@sema-agent/core 5.27.0 → 5.29.0

package/dist/core/permission-rule-sync.d.ts

@@ -25,7 +25,7 @@
  * privilege-separation ticket adds device-bound signatures. Deployments should connect knowing which
  * level they are buying.
  */
-import type { PersistedAllowRule, RuleDot, RuleScope, RuleTombstone } from "./permission-rule-model.js";
+import type { PersistedAllowRule, RuleDot, RuleRejectCode, RuleScope, RuleTombstone } from "./permission-rule-model.js";
 import type { PermissionRuleStoreProvider, RuleOwner, RuleSyncDrop, RuleSyncFrontier, RuleSyncState } from "./permission-rule-store.js";
 import { type TracerHook } from "./trace.js";
 /** The injected HTTP seam — core never bundles a fetch. The deployment owns base URL, auth, TLS and
@@ -125,6 +125,15 @@ interface ParsedRuleSyncResponse {
         dot: RuleDot;
         reason: string;
     }>;
+    /** Tombstones whose SHAPE is whole but whose rule TEXT the current validator refuses — the third
+     *  outcome, kept OUT of `merged.tombstones` so it does not read as malformed. See {@link
+     *  parseRuleSyncResponse} for why this one does not withhold the round's adds (backlog #176). */
+    textRefusedTombstones: Array<{
+        rule: string;
+        scope: RuleScope;
+        dot: RuleDot;
+        code: RuleRejectCode;
+    }>;
     warnings: string[];
 }
 /**
@@ -134,6 +143,11 @@ interface ParsedRuleSyncResponse {
  * reaches the local disk); an unshapeable tombstone is surfaced as `undefined` so the caller's
  * tighten-only partitioning withholds the round's adds. Unknown keys never flow anywhere — every field
  * below is PICKED off the response, the object itself is discarded.
+ *
+ * A tombstone has THREE outcomes, not two (backlog #176): sound; malformed (bad shape, or a spelling
+ * that parses but is not canonical — the withholding arm); and shape-whole-but-TEXT-refused, reported
+ * on {@link ParsedRuleSyncResponse.textRefusedTombstones}. The third is a legacy row a tightened
+ * validator no longer admits — permanent, so treating it as the second would stall inbound adds forever.
  */
 export declare function parseRuleSyncResponse(raw: unknown, expectedPrincipal: string): ParsedRuleSyncResponse;
 export {};

