@sema-agent/core 5.21.1 → 5.23.0

package/dist/core/hooks.js

@@ -1,7 +1,9 @@
 import { decisionText, refuseOutOfContractDecision } from "./tool-policy.js";
+import { brandPolicyAskClass } from "./ask-class.js";
 import { inlineUntrusted } from "./untrusted-text.js";
 import { ASK_USER_QUESTION_TOOL_NAME } from "./ask-question.js";
 import { createSafeNotifier } from "./safe-notify.js";
+import { ORG_ADJUDICATION_TIMEOUT_MS, ORG_RULE_DECISION_REASON, ORG_UNAVAILABLE_DECISION_REASON, settleOrgVerdictWithin } from "./permission-rule-org.js";
 export function cloneObserverInput(input) {
     try {
         return structuredClone(input);
@@ -99,7 +101,7 @@ function screenPreToolUseResult(r) {
     return refuseOutOfContractDecision(r);
 }
 export function createPreToolUseConstraintPolicy(preToolUse, env, onCrash) {
-    return {
+    return brandPolicyAskClass({
         check: async (req) => {
             let r;
             try {
@@ -128,7 +130,7 @@ export function createPreToolUseConstraintPolicy(preToolUse, env, onCrash) {
             }
             return r.updatedInput !== undefined ? { action: "allow", updatedInput: r.updatedInput } : { action: "allow" };
         },
-    };
+    }, "hook");
 }
 function traceHookCrash(input, err, notifier) {
     notifier.notify(() => input.onHookError?.(err), "toolGate.onHookError");
@@ -245,12 +247,73 @@ export async function runToolGate(input) {
             denySource = input.shellGated === true ? "shellGate" : "safety";
         }
     }
+    let orgRealApprovalRequired = false;
+    let orgTightenCount = 0;
+    const applyOrgLayer = async (current, args) => {
+        if (input.orgRules === undefined)
+            return current;
+        if (toolName === ASK_USER_QUESTION_TOOL_NAME && input.orgRules.contentAskToolMounted === true)
+            return current;
+        let decided = current;
+        const answer = await settleOrgVerdictWithin(input.orgRules
+            .adjudicate({ toolName, args, toolCallId })
+            .catch((err) => ({
+            status: "unavailable",
+            disclosures: [`the org adjudication face threw: ${err instanceof Error ? err.message : String(err)}`],
+        })), {
+            status: "unavailable",
+            disclosures: [`the org adjudication face did not answer within ${ORG_ADJUDICATION_TIMEOUT_MS}ms (or the task ended first)`],
+        }, { ...(input.abortSignal !== undefined ? { signal: input.abortSignal } : {}), timeoutMs: ORG_ADJUDICATION_TIMEOUT_MS });
+        if (answer.status === "unavailable") {
+            orgRealApprovalRequired = true;
+            await notifier.notifyAsync(() => input.orgRules?.onUnavailable?.({ toolName, toolCallId, message: answer.disclosures.join("; ") }), "toolGate.orgSnapshotUnavailable");
+            if (decided.action === "allow") {
+                decided = {
+                    action: "ask",
+                    message: `tool "${toolName}" needs approval: this deployment is org-governed and cannot currently adjudicate ` +
+                        `against an organization policy snapshot — every allow tightens to a real approval until it can`,
+                    decisionReason: ORG_UNAVAILABLE_DECISION_REASON,
+                    requiresRealApproval: true,
+                };
+                orgTightenCount += 1;
+                denySource = "org";
+            }
+            else if (decided.action === "ask" && decided.requiresRealApproval !== true) {
+                decided = { ...decided, requiresRealApproval: true };
+                orgTightenCount += 1;
+            }
+            return decided;
+        }
+        if (answer.verdict === undefined)
+            return decided;
+        const { behavior, rule } = answer.verdict;
+        if (behavior === "deny") {
+            orgTightenCount += 1;
+            denySource = "org";
+            return { action: "deny", message: `an organization policy rule (${rule}) denies this call`, decisionReason: ORG_RULE_DECISION_REASON };
+        }
+        if (decided.action === "deny")
+            return decided;
+        orgTightenCount += 1;
+        denySource = "org";
+        orgRealApprovalRequired = true;
+        return decided.action === "ask"
+            ? { ...decided, requiresRealApproval: true }
+            : {
+                action: "ask",
+                message: `an organization policy rule (${rule}) requires approval for this call`,
+                decisionReason: ORG_RULE_DECISION_REASON,
+                requiresRealApproval: true,
+            };
+    };
+    decision = await applyOrgLayer(decision, policyRewrite !== undefined ? policyRewrite : currentInput);
     if (decision.action === "ask") {
         if (policyRewrite !== undefined) {
             currentInput = policyRewrite;
             req.args = policyRewrite;
         }
         if (input.persistedRules &&
+            !orgRealApprovalRequired &&
             decision.action === "ask" &&
             decision.requiresRealApproval !== true &&
             decision.decisionReason !== "hook" &&
@@ -268,6 +331,7 @@ export async function runToolGate(input) {
             }
         }
         if (input.autoMode &&
+            !orgRealApprovalRequired &&
             decision.action === "ask" &&
