@sema-agent/core 5.59.0 → 5.60.1

package/dist/core/checkpoint-store.js

@@ -1,6 +1,8 @@
 import { randomBytes, randomUUID } from "node:crypto";
 import { uuidv7 } from "../internal/harness.js";
-import { inlineUntrusted, sanitizeUntrustedText } from "./untrusted-text.js";
+import { PROBE_CAUSE_PATH_MAX, inlineUntrusted, sanitizeUntrustedText } from "./untrusted-text.js";
+import { carriesBidiControls } from "./tool-policy.js";
+import { renderUntrustedCommandText } from "./permission-rule-model.js";
 import { ASK_USER_QUESTION_TOOL_NAME } from "./ask-question.js";
 export function mintCheckpointToken() {
     return randomBytes(16).toString("hex");
@@ -9,7 +11,6 @@ export function mintCheckpointId() {
     return `cp_${randomUUID()}`;
 }
 export const PROBE_REASON_MAX = 200;
-export const PROBE_CAUSE_PATH_MAX = 200;
 const PROBE_CAUSE_MAX_SHOWN = 8;
 export function normalizeProbeCause(value) {
     if (!isPlainRecord(value))
@@ -62,6 +63,8 @@ const MAX_TOUCHED_PATHS = 8;
 const MAX_DIGEST_KEYS = 16;
 const MAX_DIGEST_SCAN_KEYS = 256;
 export const MAX_TOOL_INPUT_PREVIEW_CHARS = 512;
+const BIDI_BACKFILL_MAX_CHARS = 32_000;
+const BIDI_BACKFILL_MAX_NODES = 512;
 export const MAX_PENDING_STEER_CHARS = 16_000;
 export const PENDING_STEER_QUEUE_BYTE_BUDGET_BYTES = 48_000;
 export const MAX_PENDING_STEER_ENTRIES = Math.floor(PENDING_STEER_QUEUE_BYTE_BUDGET_BYTES / MAX_PENDING_STEER_CHARS);
@@ -121,7 +124,7 @@ export function buildRiskDescriptor(input) {
         if (shell || toolName === "Bash") {
             const cmd = isPlainRecord(args) ? safeDataValue(args, "command") : undefined;
             if (typeof cmd === "string" && cmd.length > 0)
-                summary = inlineUntrusted(cmd, SUMMARY_CMD_MAX);
+                summary = renderUntrustedCommandText(cmd, SUMMARY_CMD_MAX);
             const bg = isPlainRecord(args) ? safeDataValue(args, "run_in_background") : undefined;
             if (bg === true)
                 summary = `[background persistent process — no per-step recheck] ${summary ?? ""}`.trimEnd();
@@ -135,20 +138,20 @@ export function buildRiskDescriptor(input) {
                     const v = safeDataValue(args, key);
                     if (typeof v === "string" || typeof v === "number" || typeof v === "boolean") {
                         const encDigest = (s) => s.replace(/%/g, "%25").replace(/=/g, "%3D").replace(/ /g, "%20");
-                        const k = encDigest(inlineUntrusted(key, 40));
-                        const val = encDigest(inlineUntrusted(String(v), SUMMARY_VALUE_MAX));
+                        const k = encDigest(renderUntrustedCommandText(key, 40));
+                        const val = encDigest(renderUntrustedCommandText(String(v), SUMMARY_VALUE_MAX));
                         parts.push(`${k}=${val}`);
                     }
                 }
                 if (parts.length > 0)
-                    summary = inlineUntrusted(parts.join(" "), SUMMARY_TOTAL_MAX);
+                    summary = renderUntrustedCommandText(parts.join(" "), SUMMARY_TOTAL_MAX);
             }
         }
         const touched = [];
         if (!shell && toolName !== "Bash") {
             const p = fsPathArg(args);
             if (p !== undefined)
-                touched.push(inlineUntrusted(p, PATH_MAX));
+                touched.push(renderUntrustedCommandText(p, PATH_MAX));
         }
         const touchedPaths = touched.length > 0 ? touched.slice(0, MAX_TOUCHED_PATHS) : undefined;
         return {
@@ -156,7 +159,7 @@ export function buildRiskDescriptor(input) {
             axes,
             toolName,
             ...(input.shellGated && input.shellGateDoctrine !== undefined ? { shellGateDoctrine: input.shellGateDoctrine } : {}),
