@sema-agent/core 5.28.0 → 5.29.0

package/dist/core/permission-rule-model.d.ts

@@ -18,7 +18,7 @@
  *
  * The floor is `parseLeadingCommandName` — the one simple-command parser already shared by the
  * read-only classifier, the reversibility probe, the coarse command-name policy and the skill tool
- * specifier. A second tokenizer would drift, and drift on a loosening face shows up as a bypass rather
+ * specifier. A second tokenizer would drift, and drift on a loosening face shows up as a circumvention rather
  * than as a test failure.
  *
  * ## Normalization order is load-bearing

package/dist/core/permission-rule-org.d.ts

@@ -203,7 +203,7 @@ export interface EffectivePermissionRule {
 /**
  * design/182 §7.3 — the introspection face: every personal rule with its effective status under the org
  * overlay. An org deny does not delete a personal rule — the personal rule is the user's approval
- * record, and the org's power is to OVERRIDE it, not to forge its removal — so a shadowed rule reports
+ * record, and the org's power is to OVERRIDE it, not to self-declare its removal — so a shadowed rule reports
  * `shadowed-by-org` and comes back by itself when the org deny is withdrawn. A rule whose every add is
  * tombstoned reports `removed` (its tombstone identity is still visible in the store).
  *

package/dist/core/permission-rule-store.d.ts

@@ -159,7 +159,7 @@ export interface RuleSyncJoinDelta {
  * What a write may say. Authorization discriminates on the DELTA SHAPE, not on a full snapshot: only the
  * add arm can introduce a dot, and the delete arm carries a tombstone and no adds. A backend additionally
  * REFUSES at runtime any delete that would introduce a new add dot — structure and runtime check together,
- * so "pick the delete arm and smuggle an add" is neither expressible nor accepted. The `sync-join` arm's
+ * so "pick the delete arm and carry across an add" is neither expressible nor accepted. The `sync-join` arm's
  * safety does not rest on hiding the type (ruled 2026-08-10: the backend contract IS exported for
  * out-of-repo store twins) — it rests on every inbound record inside it passing the single validator
  * again AT THE BACKEND: the fifth door of design/179 §4's validator list closes here, not at the

package/dist/core/runner/active-skill-scope.d.ts

@@ -34,7 +34,7 @@ export declare class ActiveSkillScope {
  *  - DENY any tool not in the INTERSECTION of every active frame's `allowTools`.
  *  - For a WRITE tool with an `allowPaths` constraint on ANY active frame, DENY a write whose
  *    canonicalized target is outside every listed prefix (reuses {@link canonicalizeTarget}, so a
- *    symlink can't smuggle a write outside the allowed paths).
+ *    symlink can't carry across a write outside the allowed paths).
  *  - A frame whose manifest could not be resolved (`kind:"unresolved"`) → DENY-ALL (fail-closed: no
  *    allowlist means nothing is allowed — NOT the bare task policy).
  * When NO frame is active, the policy returns `allow` for everything (it only ever subtracts), leaving

package/dist/core/runner/memory-consolidation.d.ts

@@ -27,7 +27,7 @@ export declare const DEFAULT_CONSOLIDATION_MAX_NOTES = 50;
 export declare const DEFAULT_CONSOLIDATION_TIMEOUT_SEC = 30;
 /** Normalize a note body for the EXACT-restatement check in the `<lo` near-dup cheap path. Case- + whitespace-
  *  insensitive ONLY (lower-case, collapse whitespace runs, trim); it PRESERVES every symbol/punctuation so it can
- *  NOT false-equate semantically-distinct facts. (service [365] adversarial: the earlier `[^\p{L}\p{N}]`-stripping
+ *  NOT false-equate semantically-distinct facts. (service [365] falsification-style: the earlier `[^\p{L}\p{N}]`-stripping
  *  normalization made "C#"≡"C", "delta +5"≡"delta -5", "100%"≡"100" — and a textual-CONTAINMENT test on top of it
  *  also mis-judged "rate limit 1000" ⊇ "rate limit 100" (word boundary). A fire-on-every-note, no-LLM path must not
  *  make a semantic-subset call, so the cheap path now folds ONLY an exact restatement; every real near-dup defers

