+    if (triggerWindow.clamped) {
+        deliverEngineNotice(deps.onNotice, {
+            code: "config.autocompact_window_clamped",
+            message: `model "${model.id}" declares autoCompactTokens=${triggerWindow.declaredAutoCompactTokens} ABOVE its physical window ` +
+                `${triggerWindow.physicalWindow}; the autocompact window only ever LOWERS the trigger-side geometry, so the value was ` +
+                `clamped to the physical window — fix the model config (declare a value at or below the physical window, or omit it)`,
+            detail: {
+                modelId: model.id,
+                declaredAutoCompactTokens: triggerWindow.declaredAutoCompactTokens,
+                physicalWindow: triggerWindow.physicalWindow,
+                sessionId,
+            },
+        });
+    }
+    return {
+        machine: knob.machine,
+        clearOnRejection: knob.clearOnRejection,
+        ledger: createClearedProjectionLedger(),
+        projectionRef: {},
+        ...(offloadStore ? { offloadPersist: createOffloadPersist(offloadStore, sessionId, deps.onNotice) } : {}),
+    };
+}
+function recordFrontierClears(args) {
+    for (const { index } of args.pass.clears) {
+        const at = args.index.keyAt(index);
+        const clearedMsg = args.edited[index];
+        const markerText = clearedMsg.content?.[0]?.text;
+        if (at !== undefined && typeof markerText === "string") {
+            args.ledger.entries.set(at.key, { marker: markerText, groupCount: at.groupCount, fp: at.fp });
+        }
+    }
+    emitTrace(args.tracer, () => ({
+        kind: "context.mc_clear",
+        version: 1,
+        taskId: args.taskId,
+        clearedCount: args.pass.clears.length,
+        tokensSavedEstimate: args.pass.tokensSavedEstimate,
+        trigger: "frontier",
+        ts: Date.now(),
+    }));
+}
 export function gatedCallIdOf(p) {
     if (p.suspendRef.token !== undefined)
         return p.suspendRef.gatedCallId;
@@ -492,7 +562,7 @@ async function derivedRouteFallsBack(args) {
 export async function prepareTask(spec, deps, sessions, resume, internals, runnerSelf) {
     const doors = prepareConfigDoors({ spec, deps, sessions, resume, internals });
     spec = doors.spec;
-    const { toolFaceSnapshot, promptProfile, lockedPreflight, resolvedInteractionPosture, resolvedRole, model, thinking, compModel, fableMitigations, memoryDelegationEvidence, memoryProvenance, usageWindows, brainCallGuardrailRef, brainCallGuardrailMs } = doors;
+    const { toolFaceSnapshot, promptProfile, lockedPreflight, resolvedInteractionPosture, microCompactKnob, resolvedRole, model, thinking, compModel, fableMitigations, memoryDelegationEvidence, memoryProvenance, usageWindows, brainCallGuardrailRef, brainCallGuardrailMs } = doors;
     announceToolModelGate(deps.onNotice, model.id, doors.modelGate);
     const { toolEffects, egressTools, irreversibleTools, irreversibilityTier, axisExplicitNegatives, reversibilityProbes, ownToolNames } = prepareSafetyScan({ spec, deps });
     let shellGatedBash = false;
@@ -2079,6 +2149,13 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
             const trustedTools = effectiveSafety.trustedTools;
             const execIsExternalContent = effectiveSafety.execIsExternalContent;
             provenanceForChildrenRef.current = { trustedTools: [...trustedTools], execIsExternalContent };
+            announceDeclaredMcpContentClasses({
+                entries: lockedPreflight.mcp,
+                statuses: mcp?.statuses,
+                execIsExternalContent,
+                sessionId,
+                onNotice: deps.onNotice,
+            });
             if (memoryEngineSession?.settlement !== undefined) {
                 delegationSettlementRef.current = { controlDir: memoryEngineSession.settlement.controlDir, sessionId: memoryEngineSession.settlement.sessionId };
             }
@@ -4229,7 +4306,11 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                                 args: parkedArgs,
                                 ...(() => {
                                     const preview = approvalPreviewOf(req.toolName, parkedArgs);
-                                    return preview !== undefined ? { preview } : {};
+                                    const bidi = carriesBidiControls(parkedArgs) || carriesBidiControls(preview);
+                                    return {
+                                        ...(preview !== undefined ? { preview } : {}),
+                                        ...(bidi ? { hasBidiControls: true } : {}),
+                                    };
                                 })(),
                                 ...ruleOffersOf(req.toolName, parkedArgs, {
                                     ...(realApproval !== undefined ? { requiresRealApproval: true } : {}),
@@ -4502,11 +4583,14 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
         }
         const editAt = editBudget(model);
         const guardAt = guardBudget(model);
+        const microCompact = buildMicroCompactState(deps, model, sessionId, offloadStore, microCompactKnob);
