@sema-agent/core 5.23.0 → 5.24.0

package/CHANGELOG.md

@@ -1,5 +1,105 @@
 # Changelog
 
+## 5.24.0 — 2026-08-10
+
+No API-BREAKING changes (exports grow only; `suspendAsk` gains an optional fifth parameter;
+`removePersistedRule` widens its `principal` input to a union). Behavior-surface narrowings and two
+deliberate loosenings are called out below; checkpoint **v8** is a compatibility disclosure, not a
+breaking change (rows without the new gate bit keep their historic stamps).
+
+### Narrowed (behavior)
+
+- **The real-approval bit survives the durability boundary (#130/#120).** An ask carrying
+  `requiresRealApproval` (an org ASK rule, the org-unavailable tighten, or a policy that minted the
+  bit) now parks as the NON-BUDGETABLE `irreversible_ask` gate kind — it used to park as plain
+  `human`, the one kind a network budget resolver may auto-approve. The gate carries
+  `RealApprovalGateBit` (`origin: "org_rule" | "org_unavailable" | "policy"`), the row stamps
+  `REAL_APPROVAL_CHECKPOINT_VERSION = 8` (`MAX_SUPPORTED` raised to 8 — a pre-5.24 worker rejects a
+  v8 row pre-CAS as `unsupported_version`, the row stays pending). Resume adds three guards: a
+  governed row (org origin) is refused PRE-CAS on a worker with no `permissionRuleOrg` wiring (the
+  human decision stays unspent, redeemable on an org-wired worker; a post-CAS belt remains as
+  defense in depth); a v8 row whose bit was stripped in storage, and a sub-v8 row carrying a bit no
+  release minted, are both refused pre-CAS (corruption/forgery guards).
+- **`run_in_background: true` is judged by the backgrounding doctrine (#125, P0).** On a
+  `shellGate:"classify"` deployment, `bashReversibilityProbe` used to read only the command text, so
+  `ls` + the parameter form auto-admitted exactly what `ls &` asks for. The parameter spelling now
+  gets the textual spelling's verdict (not reversible ⇒ ask).
+- **Oversized strings inside `details` are offloaded (#116).** `withToolResultOffload` used to
+  replace only `res.content`; a Bash call's 140k-char `details.stdout` sailed into session
+  persistence and every wire projection. Every oversized string inside `details` (deep walk, plain
+  objects/arrays, cycle-cut with a completed-transform memo, identity-preserving when untouched) is
+  now offloaded to the same store and replaced by a bounded head naming its ref; judged
+  independently of content size. Sequenced after the server tool-results read face (7.11.0) so full
+  payloads always have a host-side egress. `Write` joins `Read`'s structural offload exemption: its
+  `details.content` is the session-continuation replay's authorization source, and the replay
+  additionally refuses to seed a content string carrying the offload-replacement notice
+  (`isOffloadedDetailReplacement`, exported). An own `__proto__` key in `details` survives the
+  rebuild as data (never installed as the rebuilt object's prototype), and below head+notice size a
+  string rides untouched (no replacement that grows).
+- **A local-owner adoption rebinds the anonymous session-policy estate (#132).** The
+  session-policy leg now runs for BOTH adoption shapes: the local-owner shape rewrites `[sid, null]`
+  rows to the adopted principal (a foreign principal's row stays), and the terminal report says
+  `row-rewrite` with the real count. On such a root the anonymous lane ALIASES to the adopted
+  principal (reads and writes), so the window between terminal adoption and the operator landing the
+  principal wiring cannot drop tighten-only deny rules; unadopted and principal-adopted roots are
+  untouched. Narrow disclosed window: a pre-5.24 in-flight local-owner marker (a stage-3 claim with
+  no session-policy evidence) reads as corrupt — recovery is an operator action (remove the root's
+  adoption.json and adopt afresh).
+
+### Loosened (deliberate, ruled)
+
+- **A park minted under org UNAVAILABILITY honors the approval it solicited (#131).** The gate's
+  own message promises "every allow tightens to a real approval until [the org] can [be read]" — but
+  the resume belt refused that very approval and burned it, livelocking a park-only deployment
+  (ask → park → approved → still unavailable → refused, forever). A row with
+  `origin:"org_unavailable"` now EXECUTES on an approved resume even while the org stays unreadable
+  (the durable row — origin plus the human outcome — is the audit record); `org_rule` rows and
+  pre-v8 rows keep the strict fail-closed posture, and a published org deny blocks regardless of
+  origin.
+- **The adoption terminal record's read validator checks shape, not this build's constants
+  (#133).** The stored report snapshots the by-design-not-migrated set and the config table AS RULED
+  AT ADOPTION TIME; both may grow by ruling, and the old exact-equality read marked every
+  already-adopted root corrupt on the first release after any growth (and again on rollback), across
+  13 store constructors at once. Read time now enforces non-empty/well-formed/no-duplicate-identity;
+  the writer-emits-the-constant drift guard moves to the test grid, where a change is a deliberate,
+  reviewable edit. Empty, duplicate-carrying and mangled reports are refused exactly as before.
+
+### Added
+
+- **The permission-rule BACKEND CONTRACT is exported** (ruled 2026-08-10): `PERMISSION_RULE_WRITER`,
+  `writerOf`, `foldDelta`, `addDotsOf`, the delta/writer/store types and the two consent-boundary
+  assertions — an out-of-repo store twin builds against the same definitions the file backend
+  implements instead of mirroring them. The consent boundary is unchanged and now PINNED: the engine
+  reaches `writer.apply` only on the consent redemption, tighten-delete and sync-join lanes
+  (registered-caller scan + a second net over every file naming the writer handle).
+- **`removePersistedRule` accepts a structural `RuleOwner`** — the string shorthand is unchanged;
+  `{ kind: "local-owner" }` resolves the local-owner bucket (previously unrevokable through this
+  entry), and a provider without `forLocalOwner` fails loudly instead of no-oping against the
+  zero-rule store.
+- `RealApprovalGateBit` exported (the supervisor-inbox / SQL-twin read of the new gate member).
+
+### Fixed
+
+- **The background time wall is stated as a budget, never a kill threat (#121).** Under deadline
+  pressure a model read "auto-terminates if still running after 600s" as "better TaskStop it myself
+  first" (a measured 6.3s self-stop where waiting was optimal). All three Bash minting arms and both
+  Monitor siblings now say "may run up to Ns"; the kill explanation stays with the terminal
+  timed-out wording, which fires only when a timeout actually happens. Retired-dialect tripwires on
+  both faces.
+- **`createAllowDenyPolicy`'s invalid-name refusal teaches each lesson once.** A CC-migrated
+  settings file with 39 content-form entries repeated the same three-line lesson 39 times; the
+  thrown string now groups by lesson (entries listed under it). The structured `issues` face stays
+  per-entry and gains a `lesson` member (additive).
+- Three public comment surfaces stopped recommending prefix recomposition over `buildToolResultRef`
+  (#134 — the encoding is not injective; ownership is exact-equality against a recomposed ref), the
+  `RunnerDeps.permissionRuleStore` docstring states the ruled backend-contract boundary instead of
+  "the write face is core-private", and dated errata landed for two past releases (5.22.0: the
+  design/182 rule-sync core half shipped unlisted; 5.13.0: safety asks going sync-first under a live
+  approver shipped unlisted and superseded a written park promise).
+- Docs: `docs/sdk/09` gains the sandbox-admission section (every exclusion conjunct, from source)
+  and an org-rule-layer account stated in terms of the mechanism that actually holds the line
+  (`requiresRealApproval` excluded at every loosening seam, now including the durability boundary).
+
 ## 5.23.0 — 2026-08-10
 
 No BREAKING changes.
@@ -92,7 +192,10 @@ No BREAKING changes.
   delegation-provenance aggregate rides the durable checkpoint; a resumed leg missing the state
   reads as `unknown` (static floor), never as `clean`.
 - **`buildToolResultRef` exported from the package root** — a host wiring an HTTP tool-result read
-  face binds an incoming ref to its owning task by prefix recomputation.
+  face composes refs through the single source instead of reimplementing the segment escaping.
+  (Erratum 2026-08-10: this entry originally said a read face binds a ref to its owning task "by
+  prefix recomputation". It must not — the encoding is not injective over the two segments, so
+  ownership is an exact-equality test against a recomposed ref, never a prefix match.)
 - **Content mandate split from the approval mandate (#94).** A delegated child's question routes on
   the QUESTION seat, not the approver seat. Behavior widening, called out explicitly: under
   `durableApproval` with a live `onQuestion`, an absent or string approver seat used to leave child
@@ -103,6 +206,13 @@ No BREAKING changes.
   `TaskRegistry.reviveBackgroundAgent`'s refusal union gains the `recycling` member — exhaustive
   consumers add one arm.
 
+_Addendum (2026-08-10, #135 erratum): the design/182 rule-sync **core half also shipped in this
+release** and was not listed. It added the sync client and its wire contract to the public surface:
+`syncPermissionRules` (full-state join, screened in both directions), `PERMISSION_RULE_SYNC_PATH`,
+`RuleSyncRequestBody` / `RuleSyncResponseBody` / `PermissionRuleSyncResult`, `parseRuleSyncResponse`,
+and `LOCAL_OWNER_UNSYNCABLE_CODE` (a local-owner bucket refuses to sync, loudly) — the definitions a
+server-side rule store builds against. Recorded as a dated erratum rather than a silent rewrite._
+
 ## 5.21.1 — 2026-08-09
 
 - **Fix: every `hands: none` deployment failed at the door on 5.21.0** (P0). `HAND_TOOL_EFFECTS`
@@ -1105,6 +1215,17 @@ mysterious runtime.
 