package/dist/core/runner/prepare-task.d.ts

@@ -864,7 +864,7 @@ export interface InheritedGate {
      * Org-memory admission freeze (ruled 2026-08-05): the spawning chain's FROZEN admitted org-scope
      * set — every org memory scope the parent actually mounted (deployment-origin + admitted request).
      * A delegated child's REQUEST-origin org scopes must be a subset (intersection ≠ request ⇒ the
-     * child's prepare refuses, `memory.admission_denied`); deployment-origin scopes bypass the freeze
+     * child's prepare refuses, `memory.admission_denied`); deployment-origin scopes circumvent the freeze
      * (operator authority is deployment-wide). ALWAYS emitted by chain assembly (empty array = parent
      * mounted no org plane), so an ABSENT field discriminates an older-shape chain — which the child
      * side reads fail-closed as the empty set. Serializable (plain strings): persists on the
@@ -872,7 +872,7 @@ export interface InheritedGate {
      */
     admittedOrgScopes?: readonly string[];
     /**
-     * The MONOTONIC org-governance provenance bit (adversarial round 5): `true` when any leg of this
+     * The MONOTONIC org-governance provenance bit (falsification-style round 5): `true` when any leg of this
      * tree ran with an org-admission surface configured (resolver / deployment scope list) or
      * inherited the bit. It never clears once set (a governed tree stays governed), and it counts as
      * governance evidence at the admission door EVEN when every admitted set en route is empty — a
@@ -1055,7 +1055,7 @@ export interface RunInternals {
      * arbitration is decided) and BEFORE the resumed leg starts. The parked-resume caller uses it to
      * flip the reserved row `parked→running` (guarded CAS) + adopt the live handle/lane — the ONLY
      * legal site for that flip (a pre-consume flip would let TaskStop hit the plain running arm and
-     * bypass the checkpoint arbitration entirely). A THROW here aborts the resume (propagates out of
+     * circumvent the checkpoint arbitration entirely). A THROW here aborts the resume (propagates out of
      * `resumeStream`): the checkpoint is already consumed, so the caller's compensation
      * (`rollbackParkedClaim`) reads `resolved` and settles the honest failed/outcome-unknown terminal
      * — never a silent run without an adopted row. Deployment/trusted-caller channel only, mirroring
@@ -1442,6 +1442,11 @@ export interface ResolvedWorkspace {
     cwd: string;
     /** True only for an accepted `isolation: "worktree"` request (⇒ `cwd` is this agent's own worktree). */
     isolated: boolean;
+    /** True when the task's execution env is REMOTE (#197 BGW-7): `cwd` then names a path INSIDE the remote
+     *  target (a per-task sandbox on the shape-(d) exemption leg, e.g. `/workspace`), which does not exist —
+     *  or names an unrelated directory — on the host. `isolated && !remote` is the only combination under
+     *  which `cwd` is a host path a consumer may diff / merge / remove. */
+    remote: boolean;
 }
 /**
  * From the resumed/active transcript, the batch position of `currentId` (design/45 §4.ter): the tool-call