-            ...(input.shadowedRule !== undefined ? { shadowedRule: inlineUntrusted(input.shadowedRule, 200) } : {}),
+            ...(input.shadowedRule !== undefined ? { shadowedRule: renderUntrustedCommandText(input.shadowedRule, 200) } : {}),
             ...(input.probeReason !== undefined ? { probeReason: inlineUntrusted(input.probeReason, PROBE_REASON_MAX) } : {}),
             ...(() => {
                 if (input.probeCause === undefined)
@@ -235,6 +238,9 @@ export function summarizeCheckpoint(cp) {
             toolInput = undefined;
         }
     }
+    const hasBidi = tool !== undefined &&
+        (tool.hasBidiControls === true ||
+            carriesBidiControls([toolInput, tool.preview], { maxNodes: BIDI_BACKFILL_MAX_NODES, maxChars: BIDI_BACKFILL_MAX_CHARS }));
     return {
         token: cp.token,
         ...(cp.checkpointId !== undefined ? { checkpointId: cp.checkpointId } : {}),
@@ -254,6 +260,7 @@ export function summarizeCheckpoint(cp) {
             ? { restoreMode: cp.state.workspaceHandle.restoreMode === "park_only" ? "park_only" : "snapshot" }
             : {}),
         ...(tool?.preview !== undefined ? { preview: tool.preview } : {}),
+        ...(hasBidi ? { hasBidiControls: true } : {}),
     };
 }
 export class CheckpointError extends Error {

package/dist/core/context-edit.d.ts

@@ -48,6 +48,53 @@ export declare const COMPACTION_TRIGGER_BUFFER_TOKENS = 13000;
  * and the fixed deduction strictly wins from W = 110001 up.
  */
 export declare function contextEditFrontier(window: number): number;
+/**
+ * design/374 — which CLEARING MACHINE `clearStaleToolResults` runs.
+ *
+ *  - `"legacy"` (default): the historical sema machine — keep 3, no minimum-savings gate,
+ *    incremental oldest-first clearing that STOPS once the budget is met, legacy marker bytes.
+ *  - `"cc"`: the CC 2.1.223 `yId` machine — keep 5, a ≥20000-token minimum-savings gate (below it
+ *    the pass is byte-identical no-op), ONE deep clear of everything beyond the keep window, the
+ *    window base counts already-cleared/offloaded occurrences (they hold their keep slots), and
+ *    CC's plain marker bytes.
+ *
+ * ⚠️ P-FORM WARNING (design/374 r2-B⑨, constraint C-5): until the slice-3 fallback re-ordering
+ * ships (blocking-point machine re-run → in-turn forced compaction → trim demoted to last resort),
+ * selecting `"cc"` here puts the 20k gate IN FRONT of the only reduction between the frontier and
+ * the guard trim while the OLD guard-trim backstop still drops messages: a pass that now correctly
+ * refuses an under-20k clear hands the request straight to the message-dropping trim — WORSE than
+ * the legacy default in that band. Opt in before slice 3 only if you accept that trade (e.g. to
+ * exercise the machine); the default flip to `"cc"` ships together with the re-ordered backstops.
+ */
+export type ContextEditMachine = "legacy" | "cc";
+/**
+ * How many most-recent CANDIDATE tool results keep their content when the stale-result pass runs —
+ * per machine (design/374: the two values govern DIFFERENT machines, so they are separate
+ * constants, not one adjudicated number):
+ *
+ *  - LEGACY machine: 3. The measured objection to 5 stands FOR THIS MACHINE (probed on a 200k model,
+ *    140k usage anchor, five 36k-char Bash results: at 3 the pass clears two and lands under the
+ *    177k guard; at 5 nothing is clearable and the guard trim cannot recover the batch either) —
+ *    on the legacy machine the keep window is the only lever between the frontier and the
+ *    message-dropping trim, so widening it disables the whole defense in exactly the terminal-batch
+ *    shape that needs it.