 - **`finalVerification` mechanism hardening (four of the seven field failure modes).** ① The injection headroom guard read only the turn axis — it now also reads the tightest caller-armed budget axis (tokens/cost/walltime, same axes as the limit-approach frames); ≥90% full skips the injection, so the gate can no longer convert an externally-passing run into `limits.*_exceeded`. ② Both injections emit the standard `steering_injected` echo (**new closed-set member: `source: "final_verification"`** — switches over the source union add an arm), closing the stats-vs-stream observability gap. ③ The nudge licenses cleaning up residue the model's own testing created (the state-harmless clause no longer reads as "leave your test residue in place"). ④ The nudge forbids laundering pre-existing uncertainty into "confirmed". The remaining modes are design-bounded: the engine never judges check semantics, and self-grading is the deployment's verifier-role wiring.
 
+_Addendum to 5.13.0 (2026-08-10, erratum — the entry below was missing at release): **SAFETY asks go
+sync-first when a live approver is wired.** With a FUNCTION-valued `onAsk` present, an
+egress/irreversibility-tightened ask now resolves in-stream through that approver (same turn, no
+checkpoint) instead of always parking as `irreversible_ask`; the durable park remains the headless /
+no-live-approver / `forceDurableGate` / live-face-answered-unavailable path, where the gate kind,
+`safetyAxis` and risk descriptor are unchanged. This superseded the earlier written promise that
+"safety asks … still park" with a live approver (the 1.37x sync-approval entry). The change shipped
+in 5.13.0 with no changelog entry — recorded here as a dated erratum rather than a silent rewrite;
+consumer flips: a probe pinning "an `irreversibility:'always'` tool always suspends" reds whenever a
+live `onAsk` is wired — drop the approver (or arm `forceDurableGate`) to test the park leg._
+
 ## 5.12.0 — 2026-08-05
 
 ### BREAKING

package/dist/core/checkpoint-store.d.ts

@@ -267,6 +267,28 @@ export declare function buildRiskDescriptor(input: {
     /** The resolved doctrine to persist when `shellGated` (see {@link RiskDescriptor.shellGateDoctrine}). */
     shellGateDoctrine?: "classify" | "always";
 }): RiskDescriptor;
+/**
+ * #130/#131/#120 (2026-08-10) — the durable record of an ask's `requiresRealApproval` bit, which used
+ * to DIE at the park: the mint keyed the gate kind on the static tool marks only, so an org-governed
+ * ask on an unmarked tool minted a plain `{kind:"human"}` — the one kind a network budget resolver may
+ * auto-approve — and the org's "only judgment clears this" demand was silently budgetable after the
+ * durability boundary. Present ⇒ the mint escalates to `irreversible_ask` (non-budgetable) and stamps
+ * {@link REAL_APPROVAL_CHECKPOINT_VERSION}. `origin` additionally records WHY, for the resume belts:
+ *  · `"org_rule"` — an org ASK rule fired (governance was READABLE at mint). Resume keeps the strict
+ *    posture: org unavailable at resume still refuses (newly-blind ⇒ fail-closed).
+ *  · `"org_unavailable"` — governance could NOT be read at mint and the gate's own message promised
+ *    "every allow tightens to a real approval until it can". A person approving THIS park IS that real
+ *    approval — so a resume that finds org still unavailable executes instead of refusing and burning
+ *    the approval (the park-only livelock #131 closed). The durable row itself — this origin plus the
+ *    recorded human outcome — is the audit record of that passage; the resume emits no extra notice.
+ *  · `"policy"` — a policy/hook minted the bit (e.g. the always-on classifier-parity rule); no org
+ *    semantics, the resume belts treat it as a plain non-budgetable approval.
+ * Both org origins double as the #120 governed mark: a resuming worker with NO org adjudication wiring
+ * refuses to redeem such a row (the governed boundary must not vanish with a deployment's wiring).
+ */
+export interface RealApprovalGateBit {
+    origin: "org_rule" | "org_unavailable" | "policy";
+}
 export type CheckpointGate = 
 /** F4: a human (or any external authority) must allow/deny a pending tool call. design/80 §D-E:
  *  carries an OPTIONAL display-only {@link RiskDescriptor} (severity/axes/summary) for the supervisor
@@ -292,6 +314,7 @@ export type CheckpointGate =
     reason: string;
     toolName: string;
     safetyAxis?: SafetyAxis;
+    realApproval?: RealApprovalGateBit;
     riskDescriptor?: RiskDescriptor;
 }
 /** design/74: a resource slice limit (budget/walltime/turns) was reached — suspend (resumable) instead of
@@ -909,13 +932,25 @@ export declare const ORG_ADMISSION_CHECKPOINT_VERSION = 6;
  * state keeps the historic stamps — deployments not delegating see zero version movement.
  */
 export declare const F012_CHECKPOINT_VERSION = 7;
+/**
+ * #130/#120 (2026-08-10 — the F012_CHECKPOINT_VERSION precedent replayed a sixth time): the schema
+ * version a suspend stamps when its gate carries {@link RealApprovalGateBit}. The enforcement lives
+ * ENTIRELY in the resuming worker (the no-org-wiring refusal, the org_unavailable resume-belt
+ * distinction): a pre-131 worker (MAX_SUPPORTED=7) would accept the row, ignore `realApproval`, and
+ * either redeem a governed row with no org wiring at all (#120's exact hole, replayed through version
+ * skew) or burn the approval on the unavailable belt the bit exists to soften. Stamping v8 forces it
+ * to reject PRE-CAS (`unsupported_version`, stays `pending`, retried on an enforcing worker). A gate
+ * with NO `realApproval` keeps the historic stamps — ungoverned deployments see zero version movement.
+ */
+export declare const REAL_APPROVAL_CHECKPOINT_VERSION = 8;
 /** The highest {@link Checkpoint.version} `runner.resume` will act on; a higher one is rejected pre-CAS with
  *  {@link CheckpointError} `unsupported_version` (the checkpoint stays `pending`, retryable on a newer worker).
- *  Raised to 7 for F-012-bearing checkpoints — this worker reads v1 (legacy human), v2 (resource), v3
+ *  Raised to 8 for realApproval-bearing gates — this worker reads v1 (legacy human), v2 (resource), v3
  *  (binding human/irreversible_ask), v4 (a pre-164 row, refused only when it carries the retired
  *  wall-clock allocation), v5 (token-allocation-bearing resource/approval), v6 (org-admission freeze
- *  state) and v7 (F-012 constraint-chain / delegation-provenance enforcement state). */
-export declare const MAX_SUPPORTED_CHECKPOINT_VERSION = 7;
+ *  state), v7 (F-012 constraint-chain / delegation-provenance enforcement state) and v8 (a
+ *  non-budgetable `realApproval` gate bit with its org-origin resume semantics). */
+export declare const MAX_SUPPORTED_CHECKPOINT_VERSION = 8;
 /**
  * Read a checkpoint's schema version, defaulting an absent field to **legacy `0`** (a 1.67-era checkpoint
  * written before the field existed — it carries no `workspaceHandle`, so resuming it the v1 way is safe).

package/dist/core/checkpoint-store.js

@@ -134,7 +134,8 @@ export const BINDING_CHECKPOINT_VERSION = 3;
 export const TOKEN_CHECKPOINT_VERSION = 5;
 export const ORG_ADMISSION_CHECKPOINT_VERSION = 6;
 export const F012_CHECKPOINT_VERSION = 7;
-export const MAX_SUPPORTED_CHECKPOINT_VERSION = 7;
+export const REAL_APPROVAL_CHECKPOINT_VERSION = 8;
+export const MAX_SUPPORTED_CHECKPOINT_VERSION = 8;
 export function checkpointVersionOf(cp) {
     return cp.version ?? 0;
 }

package/dist/core/hooks.d.ts

@@ -602,7 +602,13 @@ export interface ToolGateInput {
      *  prefer, so the closure must NOT take its sync-first decline and should park durably. All other
      *  decline/pre-commit-failure paths keep their existing `undefined` fallbacks (the gate then keeps the
      *  fail-closed deny / typed refusal the caller carries). */
-    liveFaceUnavailable?: boolean) => Promise<ToolGateResult["suspend"] | ParkAttemptFailed | undefined>;
+    liveFaceUnavailable?: boolean, 
+    /** #130: present ⇒ the surviving ask carries `requiresRealApproval` and the mint must escalate to
+     *  the non-budgetable `irreversible_ask` kind carrying this bit (a budget resolver must never
+     *  auto-approve what only judgment may clear). `origin` records whether the bit came from an org
+     *  ASK rule, from the org-unavailable tighten (whose resume semantics differ — see
+     *  {@link import("./checkpoint-store.js").RealApprovalGateBit}), or from a policy/hook. */
+    realApproval?: import("./checkpoint-store.js").RealApprovalGateBit) => Promise<ToolGateResult["suspend"] | ParkAttemptFailed | undefined>;
     /**
      * design/174 — route a policy `ask` on the reserved question tool to this run's CONTENT-ask channel
      * before it can become a park or a refusal. Called in the `ask` branch with the FINAL post-hook,