package/dist/core/permission-rule-sync.js

@@ -1,4 +1,4 @@
-import { parseAllowRuleText } from "./permission-rule-model.js";
+import { escapeForDisclosure, parseAllowRuleText } from "./permission-rule-model.js";
 import { applyTombstones, errText, joinFrontiers, joinRuleStates, normalizePersistedRule, ruleSyncVector, sameScope, screenRuleSyncState, writerOf, } from "./permission-rule-store.js";
 import { emitTrace } from "./trace.js";
 export const PERMISSION_RULE_SYNC_PATH = "/v1/permission-rules/sync";
@@ -9,12 +9,13 @@ function refuseLocalOwnerSync() {
     throw e;
 }
 const SYNC_MAX_ATTEMPTS = 8;
+const DISCLOSED_REFUSED_TOMBSTONES = 5;
 export async function syncPermissionRules(opts) {
     if (opts.owner !== undefined) {
         if (opts.owner.kind === "local-owner")
             refuseLocalOwnerSync();
         if (opts.owner.principal !== opts.principal) {
-            throw new Error(`contradictory identity: principal "${opts.principal}" and owner principal "${opts.owner.principal}" disagree`);
+            throw new Error(`contradictory identity: principal "${escapeForDisclosure(opts.principal)}" and owner principal "${escapeForDisclosure(opts.owner.principal)}" disagree`);
         }
     }
     if (typeof opts.principal !== "string" || opts.principal === "") {
@@ -83,6 +84,18 @@ export async function syncPermissionRules(opts) {
     if (tombstoneWithholding) {
         warnings.push("the response carried at least one malformed tombstone — every inbound add is withheld this round (legal tombstones land; the adds re-arrive once the peer repairs the tombstone: full-state exchange has no missed-forever window)");
     }
+    for (const t of response.textRefusedTombstones) {
+        dropped.push({ rule: t.rule, scope: t.scope, dot: t.dot, reason: "invalid_rule_text" });
+    }
+    if (response.textRefusedTombstones.length > 0) {
+        const named = response.textRefusedTombstones
+            .slice(0, DISCLOSED_REFUSED_TOMBSTONES)
+            .map((t) => `"${escapeForDisclosure(t.rule)}" (${t.code})`)
+            .join(", ");
+        const more = response.textRefusedTombstones.length - DISCLOSED_REFUSED_TOMBSTONES;
+        warnings.push(`the response carried ${response.textRefusedTombstones.length} tombstone(s) whose rule text this version's validator refuses — ${named}${more > 0 ? ` and ${more} more` : ""}. ` +
+            "They are refused here and never land; this round's inbound adds are NOT withheld for them (an add under the same text is refused by the same validator, so such a tombstone covers nothing that could go live). The peer still holds them — removing them there is what ends this notice");
+    }
     const inboundRules = [];
     if (!tombstoneWithholding) {
         for (const r of response.merged.rules) {
@@ -120,7 +133,7 @@ export async function syncPermissionRules(opts) {
             dropped.push({ rule: d.rule, scope: d.scope, dot: d.dot, reason });
         }
         else {
-            warnings.push(`the server dropped an inbound-side record (${d.rule}, dot ${d.dot.actor}#${d.dot.counter}): ${d.reason}`);
+            warnings.push(`the server dropped an inbound-side record (${escapeForDisclosure(d.rule)}, dot ${escapeForDisclosure(d.dot.actor)}#${d.dot.counter}): ${escapeForDisclosure(d.reason)}`);
         }
     }
     const clean = !tombstoneWithholding;
@@ -147,7 +160,7 @@ export async function syncPermissionRules(opts) {
                 resurrected: [],
                 dropped,
                 rev: current.rev,
-                warnings: [...warnings, `the store refused the sync landing: ${errText(err)} — nothing landed, the local state is unchanged`],
+                warnings: [...warnings, `the store refused the sync landing: ${escapeForDisclosure(errText(err))} — nothing landed, the local state is unchanged`],
             });
         }
         if ("conflict" in res) {
@@ -205,9 +218,11 @@ export async function syncPermissionRules(opts) {
         warnings: [...warnings, `optimistic-concurrency retries exhausted after ${SYNC_MAX_ATTEMPTS} attempts — nothing landed, the local state is unchanged`],
     });
 }
-function isDot(v) {
+function pickDot(v) {
     const d = v;
-    return typeof d?.actor === "string" && d.actor !== "" && typeof d.counter === "number" && Number.isFinite(d.counter);
+    const actor = d?.actor;
+    const counter = d?.counter;
+    return typeof actor === "string" && actor !== "" && typeof counter === "number" && Number.isFinite(counter) ? { actor, counter } : undefined;
 }
 function pickScope(v) {
     const s = v;
@@ -219,13 +234,16 @@ function pickScope(v) {
 }
 function pickAdd(v) {
     const a = v;
-    if (!isDot(a?.dot))
+    const dot = pickDot(a?.dot);
+    const origin = a?.origin;
+    const createdAt = a?.createdAt;
+    if (dot === undefined)
         return undefined;
-    if (a.origin !== "user" && a.origin !== "imported-cc" && a.origin !== "starter")
+    if (origin !== "user" && origin !== "imported-cc" && origin !== "starter")
         return undefined;
-    if (typeof a.createdAt !== "string")
+    if (typeof createdAt !== "string")
         return undefined;
-    return { dot: { actor: a.dot.actor, counter: a.dot.counter }, origin: a.origin, createdAt: a.createdAt };
+    return { dot, origin, createdAt };
 }
 function pickFrontier(v) {
     if (v === null || typeof v !== "object" || Array.isArray(v))
@@ -243,35 +261,44 @@ export function parseRuleSyncResponse(raw, expectedPrincipal) {
         throw new Error("the sync response is not an object — protocol error, nothing landed");
     }
     const r = raw;
-    if (typeof r.principal !== "string") {
+    const echoedPrincipal = r.principal;
+    if (typeof echoedPrincipal !== "string") {
         throw new Error("the sync response carries no principal echo — protocol error, nothing landed");
     }
-    if (r.principal !== expectedPrincipal) {
-        throw new Error(`the sync response echoes principal "${r.principal}" but this round synced "${expectedPrincipal}" — the transport is wired to the wrong bucket; refusing the whole round`);
+    if (echoedPrincipal !== expectedPrincipal) {
+        throw new Error(`the sync response echoes principal "${escapeForDisclosure(echoedPrincipal)}" but this round synced "${escapeForDisclosure(expectedPrincipal)}" — the transport is wired to the wrong bucket; refusing the whole round`);
     }
     const merged = r.merged;
