@sema-agent/core 5.59.0 → 5.60.1

package/dist/core/memory-engine/engine.d.ts

@@ -406,12 +406,11 @@ export declare function memorySessionPollutedNotice(input: {
  * arithmetic would report a clean containment while a known failure sat in the report. Every
  * not-moved file does have an escalation row, so `escalated` is the superset and the honest clause.
  *
- * KNOWN GAP (adversarial-review round 1, P2 — registered, not closed here): the derived index is
- * contained by a different path (`restorePollutedIndex` captures and restores `MEMORY.md`) that mints
- * no rejection row, so a polluted session whose ONLY memory change was an index line produces no
- * `count` and no notice — its containment is disclosed by the harvest report's warnings alone. Closing
- * it needs a structured containment signal on `HarvestReport`, a public type this fix does not touch.
- * The wording therefore says "entry file(s)" rather than implying the whole containment.
+ * The derived index is contained by a different path (`restorePollutedIndex` captures and restores
+ * `MEMORY.md`) that mints no rejection row; that gap was CLOSED by the structured containment signal
+ * on `HarvestReport.containment` (indexRolledBack — see the containment block below), so an
+ * index-only polluted session now signals and notices instead of hiding in warnings prose. The
+ * wording says "entry file(s)" because index containment reports through its own signal.
  *
  * `reason` is optional because the mark record is read separately from the report: a record that cannot
  * be read must not turn a true "N files were withheld" into a lie about why.

package/dist/core/memory.d.ts

@@ -477,6 +477,16 @@ export interface NormalizedMemorySpec {
      * of the fail-closed `"external"` default. The explicit-config channel for a deployment whose custom
      * tools predate the {@link import("./types.js").ToolSpec.contentOrigin} declaration; it never
      * overrides a tool's OWN declaration. Normalized: trimmed, deduped, empties dropped.
+     *
+     * NOT the channel for MCP servers (design/378). A per-name entry here keys on the MINTED name — the
+     * host has to predict the namespacing and charset normalization — covers nothing a mid-task refresh
+     * adds, and says "exempt this undeclared tool" where the fact is "this whole server is mine".
+     * {@link import("./types.js").McpServerSpec.contentOrigin} states that fact at the entry, and being
+     * a DECLARATION it wins over this allowlist in both directions: a declared server's tools leave this
+     * list's reach entirely, an explicit `"external"` declaration included (that is the one way a
+     * deployment can pin a server's tools BEYOND this exemption). This list is not retired — it remains
+     * the in-register channel for undeclared HOST tools and for a deployment not ready to touch its
+     * server entries.
      */
     trustedTools?: string[];
     /**

package/dist/core/park-selfcheck.js

@@ -70,6 +70,7 @@ function syntheticCheckpoint(scope) {
             toolName: "SelfCheck",
             args: { probe: true, nested: { depth: 2, list: [1, 2, 3] } },
             boundInputHash: boundInputHashOf({ probe: true, nested: { depth: 2, list: [1, 2, 3] } }),
+            hasBidiControls: true,
             batchToolCallIds: [`${scope}:call`],
             completedCallIds: [],
         },

