@sema-agent/core 5.25.0 → 5.26.0

package/CHANGELOG.md

@@ -1,5 +1,71 @@
 # Changelog
 
+## 5.26.0 — 2026-08-11
+
+No API-BREAKING changes (exports grow only; new members optional/additive). Several
+behavior-surface narrowings — every one tighten-direction — called out below.
+
+### Narrowed (behavior, ruled)
+
+- **A remote execution env no longer teaches the memory write path.** With `executionEnv` remote
+  and a memory store mounted, the `# Memory` write instruction is withheld (the sandboxed hands
+  cannot reach the host store; teaching the path walked the model into receipting saves that never
+  land). A deployment persisting through its own closure restores it by declaring
+  `TaskSpec.memoryPersistenceCapable: true`. **Consumer note**: probes pinning "remote run carries
+  the write instruction" go red; re-pin on the declaration.
+- **`memoryPersistenceCapable: false` is enforced, not just disclosed.** Over a writable scope the
+  session mounts the read-only notice AND the write gate refuses file-tool writes into the memory
+  root (`read_only_layering`, loud), and the terminal/checkpoint harvest admits nothing — through
+  the engine's zero-admission arm, so the report half still runs: materialize-time inbound findings
+  and quarantine escalations are drained into a real `HarvestReport` (with a warning naming the
+  declaration) instead of a fabricated empty one.
+- **The read-only notice retraction is DECLARED-only.** Only an explicit
+  `memoryPersistenceCapable: true` retracts the engine's writeScope-null notice; a write-capable
+  roster alone (inferred capability) no longer strips it — the gate refuses those very writes, so
+  inference proved nothing about the store.
+- **Dual-root overlap is a prepare-time configuration error.** Two memory planes whose data roots
+  or control dirs overlap (either direction, either tier) are refused loudly at prepare instead of
+  running two engines over shared physical state.
+- **A shell-doctrine mark is positive-only and monotonic.** A negative `irreversibility` tier is
+  not a provenance mark; `shellGate:"classify"` never downgrades an explicitly marked `"always"`.
+  Deployments with marked tools will see asks that classify used to swallow.
+- **Tool-result refs are injective and conflict-typed (#119).** The mint hashes an injective
+  representation (four `~`-separated segments incl. a content digest); writing a different payload
+  under an existing ref is a typed `ref_conflict` error, never a silent overwrite; a damaged owner
+  record refuses whole.
+
+### Added
+
+- **`TaskSpec.memoryPersistenceCapable`** (tri-state, additive): `true` = the deployment vouches
+  for a persistence channel the engine cannot see; `false` = mandatory floor (disclosure + write
+  gate + zero-admission harvest); absent = inferred from the final roster. Crosses the delegation
+  boundary tighten-only (a parent's `false` binds the subtree; a child definition cannot loosen
+  it). Non-boolean values are refused loudly at both doors (`config.memory_persistence_invalid` /
+  `config.agent.invalid`).
+- **`MEMORY_READONLY_NOTICE` / `NO_PERSISTENT_MEMORY_NOTICE` exported**, and
+  **`MemoryInjection.readOnlyNotice`** (additive member): a session with no write channel is told
+  so instead of silently receipting saves; the standalone notice serves rosters the engine never
+  sees.
+- **`MemoryEngine.harvest` accepts `admitNothing`** (additive option): a real harvest that commits
+  nothing while still draining and announcing inbound findings.
+
+### Fixed
+
+- Delegation seats forward the capability floor (subagent arbitration, retained-resume folding,
+  workflow agent-type folding fill absence only).
+- The offloaded-detail notice allowance derives from the ref-mint ceiling (a literal sized against
+  the retired two-segment shape under-bounded the four-segment notice).
+- Ten stale-or-loose doc/comment spots from the merged-code rescan (classify doctrine conditionals
+  stated in public docs; JSDoc reattachments; TiDB sizing note states the four-segment mint).
+
+### Known residual (registered, not a regression)
+
+- The zero-copy File backend's read-side inbound sync adopts disk divergence independent of session
+  intent: bytes a shell lands under the memory root during a read-only or declared-false session
+  can be adopted at a later materialize (checkpoint-resume included). Registered with three
+  candidate fixes pending a direction ruling; the disclosure, gate, and harvest boundaries above
+  all hold — this is the remaining channel, stated here so the boundary's edges are explicit.
+
 ## 5.25.0 — 2026-08-10
 