             req.toolName !== ASK_USER_QUESTION_TOOL_NAME &&
             input.isMarkedUnresolvable?.(input.event.toolCallId) !== true) {
@@ -293,6 +357,29 @@ export async function runToolGate(input) {
                 denySource = "classifier";
             }
         }
+        if (input.sandboxAdmission !== undefined &&
+            decision.action === "ask" &&
+            req.toolName !== ASK_USER_QUESTION_TOOL_NAME &&
+            input.isMarkedUnresolvable?.(input.event.toolCallId) !== true &&
+            decision.requiresRealApproval !== true &&
+            decision.decisionReason !== "hook" &&
+            hookAsk === undefined &&
+            input.egress !== true &&
+            input.sandboxAdmission.boundaryCapable !== true) {
+            const recorded = input.sandboxAdmission.askClassesOf(toolCallId);
+            const admissible = recorded !== undefined && recorded.length > 0 && recorded.every((r) => r.cls === "sandbox_local");
+            if (admissible) {
+                const askClasses = recorded;
+                input.sandboxAdmission.onAdmitted({ toolCallId, toolName, askClasses, boundary: "sandbox_internal" });
+                preToolContext.push(`permission.sandbox_admitted: this call's pending approval was auto-admitted because the deployment declares an isolated sandbox execution env and the request stays inside it. Recorded for audit.`);
+                decision = {
+                    action: "allow",
+                    message: "admitted inside the deployment-declared sandbox (permission.sandbox_admitted)",
+                    decisionReason: "sandbox",
+                    ...(policyRewrite !== undefined ? { updatedInput: policyRewrite } : {}),
+                };
+            }
+        }
         const egressTool = input.egress === true;
         const irreversibleTool = input.irreversibility === "always" || input.irreversibility === "maybe";
         const safety = egressTool || irreversibleTool ? { egress: egressTool, irreversible: irreversibleTool } : undefined;
@@ -394,23 +481,34 @@ export async function runToolGate(input) {
                                 editArgs = hr.updatedInput;
                         }
                     }
-                    if (!adjudicate)
+                    if (!adjudicate && input.orgRules === undefined)
                         break;
-                    let recheck;
-                    try {
-                        recheck = await adjudicate({ toolName, args: editArgs, toolCallId });
-                    }
-                    catch (err) {
-                        recheck = {
-                            action: "deny",
-                            message: `policy re-check of the approved edit for "${toolName}" errored: ${err instanceof Error ? err.message : String(err)}`,
-                        };
+                    let recheck = { action: "allow" };
+                    if (adjudicate) {
+                        try {
+                            recheck = await adjudicate({ toolName, args: editArgs, toolCallId });
+                        }
+                        catch (err) {
+                            recheck = {
+                                action: "deny",
+                                message: `policy re-check of the approved edit for "${toolName}" errored: ${err instanceof Error ? err.message : String(err)}`,
+                            };
+                        }
                     }
                     if (recheck.action === "deny") {
                         editDenied = recheck;
                         denySource = "policy";
                         break;
                     }
+                    if (recheck.updatedInput !== undefined)
+                        editArgs = recheck.updatedInput;
+                    const orgTightensBefore = orgTightenCount;
+                    recheck = await applyOrgLayer(recheck, editArgs);
+                    const orgRaisedThisRound = orgTightenCount > orgTightensBefore;
+                    if (recheck.action === "deny") {
+                        editDenied = recheck;
+                        break;
+                    }
                     if (recheck.action === "allow") {
                         if (recheck.updatedInput !== undefined)
                             editArgs = recheck.updatedInput;
@@ -421,11 +519,15 @@ export async function runToolGate(input) {
                     const rr = await resolveAsk(recheck, { toolName, args: editArgs, toolCallId });
                     if (rr.action !== "allow") {
                         editDenied = rr;
-                        denySource = "policy";
+                        if (!orgRaisedThisRound)
+                            denySource = "policy";
                         break;
                     }
-                    if (rr.updatedInput === undefined)
+                    if (rr.updatedInput === undefined) {
+                        if (rr.presentedInput !== undefined)
+                            editArgs = rr.presentedInput;
                         break;
+                    }
                     editArgs = rr.updatedInput;
                 }
                 decision = editDenied ?? { ...decision, updatedInput: editArgs };