         const charsPerToken = model.charsPerToken ?? DEFAULT_CHARS_PER_TOKEN;
         harness.on("context", async ({ messages }) => {
             batchHaltRef.current = undefined;
             const healed = dropEmptyFailureAssistants(messages);
-            const capped = await capAggregateToolResults(healed, {
+            const replay = replayClearedProjection(healed, microCompact.ledger);
+            const replayed = replay.messages;
+            const capped = await capAggregateToolResults(replayed, {
                 store: offloadStore,
                 sessionId,
                 onCapped: (info) => emitTrace(deps.tracer, () => ({
@@ -4523,8 +4607,17 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                 limitBytes: deps.mediaByteCapBytes ?? AGGREGATE_MEDIA_BUDGET_BYTES,
                 onStripped: deps.onMediaStripped,
             });
+            let ccPass;
             const edited = clearStaleToolResults(mediaCapped, {
                 budgetTokens: editAt,
+                ...(microCompact.machine === "cc" || microCompact.clearOnRejection ? { recognizeCcMarkers: true } : {}),
+                ...(microCompact.machine === "cc"
+                    ? {
+                        machine: "cc",
+                        clearSource: replayed,
+                        onCleared: (pass) => { ccPass = pass; },
+                    }
+                    : {}),
                 anchoredTotalTokens: estimateContextTokens(mediaCapped, charsPerToken).tokens,
                 charsPerToken,
                 ...(offloadStore
@@ -4535,6 +4628,9 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                     }
                     : {}),
             });
+            if (ccPass !== undefined) {
+                recordFrontierClears({ pass: ccPass, index: replay.index, edited, ledger: microCompact.ledger, tracer: deps.tracer, taskId: spec.taskId ?? sessionId });
+            }
             let trimmed = trimToBudget(edited, guardAt, estimateContextTokens(edited, charsPerToken).tokens, charsPerToken);
             const trimDroppedMessages = trimmed.length < edited.length;
             if (trimDroppedMessages) {
@@ -4575,12 +4671,14 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                 }
             }
             requestLossyRef.current =
-                capped !== healed ||
+                replayed !== healed ||
+                    capped !== replayed ||
                     mediaCapped !== capped ||
                     edited !== mediaCapped ||
                     trimDroppedMessages ||
                     swept.dropped.length > 0 ||
                     gitStatusRef.overBudgetShrunk === true;
+            microCompact.projectionRef.current = { messages: swept.messages, keyOf: replay.index.keyOf };
             return { messages: swept.messages };
         });
         const cacheBreakDetector = deps.cacheBreakDetection === false ? undefined : new CacheBreakDetector();
@@ -4769,7 +4867,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
         const effectiveReadFaceObserved = carrierReadFace();
         const effectiveReadDenyObserved = readDenyAdditionsNormalized.length > 0 ? readDenyAdditionsNormalized.map((e) => ({ ...e })) : undefined;
         const preparedHolder = {};
-        const buildPrepared = () => ({ harness, session, sessionId, reminderMark, reminderDisclosureCounts, taskRootPath: taskRootFinal, model, thinking, compModel: effectiveCompModel, mcp: mcp, ...(a2a !== undefined && a2a.tools.length > 0 ? { a2a } : {}), blockedRef, outputRef, abortController, conflictRef, blockedToolCalls, approvalSettlement, batchHaltRef, nestedStats, ...(rewindNotes.length > 0 ? { rewindNotes } : {}), ...(effectiveReadFaceObserved !== undefined ? { effectiveReadFace: effectiveReadFaceObserved } : {}), ...(effectiveReadDenyObserved !== undefined ? { effectiveReadDenyPatterns: effectiveReadDenyObserved } : {}), effectiveMemoryScopes: memoryEffectiveScopes, cwdRef: handsCwdRef, ...(worktreeSessionRef !== undefined ? { worktreeSessionRef } : {}), ...(workspaceStateSettle !== undefined ? { workspaceStateSettle } : {}), denyNarrowingPolicy, ...(basePolicyForResumeEdit !== undefined ? { basePolicyForResumeEdit } : {}), ...(permissionRuleOrgLane !== undefined ? { permissionRuleOrg: permissionRuleOrgLane } : {}), releaseSignal, settleContentAskBindings, cacheBreakDetector, cacheFingerprint, wiringManifest, promptManifest, epochDeclaredSections, activeTools, ...(deferred.size > 0 ? { deferredToolNames: deferred } : {}), toolMaterializeStatic, deferDirectCall, ...(staticFaceForRef.current !== undefined ? { staticFaceFor: staticFaceForRef.current } : {}), ownedEnv, suspendRef, suspendProgressRef, reviewRef, remoteEnvFailures, reviewRequestRef, suspendLoopRef, suspendForResource, ...(suspendForPlatformLimit !== undefined ? { suspendForPlatformLimit } : {}), ...(envLifetimeSuspendAt !== undefined ? { envLifetimeSuspendAt } : {}), ...(usageGovernance !== undefined ? { usageGovernance } : {}), callIssuedAtRef, brainCallGuardrailRef, suspendForReview, resourceLedger: priorLedger, liveSpendRef, humanReviewRef, now, tools, toolEffects, wakeRecovered, promptOverheadTokens, lastBrainContext, readTaskFile, recentlyReadFiles, normalizeAttachmentPath, isDedupStubResult, ...