 No API-BREAKING changes (exports grow only; every new member is optional/additive). One

package/dist/agents/agent-definition.js

@@ -4,5 +4,10 @@ export function defineAgent(def) {
         e.code = "config.agent.invalid";
         throw e;
     }
+    if (def.memoryPersistenceCapable !== undefined && typeof def.memoryPersistenceCapable !== "boolean") {
+        const e = new Error(`defineAgent("${def.name}"): memoryPersistenceCapable must be a boolean when present — got ${JSON.stringify(def.memoryPersistenceCapable)} (a string "false" would silently read as capable).`);
+        e.code = "config.agent.invalid";
+        throw e;
+    }
     return Object.freeze({ ...def });
 }

package/dist/agents/send-message-tool.js

@@ -682,6 +682,7 @@ export function createSendMessageTool(opts) {
                         ...(ctx.handsReadOnly === true ? { handsReadOnly: true } : {}),
                         ...(ctx.interactiveTools === false ? { interactiveTools: false } : {}),
                         ...(ctx.oneShot === true ? { oneShot: true } : {}),
+                        ...(ctx.memoryPersistenceCapable === false ? { memoryPersistenceCapable: false } : {}),
                     },
                     ...(ctx.autoModeReview !== undefined ? { currentAutoModeReview: ctx.autoModeReview } : {}),
                 });

package/dist/agents/subagent.d.ts

@@ -400,6 +400,7 @@ export declare function createSubagentResume(deps: {
         handsReadOnly?: true;
         interactiveTools?: false;
         oneShot?: true;
+        memoryPersistenceCapable?: false;
     };
     /** The RESUMING caller's own handback-review seat (its trusted `ToolExecuteContext.autoModeReview`),
      *  same turn-bound reasoning as `currentOnQuestion` above: a resumed cycle is a completion like any

package/dist/agents/subagent.js

@@ -522,6 +522,9 @@ export function createSubagentResume(deps) {
                 ...(entry.specSnapshot.handsReadOnly === true || deps.currentClamps?.handsReadOnly === true ? { handsReadOnly: true } : {}),
                 ...(entry.specSnapshot.interactiveTools === false || deps.currentClamps?.interactiveTools === false ? { interactiveTools: false } : {}),
                 ...(entry.specSnapshot.oneShot === true || deps.currentClamps?.oneShot === true ? { oneShot: true } : {}),
+                ...(entry.specSnapshot.memoryPersistenceCapable === false || deps.currentClamps?.memoryPersistenceCapable === false
+                    ? { memoryPersistenceCapable: false }
+                    : {}),
                 signal: abort.signal,
             };
             if (deps.registry !== undefined && deps.taskId !== undefined && deps.taskAccess !== undefined) {
@@ -1668,6 +1671,7 @@ function createSubagentToolNode(opts, depth, excluded, extraToolsBudget) {
             };
             const childThinking = def?.thinking ?? ctx.thinkingLevel;
             const provenanceAgentName = agentName ?? def?.name;
+            const childMemoryPersistenceCapable = ctx.memoryPersistenceCapable === false ? false : (def?.memoryPersistenceCapable ?? ctx.memoryPersistenceCapable);
             const childOnAsk = ctx.onAsk !== undefined
                 ? withDelegationProvenance(ctx.onAsk, {
                     parentToolCallId: ctx.toolCallId,
@@ -1689,6 +1693,7 @@ function createSubagentToolNode(opts, depth, excluded, extraToolsBudget) {
                 ...(ctx.onQuestion !== undefined ? { onQuestion: ctx.onQuestion } : {}),
                 ...(ctx.interactiveTools === false ? { interactiveTools: false } : {}),
                 ...(ctx.handsReadOnly === true ? { handsReadOnly: true } : {}),
+                ...(childMemoryPersistenceCapable !== undefined ? { memoryPersistenceCapable: childMemoryPersistenceCapable } : {}),
                 ...(ctx.oneShot === true ? { oneShot: true } : {}),
                 ...(ctx.clientContext !== undefined ? { clientContext: ctx.clientContext } : {}),
                 ...(ctx.excludeTools !== undefined ? { excludeTools: [...ctx.excludeTools] } : {}),