package/dist/core/locked-config.d.ts

@@ -18,7 +18,7 @@ export declare const LOCKED_KEY_REGISTRY: {
         readonly specFields: readonly ["mcp"];
     };
     readonly toolPolicy: {
-        readonly specFields: readonly ["toolPolicy"];
+        readonly specFields: readonly ["toolPolicy", "basePolicyForResumeEdit"];
     };
     readonly compliancePosture: {
         readonly specFields: readonly [];
@@ -46,6 +46,12 @@ export interface LockedPreflight {
      *  always enforced, resolved ONCE here. With `toolPolicy` locked, the deployment's own
      *  `deps.toolPolicy` is the whole answer (a spec-supplied policy has already been refused). */
     toolPolicy: ToolPolicy | undefined;
+    /** F-012 (codex round 8): the effective resume-edit re-adjudication OVERRIDE, resolved lock-aware in
+     *  the SAME slot as {@link toolPolicy}. With `toolPolicy` locked, a spec-supplied
+     *  `basePolicyForResumeEdit` has already been refused wholesale, so this is the deployment's own
+     *  `deps.basePolicyForResumeEdit` (or undefined — the caller-policy fallback then applies at the use
+     *  site). Unlocked: `spec.basePolicyForResumeEdit ?? deps.basePolicyForResumeEdit`. */
+    basePolicyForResumeEdit: ToolPolicy | undefined;
 }
 /**
  * Validate a deployment's lock declaration against the closed registry. Fail-loud on any unknown

package/dist/core/locked-config.js

@@ -1,6 +1,6 @@
 export const LOCKED_KEY_REGISTRY = {
     mcp: { specFields: ["mcp"] },
-    toolPolicy: { specFields: ["toolPolicy"] },
+    toolPolicy: { specFields: ["toolPolicy", "basePolicyForResumeEdit"] },
     compliancePosture: { specFields: [] },
     retentionPolicy: { specFields: [] },
 };
@@ -38,5 +38,6 @@ export function preflightLockedConfig(spec, deps) {
         lockedKeys,
         mcp: lockedKeys.has("mcp") ? undefined : spec.mcp,
         toolPolicy: lockedKeys.has("toolPolicy") ? deps.toolPolicy : (spec.toolPolicy ?? deps.toolPolicy),
+        basePolicyForResumeEdit: lockedKeys.has("toolPolicy") ? deps.basePolicyForResumeEdit : (spec.basePolicyForResumeEdit ?? deps.basePolicyForResumeEdit),
     };
 }