package/dist/core/hooks.js

@@ -248,6 +248,7 @@ export async function runToolGate(input) {
         }
     }
     let orgRealApprovalRequired = false;
+    let orgAskOrigin;
     let orgTightenCount = 0;
     const applyOrgLayer = async (current, args) => {
         if (input.orgRules === undefined)
@@ -266,6 +267,7 @@ export async function runToolGate(input) {
         }, { ...(input.abortSignal !== undefined ? { signal: input.abortSignal } : {}), timeoutMs: ORG_ADJUDICATION_TIMEOUT_MS });
         if (answer.status === "unavailable") {
             orgRealApprovalRequired = true;
+            orgAskOrigin = "unavailable";
             await notifier.notifyAsync(() => input.orgRules?.onUnavailable?.({ toolName, toolCallId, message: answer.disclosures.join("; ") }), "toolGate.orgSnapshotUnavailable");
             if (decided.action === "allow") {
                 decided = {
@@ -297,6 +299,7 @@ export async function runToolGate(input) {
         orgTightenCount += 1;
         denySource = "org";
         orgRealApprovalRequired = true;
+        orgAskOrigin = "rule";
         return decided.action === "ask"
             ? { ...decided, requiresRealApproval: true }
             : {
@@ -383,8 +386,11 @@ export async function runToolGate(input) {
         const egressTool = input.egress === true;
         const irreversibleTool = input.irreversibility === "always" || input.irreversibility === "maybe";
         const safety = egressTool || irreversibleTool ? { egress: egressTool, irreversible: irreversibleTool } : undefined;
+        const realApprovalOf = (d) => d.action === "ask" && d.requiresRealApproval === true
+            ? { origin: orgAskOrigin !== undefined ? `org_${orgAskOrigin}` : "policy" }
+            : undefined;
         if (suspendAsk && decision.action === "ask") {
-            const suspended = await suspendAsk(req, currentInput, safety);
+            const suspended = await suspendAsk(req, currentInput, safety, undefined, realApprovalOf(decision));
             if (suspended) {
                 if ("parkFailed" in suspended)
                     parkFailed = suspended.parkFailed;
@@ -403,7 +409,7 @@ export async function runToolGate(input) {
                     req.args = outcome.presentedInput;
                 }
                 if (suspendAsk && outcome.parkDeclined && parkFailed === undefined) {
-                    const suspended = await suspendAsk(req, currentInput, safety, true);
+                    const suspended = await suspendAsk(req, currentInput, safety, true, realApprovalOf(decision));
                     if (suspended) {
                         if ("parkFailed" in suspended)
                             parkFailed = suspended.parkFailed;
@@ -427,10 +433,11 @@ export async function runToolGate(input) {
             }
         }
         if (decision.action === "ask") {
+            const askBeforeResolve = decision;
             const resolved = await resolveAsk(decision, req);
             decision = resolved;
             if (resolved.action === "deny" && resolved.approverUnavailable === true && suspendAsk && parkFailed === undefined) {
-                const suspended = await suspendAsk(req, currentInput, safety, true);
+                const suspended = await suspendAsk(req, currentInput, safety, true, realApprovalOf(askBeforeResolve));
                 if (suspended) {
                     if ("parkFailed" in suspended)
                         parkFailed = suspended.parkFailed;

package/dist/core/permission-rule-store.d.ts

@@ -1,11 +1,14 @@
 /**
- * design/179 §8 — the persisted allow-rule store seam, its core-private write face, and the removal entry.
+ * design/179 §8 — the persisted allow-rule store seam, its backend write face, and the removal entry.
  *
  * ## Two faces, deliberately unequal
  *
- * A deployment sees a READ face: `list()`, scoped to one verified principal by a factory. There is no
- * exported write API at all — the only way a rule enters the store through the engine is the core-private
- * redemption path (`permission-rule-consent.ts`), which requires an approved durable approval record.
+ * A deployment sees a READ face: `list()`, scoped to one verified principal by a factory. The write face
+ * is a BACKEND CONTRACT (ruled 2026-08-10: exported so an out-of-repo store twin builds against the same
+ * definitions instead of mirroring them), not a host write API — the only way a rule enters the store
+ * through the ENGINE is the redemption path (`permission-rule-consent.ts`), which requires an approved
+ * durable approval record; that invariant lives in the engine's wiring and is pinned by the
+ * writer-caller registry test, not in type visibility.
  * `expectedRev` is concurrency control, not authorization, so "hold a put API and skip the ticket" is not
  * a shape that exists here rather than a rule someone must remember.
  *
@@ -156,15 +159,19 @@ export interface RuleSyncJoinDelta {
  * What a write may say. Authorization discriminates on the DELTA SHAPE, not on a full snapshot: only the
  * add arm can introduce a dot, and the delete arm carries a tombstone and no adds. A backend additionally
  * REFUSES at runtime any delete that would introduce a new add dot — structure and runtime check together,
- * so "pick the delete arm and smuggle an add" is neither expressible nor accepted. The `sync-join` arm is
- * constructible only by core (the writer is never exported), and every inbound record inside it passes the
- * single validator again AT THE BACKEND — the fifth door of design/179 §4's validator list closes here,
- * not at the calling layer.
+ * so "pick the delete arm and smuggle an add" is neither expressible nor accepted. The `sync-join` arm's
+ * safety does not rest on hiding the type (ruled 2026-08-10: the backend contract IS exported for
+ * out-of-repo store twins) — it rests on every inbound record inside it passing the single validator
+ * again AT THE BACKEND: the fifth door of design/179 §4's validator list closes here, not at the
+ * calling layer, and closes identically for every caller.
  */
 export type RuleWriteDelta = RuleAddDelta | RuleDeleteDelta | RuleSyncJoinDelta;
 /**
- * The core-private write face. Deliberately absent from the package's public exports: a host cannot hold
- * one, so no API-level path to the store bypasses the consent protocol.
+ * The backend write face. Exported as part of the BACKEND CONTRACT (ruled 2026-08-10) so an
+ * out-of-repo store implementation hangs the same face the file backend does, instead of mirroring the
+ * types. The consent boundary is unchanged by the export: the ENGINE reaches a writer only through the
+ * consent protocol's redemption (and the sync client's join) — a property of the engine's wiring —
+ * and a deployment always owned its own storage bytes, so type visibility grants nothing new.
  */
 export interface PermissionRuleWriter {
     /** Mint the next dot for this replica. Counters need only be unique and monotonic, so a dot minted for
@@ -198,11 +205,11 @@ export interface RawRuleSyncState {
     quarantined?: QuarantinedRuleAdd[];
 }
 /**
- * The internal handle a writable backend hangs its write face on. Not exported from the package index —
- * that omission IS the boundary described in the module doc.
+ * The handle a writable backend hangs its write face on (exported with the backend contract, ruled 2026-08-10;
+ * the consent boundary lives in the engine's wiring, not in this key's visibility).
  */
 export declare const PERMISSION_RULE_WRITER = "__semaPermissionRuleWriter";
-/** A store that also carries the core-private write face. */
+/** A store that also carries the backend write face. */
 export interface WritablePermissionRuleStore extends PermissionRuleStore {
     readonly [PERMISSION_RULE_WRITER]: PermissionRuleWriter;
 }
@@ -419,7 +426,11 @@ export type RemoveResult =
 export declare function removePersistedRule(opts: {
     rule: string;
     scope: RuleScope;
-    principal: string;
+    /** Whose bucket. A bare string stays the principal shorthand (unchanged callers); the structural
+     *  {@link RuleOwner} form adds the local-owner bucket (downstream request, 2026-08-10 — design/182 §4.5's
+     *  `forLocalOwner()` face existed, but removal could not name it, so a local-owner rule was
+     *  unrevokable through this entry). Same observed-remove/add-wins/stillLive semantics either way. */
+    principal: string | RuleOwner;
     provider: PermissionRuleStoreProvider;
 }): Promise<RemoveResult>;
 export declare function errText(err: unknown): string;

package/dist/core/permission-rule-store.js

@@ -327,7 +327,11 @@ export async function ruleStoreChecksum(payload) {
 }
 const REMOVE_MAX_ATTEMPTS = 8;
 export async function removePersistedRule(opts) {
-    const store = opts.provider.forPrincipal(opts.principal);
+    const owner = typeof opts.principal === "string" ? { kind: "principal", principal: opts.principal } : opts.principal;
+    if (owner.kind === "local-owner" && opts.provider.forLocalOwner === undefined) {
+        return { status: "failed", error: "this provider has no local-owner bucket (forLocalOwner is not implemented) — a local-owner rule cannot be removed through it" };
+    }
+    const store = owner.kind === "local-owner" ? opts.provider.forLocalOwner() : opts.provider.forPrincipal(owner.principal);
     const writer = writerOf(store);
     if (writer === undefined) {
         return { status: "failed", error: "the resolved permission-rule store has no write face — rules cannot be removed through it" };