-    if (merged === null || typeof merged !== "object" || !Array.isArray(merged.rules) || !Array.isArray(merged.tombstones)) {
+    const mergedRules = merged?.rules;
+    const mergedTombstones = merged?.tombstones;
+    if (merged === null || typeof merged !== "object" || !Array.isArray(mergedRules) || !Array.isArray(mergedTombstones)) {
         throw new Error("the sync response carries no merged state — protocol error, nothing landed");
     }
+    const rawGcFrontier = r.gcFrontier;
     let gcFrontier;
-    if (r.gcFrontier !== undefined) {
-        gcFrontier = pickFrontier(r.gcFrontier);
+    if (rawGcFrontier !== undefined) {
+        gcFrontier = pickFrontier(rawGcFrontier);
         if (gcFrontier === undefined) {
             throw new Error("the sync response carries an unparseable gcFrontier — refusing the whole round (a garbled frontier must not drive the fence arm)");
         }
     }
     const warnings = [];
     const rules = [];
-    for (const entry of merged.rules) {
+    for (const entry of mergedRules) {
         const e = entry;
         const scope = pickScope(e?.scope);
-        if (typeof e?.rule !== "string" || scope === undefined || !Array.isArray(e.adds) || typeof e.command !== "string" || typeof e.tool !== "string" || typeof e.match !== "string") {
+        const eRule = e?.rule;
+        const eCommand = e?.command;
+        const eTool = e?.tool;
+        const eMatch = e?.match;
+        const eAdds = e?.adds;
+        if (typeof eRule !== "string" || scope === undefined || !Array.isArray(eAdds) || typeof eCommand !== "string" || typeof eTool !== "string" || typeof eMatch !== "string") {
             warnings.push("the response carried an unshapeable rule entry — skipped (it never reaches the local store)");
             continue;
         }
         const adds = [];
         let addDamaged = false;
-        for (const a of e.adds) {
+        for (const a of eAdds) {
             const picked = pickAdd(a);
             if (picked === undefined) {
                 addDamaged = true;
@@ -280,64 +307,79 @@ export function parseRuleSyncResponse(raw, expectedPrincipal) {
             adds.push(picked);
         }
         if (addDamaged)
-            warnings.push(`rule "${e.rule}" carried at least one unshapeable add — skipped those adds`);
+            warnings.push(`rule "${escapeForDisclosure(eRule)}" carried at least one unshapeable add — skipped those adds`);
         if (adds.length === 0)
             continue;
         rules.push({
-            rule: e.rule,
-            tool: e.tool,
-            match: e.match,
-            command: e.command,
+            rule: eRule,
+            tool: eTool,
+            match: eMatch,
+            command: eCommand,
             scope,
             adds,
         });
     }
     const tombstones = [];
-    for (const entry of merged.tombstones) {
+    const textRefusedTombstones = [];
+    for (const entry of mergedTombstones) {
         const t = entry;
         const scope = pickScope(t?.scope);
-        const canonicalTomb = typeof t?.rule === "string" ? parseAllowRuleText(t.rule) : undefined;
-        if (typeof t?.rule !== "string" ||
-            canonicalTomb === undefined ||
-            "reject" in canonicalTomb ||
-            canonicalTomb.rule.rule !== t.rule ||
-            scope === undefined ||
-            !isDot(t.deletedBy) ||
-            !Array.isArray(t.removedDots) ||
-            t.removedDots.length === 0 ||
-            !t.removedDots.every(isDot)) {
+        const ruleText = t?.rule;
+        const deletedBy = pickDot(t?.deletedBy);
+        const removedRaw = t?.removedDots;
+        const removedDots = [];
+        if (Array.isArray(removedRaw)) {
+            for (const d of removedRaw) {
+                const dot = pickDot(d);
+                if (dot === undefined) {
+                    removedDots.length = 0;
+                    break;
+                }
+                removedDots.push(dot);
+            }
+        }
+        if (typeof ruleText !== "string" || scope === undefined || deletedBy === undefined || removedDots.length === 0) {
             tombstones.push(undefined);
             continue;
         }
-        tombstones.push({
-            rule: t.rule,
-            scope,
-            removedDots: t.removedDots.map((d) => ({ actor: d.actor, counter: d.counter })),
-            deletedBy: { actor: t.deletedBy.actor, counter: t.deletedBy.counter },
-        });
+        const canonicalTomb = parseAllowRuleText(ruleText);
+        if ("reject" in canonicalTomb) {
+            textRefusedTombstones.push({ rule: ruleText, scope, dot: deletedBy, code: canonicalTomb.reject.code });
+            continue;
+        }
+        if (canonicalTomb.rule.rule !== ruleText) {
+            tombstones.push(undefined);
+            continue;
+        }
+        tombstones.push({ rule: ruleText, scope, removedDots, deletedBy });
     }
     const dropped = [];
-    if (r.dropped !== undefined) {
-        if (!Array.isArray(r.dropped)) {
+    const rawDropped = r.dropped;
+    if (rawDropped !== undefined) {
+        if (!Array.isArray(rawDropped)) {
             warnings.push("the response carried a non-array dropped field — ignored");
         }
         else {
-            for (const entry of r.dropped) {
+            for (const entry of rawDropped) {
                 const d = entry;
                 const scope = pickScope(d?.scope);
-                if (typeof d?.rule !== "string" || scope === undefined || !isDot(d.dot) || typeof d.reason !== "string") {
+                const dRule = d?.rule;
+                const dDot = pickDot(d?.dot);
+                const dReason = d?.reason;
+                if (typeof dRule !== "string" || scope === undefined || dDot === undefined || typeof dReason !== "string") {
                     warnings.push("the response carried an unshapeable dropped entry — ignored (the server's own drop discipline is its contract obligation)");
                     continue;
                 }
-                dropped.push({ rule: d.rule, scope, dot: { actor: d.dot.actor, counter: d.dot.counter }, reason: d.reason });
+                dropped.push({ rule: dRule, scope, dot: dDot, reason: dReason });
             }
         }
     }
     return {
-        principal: r.principal,
+        principal: echoedPrincipal,
         merged: { rules, tombstones },
         ...(gcFrontier !== undefined ? { gcFrontier } : {}),
         dropped,
+        textRefusedTombstones,
         warnings,
     };
 }