+ *  - CC machine: 5 (2.1.223 `uAp`; same value on CC 88's `timeBasedMCConfig` — stable across both
+ *    corpus generations). The #384 adjudication adopted 5 CONDITIONAL on the whole machine coming
+ *    with it (20k gate + deep clear + re-ordered backstops); the cc machine is that condition's
+ *    carrier, and the 200k probe above stops being an objection there (§3.5: the gate correctly
+ *    refuses the no-win clear and the recovery chain owns the request instead).
+ */
+export declare const DEFAULT_KEEP_RECENT_TOOL_RESULTS = 3;
+export declare const CC_DEFAULT_KEEP_RECENT_TOOL_RESULTS = 5;
+/** design/374 §3.1 — CC's minimum-savings gate (`vUs` :397773): the cc machine refuses to clear at
+ *  all unless the structural estimate of what WOULD be cleared reaches this many tokens. Rationale
+ *  (independent of "CC does it"): every clear breaks the provider prefix cache once, so a clear that
+ *  saves less than the re-prefill it causes is a net loss; the gate prices that trade. The LEGACY
+ *  machine has no such gate (1 token over budget clears) — that difference is machine-defining. */
+export declare const MIN_CLEAR_SAVINGS_TOKENS = 20000;
+/** Minimum kept results — CC `EUs` :397710 `Math.max(1, keepRecent)`. See
+ *  {@link ContextEditOptions.keepRecentToolResults} for why both degenerate ends are unusable. */
+export declare const MIN_KEEP_RECENT_TOOL_RESULTS = 1;
 /**
  * checklist #54 (CC microCompact.ts:41-50 `COMPACTABLE_TOOLS` parity): the INCLUSION whitelist of
  * tools whose results may be content-cleared by the stale-result pass. CC's set is exactly
@@ -58,43 +105,43 @@ export declare function contextEditFrontier(window: number): number;
  * PowerShell is kept for CC fidelity even though sema does not mount it. Overridable per call via
  * {@link ContextEditOptions.compactableTools} for custom-tool-heavy embedders.
  */
-/**
- * How many most-recent CANDIDATE tool results keep their content when the stale-result pass runs.
- *
- * 3, UNCHANGED — and the fact that CC's corresponding number is 5 (2.1.223 `uAp`, and the same value
- * on CC 88's `timeBasedMCConfig`, so it is stable across both corpus generations) is deliberately NOT
- * adopted here. Two reasons, in order of weight:
- *
- *  1. MEASURED: widening the window removes this pass's only lever in the shape where a terminal
- *     parallel batch holds exactly as many large results as the window keeps. Probed on a 200k model
- *     with a 140k usage anchor and five 36k-char Bash results: at 3 the pass clears two and the
- *     request lands at ~167k, UNDER the 177k request guard; at 5 nothing is clearable, the request
- *     stays at 185k, and the guard cannot recover it either — `trimToBudget` must turn-align back to
- *     the emitting assistant, so the whole batch is retained. The window is count-based on both
- *     sides (CC's `slice(-keepRecent)` too), so this ceiling exists at every value; 5 simply widens
- *     the band that reaches it.
- *  2. SEAT: the two numbers do not govern the same machine. CC's keep-recent clear runs ONLY on the
- *     `context_hint` rejection leg — gated off by default — and behind a hard "saves ≥ 20000 tokens
- *     or don't bother" test, with request REFUSAL as the real backstop. Ours is on by default, is
- *     the only reduction between the frontier and the guard, and its backstop drops messages instead
- *     of refusing. Copying a constant across that difference is the "same name, different question"
- *     mistake, not parity.
- *
- * So the VALUE is an open adjudication (recorded with the probe above), while the two things CC
- * unambiguously answers — the floor and the candidate-scoped window — are followed exactly.