package/dist/core/hooks.js

@@ -342,11 +342,12 @@ export async function runToolGate(input) {
                 await notifier.notifyAsync(() => input.persistedRules?.onResolved?.({ toolName: req.toolName, toolCallId, rule: hit }), "toolGate.persistedRuleResolved");
             }
             else if (hit !== undefined) {
+                const shownRule = inlineUntrusted(hit, 200);
                 const mandateNoun = persistedRuleMandate === "operator_always" ? "this deployment mandates per-call confirmation for shell commands (shellGate: always)" : "this tool carries egress/irreversibility marks (a mandated confirmation a rule cannot clear)";
                 decision = {
                     ...decision,
-                    persistedRuleShadowed: hit,
-                    message: `${decision.message !== undefined ? `${decision.message} ` : ""}(a persisted allow rule (${hit}) matches this call but does not clear the ask — ${mandateNoun})`,
+                    persistedRuleShadowed: shownRule,
+                    message: `${decision.message !== undefined ? `${decision.message} ` : ""}(a persisted allow rule (${shownRule}) matches this call but does not clear the ask — ${mandateNoun})`,
                 };
             }
         }

package/dist/core/memory-engine/dual-root.js

@@ -31,13 +31,15 @@ export function mergeInjections(project, personal) {
     if (!personal)
         return project;
     const instruction = project.instruction || personal.instruction;
+    const readOnlyNotice = instruction === "" && project.readOnlyNotice !== undefined && personal.readOnlyNotice !== undefined ? project.readOnlyNotice : undefined;
     const indexParts = [project.index, personal.index].filter((s) => Boolean(s && s.trim()));
     const announcements = [...(project.announcements ?? []), ...(personal.announcements ?? [])];
     const announceParts = [project.announceBlock, personal.announceBlock].filter((s) => Boolean(s && s.trim()));
-    const blockParts = [instruction, ...indexParts, ...announceParts];
+    const blockParts = [instruction || readOnlyNotice, ...indexParts, ...announceParts];
     const indexSeed = project.indexSeed ?? personal.indexSeed;
     return {
         instruction,
+        ...(readOnlyNotice !== undefined ? { readOnlyNotice } : {}),
         ...(indexParts.length > 0 ? { index: indexParts.join("\n\n") } : {}),
         ...(announcements.length > 0 ? { announcements } : {}),
         ...(announceParts.length > 0 ? { announceBlock: announceParts.join("\n\n") } : {}),