package/dist/core/permission-rule-consent.js

@@ -1,5 +1,5 @@
 import { randomBytes } from "node:crypto";
-import { hasUnrenderableCharacters, parseAllowRuleText, ruleAdmitsCommand, segmentCoverageOf, suggestRulesForCommand, } from "./permission-rule-model.js";
+import { escapeForDisclosure, hasUnrenderableCharacters, parseAllowRuleText, ruleAdmitsCommand, segmentCoverageOf, suggestRulesForCommand, } from "./permission-rule-model.js";
 import { errText, sameRuleOwner, sameScope, writerOf } from "./permission-rule-store.js";
 export class InMemoryRuleApprovalRecordStore {
     rows = new Map();
@@ -115,7 +115,7 @@ function approvalRecordDamageOf(rec) {
         const seen = new Set();
         for (const member of members) {
             if (!Number.isInteger(member) || member < 0 || rec.candidates[member] === undefined) {
-                return `offer ${at} references candidate ${member}, which the record does not carry`;
+                return `offer ${at} references candidate ${escapeForDisclosure(member)}, which the record does not carry`;
             }
             const cand = rec.candidates[member];
             if (typeof cand !== "object" || cand === null || typeof cand.rule !== "string") {
@@ -138,10 +138,14 @@ function approvalRecordDamageOf(rec) {
                 }
             }
             else if (offer.segments !== undefined || offer.uncoveredSegments !== undefined) {
-                return `${rec.kind} batch offer ${at} must not carry segment metadata — there is no compound command behind it`;
+                return `${escapeForDisclosure(rec.kind)} batch offer ${at} must not carry segment metadata — there is no compound command behind it`;
             }
         }
     }
+    for (const [at] of rec.candidates.entries()) {
+        if (!claimed.has(at))
+            return `candidate ${at} belongs to no offer — every candidate row is claimed by exactly one offer`;
+    }
     return undefined;
 }
 export function ruleOffersOfRecord(rec) {
@@ -325,7 +329,7 @@ function checkEditedRuleText(text, command) {
     if (!ruleAdmitsCommand(parsed.rule, command)) {
         return {
             ok: false,
-            message: `the edited rule "${parsed.rule.rule}" does not admit the command that was decided ("${command}") — a card's edit may widen how much the rule covers, never move it to a different grant`,
+            message: `the edited rule "${parsed.rule.rule}" does not admit the command that was decided ("${escapeForDisclosure(command)}") — a card's edit may widen how much the rule covers, never move it to a different grant`,
         };
     }
     return { ok: true, canonicalRule: parsed.rule.rule };
@@ -342,7 +346,7 @@ export function precheckEditedRuleText(text, command) {
         throw e;
     }
     if (hasUnrenderableCharacters(command)) {
-        const e = new Error("precheckEditedRuleText takes a command this lane can read — one carrying control or format characters is not a command any card was drawn for, and the refusal line naming it would carry those bytes onto a display surface");
+        const e = new Error("precheckEditedRuleText takes a command this lane can read — one carrying control or format characters is refused at this preflight face (likelier a caller wiring fault than a card's command; the in-engine confirmation arm still judges such a card, with the command escaped on its refusal line)");
         e.code = "config.invalid_argument";
         throw e;
     }

package/dist/core/runner/prepare-config-doors.d.ts

@@ -22,6 +22,7 @@
 import { type BrainCallGuardrailRef } from "../../brain/timeout.js";
 import type { Model } from "../../internal/llm.js";
 import type { ThinkingLevel } from "../../internal/harness.js";
+import type { ContextEditMachine } from "../context-edit.js";
 import { type LockedPreflight } from "../locked-config.js";
 import { type ResolvedRole } from "../roles.js";
 import type { SessionStore } from "../session.js";
@@ -119,6 +120,13 @@ export interface PrepareConfigDoorsResult {
     /** owned — the resolved interaction posture (spec > spawning run > deployment); the
      *  AskUserQuestion mount and the child-ctx injection read this same value. */
     resolvedInteractionPosture: "interactive" | "headless" | undefined;
+    /** owned — the validated/resolved microCompact knob (design/374; {@link resolveMicroCompactKnob}
+     *  for the door + placement reasoning). The per-run state builder consumes exactly these values —
+     *  the deps bag is never re-read after this door. */
+    microCompactKnob: {
+        machine: ContextEditMachine;
+        clearOnRejection: boolean;
+    };
     /** owned — the resolved role; its `systemPrompt` seat is still read at prompt-input time. */
     resolvedRole: ResolvedRole;
     /** owned — the resolved main model (`resolvedRole.model`, re-exposed as the name every later
@@ -163,5 +171,18 @@ export interface PrepareConfigDoorsResult {
      *  the resolver's off states). */
     brainCallGuardrailMs: number | undefined;
 }
-/** The B-1 phase body — the config-doors slice, verbatim (see the module header for the contract). */
+/** design/374 — the microCompact knob door (坏值响亮度默认律, the sibling knob doors' form:
+ *  interactionPosture / toolModelGate / staleToolResultOffload). Placement is load-bearing (review
+ *  r3): it runs in THIS pre-first-await config-doors phase so a malformed declaration refuses
+ *  BEFORE any resource-bearing preparation — session acquisition, execution-env creation, the MCP
+ *  dial — whose external effects a late refusal's teardown cannot undo. SINGLE READ per seat, and
+ *  the CONTAINER is judged first (reviews r1/r2): an accessor-backed bag answering a legal value at
+ *  one read and junk at another must be caught by whichever read this door takes, and a
+ *  `microCompact: "cc"` / null / number / array bag makes both property reads answer undefined —
+ *  it must refuse exactly like a malformed field, never fold to the defaults. The RESOLVED values
+ *  returned here are immutable and are the state builder's ONLY source — nothing re-reads the bag. */
+export declare function resolveMicroCompactKnob(bag: RunnerDeps["microCompact"]): {
+    machine: ContextEditMachine;
+    clearOnRejection: boolean;
+};
 export declare function prepareConfigDoors(input: PrepareConfigDoorsInput): PrepareConfigDoorsResult;