- */
-export declare const DEFAULT_KEEP_RECENT_TOOL_RESULTS = 3;
-/** Minimum kept results — CC `EUs` :397710 `Math.max(1, keepRecent)`. See
- *  {@link ContextEditOptions.keepRecentToolResults} for why both degenerate ends are unusable. */
-export declare const MIN_KEEP_RECENT_TOOL_RESULTS = 1;
 export declare const COMPACTABLE_TOOLS: ReadonlySet<string>;
 export interface ContextEditOptions {
     /** Start clearing once estimated context tokens exceed this. */
     budgetTokens: number;
+    /**
+     * design/374 — which clearing machine runs; see {@link ContextEditMachine} (including its P-form
+     * warning about enabling `"cc"` before the slice-3 backstop re-ordering). Default `"legacy"`:
+     * the pre-374 machine, byte-identical.
+     */
+    machine?: ContextEditMachine;
+    /**
+     * Mixed-configuration protection (design/374 r2-Md⑪ family): make the LEGACY machine recognize
+     * the CC marker forms as already-cleared, so a ledger-replayed CC marker is never re-cleared
+     * into a legacy marker (destroying its ref/media disclosure). Wired by the pipeline whenever a
+     * cc-minting knob is on (machine "cc" — where it is implied — or the rejection-recovery arm over
+     * a legacy frontier machine). Default false: in a pure default deployment tool output that
+     * merely SPELLS the CC marker is untrusted bytes and stays clearable exactly as before.
+     */
+    recognizeCcMarkers?: boolean;
+    /**
+     * Fired AT MOST ONCE per pass, only when the pass cleared at least one result: the cleared
+     * indexes (into the returned array) and the pass's savings estimate (cc machine: the structural
+     * minimum-savings estimate it gated on; legacy machine: the accounted structural delta). The
+     * request-projection ledger (design/374 §3.2.6) records cleared occurrences through this seat —
+     * observation only, a throwing callback is swallowed and never fails the request build.
+     */
+    onCleared?: (pass: {
+        clears: ReadonlyArray<{
+            index: number;
+        }>;
+        tokensSavedEstimate: number;
+    }) => void;
     /**
      * Always keep the content of this many most-recent CANDIDATE tool results (candidates = results
-     * from {@link compactableTools}). Default {@link DEFAULT_KEEP_RECENT_TOOL_RESULTS} = 3 — see that
-     * constant for why CC's 5 is not adopted here.
+     * from {@link compactableTools}). Default: the selected machine's own default —
+     * {@link DEFAULT_KEEP_RECENT_TOOL_RESULTS} = 3 (legacy) / {@link CC_DEFAULT_KEEP_RECENT_TOOL_RESULTS}
+     * = 5 (cc); see those constants for why the two machines carry different numbers.
      *
      * Floored at 1, which IS CC's rule (`EUs` `Math.max(1, keepRecent)`), whose own source note gives
      * the reason: 0 leaves the model with zero working tool context, and in CC's `slice(-0)` spelling
@@ -139,16 +186,20 @@ export interface ContextEditOptions {
      * registry state are compaction's job, not a blanking marker's.
      */
     compactableTools?: ReadonlySet<string>;
+    /**
+     * design/374 (RB-212 durable half): the PRE-CAP counterpart array of `messages`, position-aligned
+     * (the pipeline's aggregate caps replace in place, never drop). When present, the CC machine
+     * composes each clear's marker + offload text from `clearSource[idx]` — the same occurrence
+     * bytes the cleared-projection ledger repaints the marker onto at the next session rebuild — so
+     * the durable marker discloses the occurrence's REAL media and the page-back ref resolves to its
+     * real text rather than to a cap-stripped copy. Ignored by the legacy machine (its clears are
+     * request-local and correctly describe the projection they were handed — default bytes do not
+     * move). An entry that is not a tool result, or that carries a different `toolCallId` than the
+     * target, is ignored per index (composition falls back to the projection copy — a misaligned
+     * source must never mis-attribute content).