package/dist/core/runner/active-skill-scope.d.ts

@@ -34,7 +34,7 @@ export declare class ActiveSkillScope {
  *  - DENY any tool not in the INTERSECTION of every active frame's `allowTools`.
  *  - For a WRITE tool with an `allowPaths` constraint on ANY active frame, DENY a write whose
  *    canonicalized target is outside every listed prefix (reuses {@link canonicalizeTarget}, so a
- *    symlink can't smuggle a write outside the allowed paths).
+ *    symlink can't carry across a write outside the allowed paths).
  *  - A frame whose manifest could not be resolved (`kind:"unresolved"`) → DENY-ALL (fail-closed: no
  *    allowlist means nothing is allowed — NOT the bare task policy).
  * When NO frame is active, the policy returns `allow` for everything (it only ever subtracts), leaving

package/dist/core/runner/memory-consolidation.d.ts

@@ -27,7 +27,7 @@ export declare const DEFAULT_CONSOLIDATION_MAX_NOTES = 50;
 export declare const DEFAULT_CONSOLIDATION_TIMEOUT_SEC = 30;
 /** Normalize a note body for the EXACT-restatement check in the `<lo` near-dup cheap path. Case- + whitespace-
  *  insensitive ONLY (lower-case, collapse whitespace runs, trim); it PRESERVES every symbol/punctuation so it can
- *  NOT false-equate semantically-distinct facts. (service [365] adversarial: the earlier `[^\p{L}\p{N}]`-stripping
+ *  NOT false-equate semantically-distinct facts. (service [365] falsification-style: the earlier `[^\p{L}\p{N}]`-stripping
  *  normalization made "C#"≡"C", "delta +5"≡"delta -5", "100%"≡"100" — and a textual-CONTAINMENT test on top of it
  *  also mis-judged "rate limit 1000" ⊇ "rate limit 100" (word boundary). A fire-on-every-note, no-LLM path must not
  *  make a semantic-subset call, so the cheap path now folds ONLY an exact restatement; every real near-dup defers

package/dist/core/runner/prepare-task.d.ts

@@ -864,7 +864,7 @@ export interface InheritedGate {
      * Org-memory admission freeze (ruled 2026-08-05): the spawning chain's FROZEN admitted org-scope
      * set — every org memory scope the parent actually mounted (deployment-origin + admitted request).
      * A delegated child's REQUEST-origin org scopes must be a subset (intersection ≠ request ⇒ the
-     * child's prepare refuses, `memory.admission_denied`); deployment-origin scopes bypass the freeze
+     * child's prepare refuses, `memory.admission_denied`); deployment-origin scopes circumvent the freeze
      * (operator authority is deployment-wide). ALWAYS emitted by chain assembly (empty array = parent
      * mounted no org plane), so an ABSENT field discriminates an older-shape chain — which the child
      * side reads fail-closed as the empty set. Serializable (plain strings): persists on the
@@ -872,7 +872,7 @@ export interface InheritedGate {
      */
     admittedOrgScopes?: readonly string[];
     /**
-     * The MONOTONIC org-governance provenance bit (adversarial round 5): `true` when any leg of this
+     * The MONOTONIC org-governance provenance bit (falsification-style round 5): `true` when any leg of this
      * tree ran with an org-admission surface configured (resolver / deployment scope list) or
      * inherited the bit. It never clears once set (a governed tree stays governed), and it counts as
      * governance evidence at the admission door EVEN when every admitted set en route is empty — a
@@ -1055,7 +1055,7 @@ export interface RunInternals {
      * arbitration is decided) and BEFORE the resumed leg starts. The parked-resume caller uses it to
      * flip the reserved row `parked→running` (guarded CAS) + adopt the live handle/lane — the ONLY
      * legal site for that flip (a pre-consume flip would let TaskStop hit the plain running arm and
-     * bypass the checkpoint arbitration entirely). A THROW here aborts the resume (propagates out of
+     * circumvent the checkpoint arbitration entirely). A THROW here aborts the resume (propagates out of
      * `resumeStream`): the checkpoint is already consumed, so the caller's compensation
      * (`rollbackParkedClaim`) reads `resolved` and settles the honest failed/outcome-unknown terminal
      * — never a silent run without an adopted row. Deployment/trusted-caller channel only, mirroring
@@ -1442,6 +1442,11 @@ export interface ResolvedWorkspace {
     cwd: string;
     /** True only for an accepted `isolation: "worktree"` request (⇒ `cwd` is this agent's own worktree). */
     isolated: boolean;
+    /** True when the task's execution env is REMOTE (#197 BGW-7): `cwd` then names a path INSIDE the remote
+     *  target (a per-task sandbox on the shape-(d) exemption leg, e.g. `/workspace`), which does not exist —
+     *  or names an unrelated directory — on the host. `isolated && !remote` is the only combination under
+     *  which `cwd` is a host path a consumer may diff / merge / remove. */
+    remote: boolean;
 }
 /**
  * From the resumed/active transcript, the batch position of `currentId` (design/45 §4.ter): the tool-call