package/dist/core/runner/prepare-task.js

@@ -85,7 +85,7 @@ import { resolveWorkflowSizeGuideline } from "../../orchestration/workflow-size-
 import { createLspTool, gitCheckIgnoreFilter, resolveLspPath } from "../lsp.js";
 import { resolveKey } from "../../tools/fs/safety.js";
 import { wholeFileRecordsFromTranscript } from "./session-file-state-replay.js";
-import { BINDING_CHECKPOINT_VERSION, mintCheckpointToken, ORG_ADMISSION_CHECKPOINT_VERSION, F012_CHECKPOINT_VERSION, RESOURCE_CHECKPOINT_VERSION, TOKEN_CHECKPOINT_VERSION, buildRiskDescriptor, debitLedger, encodeAtFidelity, remainingBudgetMicroUsd, resolveCheckpointStore, resolveDeclaredFidelity, samePlainValue, } from "../checkpoint-store.js";
+import { BINDING_CHECKPOINT_VERSION, mintCheckpointToken, ORG_ADMISSION_CHECKPOINT_VERSION, F012_CHECKPOINT_VERSION, REAL_APPROVAL_CHECKPOINT_VERSION, RESOURCE_CHECKPOINT_VERSION, TOKEN_CHECKPOINT_VERSION, buildRiskDescriptor, debitLedger, encodeAtFidelity, remainingBudgetMicroUsd, resolveCheckpointStore, resolveDeclaredFidelity, samePlainValue, } from "../checkpoint-store.js";
 import { boundInputHashOf } from "../canonical-json.js";
 import { countElicitOptIns, deriveAskEffective, deriveWiringManifest, resolveAskSeamForm, resolveDeclaredDurability, resolveElicitSeam, resolveQuestionSeam } from "../wiring-manifest.js";
 import { GLOBAL_USAGE_KEY, resolveUsageWindows, usageRetryAfterMs } from "../usage-window-store.js";
@@ -4236,7 +4236,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                 }
             };
             const suspendAsk = parkLaneArmed && checkpointStore !== undefined
-                ? async (req, postHookArgs, safety, liveFaceUnavailable) => {
+                ? async (req, postHookArgs, safety, liveFaceUnavailable, realApproval) => {
                     const syncFirstEligible = req.toolName === ASK_USER_QUESTION_TOOL_NAME ? contentAskRoutable(req.toolCallId) : isLiveApproverSeat(onAsk);
                     if (syncFirstEligible &&
                         runtimeCaps?.forceDurableGate !== true &&
@@ -4345,12 +4345,15 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                             ...(effectiveShellGate !== "off" ? { shellGateDoctrine: effectiveShellGate } : {}),
                         });
                         gate =
-                            safety !== undefined
+                            safety !== undefined || realApproval !== undefined
                                 ? {
                                     kind: "irreversible_ask",
-                                    reason: `human approval required before safety-tightened tool "${req.toolName}"`,
+                                    reason: safety !== undefined
+                                        ? `human approval required before safety-tightened tool "${req.toolName}"`
+                                        : `real human approval required for tool "${req.toolName}" (non-budgetable: ${realApproval.origin})`,
                                     toolName: req.toolName,
-                                    safetyAxis: safety,
+                                    ...(safety !== undefined ? { safetyAxis: safety } : {}),
+                                    ...(realApproval !== undefined ? { realApproval } : {}),
                                     riskDescriptor,
                                 }
                                 : durableApproval
@@ -4373,7 +4376,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                         const mintedAt = Date.now();
                         cp = {
                             token,
-                            version: f012CheckpointState() ? F012_CHECKPOINT_VERSION : orgAdmissionCheckpointState() ? ORG_ADMISSION_CHECKPOINT_VERSION : approvalLedger.totalTokens !== undefined ? TOKEN_CHECKPOINT_VERSION : BINDING_CHECKPOINT_VERSION,
+                            version: realApproval !== undefined ? REAL_APPROVAL_CHECKPOINT_VERSION : f012CheckpointState() ? F012_CHECKPOINT_VERSION : orgAdmissionCheckpointState() ? ORG_ADMISSION_CHECKPOINT_VERSION : approvalLedger.totalTokens !== undefined ? TOKEN_CHECKPOINT_VERSION : BINDING_CHECKPOINT_VERSION,
                             scope,
                             sessionId,
                             leafId,

package/dist/core/runner/runtask.js

@@ -1,6 +1,6 @@
 import { AgentHarness, DEFAULT_COMPACTION_SETTINGS, uuidv7 } from "../../internal/harness.js";
 import { snapshotActorAssertion } from "../../internal/llm.js";
-import { CheckpointError, BINDING_CHECKPOINT_VERSION, checkpointVersionOf, MAX_SUPPORTED_CHECKPOINT_VERSION, remainingBudgetMicroUsd, readPendingSteerQueue, remainingTokens, validatePendingSteer, winnerFromOutcome, } from "../checkpoint-store.js";
+import { CheckpointError, BINDING_CHECKPOINT_VERSION, checkpointVersionOf, MAX_SUPPORTED_CHECKPOINT_VERSION, REAL_APPROVAL_CHECKPOINT_VERSION, remainingBudgetMicroUsd, readPendingSteerQueue, remainingTokens, validatePendingSteer, winnerFromOutcome, } from "../checkpoint-store.js";
 import { engineVersion } from "../version.js";
 import { CONFIG_CATALOG_VERSION, declarationReasons, resolveEffectiveConfig } from "../../config/catalog.js";
 import { eventDefaultOn } from "../../prompt-assembly/event-registry.js";
@@ -3704,6 +3704,21 @@ export class Runner {
         if (checkpointVersionOf(cp) > MAX_SUPPORTED_CHECKPOINT_VERSION) {
             throw new CheckpointError("checkpoint.unsupported_version", `checkpoint version ${checkpointVersionOf(cp)} is newer than this worker supports (max ${MAX_SUPPORTED_CHECKPOINT_VERSION})`);
         }
+        const preCasGateBit = cp.gate.kind === "irreversible_ask" ? cp.gate.realApproval : undefined;
+        const preCasBitWellFormed = preCasGateBit !== undefined &&
+            typeof preCasGateBit === "object" &&
+            (preCasGateBit.origin === "org_rule" ||
+                preCasGateBit.origin === "org_unavailable" ||
+                preCasGateBit.origin === "policy");
+        if (checkpointVersionOf(cp) >= REAL_APPROVAL_CHECKPOINT_VERSION ? !preCasBitWellFormed : preCasGateBit !== undefined) {
+            throw new CheckpointError("checkpoint.invalid_outcome", checkpointVersionOf(cp) >= REAL_APPROVAL_CHECKPOINT_VERSION
+                ? `a v${checkpointVersionOf(cp)} checkpoint must carry a well-formed non-budgetable realApproval gate bit (origin org_rule/org_unavailable/policy) on an irreversible_ask gate — this row does not; refusing to resume a damaged real-approval row (corruption / downgrade guard), the checkpoint stays pending`
+                : `a v${checkpointVersionOf(cp)} checkpoint carries a realApproval gate bit no release of that version ever minted — refusing to honor a fabricated origin (corruption / forgery guard), the checkpoint stays pending`);
+        }
+        if ((preCasGateBit?.origin === "org_rule" || preCasGateBit?.origin === "org_unavailable") &&
+            this.deps.permissionRuleOrg === undefined) {
+            throw new CheckpointError("checkpoint.unsupported_version", `this checkpoint's approval was minted under organization governance (${preCasGateBit.origin}) and this worker has no org adjudication wiring (permissionRuleOrg) — a governed approval may only be redeemed where governance can be enforced; the checkpoint stays pending, resume it on an org-wired worker`);
+        }
         const retiredWalltimeTotal = cp.resourceLedger?.totalWalltimeSec;
         if (retiredWalltimeTotal !== undefined) {
             throw new CheckpointError("checkpoint.walltime_axis_retired", "this checkpoint's ledger carries a cross-slice WALL-CLOCK allocation (resourceLedger.totalWalltimeSec), an axis this engine version retired — " +
@@ -4009,13 +4024,24 @@ export class Runner {
                 return;
             }
         }
+        const gateRealApproval = resume.cp.gate.kind === "irreversible_ask" ? resume.cp.gate.realApproval : undefined;
+        const gateOrgGoverned = gateRealApproval?.origin === "org_rule" || gateRealApproval?.origin === "org_unavailable";
+        if (gateOrgGoverned && prepared.permissionRuleOrg === undefined) {
+            const unwiredDenial = formatHookFeedback(`The approved tool call "${pendingAction.toolName}" was not executed: its approval was minted under organization governance (${gateRealApproval.origin}), and this worker has no org adjudication wiring — a governed approval may only be redeemed where governance can be enforced. This approval is spent; re-issue the call on an org-wired worker.`);
+            emitEnd(true, { content: unwiredDenial });
+            const eid = await prepared.session.appendMessage(toolResultMsg(pendingAction.toolCallId, pendingAction.toolName, unwiredDenial, true));
+            emitCommitted(eid, "toolResult", pendingAction.toolCallId);
+            return;
+        }
         if (prepared.permissionRuleOrg !== undefined) {
             const orgVerdict = prepared.permissionRuleOrg
                 .adjudicate({ toolName: pendingAction.toolName, args: resolvedArgs, toolCallId: pendingAction.toolCallId })
                 .catch(() => ({ status: "unavailable", disclosures: ["the org adjudication face threw on resume"] }));
             const org = await settleOrgVerdictWithin(orgVerdict, { status: "unavailable", disclosures: [`the org adjudication face did not answer within ${ORG_ADJUDICATION_TIMEOUT_MS}ms (or the task ended first)`] }, { signal: prepared.abortController.signal, timeoutMs: ORG_ADJUDICATION_TIMEOUT_MS });
             const blocked = org.status === "unavailable"
-                ? "this deployment is org-governed and cannot currently adjudicate against an organization policy snapshot"
+                ? gateRealApproval?.origin === "org_unavailable"
+                    ? undefined
+                    : "this deployment is org-governed and cannot currently adjudicate against an organization policy snapshot"
                 : org.verdict?.behavior === "deny"
                     ? `an organization policy rule (${org.verdict.rule}) denies it`
                     : undefined;