+     */
+    clearSource?: ReadonlyArray<AgentMessage>;
 }
-/**
- * Context-editing (the lightest, safest compaction; Anthropic reports ~29% improvement alone):
- * when context exceeds the budget, replace the CONTENT of older tool-result messages with a short
- * marker, keeping the turn structure (tool_call/tool_result pairing) intact. The most recent
- * `keepRecentToolResults` results are preserved.
- *
- * Request-only and non-destructive: returns a new array; the durable session keeps the full results.
- * Older results are cleared first, stopping as soon as the budget is met.
- */
 /**
  * audit A-1 (view-level heal for HISTORICAL pollution): drop synthetic EMPTY failure assistants —
  * stopReason aborted/error with no tool calls and no non-whitespace text/thinking. Sessions persisted
@@ -159,10 +210,161 @@ export interface ContextEditOptions {
  * New sessions never contain these (the loop exits cleanly on abort; the harness skips persisting them).
  */
 export declare function dropEmptyFailureAssistants(messages: AgentMessage[]): AgentMessage[];
+/**
+ * Context-editing — the lightest, safest reduction: when context exceeds the budget, replace the
+ * CONTENT of older tool-result messages with a short marker, keeping the turn structure
+ * (tool_call/tool_result pairing) intact; the most recent `keepRecentToolResults` CANDIDATE
+ * results keep their content. Request-only and non-destructive: returns a new array, the durable
+ * session keeps the full results (the request-projection ledger, not this function, is what makes
+ * a clear DECISION durable across requests — see `replayClearedProjection`).
+ *
+ * ANCHOR (design/374 片4 re-anchoring): this proactive frontier hook is the client-side form of
+ * Anthropic's PLATFORM context-management policy (`clear_tool_uses_20250919` — same
+ * trigger/keep/clear-at-least construction), NOT a CC-CLI parity claim: CC 2.1.x's client
+ * keep-recent clear lives exclusively on its `context_hint` REJECTION leg (default-gated off), a
+ * machine whose sema form is the MC-R arm (`planRejectionClears` + the runner's recovery chain).
+ * The per-mechanism CC anchors that DO hold (the COMPACTABLE_TOOLS set, the candidate-scoped keep
+ * window, the floor, and the whole `machine: "cc"` clearing form) are cited at their sites.
+ * (An earlier note here cited an unverified "~29% improvement" figure — removed: no first-party
+ * source in the corpus; the machine's case rests on the measured mechanics, not that number.)
+ *
+ * Clear ORDER is machine-dependent: legacy clears oldest-first and stops at the budget; the cc
+ * machine deep-clears everything beyond the keep window behind the ≥20k gate (see
+ * {@link ContextEditMachine}).
+ */
 export declare function clearStaleToolResults(messages: AgentMessage[], opts: ContextEditOptions): AgentMessage[];
+/** design/374 slice 1b (X5) — the resolved trigger-side window and whether the clamp repaired it. */
+export interface TriggerWindowResolution {
+    /** The effective trigger-side window: `autoCompactTokens ?? contextTokens ?? contextWindow`,
+     *  CLAMPED to the physical window when the declared autocompact window exceeds it. */
+    window: number;
+    /** True = the declared `autoCompactTokens` was ABOVE the physical window and got clamped down —
+     *  a bad deployment value the caller should announce loudly (坏值响亮度默认律). */
+    clamped: boolean;
+    /** Present on the clamped arm: the declared (refused) value and the physical window it was
+     *  clamped to, for the announcement text. */
+    declaredAutoCompactTokens?: number;
+    physicalWindow?: number;
+}
+/**
+ * design/374 slice 1b (X5, r2-M⑤) — SINGLE SOURCE for the trigger-side window chain
+ * (`autoCompactTokens ?? contextTokens ?? contextWindow`), now with the inversion clamp:
+ * `autoCompactTokens` is a TRIGGER-side lowering knob (dual-window semantics — the guard trim and
+ * physical request budgeting stay on `contextTokens ?? contextWindow`), so a declared value ABOVE
+ * the physical window inverts the whole geometry: the frontier (W−33000 of the declared window)
+ * lands HIGHER than the guard (physical−23000), every "the frontier machine runs first, the guard
+ * only backstops" argument silently reverses (967k declared vs 177k physical is the recorded
+ * counterexample), and the misconfiguration announces nothing. Clamp = `min(declared, physical)`,
+ * reported via `clamped` so the ONE announce point (prepare) can be loud about it. Every consumer
+ * of the chain (editBudget here / maybeCompact's window derivation / the compaction-window-hazard
+ * estimate / runtask's prefix-overhead disclosure) reads THIS helper — a fifth copy of the `??`
+ * chain is the drift this function exists to end. Non-finite/≤0 declared values keep their historic
+ * meaning (each consumer's own unknown-window sentinel), deliberately untouched here.