package/dist/core/memory-engine/delegation-provenance.d.ts

@@ -0,0 +1,62 @@
+/**
+ * design/180 half A — delegation RUNTIME provenance: the three-value attestation and its monotonic
+ * aggregate. The static tool-face judgment ({@link import("./content-origin.js").delegationCallIsExternal})
+ * stays the PERMANENT FLOOR: runtime evidence may only retire the static verdict when a COMPLETE
+ * clean proof is in hand; any evidence gap falls back to the floor. "We could not prove it clean"
+ * and "it is clean" are different answers — replacing the floor outright would fail OPEN on every
+ * evidence gap (old child vintages, crashes, un-armed sessions).
+ *
+ * The aggregate is two MONOTONIC bits plus versioning:
+ *  - `sawExternal` — an actually-observed polluting-class invocation (own recorder, or a delivered
+ *    child attestation of `external`). Once set, never cleared.
+ *  - `incomplete` — some stretch of the session's conduct is unprovable (a delegation delivered no /
+ *    an unknown attestation, a resume lost the aggregate, the recorder was not armed from turn 0).
+ *    Once set, never cleared.
+ * Reduction order is FIXED (design/180 r3): `sawExternal ⇒ external` > `incomplete ⇒ unknown` >
+ * `clean` — an observed external event always outranks an evidence gap (missing evidence can make
+ * "clean" unprovable; it can never make an observed event disappear).
+ */
+/** The three-value delegation attestation. Only `clean` changes behavior (the parent skips the
+ *  static mark); `unknown` is byte-equivalent to absence (static floor governs); `external` marks
+ *  unconditionally, with the observed-event reason. */
+export type DelegationAttestation = "clean" | "external" | "unknown";
+/** The monotonic per-run provenance aggregate (in-process this slice; the durable-checkpoint
+ *  persistence leg rides the background-face slice — absence after a resume reads `incomplete`,
+ *  which is the fail-closed default this shape is built around). */
+export interface DelegationProvenanceAggregate {
+    version: 1;
+    /** Turn index the recorder was armed from. 0 ⇔ armed at prepare (full coverage). */
+    coverageStartTurn: number;
+    sawExternal: boolean;
+    incomplete: boolean;
+}
+/** The frozen content-safety snapshot a parent hands its delegated children (design/180 A-2): the
+ *  classification config the child's recorder must judge under. Inherit-narrow-only — see
+ *  {@link narrowContentSafety}. */
+export interface DelegationContentSafety {
+    trustedTools: readonly string[];
+    execIsExternalContent: boolean;
+}
+export declare function newDelegationProvenanceAggregate(): DelegationProvenanceAggregate;
+/**
+ * Effective content-safety for a run: the parent chain's frozen snapshot ∩ the run's own config.
+ * A child may NARROW what the chain trusts (fewer trusted tools, stricter exec), never widen it —
+ * a wider child-side allowlist must not launder a chain-external tool into `local` on the way up.
+ * At least one input must be present (the caller only computes this when armed).
+ */
+export declare function narrowContentSafety(parent: DelegationContentSafety | undefined, own: {
+    trustedTools: ReadonlySet<string>;
+    execIsExternalContent: boolean;
+} | undefined): {
+    trustedTools: Set<string>;
+    execIsExternalContent: boolean;
+};
+/** Reduce an aggregate to the delivered attestation. `completed` = the child reached its terminal
+ *  normally with its full result delivered — a salvage/partial/errored child can never prove clean
+ *  (its conduct after the cut is unobserved), though an OBSERVED external event still reports. */
+export declare function reduceDelegationAttestation(agg: DelegationProvenanceAggregate | undefined, opts: {
+    completed: boolean;
+}): DelegationAttestation;
+/** Read a delivered card's attestation field (the explicit-whitelist handback seat). Anything but
+ *  the three spellings — including absence — reads as undefined, i.e. the static floor governs. */
+export declare function readCardAttestation(details: unknown): DelegationAttestation | undefined;

package/dist/core/memory-engine/delegation-provenance.js

@@ -0,0 +1,26 @@
+export function newDelegationProvenanceAggregate() {
+    return { version: 1, coverageStartTurn: 0, sawExternal: false, incomplete: false };
+}
+export function narrowContentSafety(parent, own) {
+    if (parent === undefined) {
+        return { trustedTools: new Set(own?.trustedTools ?? []), execIsExternalContent: own?.execIsExternalContent ?? false };
+    }
+    const fromParent = new Set(parent.trustedTools);
+    const trustedTools = own === undefined ? fromParent : new Set([...fromParent].filter((t) => own.trustedTools.has(t)));
+    return { trustedTools, execIsExternalContent: parent.execIsExternalContent || (own?.execIsExternalContent ?? false) };
+}
+export function reduceDelegationAttestation(agg, opts) {
+    if (agg === undefined)
+        return "unknown";
+    if (agg.sawExternal)
+        return "external";
+    if (agg.incomplete || !opts.completed || agg.version !== 1 || agg.coverageStartTurn !== 0)
+        return "unknown";
+    return "clean";
+}
+export function readCardAttestation(details) {
+    if (details === null || typeof details !== "object")
+        return undefined;
+    const v = details.attestation;
+    return v === "clean" || v === "external" || v === "unknown" ? v : undefined;
+}