package/dist/core/memory-engine/engine.d.ts

@@ -40,6 +40,37 @@ export declare const MEMORY_RECALL_DISCIPLINE = "Before answering questions abou
  * would forge the very account the three-tier discipline forbids forging).
  */
 export declare const MEMORY_PREFERENCE_DISCIPLINE = "When the user confirms a stored preference or fact still holds, refresh that entry's `last-confirmed: <YYYY-MM-DD>` frontmatter line (add it when absent). When you save a preference, add an `applies-when: <context>` frontmatter line naming when it applies. Both are plain frontmatter lines \u2014 write them yourself; nothing fills them in for you.";
+/**
+ * Corrections for announcement segments that carry store-mutation guidance ("record a fresh entry …
+ * tombstone the old one", minted in an earlier writable session) a session cannot act on. The queue
+ * items are opaque strings (rewriting them would be text surgery over minted-at-enqueue wording),
+ * so the correction is a trailing coda, not a rewrite — in two scopes, because the two mounting
+ * seats speak about different things (an unqualified "the memory store is not writable" beside
+ * another, WRITABLE plane's instruction would negate that plane's guidance):
+ * - PLANE scope, attached by `inject()` right after a read-only layering's own announcement block:
+ *   explicitly local to the immediately preceding notices, so a mixed dual-root merge keeps the
+ *   writable plane's instruction and announcements fully actionable.
+ * - SESSION scope, attached by the runner at the block tail when the whole session cannot persist:
+ *   there is no writable instruction left standing there (it is replaced or absent), so the global
+ *   wording is accurate. Name-free by construction (#181 class).
+ */
+export declare const MEMORY_ANNOUNCEMENT_READONLY_PLANE_CODA = "The notices immediately above concern a READ-ONLY memory store: any guidance in them to record, update, or tombstone an entry cannot be applied to that store this session \u2014 surface it to the user instead of claiming it done.";
+export declare const MEMORY_ANNOUNCEMENT_READONLY_CODA = "The memory store itself is not writable this session, so any guidance above to record, update, or tombstone a memory entry cannot be applied here \u2014 surface it to the user instead of claiming it done.";
+/**
+ * The read-only counterpart of the `# Memory` write instruction. A run with memory mounted but no
+ * way to write it used to get an EMPTY instruction — correct in what it doesn't teach, but silent
+ * about the state itself, and a model asked "remember X" under that silence answers with a success
+ * receipt for a save that never happens (the confabulated-receipt shape). This section states the
+ * state instead. Mounted only where "you cannot save" is provably TRUE: by `inject()` for a
+ * read-only layering (writeScope null ⇒ chmod'd tree), and by the runner for handsReadOnly (the
+ * shell rides the read-only band), for a declared-unavailable session (`memoryPersistenceCapable:
+ * false` — where the runner's write gate also refuses the file channel, keeping the engine-refusal
+ * sentence true), and for a write-less roster the persistence inference cannot vouch for. A merely
+ * Write-less roster does NOT qualify — other tools can still write the root. Name-free by
+ * construction (#181 class — it names no tool), and NOT part of the CC-verbatim capture: CC has no
+ * read-only memory layering, so there is nothing to capture; the section is sema-authored.
+ */
+export declare const MEMORY_READONLY_NOTICE = "# Memory\n\nYou have READ-ONLY access to persistent memory in this session: stored notes are available below, but this session has no memory write channel \u2014 the engine will not accept writes into the memory store. If the user asks you to remember something for later, say plainly that you cannot save it in this session \u2014 never claim to have noted or remembered it.";
 /** CC index-injection parameters: MEMORY.md's first 200 lines / 25KB enter the prompt. */
 export declare const MEMORY_INDEX_MAX_LINES = 200;
 export declare const MEMORY_INDEX_MAX_BYTES: number;
@@ -105,6 +136,16 @@ export interface MemoryInjection {
     /** CC `# Memory` section (system-authority instruction — §0.3 逐字 surface). Empty for a read-only
      *  layering (no write channel to instruct). */
     instruction: string;
+    /** Present exactly when this is a read-only LAYERING (writeScope null — the tree is chmod'd
+     *  read-only, so no tool writes into it whatever the roster): the {@link MEMORY_READONLY_NOTICE}
+     *  section stating that memory cannot be saved to, so the model declines "remember X" instead of
+     *  issuing a confabulated success receipt. NOT set for `writeToolMounted:false` over a writable
+     *  scope — there only the instruction-named tool is absent, other roster tools can still write the
+     *  root, and the claim would be false (the runner mounts the notice for its own provably
+     *  write-less shape, handsReadOnly). Kept as its OWN member (not folded into `instruction`) so the
+     *  dual-root merge's "the write plane's instruction wins" falsy-OR keeps working: a read-only
+     *  plane must never outrank a write plane's instruction. */
+    readOnlyNotice?: string;
     /** The derived MEMORY.md index, truncated (200 lines / 25KB) and FENCED untrusted. Undefined when empty. */
     index?: string;
     /** design/138 S2-B (时机①) — the announcements DRAINED by this inject (queued by the previous
@@ -301,7 +342,7 @@ export declare class MemoryEngine {
         ok: true;
     } | {
         ok: false;
-        code: ScanFinding["code"];
+        code: ScanFinding["code"] | "read_only_layering";
         reason: string;
         muted: boolean;
     };
@@ -315,6 +356,9 @@ export declare class MemoryEngine {
             reason: string;
         };
         sessionId?: string;
+        admitNothing?: {
+            reason: string;
+        };
     }): Promise<HarvestReport>;
     private harvestCore;
     /**