package/dist/core/runner/prepare-config-doors.js

@@ -83,10 +83,45 @@ export function resolveModelPromptTraits(model, spec, internals) {
         fableMitigations: isFableFamilyModelId(model.id),
     };
 }
+function microCompactConfigError(field, value, legal) {
+    let shown;
+    try {
+        shown = JSON.stringify(value) ?? String(value);
+    }
+    catch {
+        try {
+            shown = String(value);
+        }
+        catch {
+            shown = `[unrepresentable ${typeof value}]`;
+        }
+    }
+    const seat = field === undefined ? "microCompact" : `microCompact.${field}`;
+    const e = new Error(`${seat} ${shown} is not ${legal} — an unevaluable declaration is refused loudly, ` +
+        `never folded to the default: a silently-ignored opt-in would run the pre-374 machine while the ` +
+        `deployment believes it opted in.`);
+    e.code = "config.microcompact_invalid";
+    return e;
+}
+export function resolveMicroCompactKnob(bag) {
+    if (bag !== undefined && (typeof bag !== "object" || bag === null || Array.isArray(bag))) {
+        throw microCompactConfigError(undefined, bag, "an object carrying optional machine/clearOnRejection keys");
+    }
+    const declaredMachine = bag?.machine;
+    if (declaredMachine !== undefined && declaredMachine !== "legacy" && declaredMachine !== "cc") {
+        throw microCompactConfigError("machine", declaredMachine, `"legacy" | "cc"`);
+    }
+    const declaredClearOnRejection = bag?.clearOnRejection;
+    if (declaredClearOnRejection !== undefined && typeof declaredClearOnRejection !== "boolean") {
+        throw microCompactConfigError("clearOnRejection", declaredClearOnRejection, "a boolean");
+    }
+    return { machine: declaredMachine ?? "legacy", clearOnRejection: declaredClearOnRejection === true };
+}
 export function prepareConfigDoors(input) {
     const { deps, sessions, resume, internals } = input;
     let spec = input.spec;
     assertRestoreGatedToolsValue(spec.restoreGatedTools);
+    const microCompactKnob = resolveMicroCompactKnob(deps.microCompact);
     const assertToolNameListValue = (value, seat) => {
         if (value === undefined)
             return;
@@ -318,6 +353,7 @@ export function prepareConfigDoors(input) {
         promptProfile,
         lockedPreflight,
         resolvedInteractionPosture,
+        microCompactKnob,
         resolvedRole,
         model,
         thinking,

package/dist/core/runner/prepare-task.d.ts

@@ -20,6 +20,7 @@ import type { MemoryEngine } from "../memory-engine/engine.js";
 import { type GitStatusLaneRef } from "./git-status-frame.js";
 import { type ToolManifestRow } from "../../prompt-assembly/tool-catalog.js";
 import type { ToolDisclosureManifest } from "../trace.js";
+import { type ClearedProjectionLedger, type ContextEditMachine, type OccurrenceIndex } from "../context-edit.js";
 import type { TaskNotificationPayload } from "../task-notification.js";
 import { type CwdRef, type ReadFace } from "../../tools/fs/index.js";
 import { type WorkflowSizeGuideline } from "../../orchestration/workflow-size-guideline.js";
@@ -134,7 +135,6 @@ export declare function checkpointScopeOf(spec: {
 export { resolveCheckpointStore } from "../checkpoint-store.js";
 export { isFableFamilyModelId, resolveModelPromptTraits, resolveTaskLimits } from "./prepare-config-doors.js";
 export { rebaseWorkspacePath, rebaseWorkspacePathAcross } from "./prepare-workspace-restore.js";
-/** Everything the run loop needs, built once by {@link prepareTask} (task setup, isolated from the loop). */
 export interface Prepared {
     harness: AgentHarness;
     /** The CONCRETE built-in session (engine-internal: prepare constructs/acquires `StoredSession` itself,
@@ -876,6 +876,33 @@ export interface Prepared {
     trimPressureRef: {
         droppedMessages: boolean;
     };
+    /** design/374 slices 1b/2 — the microCompact machine state this run: the selected clearing
+     *  machine, the cleared-projection ledger (request-view application, durable decisions — see
+     *  `context-edit.ts`'s ledger note; per-run in-memory, so durable resume / `resumeAt` rebuilds
+     *  start EMPTY by construction), the last request's projection seat (what the provider actually
+     *  saw — the MC-R rejection arm computes its candidates and savings on THIS view, never on the
+     *  raw session rebuild), and the MC-R knob. Default machine "legacy" + MC-R off ⇒ the ledger
+     *  never gains an entry and every replay is a same-reference no-op (default bytes unchanged). */
+    microCompact: PreparedMicroCompact;
+}
+/** See {@link Prepared.microCompact}. */
+export interface PreparedMicroCompact {
+    machine: ContextEditMachine;
+    /** MC-R (design/374 §3.2): one-shot clear-and-retry on a provider input-too-long rejection.
+     *  Default false (X2: lands with the machinery, flips with slice 3). */
+    clearOnRejection: boolean;
+    ledger: ClearedProjectionLedger;
+    projectionRef: {
+        current?: {
+            /** The FINAL projected view of the last provider request (post trim/sweep). */
+            messages: AgentMessage[];
+            /** Occurrence coordinates of that view (object-identity first, unambiguous-group fallback). */
+            keyOf: OccurrenceIndex["keyOf"];
+        };
+    };
+    /** The same offload persist seat the frontier machine uses (write-once, idempotent), so MC-R
+     *  clears compose identical markers. Absent when no offload store is configured. */
+    offloadPersist?: (toolCallId: string, fullText: string) => string;
 }
 /**
  * WHICH tool call a committed durable park is holding this run — `undefined` when nothing parked, or