package/dist/core/runner/prepare-task.js

@@ -89,10 +89,14 @@ import { BINDING_CHECKPOINT_VERSION, mintCheckpointToken, ORG_ADMISSION_CHECKPOI
 import { boundInputHashOf } from "../canonical-json.js";
 import { countElicitOptIns, deriveAskEffective, deriveWiringManifest, resolveAskSeamForm, resolveDeclaredDurability, resolveElicitSeam, resolveQuestionSeam } from "../wiring-manifest.js";
 import { GLOBAL_USAGE_KEY, resolveUsageWindows, usageRetryAfterMs } from "../usage-window-store.js";
+import { deliverEngineNotice } from "../types.js";
 const announcedMaterializeEnv = new Set();
 export function __resetMaterializeEnvAnnouncements() {
     announcedMaterializeEnv.clear();
 }
+function emitMaterializeEnvNotice(onNotice, message, detail) {
+    deliverEngineNotice(onNotice, { code: "config.materialize_env_discarded", message, detail });
+}
 const RECONCILE_MAX_RETRIES = 3;
 const DEFAULT_MAX_SUSPENDS = 5;
 const TASK_LIMIT_KEY_DICT = {
@@ -215,6 +219,9 @@ export function resolveModelPromptTraits(model, spec, internals) {
         fableMitigations: isFableFamilyModelId(model.id),
     };
 }
+function hasConversationContent(branch) {
+    return branch.some((e) => e.type === "message" || e.type === "custom_message" || e.type === "compaction");
+}
 function isDelegatedNonForkChild(internals) {
     return internals?.isDelegatedChild === true && internals?.insideFork !== true;
 }
@@ -906,7 +913,12 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
         }
         if (internals?.onWorkspaceResolved !== undefined) {
             try {
-                internals.onWorkspaceResolved({ cwd: taskRootPath, isolated: internals.isolation === "worktree" });
+                const workspaceEnv = ownedEnv ?? deps.executionEnv;
+                internals.onWorkspaceResolved({
+                    cwd: taskRootPath,
+                    isolated: internals.isolation === "worktree",
+                    remote: workspaceEnv !== undefined && isRemoteExecutionEnv(workspaceEnv),
+                });
             }
             catch {
             }
@@ -1659,6 +1671,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                 ...(sessionId !== undefined ? { sessionId } : {}),
                 ...(internals?.onTaskNotification !== undefined ? { taskNotification: internals.onTaskNotification } : {}),
                 ...(internals?.detachHub !== undefined ? { detachHub: internals.detachHub } : {}),
+                ...(deps.onNotice !== undefined ? { onNotice: deps.onNotice } : {}),
                 pdfModelCapabilities: pdfModelCapabilitiesOf(model),
                 ...(deps.hands?.bashReadonlyAllow !== undefined ? { bashReadonlyAllow: deps.hands.bashReadonlyAllow } : {}),
                 ...(deps.hands?.commitCoAuthor !== undefined ? { commitCoAuthor: deps.hands.commitCoAuthor } : {}),
@@ -2012,7 +2025,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
             if (spec.sessionId) {
                 try {
                     const branch = await session.getBranch();
-                    const hasConversation = branch.some((e) => e.type === "message" || e.type === "custom_message" || e.type === "compaction");
+                    const hasConversation = hasConversationContent(branch);
                     if (!hasConversation)
                         projectMemoryPhase = "fresh";
                     else {
@@ -2493,7 +2506,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                 }
                 else if (resume === undefined && internals?.parentTaskId === undefined && internals?.parentSessionId === undefined) {
                     const candidate = deps.promptSource?.current();
-                    if (candidate !== undefined && (await session.getBranch()).length === 0) {
+                    if (candidate !== undefined && !hasConversationContent(await session.getBranch())) {
                         centerAdoption = { artifact: candidate.artifact, sourceRevision: candidate.sourceRevision };
                         centerAdoptionFresh = true;
                     }
@@ -2572,7 +2585,8 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
             const resolved = resolveEpochAgainstBundled(pinned, SEMA_DEFAULT_PACK, epochDeclaredSections);
             epochArtifactDigestForSnapshot = resolved.descriptor.artifactDigest;
             if (resolved.migrated) {
-                const activatedBy = pinned === undefined && !spec.sessionId ? "session_start" : "legacy_migration";
+                const priorConversation = pinned === undefined ? hasConversationContent(await session.getBranch()) : true;
+                const activatedBy = pinned === undefined && !priorConversation ? "session_start" : "legacy_migration";
                 await session.appendPromptEpoch({
                     ...resolved.descriptor,
                     activatedBy,
@@ -2606,7 +2620,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                 const line = `SEMA_TOOL_MATERIALIZE_STRATEGY=${JSON.stringify(raw)} is not "swap" or "static" — inert on this task (no deferred tools), but a deferring task WITHOUT an explicit spec strategy will refuse to prepare under it (an explicit legal spec outranks and discards it, loudly). Fix or unset the flag.`;
                 if (!announcedMaterializeEnv.has(line)) {
                     announcedMaterializeEnv.add(line);
-                    console.warn(line);
+                    emitMaterializeEnvNotice(deps.onNotice, line, { raw });
                 }
             }
         }
@@ -2628,7 +2642,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                 const line = `SEMA_TOOL_MATERIALIZE_STRATEGY=${JSON.stringify(rawEnvStrategy)} was ignored — not "swap" or "static", and the task spec pins toolMaterializeStrategy=${JSON.stringify(spec.toolMaterializeStrategy)} which outranks it. Fix or unset the env flag.`;
                 if (!announcedMaterializeEnv.has(line)) {
                     announcedMaterializeEnv.add(line);
-                    console.warn(line);
+                    emitMaterializeEnvNotice(deps.onNotice, line, { raw: rawEnvStrategy, specStrategy: spec.toolMaterializeStrategy });
                 }
             }
             const envStrategy = envStrategyInvalid ? undefined : rawEnvStrategy;
@@ -3180,6 +3194,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
             ...((internals?.explicitAgentName ?? internals?.agentName) !== undefined
                 ? { sourceAgentName: internals?.explicitAgentName ?? internals?.agentName }
                 : {}),
+            ...(internals?.isDelegatedChild === true ? { isDelegatedChild: true } : {}),
         });
         const riskAxesOf = (toolName) => {
             const tier = irreversibilityTier.get(toolName);
@@ -4731,7 +4746,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                 ...(offloadStore
                     ? {
                         offload: {
-                            persist: createOffloadPersist(offloadStore, sessionId),
+                            persist: createOffloadPersist(offloadStore, sessionId, deps.onNotice),
                         },
                     }
                     : {}),