package/dist/core/memory-engine/engine.js

@@ -34,6 +34,11 @@ export function buildMemoryInstruction(memoryDir, instructionFileName) {
 }
 export const MEMORY_RECALL_DISCIPLINE = "Before answering questions about earlier work, decisions, dates, people, or the user's preferences, look them up: `memory_search` finds entries by keyword and `memory_get` reads a full entry — the injected memory index only lists what exists. When a lookup comes up empty, say that you checked memory and found nothing instead of guessing.";
 export const MEMORY_PREFERENCE_DISCIPLINE = "When the user confirms a stored preference or fact still holds, refresh that entry's `last-confirmed: <YYYY-MM-DD>` frontmatter line (add it when absent). When you save a preference, add an `applies-when: <context>` frontmatter line naming when it applies. Both are plain frontmatter lines — write them yourself; nothing fills them in for you.";
+export const MEMORY_ANNOUNCEMENT_READONLY_PLANE_CODA = "The notices immediately above concern a READ-ONLY memory store: any guidance in them to record, update, or tombstone an entry cannot be applied to that store this session — surface it to the user instead of claiming it done.";
+export const MEMORY_ANNOUNCEMENT_READONLY_CODA = "The memory store itself is not writable this session, so any guidance above to record, update, or tombstone a memory entry cannot be applied here — surface it to the user instead of claiming it done.";
+export const MEMORY_READONLY_NOTICE = `# Memory
+
+You have READ-ONLY access to persistent memory in this session: stored notes are available below, but this session has no memory write channel — the engine will not accept writes into the memory store. If the user asks you to remember something for later, say plainly that you cannot save it in this session — never claim to have noted or remembered it.`;
 export const MEMORY_INDEX_MAX_LINES = 200;
 export const MEMORY_INDEX_MAX_BYTES = 25 * 1024;
 export const STUB_ARCHIVED_LINE = "[body archived — request hydration by listing the slug in memory/.hydrate]";
@@ -41,6 +46,7 @@ export const DEFAULT_MAX_MEMORY_FILES = 500;
 export const DEFAULT_HARVEST_DEADLINE_MS = 5_000;
 export const DEFAULT_HARVEST_FILE_BUDGET = 2_000;
 export const MASS_DELETION_FUSE_RATIO = 0.5;
+let indexCaptureSeq = 0;
 export class MemoryEngine {
     backend;
     memoryDir;
@@ -425,6 +431,7 @@ export class MemoryEngine {
     inject(handle, opts) {
         const writeChannel = handle.writeScope !== null && opts?.writeToolMounted !== false;
         const instruction = writeChannel ? buildMemoryInstruction(handle.writableRoot) : "";
+        const readOnlyNotice = handle.writeScope === null ? MEMORY_READONLY_NOTICE : undefined;
         const indexPath = join(handle.writableRoot, MEMORY_INDEX_FILENAME);
         const onDisk = handle.indexOnDiskUntrusted === true ? undefined : readSafe(indexPath);
         const indexText = onDisk !== undefined && onDisk.trim() !== "" ? onDisk : handle.indexText;
@@ -440,14 +447,17 @@ export class MemoryEngine {
             if (drained.queue.length > 0 || drained.folded > 0) {
                 announcements = drained.queue;
                 announceBlock = renderAnnouncements(drained.queue, drained.folded);
+                if (handle.writeScope === null)
+                    announceBlock = `${announceBlock}\n\n${MEMORY_ANNOUNCEMENT_READONLY_PLANE_CODA}`;
             }
         }
         catch (err) {
             this.discloseAnnounceFailure("inject drain", err);
         }
-        const block = [instruction, index, announceBlock].filter((s) => Boolean(s && s.trim())).join("\n\n");
+        const block = [instruction || readOnlyNotice, index, announceBlock].filter((s) => Boolean(s && s.trim())).join("\n\n");
         return {
             instruction,
+            ...(readOnlyNotice !== undefined ? { readOnlyNotice } : {}),
             ...(index !== undefined ? { index } : {}),
             ...(announcements !== undefined ? { announcements } : {}),
             ...(announceBlock !== undefined ? { announceBlock } : {}),
@@ -459,8 +469,14 @@ export class MemoryEngine {
         const root = handle.writableRoot;
         if (canonicalPath !== root && !canonicalPath.startsWith(`${root}${sep}`))
             return { ok: true };
-        if (handle.writeScope === null)
-            return { ok: true };
+        if (handle.writeScope === null) {
+            return {
+                ok: false,
+                code: "read_only_layering",
+                reason: "this session's memory is read-only (no write scope) — the engine does not accept writes into the memory domain. Nothing was written.",
+                muted: false,
+            };
+        }
         const findings = [];
         const nameFinding = scanMemoryFileName(relative(root, canonicalPath));
         if (nameFinding !== undefined)
@@ -512,10 +528,12 @@ export class MemoryEngine {
             warnings: [],
         };
         const writeScope = handle.writeScope;
-        if (writeScope === null) {
+        if (writeScope === null || opts?.admitNothing !== undefined) {
             const roFindings = this.backend.drainInboundFindings?.();
             if (roFindings !== undefined && roFindings.length > 0)
                 report.inboundFindings = roFindings;
+            if (opts?.admitNothing !== undefined)
+                report.warnings.push(opts.admitNothing.reason);
             return report;
         }
         try {
@@ -1240,7 +1258,7 @@ export class MemoryEngine {
                 }
             }
             if (!landed)
-                writeFileSync(`${dest}.${process.pid}`, text, { encoding: "utf8", flag: "wx" });
+                writeFileSync(`${dest}.${process.pid}.${indexCaptureSeq++}`, text, { encoding: "utf8", flag: "wx" });
             captured = true;
         }
         catch (err) {