package/dist/core/runner/prepare-task.js

@@ -20,7 +20,7 @@ import { createSubagentWorktreeHelper, forkGovernanceDenial, resolveDelegationEn
 import { createAgentTranscriptTool, AGENT_TRANSCRIPT_TOOL_NAME } from "../../agents/agent-transcript-tool.js";
 import { createSendMessageTool, SEND_MESSAGE_TOOL_NAME } from "../../agents/send-message-tool.js";
 import { SubagentRetainLedger } from "../../agents/retain-ledger.js";
-import { askApproverIdentity, checkToolPolicyProjection, combinePolicies, constraintChainDigest, constraintChainEntryOf, isApprovalSettledBy, isAskDenyResolution, screenApproverAttribution, createTranscriptIntegrityPolicy, createUnverifiableDeletePolicy, describeThrown, refuseOutOfContractDecision, resolveAsk, toolPolicyNameSets, tryCloneArgs } from "../tool-policy.js";
+import { askApproverIdentity, carriesBidiControls, checkToolPolicyProjection, combinePolicies, constraintChainDigest, constraintChainEntryOf, isApprovalSettledBy, isAskDenyResolution, screenApproverAttribution, createTranscriptIntegrityPolicy, createUnverifiableDeletePolicy, describeThrown, refuseOutOfContractDecision, resolveAsk, toolPolicyNameSets, tryCloneArgs } from "../tool-policy.js";
 const PERSISTED_RULE_TOOL = "Bash";
 import { findAdmittingRule, segmentCoverageOf, suggestRulesForCommand } from "../permission-rule-model.js";
 import { ActiveSkillScope, createActiveSkillScopePolicy } from "./active-skill-scope.js";
@@ -70,7 +70,7 @@ import { resolveEpochAgainstBundled } from "../../prompt-assembly/epoch.js";
 import { artifactDeclarations } from "../../prompt-assembly/artifact.js";
 import { buildTurnPromptSnapshot } from "../../prompt-assembly/turn-snapshot.js";
 import { SEMA_DEFAULT_PACK } from "../../prompt-assembly/packs/sema-default.js";
-import { clearStaleToolResults, dropEmptyFailureAssistants, editBudget } from "../context-edit.js";
+import { clearStaleToolResults, createClearedProjectionLedger, dropEmptyFailureAssistants, editBudget, replayClearedProjection, resolveTriggerWindow, } from "../context-edit.js";
 import { capAggregateToolResults } from "../tool-result-budget.js";
 import { capAggregateMediaBytes, AGGREGATE_MEDIA_BUDGET_BYTES } from "../media-byte-cap.js";
 import { dropOrphanToolResults, guardBudget, insertTrimNotice, trimToBudget } from "../context-guard.js";
@@ -124,7 +124,7 @@ function warnCompactionWindowHazard(tracer, spec, model, compModel, hostTaskId)
     if (compModel === undefined)
         return;
     const compWindow = compModel.contextTokens ?? compModel.contextWindow;
-    const mainWindow = model.autoCompactTokens ?? model.contextTokens ?? model.contextWindow;
+    const mainWindow = resolveTriggerWindow(model).window;
     if (compWindow > 0 && mainWindow > 0 && compWindow < mainWindow) {
         const merged = { ...DEFAULT_COMPACTION_SETTINGS, ...spec.compaction };
         const sanitized = sanitizeCompactionSettings(merged, mainWindow);
@@ -195,6 +195,33 @@ function announceToolModelGate(onNotice, modelId, gate) {
         }
     }
 }
+function announceDeclaredMcpContentClasses(args) {
+    for (const entry of args.entries ?? []) {
+        const declaredClass = entry.contentOrigin;
+        if (declaredClass === undefined)
+            continue;
+        const server = inlineUntrusted(String(entry.name), 160);
+        const toolCount = args.statuses?.find((s) => s.name === entry.name)?.toolNames?.length ?? 0;
+        const resourceFaceCaveat = " (Not covered: the cross-server resource faces — ListMcpResourcesTool/ReadMcpResourceTool/ReadMcpResourceDirTool — stay externally classified and still mark.)";
+        const posture = declaredClass === "local"
+            ? `this server's mounted tools' invocations will not mark this session's memory as externally exposed.${resourceFaceCaveat}`
+            : declaredClass === "execution"
+                ? `this server's mounted tools' invocations will not mark this session's memory unless the execIsExternalContent strict upgrade is armed (currently: ${args.execIsExternalContent ? "armed" : "off"}).${resourceFaceCaveat}`