+ */
+export declare function resolveTriggerWindow(model: Model): TriggerWindowResolution;
 /** The token budget at which context-editing begins for a model (below the harder guard trim).
  *  = {@link contextEditFrontier} of the model's AUTOCOMPACT window (CC-parity fixed deduction with
  *  a 0.7 small-window floor) — the same point the compaction threshold is clamped to. Dual-window
  *  semantics: `autoCompactTokens` (when declared) feeds this trigger-side geometry only; the guard
- *  trim (`guardBudget`) stays on the physical window. */
+ *  trim (`guardBudget`) stays on the physical window — which is why the window is read through
+ *  {@link resolveTriggerWindow}: an autocompact window declared ABOVE the physical one would put
+ *  this frontier above the guard (inverted geometry), so it is clamped there (slice 1b, X5). */
 export declare function editBudget(model: Model): number;
+/** Content fingerprint of an occurrence — a sha-256 digest over the FULL canonical content form
+ *  (per block: type + complete text bytes, and for non-text blocks the mime type + payload length
+ *  + a payload head), replay's mis-paint guard (adversarial rounds 1+2): ordinal mapping alone
+ *  cannot see an equal-size cut-and-append churn inside a same-(id,timestamp) group — the mapped
+ *  slot may hold a DIFFERENT occurrence, and painting it would clear content that was never
+ *  cleared. r2 rejected the first cut's {chars, head-64} pair (same-prefix/same-length tails and
+ *  media-only churn collide); the digest covers whole text bytes and block structure. A non-marker
+ *  replay target must match or the entry prunes (full text returns — always the safe direction).
+ *  Content-identical occurrences remain indistinguishable by construction and paint harmlessly. */
+export type OccurrenceFingerprint = string;
+export declare function fingerprintToolResultOccurrence(m: AgentMessage): OccurrenceFingerprint;
+/** One recorded clear: the exact marker bytes to re-apply, the occurrence-group size at record
+ *  time (the shrink-mapping input — see the lifecycle note above), and the original content's
+ *  {@link OccurrenceFingerprint} (the mis-paint guard). */
+export interface ClearedOccurrence {
+    marker: string;
+    groupCount: number;
+    fp: OccurrenceFingerprint;
+}
+/** The per-task ledger. Keys are OPAQUE occurrence coordinates minted by
+ *  {@link replayClearedProjection} / {@link OccurrenceIndex} — derived per view, never persisted. */
+export interface ClearedProjectionLedger {
+    entries: Map<string, ClearedOccurrence>;
+}
+export declare function createClearedProjectionLedger(): ClearedProjectionLedger;
+/** One minted occurrence coordinate: the opaque ledger key, the group size at mint, the
+ *  INDEXED-view fingerprint, and (when the index can hand it back) the indexed-view occurrence
+ *  MESSAGE itself — the durable-composition seat (RB-212 durable half): a ledger-bound clear
+ *  composes its marker + offload text from this occurrence, never from a cap-transformed copy, so
+ *  the recorded marker discloses the occurrence's real media and the page-back ref resolves to its
+ *  real text (the same bytes the replay repaints the marker onto). */
+export interface OccurrenceKey {
+    key: string;
+    groupCount: number;
+    fp: OccurrenceFingerprint;
+    occurrence?: AgentMessage;
+}
+/** Occurrence coordinates for ONE request view (minted fresh per view — see the ledger note). */
+export interface OccurrenceIndex {
+    /** Key the tool-result occurrence at this index of the indexed array. `fp` is the occurrence's