(onCompactionApplied ? { onCompactionApplied } : {}), compactionReuseRef, trimPressureRef, ...(memoryEngineSession ? { memoryEngineSession } : {}), ...(subagentRetain ? { subagentRetain } : {}), ...(lspDiagnostics && nudgeLspOnEdit ? { lspDiagnostics: { registry: lspDiagnostics, nudge: nudgeLspOnEdit, runIdent: lspRunIdent } } : {}), planModeRef, ...(dateChange ? { dateChange } : {}), ...(instructionSources ? { instructionSources } : {}), ...(workflowSizeGuideline ? { workflowSizeGuideline } : {}), ...(detectExternalChanges ? { detectExternalChanges } : {}), ...(toolsDeltaRef ? { toolsDeltaRef } : {}), ...(agentListing ? { agentListing } : {}), ...(skillsListing ? { skillsListing } : {}), announcedListingsRef, gitStatusRef, listBackgroundTasks, hookIdentity, hookTimeoutMs, ...(turnSnapshotRef.current !== undefined ? { turnSnapshot: turnSnapshotRef.current } : {}), ...(centerCompactionCandidate !== undefined ? { centerCompactionCandidate } : {}) });
+        const buildPrepared = () => ({ harness, session, sessionId, reminderMark, reminderDisclosureCounts, taskRootPath: taskRootFinal, model, thinking, compModel: effectiveCompModel, mcp: mcp, ...(a2a !== undefined && a2a.tools.length > 0 ? { a2a } : {}), blockedRef, outputRef, abortController, conflictRef, blockedToolCalls, approvalSettlement, batchHaltRef, nestedStats, ...(rewindNotes.length > 0 ? { rewindNotes } : {}), ...(effectiveReadFaceObserved !== undefined ? { effectiveReadFace: effectiveReadFaceObserved } : {}), ...(effectiveReadDenyObserved !== undefined ? { effectiveReadDenyPatterns: effectiveReadDenyObserved } : {}), effectiveMemoryScopes: memoryEffectiveScopes, cwdRef: handsCwdRef, ...(worktreeSessionRef !== undefined ? { worktreeSessionRef } : {}), ...(workspaceStateSettle !== undefined ? { workspaceStateSettle } : {}), denyNarrowingPolicy, ...(basePolicyForResumeEdit !== undefined ? { basePolicyForResumeEdit } : {}), ...(permissionRuleOrgLane !== undefined ? { permissionRuleOrg: permissionRuleOrgLane } : {}), releaseSignal, settleContentAskBindings, cacheBreakDetector, cacheFingerprint, wiringManifest, promptManifest, epochDeclaredSections, activeTools, ...(deferred.size > 0 ? { deferredToolNames: deferred } : {}), toolMaterializeStatic, deferDirectCall, ...(staticFaceForRef.current !== undefined ? { staticFaceFor: staticFaceForRef.current } : {}), ownedEnv, suspendRef, suspendProgressRef, reviewRef, remoteEnvFailures, reviewRequestRef, suspendLoopRef, suspendForResource, ...(suspendForPlatformLimit !== undefined ? { suspendForPlatformLimit } : {}), ...(envLifetimeSuspendAt !== undefined ? { envLifetimeSuspendAt } : {}), ...(usageGovernance !== undefined ? { usageGovernance } : {}), callIssuedAtRef, brainCallGuardrailRef, suspendForReview, resourceLedger: priorLedger, liveSpendRef, humanReviewRef, now, tools, toolEffects, wakeRecovered, promptOverheadTokens, lastBrainContext, readTaskFile, recentlyReadFiles, normalizeAttachmentPath, isDedupStubResult, ...(onCompactionApplied ? { onCompactionApplied } : {}), compactionReuseRef, trimPressureRef, microCompact, ...(memoryEngineSession ? { memoryEngineSession } : {}), ...(subagentRetain ? { subagentRetain } : {}), ...(lspDiagnostics && nudgeLspOnEdit ? { lspDiagnostics: { registry: lspDiagnostics, nudge: nudgeLspOnEdit, runIdent: lspRunIdent } } : {}), planModeRef, ...(dateChange ? { dateChange } : {}), ...(instructionSources ? { instructionSources } : {}), ...(workflowSizeGuideline ? { workflowSizeGuideline } : {}), ...(detectExternalChanges ? { detectExternalChanges } : {}), ...(toolsDeltaRef ? { toolsDeltaRef } : {}), ...(agentListing ? { agentListing } : {}), ...(skillsListing ? { skillsListing } : {}), announcedListingsRef, gitStatusRef, listBackgroundTasks, hookIdentity, hookTimeoutMs, ...(turnSnapshotRef.current !== undefined ? { turnSnapshot: turnSnapshotRef.current } : {}), ...(centerCompactionCandidate !== undefined ? { centerCompactionCandidate } : {}) });
         const prepared = buildPrepared();
         preparedHolder.current = prepared;
         return prepared;

package/dist/core/runner/runtask.js

@@ -2,6 +2,7 @@ import { persistedReadDenyEntryProblem } from "../../tools/fs/read-deny.js";
 import { createSafeNotifier, observeThenableRejection } from "../safe-notify.js";
 import { mintSystemReminder, openSystemReminder } from "../reminder-mint.js";
 import { deliverDelegationLifecycle, deliverEngineNotice, undrainedUserInputNotices } from "../types.js";
+import { planRejectionClears, resolveTriggerWindow } from "../context-edit.js";
 import { AgentHarness, DEFAULT_COMPACTION_SETTINGS, uuidv7 } from "../../internal/harness.js";
 import { snapshotActorAssertion } from "../../internal/llm.js";
 import { CheckpointError, BINDING_CHECKPOINT_VERSION, checkpointVersionOf, F012_CHECKPOINT_VERSION, MAX_SUPPORTED_CHECKPOINT_VERSION, REAL_APPROVAL_CHECKPOINT_VERSION, FACE_CHECKPOINT_VERSION, remainingBudgetMicroUsd, readPendingSteerQueue, remainingTokens, LEGACY_PENDING_STEER_INPUT_ID, MAX_STEER_INPUT_ID_CHARS, validatePendingSteer, winnerFromOutcome, } from "../checkpoint-store.js";