+                : "its tools stay externally classified and this declaration PINS that — the trustedTools allowlist no longer exempts them, and invocations mark this session's memory.";
+        deliverEngineNotice(args.onNotice, {
+            code: "memory.content_class_declared",
+            message: `MCP server "${server}" (${toolCount} tool(s) mounted) is declared ` +
+                `contentOrigin "${declaredClass}" by this deployment's configuration — ${posture}`,
+            detail: {
+                server,
+                contentOrigin: declaredClass,
+                toolCount,
+                ...(declaredClass === "execution" ? { execIsExternalContent: args.execIsExternalContent } : {}),
+                sessionId: args.sessionId,
+            },
+        });
+    }
+}
 export { __resetReadFaceClampAnnouncement } from "./prepare-hands-readface.js";
 const DEFAULT_MAX_SUSPENDS = 5;
 const ULTRA_REASONING_TIERS = new Set(["xhigh", "max"]);
@@ -242,6 +269,49 @@ class ParkRefusal extends Error {
 export { resolveCheckpointStore } from "../checkpoint-store.js";
 export { isFableFamilyModelId, resolveModelPromptTraits, resolveTaskLimits } from "./prepare-config-doors.js";
 export { rebaseWorkspacePath, rebaseWorkspacePathAcross } from "./prepare-workspace-restore.js";
+function buildMicroCompactState(deps, model, sessionId, offloadStore, knob) {
+    const triggerWindow = resolveTriggerWindow(model);
+    if (triggerWindow.clamped) {
+        deliverEngineNotice(deps.onNotice, {
+            code: "config.autocompact_window_clamped",
+            message: `model "${model.id}" declares autoCompactTokens=${triggerWindow.declaredAutoCompactTokens} ABOVE its physical window ` +
+                `${triggerWindow.physicalWindow}; the autocompact window only ever LOWERS the trigger-side geometry, so the value was ` +
+                `clamped to the physical window — fix the model config (declare a value at or below the physical window, or omit it)`,
+            detail: {
+                modelId: model.id,
+                declaredAutoCompactTokens: triggerWindow.declaredAutoCompactTokens,
+                physicalWindow: triggerWindow.physicalWindow,
+                sessionId,
+            },
+        });
+    }
+    return {
+        machine: knob.machine,
+        clearOnRejection: knob.clearOnRejection,
+        ledger: createClearedProjectionLedger(),
+        projectionRef: {},
+        ...(offloadStore ? { offloadPersist: createOffloadPersist(offloadStore, sessionId, deps.onNotice) } : {}),
+    };
+}
+function recordFrontierClears(args) {
+    for (const { index } of args.pass.clears) {
+        const at = args.index.keyAt(index);
+        const clearedMsg = args.edited[index];
+        const markerText = clearedMsg.content?.[0]?.text;
+        if (at !== undefined && typeof markerText === "string") {
+            args.ledger.entries.set(at.key, { marker: markerText, groupCount: at.groupCount, fp: at.fp });
+        }
+    }
+    emitTrace(args.tracer, () => ({
+        kind: "context.mc_clear",
+        version: 1,
+        taskId: args.taskId,
+        clearedCount: args.pass.clears.length,
+        tokensSavedEstimate: args.pass.tokensSavedEstimate,
+        trigger: "frontier",
+        ts: Date.now(),
+    }));
+}
 export function gatedCallIdOf(p) {
     if (p.suspendRef.token !== undefined)
         return p.suspendRef.gatedCallId;
@@ -492,7 +562,7 @@ async function derivedRouteFallsBack(args) {
 export async function prepareTask(spec, deps, sessions, resume, internals, runnerSelf) {
     const doors = prepareConfigDoors({ spec, deps, sessions, resume, internals });
     spec = doors.spec;
-    const { toolFaceSnapshot, promptProfile, lockedPreflight, resolvedInteractionPosture, resolvedRole, model, thinking, compModel, fableMitigations, memoryDelegationEvidence, memoryProvenance, usageWindows, brainCallGuardrailRef, brainCallGuardrailMs } = doors;
+    const { toolFaceSnapshot, promptProfile, lockedPreflight, resolvedInteractionPosture, microCompactKnob, resolvedRole, model, thinking, compModel, fableMitigations, memoryDelegationEvidence, memoryProvenance, usageWindows, brainCallGuardrailRef, brainCallGuardrailMs } = doors;