+     *  fingerprint IN THE INDEXED (pre-cap) view — the same bytes the next session rebuild presents,
+     *  which is what the replay guard compares against (r2: fingerprinting the post-cap projection
+     *  instead made an MC-R clear of a cap-transformed result prune ITSELF on the retry build — an
+     *  advertised clear that never reached the wire). */
+    keyAt(index: number): OccurrenceKey | undefined;
+    /** Key a tool-result by OBJECT identity against the indexed view (the MC-R seat: the rejected
+     *  projection reuses the view's message objects for everything the caps did not replace); falls
+     *  back to the unambiguous single-member (id, timestamp) group for cap-replaced copies, and
+     *  answers undefined — "not clearable via the ledger" — for anything ambiguous. The returned
+     *  `fp` (and `occurrence`) are ALWAYS of the indexed-view occurrence (never of a cap-replaced
+     *  copy the caller holds). */
+    keyOf(m: AgentMessage): OccurrenceKey | undefined;
+}
+/** The MC-R planner's verdict — either the entries to record (with the pass's gated savings) or a
+ *  typed decline the caller reports on the `context.mc_null` observation face. */
+export type RejectionClearPlan = {
+    cleared: Array<{
+        key: string;
+        groupCount: number;
+        marker: string;
+        fp: OccurrenceFingerprint;
+    }>;
+    tokensSavedEstimate: number;
+} | {
+    declined: "no_candidates" | "below_min_savings";
+};
+/**
+ * design/374 §3.2 (slice 2) — plan the MC-R rejection clear over the REJECTED projection: the same
+ * cc machine (keep 5 default, window base counts cleared occurrences, five-form exclusion, Sby
+ * savings, ≥20k gate) with the TRIGGER replaced by the rejection itself — the provider already said
+ * the input does not fit, so there is no budget coordinate to compare against (which is also why an
+ * enabled MC-R always runs the cc form regardless of the frontier machine knob: the legacy
+ * incremental form is defined by "stop when the budget is met" and has no meaning here).
+ * `keyOf` threads occurrence identity (the ledger is the ONLY way a rejection-arm clear survives
+ * the session rebuild — §1.2's adoption chain discards the in-memory view); a candidate the index
+ * cannot key is skipped from BOTH the clear set and the savings (never promise savings the ledger
+ * cannot deliver). Marker composition (offload persist included) runs only on the accept path —
+ * a declined plan has zero side effects.
+ */
+export declare function planRejectionClears(messages: AgentMessage[], opts: {
+    keyOf: OccurrenceIndex["keyOf"];
+    offload?: ContextEditOptions["offload"];
+    compactableTools?: ReadonlySet<string>;
+    keepRecentToolResults?: number;
+}): RejectionClearPlan;
+/**
+ * Replay the ledger onto a freshly rebuilt request view (design/374 §3.2.6, r2-M⑩: positioned
+ * AFTER the heal, BEFORE the aggregate caps — so every estimator, cap and trigger downstream
+ * accounts the REPLAYED view, and a replayed marker never re-enters the cap store or re-emits a
+ * cap frame). Also the ledger's intersection point: entries that no longer resolve are pruned, and
+ * surviving entries are RE-KEYED to the current view's coordinates. Returns the SAME array instance
+ * when nothing changed (reference inequality is the pipeline's lossy-change signal), plus the
+ * view's occurrence index for the record/MC-R seats.
+ */
+export declare function replayClearedProjection(messages: AgentMessage[], ledger: ClearedProjectionLedger): {
+    messages: AgentMessage[];
+    index: OccurrenceIndex;
+};