package/dist/core/runner/prepare-task.js

@@ -219,6 +219,9 @@ export function resolveModelPromptTraits(model, spec, internals) {
         fableMitigations: isFableFamilyModelId(model.id),
     };
 }
+function hasConversationContent(branch) {
+    return branch.some((e) => e.type === "message" || e.type === "custom_message" || e.type === "compaction");
+}
 function isDelegatedNonForkChild(internals) {
     return internals?.isDelegatedChild === true && internals?.insideFork !== true;
 }
@@ -910,7 +913,12 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
         }
         if (internals?.onWorkspaceResolved !== undefined) {
             try {
-                internals.onWorkspaceResolved({ cwd: taskRootPath, isolated: internals.isolation === "worktree" });
+                const workspaceEnv = ownedEnv ?? deps.executionEnv;
+                internals.onWorkspaceResolved({
+                    cwd: taskRootPath,
+                    isolated: internals.isolation === "worktree",
+                    remote: workspaceEnv !== undefined && isRemoteExecutionEnv(workspaceEnv),
+                });
             }
             catch {
             }
@@ -2017,7 +2025,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
             if (spec.sessionId) {
                 try {
                     const branch = await session.getBranch();
-                    const hasConversation = branch.some((e) => e.type === "message" || e.type === "custom_message" || e.type === "compaction");
+                    const hasConversation = hasConversationContent(branch);
                     if (!hasConversation)
                         projectMemoryPhase = "fresh";
                     else {
@@ -2498,7 +2506,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                 }
                 else if (resume === undefined && internals?.parentTaskId === undefined && internals?.parentSessionId === undefined) {
                     const candidate = deps.promptSource?.current();
-                    if (candidate !== undefined && (await session.getBranch()).length === 0) {
+                    if (candidate !== undefined && !hasConversationContent(await session.getBranch())) {
                         centerAdoption = { artifact: candidate.artifact, sourceRevision: candidate.sourceRevision };
                         centerAdoptionFresh = true;
                     }
@@ -2577,7 +2585,8 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
             const resolved = resolveEpochAgainstBundled(pinned, SEMA_DEFAULT_PACK, epochDeclaredSections);
             epochArtifactDigestForSnapshot = resolved.descriptor.artifactDigest;
             if (resolved.migrated) {
-                const activatedBy = pinned === undefined && !spec.sessionId ? "session_start" : "legacy_migration";
+                const priorConversation = pinned === undefined ? hasConversationContent(await session.getBranch()) : true;
+                const activatedBy = pinned === undefined && !priorConversation ? "session_start" : "legacy_migration";
                 await session.appendPromptEpoch({
                     ...resolved.descriptor,
                     activatedBy,
@@ -3185,6 +3194,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
             ...((internals?.explicitAgentName ?? internals?.agentName) !== undefined
                 ? { sourceAgentName: internals?.explicitAgentName ?? internals?.agentName }
                 : {}),
+            ...(internals?.isDelegatedChild === true ? { isDelegatedChild: true } : {}),
         });
         const riskAxesOf = (toolName) => {
             const tier = irreversibilityTier.get(toolName);

package/dist/core/runner/runtask.d.ts

@@ -300,7 +300,7 @@ export declare class Runner {
      *  `inheritedManifestScope` and every other RunInternals field) — the library caller is trusted to
      *  re-supply the genuine chain; a caller able to invoke resumeStream already holds full Runner
      *  authority, so constraint substitution here is outside the enforced threat model (the count check
-     *  catches shape MISTAKES, not a malicious trusted caller). */
+     *  catches shape MISTAKES, not a untrusted trusted caller). */
     internals?: RunInternals): Promise<TaskStream>;
     /**
      * design/45 resume step: with the harness idle and the branch rewound to the suspension leaf, resolve