     announceToolModelGate(deps.onNotice, model.id, doors.modelGate);
     const { toolEffects, egressTools, irreversibleTools, irreversibilityTier, axisExplicitNegatives, reversibilityProbes, ownToolNames } = prepareSafetyScan({ spec, deps });
     let shellGatedBash = false;
@@ -2079,6 +2149,13 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
             const trustedTools = effectiveSafety.trustedTools;
             const execIsExternalContent = effectiveSafety.execIsExternalContent;
             provenanceForChildrenRef.current = { trustedTools: [...trustedTools], execIsExternalContent };
+            announceDeclaredMcpContentClasses({
+                entries: lockedPreflight.mcp,
+                statuses: mcp?.statuses,
+                execIsExternalContent,
+                sessionId,
+                onNotice: deps.onNotice,
+            });
             if (memoryEngineSession?.settlement !== undefined) {
                 delegationSettlementRef.current = { controlDir: memoryEngineSession.settlement.controlDir, sessionId: memoryEngineSession.settlement.sessionId };
             }
@@ -3888,6 +3965,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                         : undefined,
                     resourceLedger: resourceLedgerOut,
                     ...(spec.durableApproval !== undefined ? { durableApproval: { ...spec.durableApproval } } : {}),
+                    ...(spec.principal ? { principal: spec.principal } : {}),
                 };
                 if (!(await commitSuspendSaga(token, cp, suspendableEnv, remoteHandle)).ok)
                     return false;
@@ -4229,7 +4307,11 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                                 args: parkedArgs,
                                 ...(() => {
                                     const preview = approvalPreviewOf(req.toolName, parkedArgs);
-                                    return preview !== undefined ? { preview } : {};
+                                    const bidi = carriesBidiControls(parkedArgs) || carriesBidiControls(preview);
+                                    return {
+                                        ...(preview !== undefined ? { preview } : {}),
+                                        ...(bidi ? { hasBidiControls: true } : {}),
+                                    };
                                 })(),
                                 ...ruleOffersOf(req.toolName, parkedArgs, {
                                     ...(realApproval !== undefined ? { requiresRealApproval: true } : {}),
@@ -4502,11 +4584,14 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
         }
         const editAt = editBudget(model);
         const guardAt = guardBudget(model);
+        const microCompact = buildMicroCompactState(deps, model, sessionId, offloadStore, microCompactKnob);
         const charsPerToken = model.charsPerToken ?? DEFAULT_CHARS_PER_TOKEN;
         harness.on("context", async ({ messages }) => {
             batchHaltRef.current = undefined;
             const healed = dropEmptyFailureAssistants(messages);
-            const capped = await capAggregateToolResults(healed, {
+            const replay = replayClearedProjection(healed, microCompact.ledger);
+            const replayed = replay.messages;
+            const capped = await capAggregateToolResults(replayed, {
                 store: offloadStore,
                 sessionId,
                 onCapped: (info) => emitTrace(deps.tracer, () => ({
@@ -4523,8 +4608,17 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                 limitBytes: deps.mediaByteCapBytes ?? AGGREGATE_MEDIA_BUDGET_BYTES,
                 onStripped: deps.onMediaStripped,
             });
+            let ccPass;
             const edited = clearStaleToolResults(mediaCapped, {
                 budgetTokens: editAt,
+                ...(microCompact.machine === "cc" || microCompact.clearOnRejection ? { recognizeCcMarkers: true } : {}),