package/dist/core/runner/runtask.d.ts

@@ -300,7 +300,7 @@ export declare class Runner {
      *  `inheritedManifestScope` and every other RunInternals field) — the library caller is trusted to
      *  re-supply the genuine chain; a caller able to invoke resumeStream already holds full Runner
      *  authority, so constraint substitution here is outside the enforced threat model (the count check
-     *  catches shape MISTAKES, not a malicious trusted caller). */
+     *  catches shape MISTAKES, not a untrusted trusted caller). */
     internals?: RunInternals): Promise<TaskStream>;
     /**
      * design/45 resume step: with the harness idle and the branch rewound to the suspension leaf, resolve

package/dist/core/runner/runtask.js

@@ -35,7 +35,7 @@ import { hasDestroy, isIsolated } from "../remote-env.js";
 import { hasBackgroundShell, sweepBackgroundShells } from "../background-shell.js";
 import { cloneObserverInput, formatHookFeedback } from "../hooks.js";
 import { buildHumanInputEvent, projectHumanInput } from "../human-input-projection.js";
-import { delimitUntrusted, inlineUntrusted, sanitizeUntrustedText } from "../untrusted-text.js";
+import { delimitUntrusted, inlineUntrusted, REVIEWER_NOTE_MAX_BODY, sanitizeUntrustedText } from "../untrusted-text.js";
 import { reconcileInterruptedSession } from "../session-reconcile.js";
 import { RunnerSharedToolResultStore } from "../tool-result-store.js";
 import { formatDiagnosticsBlock } from "../lsp-diagnostics.js";
@@ -131,7 +131,10 @@ const DEFERRED_REISSUE = "[DEFERRED] This tool call shared a batch with a call t
 function toolEndBodyFrom(result, isError, settledBy) {
     const o = toolOutputFrom(result);
     const st = structuredFrom(result);
-    const code = isError ? result?.details?.code : undefined;
+    const det = isError ? result?.details : undefined;
+    const codeRaw = det?.code;
+    const kindRaw = det?.errorKind;
+    const code = typeof codeRaw === "string" ? codeRaw : typeof kindRaw === "string" ? kindRaw : undefined;
     return {
         ...(o !== undefined ? { output: o.output, ...(o.truncated ? { truncated: true } : {}), ...(o.totalChars !== undefined ? { totalChars: o.totalChars } : {}) } : {}),
         ...(st !== undefined ? { structured: st } : {}),
@@ -242,7 +245,7 @@ function resumeContinuation(resume) {
     if (resume.outcome.gate === "dry_run_review") {
         const verdict = resume.outcome.decision === "approve"
             ? "Your predicted change was REVIEWED and APPROVED; it has been applied"
-            : `Your predicted change was REVIEWED and REJECTED${resume.outcome.reason ? `: ${delimitUntrusted("reviewer note", resume.outcome.reason)}` : ""}; it was NOT applied`;
+            : `Your predicted change was REVIEWED and REJECTED${resume.outcome.reason ? `: ${delimitUntrusted("reviewer note", resume.outcome.reason, REVIEWER_NOTE_MAX_BODY)}` : ""}; it was NOT applied`;
         return formatHookFeedback(`You were resumed after a dry-run review. ${verdict}. Before continuing, re-orient from the workspace ` +
             "(run `git status` and review your recent changes) to confirm the current state, then continue the " +
             "remaining work. Do NOT restart the task or re-run work that is already done.");
@@ -262,7 +265,7 @@ function resumeContinuation(resume) {
                 "or restart from scratch, just carry out the revised plan.\n\nThe REVISED plan to follow is:\n" +
                 delimitUntrusted("revised plan", resume.outcome.editedPlan));
         }
-        const why = resume.outcome.reason ? ` Reviewer note: ${delimitUntrusted("reviewer note", resume.outcome.reason)}` : "";
+        const why = resume.outcome.reason ? ` Reviewer note: ${delimitUntrusted("reviewer note", resume.outcome.reason, REVIEWER_NOTE_MAX_BODY)}` : "";
         return formatHookFeedback(`Your proposed PLAN was REVIEWED and REJECTED; it was NOT executed.${why} Produce a NEW plan that ` +