package/dist/core/memory-engine/engine.d.ts

@@ -1,4 +1,4 @@
-import { type MemoryPartitionIncidentSink, type RetrievedAccountRow, type SessionPollutionRecord } from "./layout.js";
+import { type ChallengeAssignment, type ChallengeEvent, type ControlPlaneRebuildReceipt, type StrictControlPlaneLedger, type ChallengedHistoryRow, type LineagePendingTxn, type LineagePromotion, type MemoryPartitionIncidentSink, type RetrievedAccountRow, type SessionPollutionRecord } from "./layout.js";
 import type { HarvestReport, MemoryAnnouncement, MemoryBackend, MemorySessionHandle, ScanFinding } from "./types.js";
 /**
  * The CC `# Memory` instruction section — VERBATIM from the live capture
@@ -31,6 +31,15 @@ export declare function buildMemoryInstruction(memoryDir: string, instructionFil
  * dual-root instruction merge ("the write plane's instruction wins") never sees a second candidate.
  */
 export declare const MEMORY_RECALL_DISCIPLINE = "Before answering questions about earlier work, decisions, dates, people, or the user's preferences, look them up: `memory_search` finds entries by keyword and `memory_get` reads a full entry \u2014 the injected memory index only lists what exists. When a lookup comes up empty, say that you checked memory and found nothing instead of guessing.";
+/**
+ * design/180 B-3 — the preference-header discipline paragraph. Same carriage as
+ * {@link MEMORY_RECALL_DISCIPLINE}: a runner-appended segment OUTSIDE `inject()`, so the
+ * CC-verbatim `# Memory` instruction stays byte-identical to its sha256-pinned capture. Appended
+ * only when a WRITE channel exists (prepare-memory gates it) — the lines it teaches are frontmatter
+ * the MODEL writes; the engine has no write arm for them (writing usage evidence for the model
+ * would forge the very account the three-tier discipline forbids forging).
+ */
+export declare const MEMORY_PREFERENCE_DISCIPLINE = "When the user confirms a stored preference or fact still holds, refresh that entry's `last-confirmed: <YYYY-MM-DD>` frontmatter line (add it when absent). When you save a preference, add an `applies-when: <context>` frontmatter line naming when it applies. Both are plain frontmatter lines \u2014 write them yourself; nothing fills them in for you.";
 /** CC index-injection parameters: MEMORY.md's first 200 lines / 25KB enter the prompt. */
 export declare const MEMORY_INDEX_MAX_LINES = 200;
 export declare const MEMORY_INDEX_MAX_BYTES: number;
@@ -188,6 +197,89 @@ export declare class MemoryEngine {
     /** The session's pollution record (in-process mark first, then the durable marker) — undefined =
      *  clean. Reads are side-effect-free. */
     sessionPollution(sessionId: string): SessionPollutionRecord | undefined;
+    /** Entry ids the session's memory tools RETURNED this process — the retrieved half of the
+     *  challenged-history mechanical event (B-3). In-process on purpose: "same session" is one runner
+     *  process by architecture, and the durable retrieved account is not session-keyed. */
+    private readonly retrievedThisSession;
+    /**
+     * The model-visible read faces' EXCLUSION view: entry id → why it is withheld.
+     *  - `challenged` — an unresolved S-grade challenge generation exists (B-2');
+     *  - `lineage_pending` — the dirty latch: a staged lineage row for this id has not been settled
+     *    (credentialed-but-unpromoted, or the undecidable crash window) — "the account is not
+     *    settled, the content does not go on the table" (r4).
+     * THROWS {@link import("./layout.js").ControlPlaneCorruptError} when either ledger's integrity is
+     * unknowable — consumers must refuse service loudly (corrupt ≠ clean), the same law the pollution
+     * marker already follows.
+     */
+    readChallengeExclusions(): Map<string, {
+        code: "challenged" | "lineage_pending";
+        generation?: number;
+        at?: number;
+    }>;
+    /** The shared challenge writer: append events idempotently, then announce OPAQUELY (id + code +
+     *  generation only — the announcement is a model-visible face, so no name/description/free reason
+     *  rides it; content stays on the host audit face). Failures are disclosed, never thrown past. */
+    private challengeAndAnnounce;
+    /** design/180 §10 — one disclosure per PROCESS per engine, not one per append: the size is a
+     *  standing property of the account, and repeating it on every challenge is the spam that gets
+     *  advisories muted (the same argument the durable-park disclosures are built on). */
+    private challengeLedgerSizeDisclosed;
+    /**
+     * design/180 §10 — the challenge ledger's size bound is a DISCLOSURE threshold, never a cap: the
+     * ledger cannot be rotated (the exclusion predicate is derived from the events, so dropping the