package/dist/core/runner/session-file-state-replay.js

@@ -1,4 +1,5 @@
 import { isAbsolutePathForm } from "../../tools/fs/safety.js";
+import { isOffloadedDetailReplacement } from "../tool-result-store.js";
 const READ_TOOL = "Read";
 const WRITE_TOOL = "Write";
 const RETRACTING_RESULTS = [
@@ -50,6 +51,8 @@ export function wholeFileRecordsFromTranscript(messages) {
         const content = isRead ? wholeFileFromReadCard(rest) : typeof rest.content === "string" ? rest.content : undefined;
         if (content === undefined)
             continue;
+        if (isOffloadedDetailReplacement(content))
+            continue;
         byPath.set(filePath, { path: filePath, content, at: m.timestamp });
     }
     return [...byPath.values()];

package/dist/core/tool-policy.js

@@ -122,12 +122,9 @@ export function createAllowDenyPolicy(opts) {
             if (entry.startsWith("mcp__")) {
                 const segments = entry.slice("mcp__".length).split("__");
                 if (segments.some((seg) => seg.length === 0)) {
-                    invalid.push({
-                        entry,
-                        list,
-                        message: `"${entry}" is a malformed MCP tool name (empty segment) — it can never match any mounted tool. ` +
-                            `Use \`mcp__<server>\` for every tool of a server, or \`mcp__<server>__<tool>\` for one tool.`,
-                    });
+                    const lesson = `a malformed MCP tool name (empty segment) — it can never match any mounted tool. ` +
+                        `Use \`mcp__<server>\` for every tool of a server, or \`mcp__<server>__<tool>\` for one tool.`;
+                    invalid.push({ entry, list, message: `"${entry}" is ${lesson}`, lesson });
                     continue;
                 }
             }
@@ -135,14 +132,11 @@ export function createAllowDenyPolicy(opts) {
                 kept.push(entry);
                 continue;
             }
-            invalid.push({
-                entry,
-                list,
-                message: `"${entry}" is a rule CONTENT form, not a tool name — a name set matches raw tool names, so this entry ` +
-                    `can never match any mounted tool (in an allow list it removes the tool entirely). Use the tool NAME here, ` +
-                    `and route the narrowing through the lane that speaks this grammar: parameter rules via ` +
-                    `createPermissionRulePolicy, Bash command prefixes via the persisted allow-rule lane.`,
-            });
+            const lesson = `a rule CONTENT form, not a tool name — a name set matches raw tool names, so this entry ` +
+                `can never match any mounted tool (in an allow list it removes the tool entirely). Use the tool NAME here, ` +
+                `and route the narrowing through the lane that speaks this grammar: parameter rules via ` +
+                `createPermissionRulePolicy, Bash command prefixes via the persisted allow-rule lane.`;
+            invalid.push({ entry, list, message: `"${entry}" is ${lesson}`, lesson });
         }
         return kept;
     };
@@ -150,8 +144,16 @@ export function createAllowDenyPolicy(opts) {
     const screenedDeny = screen(opts.deny, "deny");
     if (invalid.length > 0) {
         if ((opts.onInvalidName ?? "throw") === "throw") {
+            const byLesson = new Map();
+            for (const i of invalid) {
+                const group = byLesson.get(i.lesson) ?? [];
+                group.push({ entry: i.entry, list: i.list });
+                byLesson.set(i.lesson, group);
+            }
             const e = new Error(`createAllowDenyPolicy: ${invalid.length} entr${invalid.length === 1 ? "y is" : "ies are"} not tool name(s):\n` +
-                invalid.map((i) => `  [${i.list}] ${i.message}`).join("\n"));
+                [...byLesson.entries()]
+                    .map(([lesson, group]) => `  Each of the following is ${lesson}\n` + group.map((g) => `    [${g.list}] "${g.entry}"`).join("\n"))
+                    .join("\n"));
             e.code = "config.invalid_tool_name_set";
             e.issues = invalid;
             throw e;

package/dist/core/tool-result-store.d.ts

@@ -240,5 +240,13 @@ export declare function withToolResultOffload(tool: AgentTool, store: ToolResult
  *  ⇒ byte-identical historic preview. An accessor (not a snapshot) because the wrap happens at
  *  prepare time, before the deferred classification exists and before any activation can. */
 reachableTools?: () => ReadonlySet<string> | undefined): AgentTool;
+/** The machine-recognizable start of an offloaded-detail replacement notice. Exported for consumers
+ *  that treat a `details` string as SEMANTIC INPUT (not display) — e.g. the session-continuation
+ *  read-state replay — so they can tell "this member was offloaded, the bytes here are a preview"
+ *  and degrade honestly instead of consuming preview bytes as the real value. */
+export declare const OFFLOADED_DETAIL_NOTICE_PREFIX = "\u2026[offloaded \u2014 ";
+/** True when `s` carries an offloaded-detail replacement notice (the newline-anchored prefix form the
+ *  walk emits). A semantic consumer treats such a string as NOT the member's real bytes. */
+export declare function isOffloadedDetailReplacement(s: string): boolean;
 /** The injected `read_tool_result` tool: pages through an offloaded result. `effect:"read"` (verifier/reconcile-safe). */
 export declare function createReadToolResultTool(store: ToolResultStore): AgentTool;

package/dist/core/tool-result-store.js

@@ -121,6 +121,8 @@ export function firstPartyOffloadPolicy(toolName) {
     switch (toolName) {
         case "Read":
             return { offload: false };
+        case "Write":
+            return { offload: false };
         case "Bash":
             return { offloadThresholdChars: 30_000 };
         case "Grep":
@@ -164,21 +166,93 @@ export function withToolResultOffload(tool, store, thresholdChars, sessionId, re
         return tool;
     const wrappedExecute = async (toolCallId, params, signal, onUpdate) => {
         const res = await tool.execute(toolCallId, params, signal, onUpdate);
+        const offloadedDetails = res.details === undefined ? undefined : await offloadOversizedDetailStrings(res.details, store, thresholdChars, sessionId, toolCallId);
+        const withDetails = (r) => offloadedDetails === undefined || offloadedDetails.value === res.details ? r : { ...r, details: offloadedDetails.value };
         if (totalTextChars(res.content) <= thresholdChars)
-            return res;
+            return withDetails(res);
         const full = res.content
             .filter((b) => b.type === "text")
             .map((b) => b.text)
             .join("\n");
         if (full.length <= PREVIEW_HEAD_CHARS + PREVIEW_TAIL_CHARS)
-            return res;
+            return withDetails(res);
         const ref = buildToolResultRef(sessionId, toolCallId);
         await store.put(ref, full);
         const images = res.content.filter((b) => b.type !== "text");
-        return { ...res, content: [{ type: "text", text: buildPreview(full, ref, undefined, reachableTools?.()) }, ...images] };
+        return withDetails({ ...res, content: [{ type: "text", text: buildPreview(full, ref, undefined, reachableTools?.()) }, ...images] });
     };
     return { ...tool, execute: wrappedExecute };
 }
+const OFFLOADED_DETAIL_HEAD_CHARS = 2_000;
+const OFFLOADED_DETAIL_NOTICE_ALLOWANCE_CHARS = 400;
+export const OFFLOADED_DETAIL_NOTICE_PREFIX = "…[offloaded — ";
+export function isOffloadedDetailReplacement(s) {
+    return s.includes(`\n${OFFLOADED_DETAIL_NOTICE_PREFIX}`);
+}
+async function offloadOversizedDetailStrings(details, store, thresholdChars, sessionId, toolCallId) {
+    const puts = [];
+    const onStack = new Set();
+    const isPlainObject = (v) => {
+        if (typeof v !== "object" || v === null)
+            return false;
+        const p = Object.getPrototypeOf(v);
+        return p === Object.prototype || p === null;
+    };
+    const replace = (full, path) => {
+        const detailRef = buildToolResultRef(sessionId, toolCallId + " " + path);
+        puts.push(Promise.resolve(store.put(detailRef, full)));
+        return (`${full.slice(0, OFFLOADED_DETAIL_HEAD_CHARS)}\n` +
+            `${OFFLOADED_DETAIL_NOTICE_PREFIX}${full.length} chars total; ref "${detailRef}"; the remainder is retained in this run's tool-result store and reads back through the deployment's tool-results face]`);
+    };
+    const memo = new Map();
+    const walk = (v, segs) => {
+        if (typeof v === "string")
+            return v.length > thresholdChars && v.length > OFFLOADED_DETAIL_HEAD_CHARS + OFFLOADED_DETAIL_NOTICE_ALLOWANCE_CHARS ? replace(v, JSON.stringify(segs)) : v;
+        if (Array.isArray(v)) {
+            if (onStack.has(v))
+                return v;
+            const done = memo.get(v);
+            if (done !== undefined)
+                return done;
+            onStack.add(v);
+            let changed = false;
+            const next = v.map((item, i) => {
+                const w = walk(item, [...segs, i]);
+                if (w !== item)
+                    changed = true;
+                return w;
+            });
+            onStack.delete(v);
+            const result = changed ? next : v;
+            memo.set(v, result);
+            return result;
+        }
+        if (isPlainObject(v)) {
+            if (onStack.has(v))
+                return v;
+            const done = memo.get(v);
+            if (done !== undefined)
+                return done;
+            onStack.add(v);
+            let changed = false;
+            const next = {};
+            for (const [k, item] of Object.entries(v)) {
+                const w = walk(item, [...segs, k]);
+                if (w !== item)
+                    changed = true;
+                Object.defineProperty(next, k, { value: w, enumerable: true, writable: true, configurable: true });
+            }
+            onStack.delete(v);
+            const result = changed ? next : v;
+            memo.set(v, result);
+            return result;
+        }
+        return v;
+    };
+    const value = walk(details, []);
+    await Promise.all(puts);
+    return { value };
+}
 export function createReadToolResultTool(store) {
     return defineTool({
         name: OFFLOAD_TOOL_NAME,