+                ...(microCompact.machine === "cc"
+                    ? {
+                        machine: "cc",
+                        clearSource: replayed,
+                        onCleared: (pass) => { ccPass = pass; },
+                    }
+                    : {}),
                 anchoredTotalTokens: estimateContextTokens(mediaCapped, charsPerToken).tokens,
                 charsPerToken,
                 ...(offloadStore
@@ -4535,6 +4629,9 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                     }
                     : {}),
             });
+            if (ccPass !== undefined) {
+                recordFrontierClears({ pass: ccPass, index: replay.index, edited, ledger: microCompact.ledger, tracer: deps.tracer, taskId: spec.taskId ?? sessionId });
+            }
             let trimmed = trimToBudget(edited, guardAt, estimateContextTokens(edited, charsPerToken).tokens, charsPerToken);
             const trimDroppedMessages = trimmed.length < edited.length;
             if (trimDroppedMessages) {
@@ -4575,12 +4672,14 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                 }
             }
             requestLossyRef.current =
-                capped !== healed ||
+                replayed !== healed ||
+                    capped !== replayed ||
                     mediaCapped !== capped ||
                     edited !== mediaCapped ||
                     trimDroppedMessages ||
                     swept.dropped.length > 0 ||
                     gitStatusRef.overBudgetShrunk === true;
+            microCompact.projectionRef.current = { messages: swept.messages, keyOf: replay.index.keyOf };
             return { messages: swept.messages };
         });
         const cacheBreakDetector = deps.cacheBreakDetection === false ? undefined : new CacheBreakDetector();
@@ -4769,7 +4868,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
         const effectiveReadFaceObserved = carrierReadFace();
         const effectiveReadDenyObserved = readDenyAdditionsNormalized.length > 0 ? readDenyAdditionsNormalized.map((e) => ({ ...e })) : undefined;
         const preparedHolder = {};
-        const buildPrepared = () => ({ harness, session, sessionId, reminderMark, reminderDisclosureCounts, taskRootPath: taskRootFinal, model, thinking, compModel: effectiveCompModel, mcp: mcp, ...(a2a !== undefined && a2a.tools.length > 0 ? { a2a } : {}), blockedRef, outputRef, abortController, conflictRef, blockedToolCalls, approvalSettlement, batchHaltRef, nestedStats, ...(rewindNotes.length > 0 ? { rewindNotes } : {}), ...(effectiveReadFaceObserved !== undefined ? { effectiveReadFace: effectiveReadFaceObserved } : {}), ...(effectiveReadDenyObserved !== undefined ? { effectiveReadDenyPatterns: effectiveReadDenyObserved } : {}), effectiveMemoryScopes: memoryEffectiveScopes, cwdRef: handsCwdRef, ...(worktreeSessionRef !== undefined ? { worktreeSessionRef } : {}), ...(workspaceStateSettle !== undefined ? { workspaceStateSettle } : {}), denyNarrowingPolicy, ...(basePolicyForResumeEdit !== undefined ? { basePolicyForResumeEdit } : {}), ...(permissionRuleOrgLane !== undefined ? { permissionRuleOrg: permissionRuleOrgLane } : {}), releaseSignal, settleContentAskBindings, cacheBreakDetector, cacheFingerprint, wiringManifest, promptManifest, epochDeclaredSections, activeTools, ...(deferred.size > 0 ? { deferredToolNames: deferred } : {}), toolMaterializeStatic, deferDirectCall, ...(staticFaceForRef.current !== undefined ? { staticFaceFor: staticFaceForRef.current } : {}), ownedEnv, suspendRef, suspendProgressRef, reviewRef, remoteEnvFailures, reviewRequestRef, suspendLoopRef, suspendForResource, ...(suspendForPlatformLimit !== undefined ? { suspendForPlatformLimit } : {}), ...(envLifetimeSuspendAt !== undefined ? { envLifetimeSuspendAt } : {}), ...(usageGovernance !== undefined ? { usageGovernance } : {}), callIssuedAtRef, brainCallGuardrailRef, suspendForReview, resourceLedger: priorLedger, liveSpendRef, humanReviewRef, now, tools, toolEffects, wakeRecovered, promptOverheadTokens, lastBrainContext, readTaskFile, recentlyReadFiles, normalizeAttachmentPath, isDedupStubResult, ...