+     * oldest rows would un-withhold their entries), so crossing {@link CHALLENGE_LEDGER_MAX_EVENTS}
+     * changes nothing about what is withheld — it tells the deployment that an account on the
+     * per-tool-call read path has grown to where it costs the session latency.
+     */
+    private discloseChallengeLedgerSize;
+    /**
+     * design/180 §10 — the RECOVERY channel for a corrupt fail-closed ledger (lineage / challenges).
+     *
+     * The fail-closed family refuses every read on corruption so a silent "start fresh" cannot launder
+     * taint; permanent refusal is the point, and it left a deployment with genuinely corrupt bytes no way
+     * back except deleting engine files by hand. This is that way back, and it is explicit in every
+     * dimension: only a host call reaches it (nothing in the engine self-heals), a HEALTHY ledger is
+     * refused (`memory.control_plane_not_corrupt`), the corrupt bytes are quarantined beside the file
+     * rather than deleted, and the rebuild ANNOUNCES itself — resetting the challenge ledger un-withholds
+     * whatever it was withholding, which the model's next session must not learn about silently.
+     *
+     * `reason` is required and recorded in the announcement's shape (not its text — the announcement is a
+     * model-visible face and stays opaque); it is the operator's own note on the host error face.
+     */
+    rebuildCorruptControlPlaneLedger(ledger: StrictControlPlaneLedger, reason: string): ControlPlaneRebuildReceipt;
+    /**
+     * Host API (advisory, control-plane trust level — the same plane that can mark pollution):
+     * challenge entries by id. `requestId` is REQUIRED (the generation ledger's idempotency identity;
+     * this engine never mints one for the caller — a retried request must carry the SAME id so a lost
+     * ack cannot open a second generation). Each entry's eventId derives as `<requestId>:<entryId>`,
+     * so one batched request stays per-entry attributable.
+     */
+    challengeEntries(ids: readonly string[], reason: string, requestId: string): ChallengeAssignment[];
+    /** Host API: challenge every entry the lineage ledger attributes to `sessionId` (post-hoc source
+     *  falsification — trustedTools misconfigured, a tool re-classified, late delegation evidence).
+     *  Same requestId contract as {@link challengeEntries}. */
+    challengeSession(sessionId: string, reason: string, requestId: string): ChallengeAssignment[];
+    /** Host API: the TRUSTED resolve — closes exactly the named generation (a later challenge stays
+     *  open; a resolve never blanket-clears, and there is no model-face path to this call). Returns
+     *  false ⇔ no such generation was ever opened. */
+    resolveChallenge(entryId: string, generation: number, reason: string, requestId?: string): boolean;
+    /** Host API: adjudicate one UNDECIDABLE pending lineage transaction (the applyPatches-success →
+     *  credential-write crash window; design/180 r5 — never auto-discarded). The host, holding its own
+     *  deployment facts, states whether the commit landed. */
+    adjudicatePendingLineage(txnId: string, action: "promote" | "discard"): LineagePromotion[];
+    /** Host observability: the staged lineage transactions still awaiting settlement (their entry ids
+     *  are latched — see {@link readChallengeExclusions}). Throws on a corrupt ledger. */
+    listPendingLineage(): Record<string, LineagePendingTxn>;
+    /** Host audit reads (throw on corruption — audit must not read a laundered ledger as clean). */
+    readChallengeLedger(): ChallengeEvent[];
+    /** Observability/tests — the collect-only challenged-history account (B-3; zero engine consumers). */
+    readChallengedHistoryAccount(): Record<string, ChallengedHistoryRow>;
+    /** Promotion settlement (shared by harvest step ⑤, reconciliation and host adjudication): a
+     *  promoted contribution whose session ALREADY carries a durable pollution marker is challenged
+     *  on the spot — "mark first, promote later" must converge exactly like the reverse order. The
+     *  eventId anchors on the pollution record (sessionId + marked-at), so however many times this
+     *  settlement replays the same pollution event, the generation is allocated once. */
+    private settlePromotions;
     materialize(scopes: readonly string[], writeScope: string | null): Promise<MemorySessionHandle>;
     inject(handle: MemorySessionHandle, opts?: {
         writeToolMounted?: boolean;
@@ -222,6 +314,7 @@ export declare class MemoryEngine {
         polluted?: {
             reason: string;
         };
+        sessionId?: string;
     }): Promise<HarvestReport>;
     private harvestCore;
     /**