package/dist/core/memory-engine/index.d.ts

@@ -1,4 +1,4 @@
-export { MemoryEngine, buildMemoryInstruction, truncateIndex, MEMORY_INSTRUCTION_TEMPLATE, MEMORY_RECALL_DISCIPLINE, MEMORY_PREFERENCE_DISCIPLINE, MEMORY_INDEX_MAX_LINES, MEMORY_INDEX_MAX_BYTES, STUB_ARCHIVED_LINE, DEFAULT_MAX_MEMORY_FILES, DEFAULT_HARVEST_DEADLINE_MS, DEFAULT_HARVEST_FILE_BUDGET, MASS_DELETION_FUSE_RATIO, renderAnnouncements, type MemoryEngineOptions, type MemoryInjection, } from "./engine.js";
+export { MemoryEngine, buildMemoryInstruction, truncateIndex, MEMORY_INSTRUCTION_TEMPLATE, MEMORY_RECALL_DISCIPLINE, MEMORY_PREFERENCE_DISCIPLINE, MEMORY_READONLY_NOTICE, MEMORY_INDEX_MAX_LINES, MEMORY_INDEX_MAX_BYTES, STUB_ARCHIVED_LINE, DEFAULT_MAX_MEMORY_FILES, DEFAULT_HARVEST_DEADLINE_MS, DEFAULT_HARVEST_FILE_BUDGET, MASS_DELETION_FUSE_RATIO, renderAnnouncements, type MemoryEngineOptions, type MemoryInjection, } from "./engine.js";
 export { MEMORY_SEARCH_TOOL_NAME, MEMORY_GET_TOOL_NAME, MEMORY_ENGINE_TOOL_NAMES, type MemorySearchDetails, type MemorySearchHit, type MemoryGetDetails, } from "./tools.js";
 export { scanMemoryWrite, scanMemoryFileName, scanRemediation, MEMORY_FILENAME_SEGMENT_RE } from "./scan.js";
 export { FileMemoryEngineBackend, scanEntryFiles, MEMORY_INDEX_FILENAME, DEFAULT_MAX_ENTRY_DEPTH, type ScannedEntryFile } from "./file-backend.js";

package/dist/core/memory-engine/index.js

@@ -1,4 +1,4 @@
-export { MemoryEngine, buildMemoryInstruction, truncateIndex, MEMORY_INSTRUCTION_TEMPLATE, MEMORY_RECALL_DISCIPLINE, MEMORY_PREFERENCE_DISCIPLINE, MEMORY_INDEX_MAX_LINES, MEMORY_INDEX_MAX_BYTES, STUB_ARCHIVED_LINE, DEFAULT_MAX_MEMORY_FILES, DEFAULT_HARVEST_DEADLINE_MS, DEFAULT_HARVEST_FILE_BUDGET, MASS_DELETION_FUSE_RATIO, renderAnnouncements, } from "./engine.js";
+export { MemoryEngine, buildMemoryInstruction, truncateIndex, MEMORY_INSTRUCTION_TEMPLATE, MEMORY_RECALL_DISCIPLINE, MEMORY_PREFERENCE_DISCIPLINE, MEMORY_READONLY_NOTICE, MEMORY_INDEX_MAX_LINES, MEMORY_INDEX_MAX_BYTES, STUB_ARCHIVED_LINE, DEFAULT_MAX_MEMORY_FILES, DEFAULT_HARVEST_DEADLINE_MS, DEFAULT_HARVEST_FILE_BUDGET, MASS_DELETION_FUSE_RATIO, renderAnnouncements, } from "./engine.js";
 export { MEMORY_SEARCH_TOOL_NAME, MEMORY_GET_TOOL_NAME, MEMORY_ENGINE_TOOL_NAMES, } from "./tools.js";
 export { scanMemoryWrite, scanMemoryFileName, scanRemediation, MEMORY_FILENAME_SEGMENT_RE } from "./scan.js";
 export { FileMemoryEngineBackend, scanEntryFiles, MEMORY_INDEX_FILENAME, DEFAULT_MAX_ENTRY_DEPTH } from "./file-backend.js";