package/dist/core/types.d.ts

@@ -4188,11 +4188,13 @@ export interface RunnerDeps {
      * they confirmed once is not asked about again.
      *
      * This is the one seam in this file that LOOSENS, and it is shaped so it can only do so within limits
-     * the engine holds. The provider hands out a READ face anchored to one verified principal; the write
-     * face is core-private, so a deployment has no API path to put a rule in — that goes through the
-     * approval-record protocol, which requires a confirmed human decision. Rules are consumed post-fold, in
-     * the gate's ask branch, and never resolve an ask carrying `requiresRealApproval` or one a PreToolUse
-     * hook raised.
+     * the engine holds. The provider hands out a READ face anchored to one verified principal. The write
+     * face is an exported BACKEND CONTRACT (ruled 2026-08-10: an out-of-repo store twin builds against the
+     * same definitions instead of mirroring them), but the ENGINE reaches it only on the consent lanes —
+     * redemption of a confirmed human decision, the tighten-delete, and the sync join — a wiring invariant
+     * pinned by a registered-caller scan (test/permission-rule-writer-callers); no exported convenience
+     * mints a rule around consent. Rules are consumed post-fold, in the gate's ask branch, and never
+     * resolve an ask carrying `requiresRealApproval` or one a PreToolUse hook raised.
      *
      * Omitted ⇒ the lane does not exist: no rules are read, no field is added to any ask, and the decision
      * path is byte-identical to a build without it. An unauthenticated task (no `principal`) resolves to

package/dist/index.d.ts

@@ -88,7 +88,7 @@ export { HAND_TOOL_EFFECTS, bashReversibilityProbe, BASH_READONLY_DEFAULT_ALLOW,
 export { classifyCompoundReadonlyDetailed, formatOutOfRootReadApprovalOption, type BashReadonlyRootBoundary, type CompoundReadonlyVerdict, } from "./tools/fs/index.js";
 export { resolveBashTimeoutCaps } from "./tools/fs/index.js";
 export { InMemoryToolResultStore, OFFLOAD_TOOL_NAME, DEFAULT_TOOL_RESULT_THRESHOLD_CHARS, assertSafeToolResultRef, buildToolResultRef, type ToolResultStore, type ToolResultSlice, } from "./core/tool-result-store.js";
-export { InMemoryCheckpointStore, CheckpointError, mintCheckpointToken, checkpointVersionOf, CURRENT_CHECKPOINT_VERSION, MAX_SUPPORTED_CHECKPOINT_VERSION, ORG_ADMISSION_CHECKPOINT_VERSION, F012_CHECKPOINT_VERSION, RESOURCE_CHECKPOINT_VERSION, TOKEN_CHECKPOINT_VERSION, debitLedger, remainingBudgetMicroUsd, remainingTokens, winnerFromOutcome, validatePendingSteer, readPendingSteerQueue, appendPendingSteer, MAX_PENDING_STEER_CHARS, MAX_PENDING_STEER_ENTRIES, PENDING_STEER_QUEUE_BYTE_BUDGET_BYTES, PENDING_STEER_FROZEN_FIELDS, ACTOR_ASSERTION_FROZEN_FIELDS, MAX_ACTOR_FIELD_CHARS, MAX_STEER_INPUT_ID_CHARS, LEGACY_PENDING_STEER_INPUT_ID, type ActorAssertion, type PendingSteerEntry, type PendingSteerInput, riskSeverity, buildRiskDescriptor, summarizeCheckpoint, type RiskDescriptor, type CheckpointStore, type CheckpointSummary, type Checkpoint, type CheckpointToken, type CheckpointGate, type CheckpointState, type SerializedCheckpointState, type CheckpointFaultMode, type PendingAction, type ResumeOutcome, type ResolvedOutcome, type ReopenReason, type ResolveExpectation, type SafetyAxis, type ResourceLedger, type ResourceLimitReason, type PlatformLimitReason, } from "./core/checkpoint-store.js";
+export { InMemoryCheckpointStore, CheckpointError, mintCheckpointToken, checkpointVersionOf, CURRENT_CHECKPOINT_VERSION, MAX_SUPPORTED_CHECKPOINT_VERSION, ORG_ADMISSION_CHECKPOINT_VERSION, F012_CHECKPOINT_VERSION, RESOURCE_CHECKPOINT_VERSION, TOKEN_CHECKPOINT_VERSION, debitLedger, remainingBudgetMicroUsd, remainingTokens, winnerFromOutcome, validatePendingSteer, readPendingSteerQueue, appendPendingSteer, MAX_PENDING_STEER_CHARS, MAX_PENDING_STEER_ENTRIES, PENDING_STEER_QUEUE_BYTE_BUDGET_BYTES, PENDING_STEER_FROZEN_FIELDS, ACTOR_ASSERTION_FROZEN_FIELDS, MAX_ACTOR_FIELD_CHARS, MAX_STEER_INPUT_ID_CHARS, LEGACY_PENDING_STEER_INPUT_ID, type ActorAssertion, type PendingSteerEntry, type PendingSteerInput, riskSeverity, buildRiskDescriptor, summarizeCheckpoint, type RiskDescriptor, type CheckpointStore, type CheckpointSummary, type Checkpoint, type CheckpointToken, type CheckpointGate, type CheckpointState, type SerializedCheckpointState, type CheckpointFaultMode, type PendingAction, type ResumeOutcome, type ResolvedOutcome, type ReopenReason, type ResolveExpectation, type SafetyAxis, type RealApprovalGateBit, type ResourceLedger, type ResourceLimitReason, type PlatformLimitReason, } from "./core/checkpoint-store.js";
 export { InMemoryUsageWindowStore, GLOBAL_USAGE_KEY, EMPTY_USAGE_WINDOW_RECORD, chargeUsageRecord, readUsageRecord, usageRetryAfterMs, resolveUsageWindows, type UsageWindow, type UsageWindowStore, type UsageWindowReading, type UsageWindowRecord, type UsageSlot, type UsageBucketRow, } from "./core/usage-window-store.js";
 export { FileUsageWindowStore } from "./stores/file/usage-window-store.js";
 export { ENV_LIFETIME_SUSPEND_MARGIN_MS, USAGE_WINDOW_REAP_MARGIN_MS } from "./core/runner/prepare-task.js";
@@ -136,14 +136,20 @@ export { createPermissionRulePolicy, validatePermissionRules, parsePermissionRul
 /**
  * design/179 — persisted ALLOW rules: the standing form of approvals a person already gave.
  *
- * Note what is NOT here. `PermissionRuleWriter` is core-private and never exported, so a deployment has
- * no API path that puts a rule in the store; every rule that enters through the engine comes out of the
- * consent protocol below (a durable approval record, an authenticated confirmation, a principal-bound
- * redemption). Removal is exported without that ceremony, because narrowing on a user's behalf is allowed
- * and widening is not.
+ * The consent boundary, restated precisely (ruled 2026-08-10): the ENGINE's only write
+ * path into a rule store is the consent protocol below (a durable approval record, an authenticated
+ * confirmation, a principal-bound redemption). That fact is a property of the engine's wiring, not of
+ * what this file exports — a deployment always owned its own storage bytes. The BACKEND CONTRACT
+ * (writer types, the writer handle key, and the fold pure functions) is therefore exported further
+ * down, so an out-of-repo store implementation (the server's SQL twin) is built against the same
+ * definitions as the file backend instead of mirroring them — mirrored types are how comment/contract
+ * drift starts. What stays deliberately absent is any convenience that mints rules AROUND consent:
+ * exporting the contract gives a store implementer the same powers it already had over its own bytes,
+ * and nothing more. Removal is exported without ceremony, because narrowing on a user's behalf is
+ * allowed and widening is not.
  */
 export { parseAllowRuleText, formatAllowRuleText, ruleAdmitsCommand, findAdmittingRule, suggestRulesForCommand, scopeCoversCwd, pathWithinRoot, isRuleLive, BARE_INTERPRETER_NAMES, MAX_RULE_TEXT_CHARS, type PersistedAllowRule, type RuleTombstone, type RuleScope, type RuleDot, type RuleAdd, type RuleAddOrigin, type RuleSuggestion, type RuleReject, type RuleRejectCode, type ParsedAllowRule, type PersistedRuleTool, type PersistedRuleMatch, } from "./core/permission-rule-model.js";
-export { removePersistedRule, applyTombstones, sameScope, InMemoryPermissionRuleStore, EMPTY_RULE_STORE, type PermissionRuleStore, type PermissionRuleStoreProvider, type StoredAllowRules, type RemoveResult, type PutResult, joinRuleStates, screenRuleSyncState, collectBelowFrontier, ruleSyncVector, joinFrontiers, dotAtOrBelowFrontier, sameRuleOwner, type RuleSyncState, type RuleSyncFrontier, type RuleSyncDrop, type RuleSyncLandingReport, type RuleOwner, type QuarantinedRuleAdd, } from "./core/permission-rule-store.js";
+export { removePersistedRule, applyTombstones, sameScope, InMemoryPermissionRuleStore, EMPTY_RULE_STORE, type PermissionRuleStore, type PermissionRuleStoreProvider, type StoredAllowRules, type RemoveResult, type PutResult, joinRuleStates, screenRuleSyncState, collectBelowFrontier, ruleSyncVector, joinFrontiers, dotAtOrBelowFrontier, sameRuleOwner, type RuleSyncState, type RuleSyncFrontier, type RuleSyncDrop, type RuleSyncLandingReport, type RuleOwner, type QuarantinedRuleAdd, PERMISSION_RULE_WRITER, writerOf, foldDelta, addDotsOf, assertDeleteDeltaCarriesNoAdd, assertRedemptionNotQuarantined, type PermissionRuleWriter, type WritablePermissionRuleStore, type RuleWriteDelta, type RuleAddDelta, type RuleDeleteDelta, type RuleSyncJoinDelta, type RawRuleSyncState, type RedemptionAuthorization, } from "./core/permission-rule-store.js";
 export { syncPermissionRules, parseRuleSyncResponse, PERMISSION_RULE_SYNC_PATH, LOCAL_OWNER_UNSYNCABLE_CODE, type PermissionRuleSyncTransport, type PermissionRuleSyncResult, type RuleSyncRequestBody, type RuleSyncResponseBody, } from "./core/permission-rule-sync.js";
 export { createOrgRuleOverlay, orgRuleVerdictFor, effectivePermissionRules, orgRuleStatePersistenceOf, ORG_UNAVAILABLE_DECISION_REASON, ORG_RULE_DECISION_REASON, ORG_ADJUDICATION_TIMEOUT_MS, type OrgPermissionRule, type OrgRuleSnapshot, type OrgRuleSnapshotProvider, type OrgRuleStatePersistence, type PersistedOrgRuleState, type OrgRuleOverlay, type OrgOverlayResolution, type OrgOverlayStatus, type EffectivePermissionRule, } from "./core/permission-rule-org.js";
 export { RULE_SYNC_DROP_CODES, type RuleSyncDropReason, type RuleQuarantineReason } from "./core/governance-codes.js";