             "addresses the concern, then continue. This is a RESUMED task — re-plan from the current state; do " +
             "NOT execute the rejected plan.");
@@ -273,7 +276,7 @@ function resumeContinuation(resume) {
     }
     const decided = resume.outcome.decision === "allow"
         ? "was APPROVED and has now been executed — its result is in the tool results above"
-        : `was DENIED${resume.outcome.reason ? `: ${delimitUntrusted("reviewer note", resume.outcome.reason)}` : ""}`;
+        : `was DENIED${resume.outcome.reason ? `: ${delimitUntrusted("reviewer note", resume.outcome.reason, REVIEWER_NOTE_MAX_BODY)}` : ""}`;
     const remaining = pendingAction.batchToolCallIds.filter((id) => id !== pendingAction.toolCallId && !pendingAction.completedCallIds.includes(id)).length;
     const batchNote = remaining > 0
         ? ` ${remaining} other tool call(s) from that batch were returned as deferred and not run — re-issue any you still need.`
@@ -1412,6 +1415,10 @@ export class Runner {
         return runSideQuery(spec, { brain: this.deps.brain, models: this.deps.models, roles: this.deps.roles });
     }
     runTaskStream(spec, resume, internals) {
+        if (resume !== undefined && (typeof resume !== "object" || resume.outcome === undefined)) {
+            throw new TypeError("runTaskStream: `resume` must be a ResumeRun carrying `outcome` — got a value without one. " +
+                "(Note the parameter order: runTaskStream(spec, resume?, internals?) — internals is the THIRD parameter.)");
+        }
         const entryActor = spec.actor === undefined ? undefined : snapshotActorAssertion(spec.actor);
         const queue = new PushQueue();
         const detachHub = new ToolDetachHub();
@@ -3997,7 +4004,7 @@ export class Runner {
                 : outcome.settledBy === "aborted"
                     ? `The approval for the pending tool call "${pendingAction.toolName}" ended without anyone deciding it (it was cancelled or could not be delivered), so it was not executed.`
                     : `The pending tool call "${pendingAction.toolName}" was denied by an approver.`;
-            const reason = outcome.reason ? delimitUntrusted("reviewer note", outcome.reason) : defaultDenial;
+            const reason = outcome.reason ? delimitUntrusted("reviewer note", outcome.reason, REVIEWER_NOTE_MAX_BODY) : defaultDenial;
             emitEnd(true, { content: formatHookFeedback(reason) });
             const eid = await prepared.session.appendMessage(toolResultMsg(pendingAction.toolCallId, pendingAction.toolName, formatHookFeedback(reason), true));
             emitCommitted(eid, "toolResult", pendingAction.toolCallId);

package/dist/core/runner/session-rule-policy.d.ts

@@ -54,9 +54,9 @@ export declare function isWithin(root: string, p: string): boolean;
  *  - `toolAllow` (if set) → deny any tool NOT listed (a narrowing allowlist).
  *  - `commandAllow`/`commandDeny` → delegate to {@link createCoarseCommandNamePolicy} (argv[0] names; only
  *    speaks about shell tools). allowlist mode denies the un-listed/un-parseable; blocklist mode asks on the
- *    un-parseable bypass surface (the gate decides).
+ *    un-parseable circumvention surface (the gate decides).
  *  - `allowDirs` (if set) → a WRITE tool must land inside one of the dirs (resolved via `canonicalizeTarget`,
- *    so a symlink can't smuggle a write out); a write-capable tool that cannot be path-confined (e.g. `bash`)
+ *    so a symlink can't carry across a write out); a write-capable tool that cannot be path-confined (e.g. `bash`)
  *    is DENIED while `allowDirs` is set (fail-closed, mirrors active-skill-scope MAJOR-2).
  * Returns `allow` when nothing constrains the call. `env`/`rootPath` are the task's real exec env + root, so
  * matching sees the actual filesystem (a remote/E2B task resolves in its container). RB-108: a relative