@@ -2734,7 +2735,7 @@ export class Runner {
         const withinTaskCompaction = (spec.compaction?.enabled ?? true) && (spec.compaction?.withinTask ?? true);
         const compactionBreaker = { failures: 0 };
         if (spec.compaction?.enabled ?? true) {
-            const prefixWindow = prepared.model.autoCompactTokens ?? prepared.model.contextTokens ?? prepared.model.contextWindow;
+            const prefixWindow = resolveTriggerWindow(prepared.model).window;
             if (Number.isFinite(prefixWindow) && prefixWindow > 0) {
                 const prefixSettings = sanitizeCompactionSettings({ ...DEFAULT_COMPACTION_SETTINGS, ...spec.compaction }, prefixWindow);
                 const prefixCompactAt = prefixWindow - prefixSettings.reserveTokens;
@@ -2940,13 +2941,49 @@ export class Runner {
             thinkingOnly: {},
             degenerateOutput: { detect: (m) => isDegenerateCutMessage(m) },
             promptTooLong: {
-                recover: async () => {
+                recover: async (attempt) => {
+                    if (prepared.abortController.signal.aborted || prepared.suspendRef.token !== undefined)
+                        return false;
+                    if (prepared.microCompact.clearOnRejection && attempt === 1) {
+                        const proj = prepared.microCompact.projectionRef.current;
+                        const compactionAvailable = (spec.compaction?.enabled ?? true) && compactionBreaker.failures < MAX_CONSECUTIVE_COMPACTION_FAILURES;
+                        const declineArm = compactionAvailable ? "forced_compaction" : "none";
+                        const plan = proj === undefined
+                            ? { declined: "no_candidates" }
+                            : planRejectionClears(proj.messages, {
+                                keyOf: proj.keyOf,
+                                ...(prepared.microCompact.offloadPersist ? { offload: { persist: prepared.microCompact.offloadPersist } } : {}),
+                            });
+                        if ("declined" in plan) {
+                            emitTrace(rs.telemetry.tracer, () => ({
+                                kind: "context.mc_null",
+                                version: 1,
+                                taskId: rs.telemetry.taskId,
+                                reason: plan.declined,
+                                nextArm: declineArm,
+                                ts: Date.now(),
+                            }));
+                        }
+                        else {
+                            for (const e of plan.cleared) {
+                                prepared.microCompact.ledger.entries.set(e.key, { marker: e.marker, groupCount: e.groupCount, fp: e.fp });
+                            }
+                            emitTrace(rs.telemetry.tracer, () => ({
+                                kind: "context.mc_clear",
+                                version: 1,
+                                taskId: rs.telemetry.taskId,
+                                clearedCount: plan.cleared.length,
+                                tokensSavedEstimate: plan.tokensSavedEstimate,
+                                trigger: "refusal",
+                                ts: Date.now(),
+                            }));
+                            return true;
+                        }
+                    }
                     if (!(spec.compaction?.enabled ?? true))
                         return false;
                     if (compactionBreaker.failures >= MAX_CONSECUTIVE_COMPACTION_FAILURES)
                         return false;
-                    if (prepared.abortController.signal.aborted || prepared.suspendRef.token !== undefined)
-                        return false;
                     try {
                         const comp = await maybeCompact({
                             session: prepared.session,

package/dist/core/store-contracts/checkpoint-store-contract.js

@@ -180,6 +180,38 @@ export async function checkpointStoreContract(make, runAssertion) {
         assert.equal(list[0].token, pending.token);
         assert.equal((await store.get(pending.token)).status, "pending");
     });
+    run("#438 hasBidiControls three-form matrix: a row's `true` survives + projects; absent stays absent (clean args); an out-of-contract `false` reads as absent; a bit-less marked row backfills at projection", async () => {
+        const store = make();
+        const RLO = String.fromCodePoint(0x202e);
+        const asserted = createCheckpointFixture({ token: mintCheckpointToken(), sessionId: "bidi-true" });
+        asserted.pendingAction.hasBidiControls = true;
+        const absent = createCheckpointFixture({ token: mintCheckpointToken(), sessionId: "bidi-absent" });
+        const falsed = createCheckpointFixture({ token: mintCheckpointToken(), sessionId: "bidi-false" });
+        falsed.pendingAction.hasBidiControls = false;
+        const bitless = createCheckpointFixture({
+            token: mintCheckpointToken(),