package/dist/core/permission-rule-consent.js

@@ -281,8 +281,15 @@ export async function prepareCcImport(opts) {
                 skipped.push({ rule: String(entry), reason: "settings entry is not a string" });
                 continue;
             }
-            if (!entry.startsWith("Bash("))
+            if (!entry.startsWith("Bash(")) {
+                const reason = /^[A-Za-z][A-Za-z0-9_]*\(.*\)$/.test(entry)
+                    ? "unsupported.tool: only Bash(...) command rules import in v1 — this entry stays in the settings file, unimported"
+                    : /^[A-Za-z][A-Za-z0-9_-]*$/.test(entry)
+                        ? "unsupported.form: a bare tool-name entry is a name-set item, not a command rule — it stays in the settings file, unimported"
+                        : "unsupported.form: not a Bash(...) command rule — it stays in the settings file, unimported";
+                skipped.push({ rule: entry, reason });
                 continue;
+            }
             const parsed = parseAllowRuleText(entry);
             if ("reject" in parsed) {
                 skipped.push({ rule: entry, reason: `${parsed.reject.code}: ${parsed.reject.message}` });

package/dist/core/runner/compaction-call-options.d.ts

@@ -95,10 +95,10 @@ export declare function buildStaleOffloadPointer(toolName: string, ref: string,
  * The session transcript is NEVER touched — this runs on the outgoing {@link Context} only.
  * Error results, image/document-bearing blocks' non-text parts, already-offloaded previews, and
  * replacements that would save < `minSavingsChars` are left verbatim. The full text is persisted
- * under a deterministic content-digested ref (design/30's mint helper over
- * `<toolCallId>_s<sha256-12 of the text>` — write-once, so re-projection on every turn re-puts a
- * no-op; the digest exists because tool-call ids carry no cross-turn uniqueness contract),
- * readable back via `read_tool_result`.
+ * under a deterministic content-digested ref (`buildToolResultRef(sessionId, toolCallId,
+ * toolResultContentSegment(text))` — a `~`-separated three-segment mint whose digest is its OWN
+ * segment; write-once, so re-projection on every turn re-puts a no-op; the digest exists because
+ * tool-call ids carry no cross-turn uniqueness contract), readable back via `read_tool_result`.
  */
 export declare function projectStaleToolResults(context: Context, cfg: ResolvedStaleToolResultOffload, store: ToolResultStore, sessionId: string, 
 /** Run-scoped cache of refs already persisted by THIS run (独立复审 MED,已修): without it the

package/dist/core/runner/compaction-call-options.js

@@ -1,6 +1,5 @@
-import { createHash } from "node:crypto";
 import { emitTrace } from "../trace.js";
-import { buildToolResultRef, OFFLOAD_TOOL_NAME, PERSISTED_OUTPUT_PREFIX } from "../tool-result-store.js";
+import { buildToolResultRef, OFFLOAD_TOOL_NAME, PERSISTED_OUTPUT_PREFIX, toolResultContentSegment, toolResultProvenanceOf, } from "../tool-result-store.js";
 export function buildWorkingFileAttachments(spec, prepared) {
     if (spec.compaction?.attachWorkingFiles === false || !prepared.readTaskFile)
         return undefined;
@@ -73,13 +72,13 @@ export async function projectStaleToolResults(context, cfg, store, sessionId, wr
             const text = toolResultText(msg);
             if (text.startsWith(PERSISTED_OUTPUT_PREFIX))
                 continue;
-            const ref = buildToolResultRef(sessionId, `${msg.toolCallId}_s${createHash("sha256").update(text, "utf8").digest("hex").slice(0, 32)}`);
+            const ref = buildToolResultRef(sessionId, msg.toolCallId, toolResultContentSegment(text));
             const pointer = buildStaleOffloadPointer(toolName, ref, text.length);
             if (text.length - pointer.length < cfg.minSavingsChars)
                 continue;
             if (!writtenRefs.has(ref)) {
                 try {
-                    await store.put(ref, text);
+                    await store.put(ref, text, toolResultProvenanceOf(sessionId));
                     writtenRefs.add(ref);
                 }
                 catch {