package/dist/core/runner/runtask.js

@@ -35,7 +35,7 @@ import { hasDestroy, isIsolated } from "../remote-env.js";
 import { hasBackgroundShell, sweepBackgroundShells } from "../background-shell.js";
 import { cloneObserverInput, formatHookFeedback } from "../hooks.js";
 import { buildHumanInputEvent, projectHumanInput } from "../human-input-projection.js";
-import { delimitUntrusted, inlineUntrusted, sanitizeUntrustedText } from "../untrusted-text.js";
+import { delimitUntrusted, inlineUntrusted, REVIEWER_NOTE_MAX_BODY, sanitizeUntrustedText } from "../untrusted-text.js";
 import { reconcileInterruptedSession } from "../session-reconcile.js";
 import { RunnerSharedToolResultStore } from "../tool-result-store.js";
 import { formatDiagnosticsBlock } from "../lsp-diagnostics.js";
@@ -245,7 +245,7 @@ function resumeContinuation(resume) {
     if (resume.outcome.gate === "dry_run_review") {
         const verdict = resume.outcome.decision === "approve"
             ? "Your predicted change was REVIEWED and APPROVED; it has been applied"
-            : `Your predicted change was REVIEWED and REJECTED${resume.outcome.reason ? `: ${delimitUntrusted("reviewer note", resume.outcome.reason)}` : ""}; it was NOT applied`;
+            : `Your predicted change was REVIEWED and REJECTED${resume.outcome.reason ? `: ${delimitUntrusted("reviewer note", resume.outcome.reason, REVIEWER_NOTE_MAX_BODY)}` : ""}; it was NOT applied`;
         return formatHookFeedback(`You were resumed after a dry-run review. ${verdict}. Before continuing, re-orient from the workspace ` +
             "(run `git status` and review your recent changes) to confirm the current state, then continue the " +
             "remaining work. Do NOT restart the task or re-run work that is already done.");
@@ -265,7 +265,7 @@ function resumeContinuation(resume) {
                 "or restart from scratch, just carry out the revised plan.\n\nThe REVISED plan to follow is:\n" +
                 delimitUntrusted("revised plan", resume.outcome.editedPlan));
         }
-        const why = resume.outcome.reason ? ` Reviewer note: ${delimitUntrusted("reviewer note", resume.outcome.reason)}` : "";
+        const why = resume.outcome.reason ? ` Reviewer note: ${delimitUntrusted("reviewer note", resume.outcome.reason, REVIEWER_NOTE_MAX_BODY)}` : "";
         return formatHookFeedback(`Your proposed PLAN was REVIEWED and REJECTED; it was NOT executed.${why} Produce a NEW plan that ` +
             "addresses the concern, then continue. This is a RESUMED task — re-plan from the current state; do " +
             "NOT execute the rejected plan.");
@@ -276,7 +276,7 @@ function resumeContinuation(resume) {
     }
     const decided = resume.outcome.decision === "allow"
         ? "was APPROVED and has now been executed — its result is in the tool results above"
-        : `was DENIED${resume.outcome.reason ? `: ${delimitUntrusted("reviewer note", resume.outcome.reason)}` : ""}`;
+        : `was DENIED${resume.outcome.reason ? `: ${delimitUntrusted("reviewer note", resume.outcome.reason, REVIEWER_NOTE_MAX_BODY)}` : ""}`;
     const remaining = pendingAction.batchToolCallIds.filter((id) => id !== pendingAction.toolCallId && !pendingAction.completedCallIds.includes(id)).length;
     const batchNote = remaining > 0
         ? ` ${remaining} other tool call(s) from that batch were returned as deferred and not run — re-issue any you still need.`
@@ -4004,7 +4004,7 @@ export class Runner {
                 : outcome.settledBy === "aborted"
                     ? `The approval for the pending tool call "${pendingAction.toolName}" ended without anyone deciding it (it was cancelled or could not be delivered), so it was not executed.`
                     : `The pending tool call "${pendingAction.toolName}" was denied by an approver.`;
-            const reason = outcome.reason ? delimitUntrusted("reviewer note", outcome.reason) : defaultDenial;
+            const reason = outcome.reason ? delimitUntrusted("reviewer note", outcome.reason, REVIEWER_NOTE_MAX_BODY) : defaultDenial;
             emitEnd(true, { content: formatHookFeedback(reason) });
             const eid = await prepared.session.appendMessage(toolResultMsg(pendingAction.toolCallId, pendingAction.toolName, formatHookFeedback(reason), true));
             emitCommitted(eid, "toolResult", pendingAction.toolCallId);