+            sessionId: "bidi-bitless",
+            pendingAction: {
+                kind: "tool_approval",
+                toolCallId: "call-3",
+                toolName: "Write",
+                args: { path: `/x/${RLO}txt.exe` },
+                boundInputHash: "h0",
+                batchToolCallIds: ["call-3"],
+                completedCallIds: [],
+            },
+        });
+        for (const cp of [asserted, absent, falsed, bitless])
+            await store.put(cp.token, cp);
+        const byId = new Map((await store.listByScope("tenant-a")).map((s) => [s.sessionId, s]));
+        assert.equal(byId.get("bidi-true")?.hasBidiControls, true);
+        assert.equal("hasBidiControls" in byId.get("bidi-absent"), false, "clean+absent must project the key OMITTED, not null/false");
+        assert.equal("hasBidiControls" in byId.get("bidi-false"), false, "a written false is out-of-contract and must read as absent, never project");
+        assert.equal(byId.get("bidi-bitless")?.hasBidiControls, true, "a marked row without the bit must be backfilled at projection time");
+        assert.equal(byId.get("bidi-bitless").toolInput.includes(RLO), true);
+        const stored = (await store.get(bitless.token)).pendingAction;
+        assert.equal("hasBidiControls" in stored, false, "projection backfill must not write back to the row");
+    });
     await settle();
 }
 const sortByToken = (a, b) => a.token.localeCompare(b.token);

package/dist/core/tool-policy.d.ts

@@ -986,10 +986,15 @@ export interface AskRequest {
      *
      * SCOPE, stated so absence is not read as a clean bill on the other routes: this is the
      * SYNCHRONOUS `onAsk` ask, like `principal`/`sourceTaskId` — the closure claim is over AskRequest
-     * mint sites, not over every approval callback. Two human-decision routes never receive it:
-     * ① a durable park/suspend never invokes `onAsk`, so a parked approval row carries no twin of
-     * this bit today — an inbox rendering `RiskDescriptor` must run its own screen (or the display
-     * baseline above) rather than infer "no bit, no problem"; ② {@link createApprovalPolicy}'s
+     * mint sites, not over every approval callback. The other two human-decision routes:
+     * ① a durable park/suspend never invokes `onAsk` and never mints an AskRequest — its twin of this
+     * bit is the PERSISTED `PendingAction.tool_approval.hasBidiControls` on the parked row (judged at
+     * the park mint over the row's own fidelity-projected args snapshot + preview, so the two faces
+     * can honestly differ on a shape-changing backend), projected to the inbox as
+     * `CheckpointSummary.hasBidiControls` — see those fields in `checkpoint-store.ts` for the reading
+     * contract; absence there is still "not detected", never a clean bill, and an inbox rendering
+     * `RiskDescriptor` still owes its own screen (or the display baseline above);
+     * ② {@link createApprovalPolicy}'s
      * `approve` seat resolves in-place inside the policy and mints no AskRequest at all — its
      * callback receives a bare `ToolCallRequest` (no bit, no {@link boundInputHash}, none of this
      * surface), so a deployment doing HITL through that seat must render through
@@ -1222,18 +1227,29 @@ export type ResolvedAsk = PermissionResult & {
 };
 /**
  * Does any string reachable in `value` carry a {@link BIDI_CONTROL_RE} member? Bounded, cycle-safe,
- * and never throwing — the one caller is on the approval path, where a scan that failed must degrade
- * to "not detected" rather than turn an ask into an error (the `deliverEngineNotice` posture: a
- * derived disclosure must never become the failure of the thing it describes).
+ * and never throwing — every caller is on an approval/projection path, where a scan that failed must
+ * degrade to "not detected" rather than turn an ask into an error (the `deliverEngineNotice`
+ * posture: a derived disclosure must never become the failure of the thing it describes).
  *
  * OBJECT KEYS are scanned as well as values: a key is displayed text too, and an argument object
  * `{ "cmd<RLO>": … }` renders its own reordering in any card that prints the shape (the marker
  * is spelled out here on purpose — a literal one in this comment would reorder the comment).
  *
+ * `limits` parameterizes the two budgets WITHOUT opening a second reader: the character class and
+ * the traversal stay defined exactly here, only the allowance varies by caller. Omitted ⇒ the mint
+ * tier above (the resolveAsk chokepoint and the durable park mint, which scan one call's own
+ * payload). A per-row projection caller (the checkpoint summary backfill, which may face
+ * deployment-written rows of arbitrary size on a many-row read) passes its own smaller tier so one
+ * row's work is bounded regardless of the row's provenance. Both members are required when the
+ * object is given — a half-specified tier would silently mix two tiers in one scan.
+ *
  * Not a public export: the contract is the {@link AskRequest.hasBidiControls} bit, and a second
  * spelling of "does this carry bidi" on the public surface would be one more thing to keep in step.