package/dist/index.js

@@ -112,7 +112,7 @@ export { buildAutoModePrompt, renderAutoModeWindow, renderAutoModeAction, AUTO_M
 export { AUTO_MODE_BASE_PROMPT, AUTO_MODE_PERMISSIONS_EXTERNAL } from "./core/auto-mode-prompt-assets.js";
 export { createPermissionRulePolicy, validatePermissionRules, parsePermissionRule, wildcardMatch, } from "./core/permission-rules.js";
 export { parseAllowRuleText, formatAllowRuleText, ruleAdmitsCommand, findAdmittingRule, suggestRulesForCommand, scopeCoversCwd, pathWithinRoot, isRuleLive, BARE_INTERPRETER_NAMES, MAX_RULE_TEXT_CHARS, } from "./core/permission-rule-model.js";
-export { removePersistedRule, applyTombstones, sameScope, InMemoryPermissionRuleStore, EMPTY_RULE_STORE, joinRuleStates, screenRuleSyncState, collectBelowFrontier, ruleSyncVector, joinFrontiers, dotAtOrBelowFrontier, sameRuleOwner, } from "./core/permission-rule-store.js";
+export { removePersistedRule, applyTombstones, sameScope, InMemoryPermissionRuleStore, EMPTY_RULE_STORE, joinRuleStates, screenRuleSyncState, collectBelowFrontier, ruleSyncVector, joinFrontiers, dotAtOrBelowFrontier, sameRuleOwner, PERMISSION_RULE_WRITER, writerOf, foldDelta, addDotsOf, assertDeleteDeltaCarriesNoAdd, assertRedemptionNotQuarantined, } from "./core/permission-rule-store.js";
 export { syncPermissionRules, parseRuleSyncResponse, PERMISSION_RULE_SYNC_PATH, LOCAL_OWNER_UNSYNCABLE_CODE, } from "./core/permission-rule-sync.js";
 export { createOrgRuleOverlay, orgRuleVerdictFor, effectivePermissionRules, orgRuleStatePersistenceOf, ORG_UNAVAILABLE_DECISION_REASON, ORG_RULE_DECISION_REASON, ORG_ADJUDICATION_TIMEOUT_MS, } from "./core/permission-rule-org.js";
 export { RULE_SYNC_DROP_CODES } from "./core/governance-codes.js";

package/dist/stores/file/adoption/adopt.js

@@ -500,8 +500,8 @@ export async function adoptLocalDataRoot(opts) {
                     };
                 }
             }
-            if (opts.from.kind === "principal" && legBits[SESSION_POLICY_LEG]?.done !== true) {
-                const rows = rewriteSessionPolicyRows(opts.root, opts.from.principal, opts.toPrincipal);
+            if (legBits[SESSION_POLICY_LEG]?.done !== true) {
+                const rows = rewriteSessionPolicyRows(opts.root, opts.from.kind === "principal" ? opts.from.principal : null, opts.toPrincipal);
                 legBits = { ...legBits, [SESSION_POLICY_LEG]: { done: true, rows } };
                 publishMarker(opts.root, adoptionId, opts.from, opts.toPrincipal, 2, plan, legBits);
             }
@@ -557,12 +557,7 @@ export async function adoptLocalDataRoot(opts) {
         }
         if (plan.rulesDir !== undefined)
             legs.push({ store: "permission-rule", action: "bucket-rebind" });
-        if (opts.from.kind === "principal") {
-            legs.push({ store: SESSION_POLICY_LEG, action: "row-rewrite", rows: legBits[SESSION_POLICY_LEG]?.rows ?? 0 });
-        }
-        else {
-            legs.push({ store: SESSION_POLICY_LEG, action: "none" });
-        }
+        legs.push({ store: SESSION_POLICY_LEG, action: "row-rewrite", rows: legBits[SESSION_POLICY_LEG]?.rows ?? 0 });
         const carried = Object.entries(legBits)
             .filter(([k]) => k.startsWith(CARRIAGE_BIT_PREFIX))
             .map(([k, bit]) => ({

package/dist/stores/file/adoption/marker.d.ts

@@ -153,18 +153,26 @@ export type RootAdoptionFile = {
 export declare const ROOT_ADOPTION_FILE = "adoption.json";
 /**
  * design/183 §6 (r4) — the CLOSED SET of by-design-not-migrated assets, verbatim from the design's
- * written list. Lives HERE (beside the reader) because the terminal validator enforces EXACT
- * equality: the report is the account's recovery source, and a reduced-or-grown list at read time
- * is either damage or drift — both refused (§10.5 ①).
+ * written list. The WRITER emits exactly this list and the drift pin (§10.5 ① — the design-vs-code
+ * two-cell guard) lives in the TEST GRID, where a ruled growth of the set is a deliberate edit.
+ *
+ * #133: the terminal READ validator deliberately does NOT compare a stored report against this
+ * constant. A persisted report is a snapshot of the set AS RULED AT ADOPTION TIME; the set is
+ * allowed to grow by ruling (§10.5 ① names that road), so an exact-equality read check would mark
+ * every already-adopted root corrupt on the release after any growth (and again on rollback) — 13
+ * construction sites all refusing to serve. The read validator checks SHAPE and integrity
+ * (non-empty, well-formed entries, no duplicate assets — what an empty/mangled account rebuild
+ * actually needs), never version-crossed content equality.
  */
 export declare const NOT_MIGRATED_BY_DESIGN: ReadonlyArray<{
     asset: string;
     ruling: string;
 }>;
-/** The five baseline obligation IDENTITIES (design/183 §6 minimum face). The terminal validator
- *  requires them all: a "reduced but shaped" report would otherwise rebuild a thinner account.
- *  The writer's `baselineConfigs` emits exactly these — any drift breaks the writer's own
- *  read-back immediately (self-checking pair). */
+/** The five baseline obligation IDENTITIES (design/183 §6 minimum face). Since #133 the terminal READ
+ *  validator deliberately does NOT compare a stored report against this table (the stored report is a
+ *  snapshot of the set as ruled at adoption time; see the validator's own note) — the enforcement that
+ *  the WRITER emits exactly this set lives in the test grid (test/file-adoption-root.test.ts pins the
+ *  fresh report's identities against this constant), where a drift is a deliberate, reviewable edit. */
 export declare const BASELINE_CONFIG_IDENTITIES: ReadonlyArray<{
     deployment: string;
     key: string;

package/dist/stores/file/adoption/marker.js

@@ -74,7 +74,7 @@ function isRootAdoptionFileShape(v) {
             }
         }
         const legs = (m.legs ?? {});
-        if (m.phase >= 3 && m.from.kind === "principal" && legs["session-policy"]?.done !== true)
+        if (m.phase >= 3 && legs["session-policy"]?.done !== true)
             return false;
         if (m.phase === 5) {
             for (const store of p.carriage) {
@@ -123,14 +123,21 @@ function isRootAdoptionFileShape(v) {
                     return false;
                 configIds.add(id);
                 return true;
-            }) &&
-            BASELINE_CONFIG_IDENTITIES.every((b) => configIds.has(JSON.stringify([b.deployment, b.key])));
+            });
         const nmd = r.notMigratedByDesign;
+        const nmdAssets = new Set();
         const closedSetOk = Array.isArray(nmd) &&
-            nmd.length === NOT_MIGRATED_BY_DESIGN.length &&
-            NOT_MIGRATED_BY_DESIGN.every((m, i) => {
-                const e = nmd[i];
-                return (e !== null && typeof e === "object" && e.asset === m.asset && e.ruling === m.ruling);
+            nmd.length > 0 &&
+            nmd.every((e) => {
+                if (e === null || typeof e !== "object")
+                    return false;
+                const m = e;
+                if (typeof m.asset !== "string" || m.asset === "" || typeof m.ruling !== "string" || m.ruling === "")
+                    return false;
+                if (nmdAssets.has(m.asset))
+                    return false;
+                nmdAssets.add(m.asset);
+                return true;
             });
         const legsOk = Array.isArray(r.legs) &&
             r.legs.every((l) => {