package/dist/core/runner/session-rule-policy.d.ts

@@ -54,9 +54,9 @@ export declare function isWithin(root: string, p: string): boolean;
  *  - `toolAllow` (if set) → deny any tool NOT listed (a narrowing allowlist).
  *  - `commandAllow`/`commandDeny` → delegate to {@link createCoarseCommandNamePolicy} (argv[0] names; only
  *    speaks about shell tools). allowlist mode denies the un-listed/un-parseable; blocklist mode asks on the
- *    un-parseable bypass surface (the gate decides).
+ *    un-parseable circumvention surface (the gate decides).
  *  - `allowDirs` (if set) → a WRITE tool must land inside one of the dirs (resolved via `canonicalizeTarget`,
- *    so a symlink can't smuggle a write out); a write-capable tool that cannot be path-confined (e.g. `bash`)
+ *    so a symlink can't carry across a write out); a write-capable tool that cannot be path-confined (e.g. `bash`)
  *    is DENIED while `allowDirs` is set (fail-closed, mirrors active-skill-scope MAJOR-2).
  * Returns `allow` when nothing constrains the call. `env`/`rootPath` are the task's real exec env + root, so
  * matching sees the actual filesystem (a remote/E2B task resolves in its container). RB-108: a relative

package/dist/core/runner/teardown-bounded.d.ts

@@ -9,7 +9,7 @@
  * mask the original error") — but a promise that never settles is not a throw, and one wedged
  * adapter turned into: for-await done, `result()` never settles (②型, process alive), or — when the
  * wedge happened before the queue closed — a zero-handle pure-logic hang (the 2.12.0 exit-13 shape).
- * The session lock releases in the run IIFE's finally, so one wedged run also poisoned every later
+ * The session lock releases in the run IIFE's finally, so one wedged run also contaminated every later
  * same-session resume.
  *
  * The remedy is the same doctrine as the workflow journal drain (batch-4 F2): a best-effort leg gets

package/dist/core/runner/tool-disclosure.d.ts

@@ -223,7 +223,7 @@ export declare function resolveToolSearch(args: ToolSearchArgs, registry: Readon
  * direct call (ruled 2026-08-03) activates too and is flagged as an error, so it lands in that same
  * under-approximated class by construction: within the process the in-memory `active` set carries it, and
  * a replay that loses it costs the corrected call — which succeeds, and is itself carrier ②. The one way to
- * forge a positive is a deployment `tool_result` hook that rewrites a rejection's error flag to false,
+ * self-declare a positive is a deployment `tool_result` hook that rewrites a rejection's error flag to false,
  * which is the deployment editing its own transcript.
  *
  * design/116 W1-2 note: pre-116 checkpoints whose KEYWORD queries activated up to 25 tools re-derive at