  */
-export declare function carriesBidiControls(value: unknown): boolean;
+export declare function carriesBidiControls(value: unknown, limits?: {
+    maxNodes: number;
+    maxChars: number;
+}): boolean;
 /**
  * Resolve an `ask` decision to a terminal `allow`/`deny` via {@link OnAsk}. Centralizes the headless
  * auto-deny default, fail-closed error handling, and stable deny reasons so every ask site is

package/dist/core/tool-policy.js

@@ -903,9 +903,9 @@ export function coreMintedResolutionOf(d, call) {
 const BIDI_CONTROL_RE = /[\u061C\u200E\u200F\u202A-\u202E\u2066-\u2069]/u;
 const BIDI_SCAN_MAX_NODES = 5_000;
 const BIDI_SCAN_MAX_CHARS = 1_000_000;
-export function carriesBidiControls(value) {
-    let budget = BIDI_SCAN_MAX_NODES;
-    let charBudget = BIDI_SCAN_MAX_CHARS;
+export function carriesBidiControls(value, limits) {
+    let budget = limits?.maxNodes ?? BIDI_SCAN_MAX_NODES;
+    let charBudget = limits?.maxChars ?? BIDI_SCAN_MAX_CHARS;
     const seen = new WeakSet();
     const scan = (s) => {
         if (charBudget <= 0)

package/dist/core/tools.js

@@ -45,7 +45,7 @@ export function defineTool(spec, options) {
         executionMode,
         ...(spec.isConcurrencySafe ? { isConcurrencySafe: spec.isConcurrencySafe } : {}),
         ...(spec.effect ? { effect: spec.effect } : {}),
-        ...(spec.contentOrigin ? { contentOrigin: spec.contentOrigin } : {}),
+        ...(spec.contentOrigin !== undefined ? { contentOrigin: spec.contentOrigin } : {}),
         ...(spec.egress ? { egress: true } : {}),
         ...(spec.irreversibility !== undefined ? { irreversibility: spec.irreversibility } : {}),
         ...(spec.reversibilityProbe ? { reversibilityProbe: spec.reversibilityProbe } : {}),

package/dist/core/trace.d.ts

@@ -729,6 +729,42 @@ export type TraceEvent = {
     /** Messages dropped from THIS request view. */
     dropped: number;
     ts: number;
+} | {
+    /** design/374 (G11) — the microCompact clearing machine FIRED: `clearedCount` tool-result
+     *  occurrences were replaced with markers in one pass. `trigger` names the arm: `"frontier"`
+     *  = the proactive request-build pass (anchored estimate crossed the edit budget),
+     *  `"refusal"` = the MC-R rejection-recovery arm (provider said input-too-long), `"blocking"`
+     *  = the slice-3 pre-guard arm (reserved; not emitted before slice 3). SCOPE (X1): emitted
+     *  only when the design/374 machinery is enabled — the `"frontier"` arm requires
+     *  `microCompact.machine: "cc"`, the `"refusal"` arm requires `microCompact.clearOnRejection`;
+     *  the legacy DEFAULT machine clears silently exactly as pre-374 (its clears are ledger-less
+     *  and re-fire per request, so a frame there would re-count the same occurrences and break
+     *  this frame's cardinality clause). Cardinality: exactly ONE frame per firing pass — a retry
+     *  chain re-sending an already-cleared view emits none. A `"refusal"` frame also marks one
+     *  attempt of the shared prompt-too-long recovery budget spent (the MC-R arm's retry rides
+     *  the same per-chain account the forced-compaction arm draws on — the knob doc on
+     *  `RunnerDeps.microCompact` carries the full accounting). */
+    kind: "context.mc_clear";
+    version: 1;
+    taskId: string;
+    clearedCount: number;
+    /** The pass's structural savings estimate (the ≥20k gate's own number). */
+    tokensSavedEstimate: number;
+    trigger: "frontier" | "refusal" | "blocking";
+    ts: number;
+} | {
+    /** design/374 (G11) — the MC-R rejection arm ran and DECLINED to clear: `reason` says why
+     *  (`"no_candidates"` = nothing clearable beyond the keep window on the rejected projection;
+     *  `"below_min_savings"` = clearable but under the 20k gate), `nextArm` names where the
+     *  recovery chain goes instead (`"forced_compaction"` when the compaction arm is available,
+     *  `"none"` when it is disabled/tripped — the turn will surface the provider error). Emitted
+     *  only on the refusal arm; the frontier pass declines silently every request by design. */
+    kind: "context.mc_null";
+    version: 1;
+    taskId: string;
+    reason: "no_candidates" | "below_min_savings";
+    nextArm: "forced_compaction" | "none";
+    ts: number;
 } | {
     /** C8 — the per-turn aggregate tool-result budget capped a result (offloaded to the store, or
      *  degraded to a self-contained truncation preview when the store failed/absent). */

package/dist/core/types.d.ts

@@ -353,7 +353,14 @@ export interface ToolSpec<TParams extends TSchema = TSchema> {
      *  - `"local"` — purely local reads/computation.
      * Classification is single-sourced with the tool definition: core built-ins declare theirs here;
      * a HOST tool that omits it is classified fail-closed as `"external"` (unknown = external) unless
-     * the deployment exempts the name via `TaskSpec.memory.trustedTools`.
+     * the deployment exempts the name via `TaskSpec.memory.trustedTools`. A declaration BEATS that
+     * allowlist (the allowlist is the channel for UNDECLARED tools, never a lever to re-grade a tool
+     * that classified itself), and only a member of the closed vocabulary counts as one — an unreadable
+     * value classifies `"external"` rather than exempting anything.
+     *
+     * Tools core mints on the deployment's behalf get the same seat one level up: an MCP server's whole
+     * tool set is declared at its entry ({@link McpServerSpec.contentOrigin}, design/378), because the
+     * host never touches those tool objects.
      */
     contentOrigin?: ToolContentOrigin;
     /**
@@ -1299,7 +1306,11 @@ export interface McpServerSpec {
          */
         principalHeader?: string;
     };
-    /** Optional allowlist of tool names to expose (others are dropped). */
+    /** Optional allowlist of tool names to expose (others are dropped). ORTHOGONAL to
+     *  {@link contentOrigin} and usefully paired with it (design/378 §2): the class declaration follows
+     *  the server's roster, so a high-assurance deployment that wants a CLOSED tool set writes both —
+     *  a tool a later refresh adds then lands outside this list and is simply not mounted. Existing
+     *  semantics, no new mechanism; the refresh receipt still names every added tool either way. */
     allowTools?: string[];
     /**
      * design/99 §E23 — opt in to INBOUND elicitation for THIS server: when `true` AND a {@link RunnerDeps.onElicit}
@@ -1316,12 +1327,66 @@ export interface McpServerSpec {
      * override is AUTHORITATIVE and may LOWER an effect (vouch a tool is `read`/`idempotent`) as well as raise it
      * (`egress` / irreversible). This is the ONLY trusted way to drop an MCP tool below the fail-closed `write`
      * default (design F). Folds over the server hints in prepare-task (caller > server hint > fail-closed write).