package/dist/stores/file/session-policy-store.d.ts

@@ -31,6 +31,15 @@ export interface FileSessionPolicyStoreOptions {
 export declare class FileSessionPolicyStore implements SessionPolicyStore {
     private readonly dir;
     private readonly onCorruptRead;
+    /** #132 — the ADOPTED identity of a local-owner root's anonymous lane, or undefined on an
+     *  unadopted (or principal-adopted) root. A local-owner adoption rebinds the anonymous
+     *  `[sid,null]` estate rows to `toPrincipal`; until the deployment's principal wiring lands
+     *  (`REQUIRE_PRINCIPAL` et al. — recorded `migrated:false` in the config account, an operator
+     *  action), the runtime still queries anonymously, and ENOENT there would silently drop the very
+     *  tighten-only deny rules the rebind moved. Adoption is a transfer of the whole anonymous
+     *  identity, so on such a root the anonymous key IS the adopted principal — reads and writes
+     *  alike (a window-era anonymous write must not mint a fresh orphan row). */
+    private readonly anonymousAlias;
     constructor(root: string, opts?: FileSessionPolicyStoreOptions);
     /** The one delivery point for {@link onCorruptRead}. Swallow-guarded here so no caller has to remember. */
     private disclose;
@@ -41,7 +50,8 @@ export declare class FileSessionPolicyStore implements SessionPolicyStore {
      *  (swallow-guarded; never on a plain ENOENT, which really is absence). */
     private discloseCorrupt;
     /** `(sessionId, principal)` → a safe, INJECTIVE filename (sanitizeScope appends the full sha256 of the raw
-     *  composite key, so distinct keys never collide on disk). */
+     *  composite key, so distinct keys never collide on disk). On a local-owner-adopted root the
+     *  anonymous lane resolves to the adopted principal's key (#132 — see {@link anonymousAlias}). */
     private pathFor;
     private read;
     getRules(sessionId: string, principal?: string): Promise<StoredSessionRules | null>;

package/dist/stores/file/session-policy-store.js

@@ -2,15 +2,19 @@ import { readFileSync, readdirSync, unlinkSync } from "node:fs";
 import { join } from "node:path";
 import { loosenReasons, normalizeRules, stripRev, SessionPolicyError, } from "../../core/session-policy-store.js";
 import { atomicWriteFile, ensureDir, sanitizeScope } from "./fs-atomic.js";
-import { assertAdoptionBootGate } from "./adoption/marker.js";
+import { assertAdoptionBootGate, readRootAdoptionFile } from "./adoption/marker.js";
 export class FileSessionPolicyStore {
     dir;
     onCorruptRead;
+    anonymousAlias;
     constructor(root, opts) {
         assertAdoptionBootGate(root, "FileSessionPolicyStore");
         this.dir = join(root, "session-policy");
         ensureDir(this.dir);
         this.onCorruptRead = opts?.onCorruptRead;
+        const adoption = readRootAdoptionFile(root);
+        this.anonymousAlias =
+            adoption !== undefined && "adopted" in adoption && adoption.adopted.from.kind === "local-owner" ? adoption.adopted.toPrincipal : undefined;
     }
     disclose(info) {
         try {
@@ -23,7 +27,8 @@ export class FileSessionPolicyStore {
         this.disclose({ sessionId, ...(principal !== undefined ? { principal } : {}), path: this.pathFor(sessionId, principal), reason });
     }
     pathFor(sessionId, principal) {
-        const composite = JSON.stringify([sessionId, principal ?? null]);
+        const effective = principal ?? this.anonymousAlias;
+        const composite = JSON.stringify([sessionId, effective ?? null]);
         return join(this.dir, `${sanitizeScope(composite)}.json`);
     }
     read(sessionId, principal) {
@@ -78,7 +83,7 @@ export class FileSessionPolicyStore {
             }
         }
         const next = { ...clean, rev: (prior?.rev ?? 0) + 1 };
-        atomicWriteFile(join(this.dir, "tmp"), this.pathFor(sessionId, principal), JSON.stringify({ ...next, __sid: sessionId, __principal: principal ?? null }));
+        atomicWriteFile(join(this.dir, "tmp"), this.pathFor(sessionId, principal), JSON.stringify({ ...next, __sid: sessionId, __principal: (principal ?? this.anonymousAlias) ?? null }));
         return next;
     }
     async listBySession(sessionId) {

package/dist/tools/fs/fs-bash.js

@@ -14,9 +14,12 @@ import { BASH_READONLY_DEFAULT_ALLOW, coarseReadonlyCheck, classifyBoundedReadon
 export function bashReversibilityProbe(allow, boundary) {
     const allowSet = new Set(allow ?? BASH_READONLY_DEFAULT_ALLOW);
     return (args) => {
-        const command = args?.command;
+        const a = args;
+        const command = a?.command;
         if (typeof command !== "string")
             return { reversible: false };
+        if (a?.run_in_background === true)
+            return { reversible: false };
         const resolved = typeof boundary === "function" ? boundary() : boundary;
         if (classifyCompoundReadonly(command, allowSet, resolved) === undefined)
             return { reversible: true };
@@ -555,8 +558,8 @@ export function createBashTool(env, rootCanonical, coAuthor = false, cwdRef = {
                 const bgCappedByMax = appliedTimeoutSec !== undefined && requestedTimeoutSec !== undefined && typeof bgCaps.maxBgTimeoutSec === "number" && requestedTimeoutSec > bgCaps.maxBgTimeoutSec;
                 const budgetNote = appliedTimeoutSec !== undefined
                     ? bgCappedByMax
-                        ? ` Time budget: requested ${requestedTimeoutSec}s, capped at ${bgCaps.maxBgTimeoutSec}s (env ceiling: requests above ${bgCaps.maxBgTimeoutSec}s are reduced to it) — auto-terminates if still running after ${appliedTimeoutSec}s.`
-                        : ` Time budget: auto-terminates if still running after ${appliedTimeoutSec}s (hard cap ${bgCaps.maxBgTimeoutSec}s).`
+                        ? ` Time budget: requested ${requestedTimeoutSec}s, capped at ${bgCaps.maxBgTimeoutSec}s (env ceiling: requests above ${bgCaps.maxBgTimeoutSec}s are reduced to it) — the process may run up to ${appliedTimeoutSec}s.`
+                        : ` Time budget: the process may run up to ${appliedTimeoutSec}s (hard cap ${bgCaps.maxBgTimeoutSec}s).`
                     : "";
                 const lifetimeNote = backgroundLifetimeNote(bgCaps, bgSessionScoped, bgEnvIsolatedOwned);
                 const registry = taskOpts.taskRegistry;
@@ -655,7 +658,7 @@ export function createBashTool(env, rootCanonical, coAuthor = false, cwdRef = {
                         const tail = stdoutSoFar.slice(-1_000);
                         const adoptCaps = detachEnv.backgroundCapabilities;
                         const adoptBudgetNote = typeof adoptCaps.defaultBgTimeoutSec === "number" && typeof adoptCaps.maxBgTimeoutSec === "number"
-                            ? ` Time budget: auto-terminates if still running after ${Math.min(adoptCaps.defaultBgTimeoutSec, adoptCaps.maxBgTimeoutSec)}s (hard cap ${adoptCaps.maxBgTimeoutSec}s).`
+                            ? ` Time budget: the process may run up to ${Math.min(adoptCaps.defaultBgTimeoutSec, adoptCaps.maxBgTimeoutSec)}s (hard cap ${adoptCaps.maxBgTimeoutSec}s).`
                             : "";
                         return {
                             content: (cause === "timeout"

package/dist/tools/monitor.js

@@ -121,7 +121,7 @@ export function createMonitorTool(env, opts) {
             const envWallMs = bgTimeout !== undefined ? bgTimeout * 1000 : undefined;
             const envWallWins = !isPersistent && envWallMs !== undefined && envWallMs < timeoutMs;
             const persistentBudget = bgTimeout !== undefined
-                ? `the execution environment kills background processes after ${bgTimeout}s`
+                ? `the execution environment's background time budget ends the watch after ${bgTimeout}s`
                 : `the execution environment's background time budget still applies`;
             const retainedByEnv = env.backgroundCapabilities.retainBackgroundProcesses === true;
             const retainedBySpec = opts.retainBackgroundProcesses === true;
@@ -142,8 +142,8 @@ export function createMonitorTool(env, opts) {
             const lifetime = isPersistent
                 ? `It is persistent: no watch timeout of its own${timeoutIgnoredNote}, but ${persistentBudget}${persistentAnchor}`
                 : envWallWins
-                    ? `It will be killed after ${envWallMs}ms if still running — the execution environment's background time budget (${bgTimeout}s) is shorter than the ${timeoutMs}ms watch timeout${clampNote}, and the shorter of the two wins.`
-                    : `It will be killed after ${timeoutMs}ms${clampNote} if still running.`;
+                    ? `The watch may run up to ${envWallMs}ms — the execution environment's background time budget (${bgTimeout}s) is shorter than the ${timeoutMs}ms watch timeout${clampNote}, and the shorter of the two wins.`
+                    : `The watch may run up to ${timeoutMs}ms${clampNote}.`;
             const content = onNotify !== undefined
                 ? `Monitoring in background; task_id=${taskId}. Each stdout line becomes a notification event (lines within ` +
                     `~200ms are batched); you'll get a final notification with the exit code when it ends — do not poll. ` +

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sema-agent/core",
-  "version": "5.23.0",
+  "version": "5.24.0",
   "description": "Stateless, task-oriented AI agent core",
   "type": "module",
   "license": "BUSL-1.1",