package/dist/core/scheduler.d.ts

@@ -27,7 +27,7 @@ export declare class SchedulerError extends Error {
     constructor(code: SchedulerErrorCode, message: string, cause?: unknown | undefined);
 }
 /**
- * 🔴 **模型可控面（不可信）**：纯意图，**无任何身份字段** —— 防模型经自排 prompt 提权（design/62 同款红线：身份是
+ * 🔴 **模型可控面（不可信）**：纯意图，**无任何身份字段** —— 防模型经自排 prompt 权限抬升（design/62 同款红线：身份是
  * Runner-held，非工具参数）。`prompt` = 未来 task 的不可信 `objective`（daemon 起 task 时经完整 prepare-task gate）。
  */
 export interface ScheduledIntent {
@@ -84,7 +84,7 @@ export interface ScheduledIntent {
  */
 export interface SchedulerContext {
     /**
-     * 越权隔离键（cancel/list 只能操作同 scope 排的）。由 Runner 填，且**按被操作 intent 的 lifetime 分叉**
+     * 越界隔离键（cancel/list 只能操作同 scope 排的）。由 Runner 填，且**按被操作 intent 的 lifetime 分叉**
      * （ruled 2026-08-03）：`lifetime:"session"` 的意图用会话链（sessionId ?? principal ?? taskId ?? "default"）；
      * durable 意图用跨会话稳定身份（principal ?? "default"）——否则 durable job 会被钉死在排它的那个会话里，
      * 后续会话 cancel/list 一律 `not_found`（任务照常触发却再也删不掉）。backend 侧无需分辨腿别：照旧只按
@@ -92,7 +92,7 @@ export interface SchedulerContext {
      * ⚠️ 部署面：本分叉之前写下的 durable 行仍带旧的会话键，一次性重铸键归 backend 半场，engine 不做迁移。
      */
     scope: string;
-    /** 排程者身份；daemon 触发时原样传给 runTask（防提权）。 */
+    /** 排程者身份；daemon 触发时原样传给 runTask（防权限抬升）。 */
     principal?: string;
     /** 可选：daemon 触发新 task 时复用的 session（chat-continuity；缺省=fresh-session）。⚠️ 复用需 durable sessionStore（design/105 §3.4）。 */
     sessionId?: string;
@@ -169,7 +169,7 @@ export interface SchedulerCapability {
     schedule(intent: ScheduledIntent, ctx: SchedulerContext): Promise<Result<{
         id: ScheduledTaskId;
     }, SchedulerError>>;
-    /** 取消一个已排意图（幂等：取消不存在的是 ok no-op）。🔴 越权：`id` MUST 属本 scope；非本 scope 一律 `not_found`，不泄露存在性。 */
+    /** 取消一个已排意图（幂等：取消不存在的是 ok no-op）。🔴 越界：`id` MUST 属本 scope；非本 scope 一律 `not_found`，不越界存在性。 */
     cancel(id: ScheduledTaskId, ctx: SchedulerContext): Promise<Result<void, SchedulerError>>;
     /** 列**本 scope** 已排意图（self-discovery + 防重复排）。范围 = `ctx.scope`，非全局。 */
     list(ctx: SchedulerContext): Promise<Result<ScheduledTaskSummary[], SchedulerError>>;

package/dist/core/session-policy-store.d.ts

@@ -16,7 +16,7 @@
  *   can't lose an update (mirrors the checkpoint store's `resolve` OCC).
  * - **structured fields only**: core interprets `toolAllow/Deny`, `allowDirs`, `commandAllow/Deny` (argv[0]
  *   names). A richer rule DSL is the service's/profile's job — core grows no rule interpreter.
- * - **NOT A SANDBOX**: command rules inherit the coarse argv[0] matching (wrappers like `sh -c`/`sudo` bypass);
+ * - **NOT A SANDBOX**: command rules inherit the coarse argv[0] matching (wrappers like `sh -c`/`sudo` circumvention);
  *   the real isolation boundary is the executionEnv, never these rules.
  */
 /** The structured per-session rules. All optional; an absent field imposes no constraint of that kind. */
@@ -86,11 +86,11 @@ export interface SessionPolicyStore {
 /**
  * LEXICAL path containment for the tighten gate. **Must agree with the runtime's view of what a dir IS** (the
  * runtime resolves `..`/`.`/`//` via `canonicalizeTarget`): both args are `posix.normalize`d FIRST so a
- * non-operator can't smuggle a write-confinement OUTSIDE the prior dir by writing `<prior>/../etc` — which is
+ * non-operator can't carry across a write-confinement OUTSIDE the prior dir by writing `<prior>/../etc` — which is
  * lexically "within `<prior>`" by a naive `startsWith` but canonicalizes to `/etc` at run time (the tighten
  * gate must never UNDER-report a loosening).
  *
- * The `..`-resolving `posix.normalize` pass is THIS function's own job (the tighten gate's `..`-smuggling
+ * The `..`-resolving `posix.normalize` pass is THIS function's own job (the tighten gate's `..`-carrying across
  * defense above) and is NOT shared with the runtime's `isWithin` (session-rule-policy.ts), which compares
  * already-canonicalized keys and never resolves `..` itself — the two functions agree on every OTHER input
  * (same win-family fold, same prefix semantics) but diverge on inputs that still carry an unresolved `..`,