+     *
+     * A DIFFERENT AXIS from {@link contentOrigin}: this one is about what a call DOES (repeat-safety,
+     * blast radius, reversibility — it feeds the approval gate); the content class is about what a call
+     * BRINGS BACK (memory-write governance, no gate/policy/roster effect). Neither implies the other —
+     * a read-only tool can return third-party text, and a deployment's own writer brings back nothing
+     * external — so vouching on one axis never quietly vouches on the other.
      */
     toolAxes?: Record<string, {
         effect?: ToolEffect;
         egress?: boolean;
         irreversibility?: "always" | "never";
     }>;
+    /**
+     * design/378 — declare {@link ToolSpec.contentOrigin} on behalf of THIS SERVER'S ENTIRE TOOL SET
+     * (tools a mid-task refresh adds included), with the same authority and the same responsibility a
+     * directly-mounted host tool's own declaration carries.
+     *
+     * WHY THE SEAT EXISTS. Without it the class keys on the MOUNT SHAPE rather than on lineage: a tool
+     * the deployment wrote and runs itself is structurally `"external"` the moment it arrives over the
+     * MCP protocol namespace, so every call marks the session's memory externally exposed. The
+     * per-name channels cannot express the fact either — {@link import("./memory.js").MemorySpecInput.trustedTools}
+     * is a per-REQUEST allowlist keyed on the MINTED name (the host would have to predict the charset
+     * normalization) whose own definition is "the exception channel for UNDECLARED tools", and it says
+     * nothing about tools the server adds later.
+     *
+     * THIS IS A TRUST DECLARATION, not a routing hint. Use it only for servers inside the deployment's
+     * trust boundary — a process, socket or service the deployment itself runs. Declaring a THIRD-PARTY
+     * server means treating its output as content the deployment wrote: the class names are
+     * BOUNDARY-relative, never topological, so neither the transport kind nor the address is evidence
+     * of lineage (a stdio child can be an untrusted package; a loopback URL can be your own service) and
+     * core deliberately does not gate on either. The declaration covers THE PEER THIS ENTRY CONNECTS TO
+     * — authenticating that peer (socket permissions, credentials) is the host's mounting duty.
+     *
+     * SEMANTICS. `"local"` ⇒ invocations no longer mark this session's memory; `"execution"` ⇒ the same,
+     * except that {@link import("./memory.js").MemorySpecInput.execIsExternalContent} can still upgrade
+     * the class for a strict deployment (which is why this seat takes the three-value vocabulary and not
+     * a single "mine" flag — an execution-shaped tool mounted over MCP must stay inside that knob's
+     * reach); `"external"` is an explicit PIN, and pins are not no-ops — a declaration beats the
+     * `trustedTools` allowlist, so writing it forecloses the per-name exemption for this server's tools.
+     * ABSENT ⇒ the pre-378 behavior byte for byte: the protocol namespace classifies the tools
+     * `"external"` (fail-closed). A value outside the vocabulary is refused at the preparation door
+     * (`config.mcp_content_class`), never folded to a class.
+     *
+     * COVERAGE, stated honestly: the class rides this server's own mounted tools. The cross-server
+     * resource faces (ListMcpResourcesTool / ReadMcpResourceTool / ReadMcpResourceDirTool) aggregate
+     * over every connected server in one call, so they stay `"external"` and still mark — over-marking,
+     * the safe direction. A delegated child's pool is a separate static declaration surface
+     * ({@link ToolSpec.agentToolPool} entries carry their own `contentOrigin`): a deployment handing
+     * this server's tools to children mirrors the value there, and not mirroring it over-marks.
+     *
+     * TRUST SOURCE — a DEPLOYMENT-plane key. It redefines where the trust boundary runs, which puts it
+     * on the same authority plane as {@link RunnerDeps} wiring, not on the request plane. Core sees one
+     * `TaskSpec` and cannot tell a deployment-baseline entry from one a request supplied, so any
+     * assembly layer that accepts REQUEST-side MCP entries must reject or strip this key from them:
+     * "allowed to mount a server" is not "allowed to redefine the deployment's trust boundary", and a
+     * caller-supplied `"local"` would otherwise be self-authorization around the session mark. A
+     * single-tenant superuser surface (a host reading its own `--mcp-config` file) IS the deployment
+     * plane and needs no such gate.
+     */
+    contentOrigin?: ToolContentOrigin;
 }
 /**
  * Definition of one A2A (agent-to-agent protocol) PEER to talk to for the duration of one task.
@@ -4830,6 +4895,11 @@ export interface ProjectMemoryLoad {
  */
 export interface EngineNotice {
     /** Stable machine-readable family, dot-namespaced. Current families:
+     *  - `"config.autocompact_window_clamped"` (design/374 slice 1b) — a model declared
+     *    `autoCompactTokens` ABOVE its physical window; the trigger-side geometry was clamped to the
+     *    physical window (an autocompact window only ever lowers the trigger) and the bad value is
+     *    announced once per prepared task; `detail: { modelId, declaredAutoCompactTokens,
+     *    physicalWindow, sessionId }`.
      *  - `"config.env_timeout_discarded"` — a Bash timeout knob (option or env) held a value that is not
      *    the value in force; `detail: { knob, raw, usedMs }`.