package/dist/core/runner/teardown-bounded.d.ts

@@ -9,7 +9,7 @@
  * mask the original error") — but a promise that never settles is not a throw, and one wedged
  * adapter turned into: for-await done, `result()` never settles (②型, process alive), or — when the
  * wedge happened before the queue closed — a zero-handle pure-logic hang (the 2.12.0 exit-13 shape).
- * The session lock releases in the run IIFE's finally, so one wedged run also poisoned every later
+ * The session lock releases in the run IIFE's finally, so one wedged run also contaminated every later
  * same-session resume.
  *
  * The remedy is the same doctrine as the workflow journal drain (batch-4 F2): a best-effort leg gets

package/dist/core/runner/tool-disclosure.d.ts

@@ -223,7 +223,7 @@ export declare function resolveToolSearch(args: ToolSearchArgs, registry: Readon
  * direct call (ruled 2026-08-03) activates too and is flagged as an error, so it lands in that same
  * under-approximated class by construction: within the process the in-memory `active` set carries it, and
  * a replay that loses it costs the corrected call — which succeeds, and is itself carrier ②. The one way to
- * forge a positive is a deployment `tool_result` hook that rewrites a rejection's error flag to false,
+ * self-declare a positive is a deployment `tool_result` hook that rewrites a rejection's error flag to false,
  * which is the deployment editing its own transcript.
  *
  * design/116 W1-2 note: pre-116 checkpoints whose KEYWORD queries activated up to 25 tools re-derive at

package/dist/core/scheduler.d.ts

@@ -27,7 +27,7 @@ export declare class SchedulerError extends Error {
     constructor(code: SchedulerErrorCode, message: string, cause?: unknown | undefined);
 }
 /**
- * 🔴 **模型可控面（不可信）**：纯意图，**无任何身份字段** —— 防模型经自排 prompt 提权（design/62 同款红线：身份是
+ * 🔴 **模型可控面（不可信）**：纯意图，**无任何身份字段** —— 防模型经自排 prompt 权限抬升（design/62 同款红线：身份是
  * Runner-held，非工具参数）。`prompt` = 未来 task 的不可信 `objective`（daemon 起 task 时经完整 prepare-task gate）。
  */
 export interface ScheduledIntent {
@@ -84,7 +84,7 @@ export interface ScheduledIntent {
  */
 export interface SchedulerContext {
     /**
-     * 越权隔离键（cancel/list 只能操作同 scope 排的）。由 Runner 填，且**按被操作 intent 的 lifetime 分叉**
+     * 越界隔离键（cancel/list 只能操作同 scope 排的）。由 Runner 填，且**按被操作 intent 的 lifetime 分叉**
      * （ruled 2026-08-03）：`lifetime:"session"` 的意图用会话链（sessionId ?? principal ?? taskId ?? "default"）；
      * durable 意图用跨会话稳定身份（principal ?? "default"）——否则 durable job 会被钉死在排它的那个会话里，
      * 后续会话 cancel/list 一律 `not_found`（任务照常触发却再也删不掉）。backend 侧无需分辨腿别：照旧只按
@@ -92,7 +92,7 @@ export interface SchedulerContext {
      * ⚠️ 部署面：本分叉之前写下的 durable 行仍带旧的会话键，一次性重铸键归 backend 半场，engine 不做迁移。
      */
     scope: string;
-    /** 排程者身份；daemon 触发时原样传给 runTask（防提权）。 */
+    /** 排程者身份；daemon 触发时原样传给 runTask（防权限抬升）。 */
     principal?: string;
     /** 可选：daemon 触发新 task 时复用的 session（chat-continuity；缺省=fresh-session）。⚠️ 复用需 durable sessionStore（design/105 §3.4）。 */
     sessionId?: string;
@@ -169,7 +169,7 @@ export interface SchedulerCapability {
     schedule(intent: ScheduledIntent, ctx: SchedulerContext): Promise<Result<{
         id: ScheduledTaskId;
     }, SchedulerError>>;
-    /** 取消一个已排意图（幂等：取消不存在的是 ok no-op）。🔴 越权：`id` MUST 属本 scope；非本 scope 一律 `not_found`，不泄露存在性。 */
+    /** 取消一个已排意图（幂等：取消不存在的是 ok no-op）。🔴 越界：`id` MUST 属本 scope；非本 scope 一律 `not_found`，不越界存在性。 */
     cancel(id: ScheduledTaskId, ctx: SchedulerContext): Promise<Result<void, SchedulerError>>;
     /** 列**本 scope** 已排意图（self-discovery + 防重复排）。范围 = `ctx.scope`，非全局。 */
     list(ctx: SchedulerContext): Promise<Result<ScheduledTaskSummary[], SchedulerError>>;