package/dist/core/shared-memory/normalize.d.ts

@@ -4,7 +4,7 @@
  *
  * WHY A GATE AT ALL. A TypeScript annotation is a compile-time claim, and a Provider is third-party
  * (BYOM) code that may be plain JavaScript. Every value crossing this seam is therefore treated as
- * foreign data: exotic shapes, throwing getters and hostile metadata all have a defined verdict here,
+ * foreign data: exotic shapes, throwing getters and untrusted metadata all have a defined verdict here,
  * so no "shape outside the rules" can leak an exception into a tool body or a crafted string onto a
  * prompt line.
  *

package/dist/core/skill-tool-specifier.d.ts

@@ -35,7 +35,7 @@
  * admitting a second program smuggled in behind the first.
  *
  * Reusing that parser rather than writing a second tokenizer is deliberate: two argv[0] parsers drift,
- * and the drift shows up as a bypass rather than as a test failure.
+ * and the drift shows up as a circumvention rather than as a test failure.
  *
  * ## Scope: the shell-command lane only
  *

package/dist/core/task-notification.d.ts

@@ -6,7 +6,7 @@ export interface TaskNotificationPayload {
     task_id: string;
     /** design/144 §2: `"external"` is CORE-MINTED ONLY — `TaskStream.notify()` casts it onto every
      *  externally injected event, and the input type ({@link ExternalNotificationInput}) deliberately has
-     *  no `task_type` field, so an outside producer can never wear an internal lane's type (a forged
+     *  no `task_type` field, so an outside producer can never wear an internal lane's type (a caller-declared
      *  "background_bash completed" impersonating a real child). */
     task_type: "background_bash" | "workflow" | "background_agent" | "monitor" | "external";
     toolUseId?: string;
@@ -27,7 +27,7 @@ export interface TaskNotificationPayload {
      *     `cycleSeq`, or — on a tier-3 cross-process revival / a parked resume, which deliberately carry
      *     no retain entry — the durable row's own `seq`. ABSENT only when neither exists (retain OFF on a
      *     store-less spawn, an expired ledger with no durable row, the fork lane): the cycle count is not
-     *     knowable there, and an honest downgrade to the old single-cycle key beats a forged period
+     *     knowable there, and an honest downgrade to the old single-cycle key beats a caller-declared period
      *     number. So `seq` present does NOT imply a retain entry exists.
      *   - `external`: caller-supplied verbatim ({@link ExternalNotificationInput.seq}) — the injector's
      *     own dedup discriminator across same-task_id+status events.