(onCompactionApplied ? { onCompactionApplied } : {}), compactionReuseRef, trimPressureRef, ...(memoryEngineSession ? { memoryEngineSession } : {}), ...(subagentRetain ? { subagentRetain } : {}), ...(lspDiagnostics && nudgeLspOnEdit ? { lspDiagnostics: { registry: lspDiagnostics, nudge: nudgeLspOnEdit, runIdent: lspRunIdent } } : {}), planModeRef, ...(dateChange ? { dateChange } : {}), ...(instructionSources ? { instructionSources } : {}), ...(workflowSizeGuideline ? { workflowSizeGuideline } : {}), ...(detectExternalChanges ? { detectExternalChanges } : {}), ...(toolsDeltaRef ? { toolsDeltaRef } : {}), ...(agentListing ? { agentListing } : {}), ...(skillsListing ? { skillsListing } : {}), announcedListingsRef, gitStatusRef, listBackgroundTasks, hookIdentity, hookTimeoutMs, ...(turnSnapshotRef.current !== undefined ? { turnSnapshot: turnSnapshotRef.current } : {}), ...(centerCompactionCandidate !== undefined ? { centerCompactionCandidate } : {}) });
+        const buildPrepared = () => ({ harness, session, sessionId, reminderMark, reminderDisclosureCounts, taskRootPath: taskRootFinal, model, thinking, compModel: effectiveCompModel, mcp: mcp, ...(a2a !== undefined && a2a.tools.length > 0 ? { a2a } : {}), blockedRef, outputRef, abortController, conflictRef, blockedToolCalls, approvalSettlement, batchHaltRef, nestedStats, ...(rewindNotes.length > 0 ? { rewindNotes } : {}), ...(effectiveReadFaceObserved !== undefined ? { effectiveReadFace: effectiveReadFaceObserved } : {}), ...(effectiveReadDenyObserved !== undefined ? { effectiveReadDenyPatterns: effectiveReadDenyObserved } : {}), effectiveMemoryScopes: memoryEffectiveScopes, cwdRef: handsCwdRef, ...(worktreeSessionRef !== undefined ? { worktreeSessionRef } : {}), ...(workspaceStateSettle !== undefined ? { workspaceStateSettle } : {}), denyNarrowingPolicy, ...(basePolicyForResumeEdit !== undefined ? { basePolicyForResumeEdit } : {}), ...(permissionRuleOrgLane !== undefined ? { permissionRuleOrg: permissionRuleOrgLane } : {}), releaseSignal, settleContentAskBindings, cacheBreakDetector, cacheFingerprint, wiringManifest, promptManifest, epochDeclaredSections, activeTools, ...(deferred.size > 0 ? { deferredToolNames: deferred } : {}), toolMaterializeStatic, deferDirectCall, ...(staticFaceForRef.current !== undefined ? { staticFaceFor: staticFaceForRef.current } : {}), ownedEnv, suspendRef, suspendProgressRef, reviewRef, remoteEnvFailures, reviewRequestRef, suspendLoopRef, suspendForResource, ...(suspendForPlatformLimit !== undefined ? { suspendForPlatformLimit } : {}), ...(envLifetimeSuspendAt !== undefined ? { envLifetimeSuspendAt } : {}), ...(usageGovernance !== undefined ? { usageGovernance } : {}), callIssuedAtRef, brainCallGuardrailRef, suspendForReview, resourceLedger: priorLedger, liveSpendRef, humanReviewRef, now, tools, toolEffects, wakeRecovered, promptOverheadTokens, lastBrainContext, readTaskFile, recentlyReadFiles, normalizeAttachmentPath, isDedupStubResult, ...(onCompactionApplied ? { onCompactionApplied } : {}), compactionReuseRef, trimPressureRef, microCompact, ...(memoryEngineSession ? { memoryEngineSession } : {}), ...(subagentRetain ? { subagentRetain } : {}), ...(lspDiagnostics && nudgeLspOnEdit ? { lspDiagnostics: { registry: lspDiagnostics, nudge: nudgeLspOnEdit, runIdent: lspRunIdent } } : {}), planModeRef, ...(dateChange ? { dateChange } : {}), ...(instructionSources ? { instructionSources } : {}), ...(workflowSizeGuideline ? { workflowSizeGuideline } : {}), ...(detectExternalChanges ? { detectExternalChanges } : {}), ...(toolsDeltaRef ? { toolsDeltaRef } : {}), ...(agentListing ? { agentListing } : {}), ...(skillsListing ? { skillsListing } : {}), announcedListingsRef, gitStatusRef, listBackgroundTasks, hookIdentity, hookTimeoutMs, ...(turnSnapshotRef.current !== undefined ? { turnSnapshot: turnSnapshotRef.current } : {}), ...(centerCompactionCandidate !== undefined ? { centerCompactionCandidate } : {}) });
         const prepared = buildPrepared();
         preparedHolder.current = prepared;
         return prepared;