package/dist/core/runner/prepare-memory.d.ts

@@ -1,11 +1,3 @@
-/**
- * design/157 B15 一期 (P6 相位抽取) — prepareTask's long-term-memory phase, verbatim. The ONLY inputs
- * are the five fields below (measured, not assumed: spec.memory + deps.* + the three ambient values);
- * the ONLY outputs are the memory-engine session and the composed injection block. `deps.onError`
- * call order and payloads are part of the contract (event-sequence snapshot pin recorded across the
- * move). Throws pass through unchanged: a `config.memory_*`-coded violation is a DELIBERATE refusal
- * (design/142 S1 硬门) and must keep failing prepare loudly.
- */
 import type { BeforeWriteHook, RunnerDeps, TaskSpec, ToolSpec } from "../types.js";
 import type { Prepared } from "./prepare-task.js";
 export interface PrepareMemoryInput {
@@ -18,15 +10,42 @@ export interface PrepareMemoryInput {
     };
     /**
      * #181-F5 — whether a tool NAMED `Write` (the tool the CC `# Memory` instruction names) is on the
-     * ASSEMBLED roster this run and not excluded: prepare-task's
-     * `tools.some(t => t.name === "Write") && !exclude.includes("Write")`. Name occupancy IS the channel
-     * declaration, so the hands band is only one of the arms that can satisfy it — a hands-less run that
-     * mounts its own `Write` counts, and an `excludeTools: ["Write"]` run reads as unmounted whatever the
-     * hands band did. Threaded into `engine.inject` so a run with a writable memory scope but no write
-     * channel is not instructed to call a tool that is not on its roster; the RB-276 index seed follows
-     * the same gate (it exists only to satisfy the Write tool's unread-overwrite guard).
+     * ASSEMBLED roster this run, not excluded, AND can actually REACH the host-side memory root:
+     * prepare-task's `tools.some(t => t.name === "Write") && !exclude.includes("Write")` plus the
+     * remote-env conjunct (a hand-band Write on a remote ExecutionEnv writes the sandbox filesystem,
+     * not the host memory root — it does not count unless the deployment declares the mount shared
+     * via `memoryPersistenceCapable: true`). Name occupancy IS the channel declaration for the local
+     * arms — a hands-less run that mounts its own `Write` counts, and an `excludeTools: ["Write"]`
+     * run reads as unmounted whatever the hands band did. Threaded into `engine.inject` so a run with
+     * a writable memory scope but no write channel is not instructed to call a tool that is not on
+     * its roster (or cannot reach the store); the RB-276 index seed follows the same gate.
      */
     writeToolsMounted: boolean;
+    /**
+     * The session-wide persistence verdict: `TaskSpec.memoryPersistenceCapable` (the deployment's own
+     * statement — the only honest channel for a custom memory writer persisting through its closure,
+     * which no inference can see) when set, else the KNOWN-store-path inference: a mounted,
+     * non-excluded file-write tool (Write/Edit/NotebookEdit) or a write-capable shell. A generic
+     * write-effect tool does NOT count — a mail sender's side effect is not a memory store, and
+     * counting it re-opened the silent-confabulation hole. `false` ⇒ this phase mounts
+     * {@link MEMORY_READONLY_NOTICE} where the engine is silent.
+     */
+    rosterCanPersist: boolean;
+    /**
+     * The raw `TaskSpec.memoryPersistenceCapable` DECLARATION, kept separate from the composed
+     * {@link rosterCanPersist} verdict because the two drive different arms:
+     * - `true` (declared) RETRACTS the engine's own read-only notice — the deployment vouches for a
+     *   persistence channel the engine cannot see (a custom writer persisting through its closure),
+     *   so "you cannot save" beside it would be a false claim. An INFERRED-true roster must NOT
+     *   retract: over a writeScope-null layering the engine will refuse those very file writes
+     *   (`read_only_layering`), so the roster's write tools prove nothing about THIS store and
+     *   stripping the notice re-opens the silent-confabulation hole for exactly the state the
+     *   notice was built for.
+     * - `false` (declared) also CLOSES the file-tool write channel into the writable memory root
+     *   (the write gate refuses), so the mounted notice's "the engine will not accept writes into
+     *   the memory store" stays a true statement instead of a disclosure the store then contradicts.
+     */
+    memoryPersistenceDeclared?: boolean;
     /**
      * design/178 ②-1 — whether the `memory_search`/`memory_get` pair PASSED its early mount conjuncts
      * (exclusion + name occupancy, decided in prepare-task BEFORE this phase). True ⇒ this phase builds