      *  - `"config.materialize_env_discarded"` — `SEMA_TOOL_MATERIALIZE_STRATEGY` held a value outside the
@@ -4997,6 +5067,27 @@ export interface EngineNotice {
      *    `detail: { reason, subagentType?, sessionId? }` — `reason` is the same sentence the waived
      *    mark would have carried, neutralized/length-bounded (tool and agent-type names are
      *    host/model-controlled inputs).
+     *  - `"memory.content_class_declared"` (design/378) — an `McpServerSpec` entry carries an explicit
+     *    {@link McpServerSpec.contentOrigin}: the deployment declared this server's whole tool set to
+     *    be inside (or explicitly outside) its trust boundary, so the protocol namespace's structural
+     *    `"external"` no longer decides. The AUDIT line for a trust boundary an operator drew by
+     *    configuration — which is why it announces on the explicit `"external"` value too: pinning is
+     *    not a no-op (a declaration beats the `trustedTools` allowlist, so it forecloses the per-name
+     *    exemption for this server's tools). One line per DECLARED ENTRY per prepared task leg, minted
+     *    once at preparation and never per call (the declaration's whole effect is that calls stop
+     *    marking; narrating each call would trade the saved mark for equal noise). Armed on the SAME
+     *    condition as the classification it talks about — a leg with no engine-memory session and no
+     *    provenance recorder classifies nothing, so there is no posture to report and no line is
+     *    minted. `detail: { server,
+     *    contentOrigin, toolCount, execIsExternalContent?, sessionId? }` — `server` is the
+     *    host-authored entry name, neutralized/length-bounded; `toolCount` is what this entry actually
+     *    mounted (0 for a server that failed to connect — the declaration still stands and is still
+     *    disclosed); `execIsExternalContent` rides the `"execution"` value only and reports the strict
+     *    knob AS RESOLVED FOR THIS RUN, because that arm's posture depends on it. The message's closing
+     *    clause is written per value so it can never describe a posture the run does not have. The
+     *    entry's TRANSPORT is deliberately absent: it is a claim about a mutable host-owned object made
+     *    long after the dial, and D-10 already rules topology is not evidence of the lineage this line
+     *    audits — connection facts live on `MaterializedMcp.statuses` instead.
      *
      *  - `"memory.consolidation_incomplete"` (design/376, LLM consolidation driver) — a driver run
      *    settled without reaching the fixpoint: `detail` names the stop reason (the closed
@@ -6070,6 +6161,40 @@ export interface RunnerDeps {
      * ~20000; set `0` or `Infinity` to disable offloading. Per-tool override via `ToolSpec.offloadThresholdChars`.
      */
     toolResultThresholdChars?: number;
+    /**
+     * design/374 — microCompact machine-alignment knobs (EXPERIMENTAL until the slice-3 default
+     * flip; both default OFF so a deployment that never touches this bag runs the pre-374 machine
+     * byte for byte).
+     *
+     *  - `machine`: which stale-tool-result clearing machine the request pipeline runs —
+     *    `"legacy"` (default; the historical keep-3 / clear-to-budget machine) or `"cc"` (the CC
+     *    2.1.223 rejection-leg form: keep 5, ≥20k minimum-savings gate, one deep clear beyond the
+     *    keep window, CC marker bytes). ⚠️ Read the P-form warning on
+     *    {@link import("./context-edit.js").ContextEditMachine} before selecting `"cc"`: until the
+     *    slice-3 fallback re-ordering ships, the 20k gate sits in front of the only reduction while
+     *    the message-dropping guard trim still backstops — opting in is accepting that trade.
+     *  - `clearOnRejection` (MC-R, slice 2): on a provider input-too-long rejection, run ONE cheap
+     *    deterministic clear over the rejected projection (same cc machine, savings ≥20k or nothing)
+     *    and retry inside the turn BEFORE the forced-compaction recovery. Default false (X2: the
+     *    machinery lands dark; the default flips together with the machine in slice 3). Independent
+     *    of `machine` — an enabled MC-R always clears in the cc form (the rejection arm has no
+     *    budget coordinate for the legacy incremental form to stop at). BUDGET ACCOUNTING (design/374
+     *    §3.2.1, stated here because it is otherwise invisible to a deployment): a successful MC-R
+     *    clear-and-retry SPENDS one attempt of the shared prompt-too-long recovery budget (default 2
+     *    attempts per chain), so a chain that clears and is rejected AGAIN has one forced-compaction
+     *    attempt left where the knob-off chain nominally had two — the trade costs no effective
+     *    compaction pass, because the second forced-compaction call of the off chain is structurally
+     *    a no-op whenever the first one landed (the branch leaf is already a compaction entry).
+     *
+     *  A declaration outside the closed vocabulary (a `machine` string not in the union, a
+     *  non-boolean `clearOnRejection` — JSON/env-derived config the type cannot guard) refuses the
+     *  whole prepare loudly (`code: "config.microcompact_invalid"`, no silent re-default): folding it
+     *  would run the pre-374 machine while the deployment believes it opted in.
+     */
+    microCompact?: {
+        machine?: "legacy" | "cc";
+        clearOnRejection?: boolean;
+    };
     /**
      * Two-phase prefix-cache-break detection (design/31): per turn, fingerprint the prefix and, on a
      * confirmed `cacheRead` drop, emit a root-cause finding via `onError(phase:"prompt-cache")`. Cheap