package/dist/core/task-registry-agent.d.ts

@@ -14,14 +14,14 @@ export declare function ensureDurableHeartbeatLane(core: DurableAgentCore): void
  *     re-apply (the real terminal truth must beat a reaper's guess); only a row carrying a
  *     FOREIGN writerId poisons the lane (never clobber another writer). */
 export declare function durableAgentWriteLane(handle: BackgroundAgentTaskHandle, patch: Partial<BackgroundAgentRecord>, clear?: readonly (keyof BackgroundAgentRecord)[]): void;
-/** design/151 S1b — is this row's durable lane ARMED (store wired at registration, not poisoned)?
+/** design/151 S1b — is this row's durable lane ARMED (store wired at registration, not contaminated)?
  *  Observability/test face. ⚠️ NOT the lifecycle-flip key: arming says a row was ATTEMPTED, not
  *  that it EXISTS — release anchors gate on {@link durableAgentRowProbe} (codex r2 F2). */
 export declare function durableAgentArmedLane(core: DurableAgentCore, id: string): boolean;
 /** design/151 S1b (codex r2 F2) — the AWAITABLE lifecycle-flip key. Returns undefined when no
  *  lane was armed; otherwise a probe CLOSURE over the HANDLE (outlives its eviction from the map —
  *  retain-ledger TTL arms fire hours after terminal GC) that flushes the queued writes and answers
- *  whether a durable row actually EXISTS right now (initial put confirmed, not poisoned). A store
+ *  whether a durable row actually EXISTS right now (initial put confirmed, not contaminated). A store
  *  that never accepted the put answers false — the caller then RELEASES the session (pre-151 path)
  *  instead of stranding an unreachable transcript.
  *
@@ -102,13 +102,13 @@ export declare function bindBackgroundAgentSessionLane(core: DurableAgentCore, i
  * per leg at the injector-ready barrier (prepare has succeeded by then, so the verdict exists); a
  * revival cycle overwrites the previous cycle's record with its own, which the admission door
  * guarantees is a subset. Same durable write lane as every other post-registration fact — a
- * store-less registration is a no-op, and a poisoned lane stays poisoned.
+ * store-less registration is a no-op, and a contaminated lane stays contaminated.
  *
  * A DROPPED write is disclosed. This record is the only carrier a narrowing has across a process
  * boundary, so what stands on the row when the write does not land is the PREVIOUS leg's wider
- * verdict — which the next revival then seeds from. Two drop shapes, one message each: a poisoned
+ * verdict — which the next revival then seeds from. Two drop shapes, one message each: a contaminated
  * lane refuses at its front door, and an exhausted flush leaves the value unwritten with the lane
- * still armed. The channel is the same durable-agents warning channel the lane uses for the poison
+ * still armed. The channel is the same durable-agents warning channel the lane uses for the contamination
  * itself (that one says writes stopped; this one says WHICH fact stopped with them). The write
  * remains best-effort: no leg faults because its bookkeeping failed.
  *
@@ -197,7 +197,7 @@ export declare function rollbackParkedClaimLane(core: DurableAgentCore, stores:
  * design/153 §7.2d (件3c, codex 3c H-1) — the CONSUME FLIP, SERIALIZED THROUGH THE DURABLE LANE:
  * the guarded parked→running store CAS runs INSIDE the lane chain (ordered after every seeded
  * write — the session-bind CAS included), so no in-flight lane write can race it, CAS-fail on the
- * flip's rev bump, read the new epoch as foreign, and poison the lane (which would permanently
+ * flip's rev bump, read the new epoch as foreign, and contaminate the lane (which would permanently
  * drop finalize/terminal/re-park writes). On a won CAS the lane record/rev swap happens in the
  * SAME chain step and the live handle adopts (running, arbitration dropped — the token is
  * consumed; `parkClaimId` stays visible until finalize). Returns false when the row moved
@@ -284,7 +284,7 @@ export declare function markRetainedContinuationLane(core: DurableAgentCore, id:
  *  The DURABLE transition is a {@link claimTerminalRowForRevive} claim, awaited BEFORE the in-memory
  *  flip — the two orders are not equivalent: flipping memory first (the pre-arbitration shape, a plain lane
  *  write with no row guard) let a foreign claim win the row while this process kept serving
- *  `running`, and every later write of this cycle then died in the poisoned lane without a trace.
+ *  `running`, and every later write of this cycle then died in the contaminated lane without a trace.
  *  Three lane shapes, three treatments:
  *   - NO lane (store-less registration): the pre-arbitration in-memory-only transition, unchanged — there is
  *     no row, hence no arbitration domain and no competitor;
@@ -293,11 +293,11 @@ export declare function markRetainedContinuationLane(core: DurableAgentCore, id:
  *     the chain (row absent AND the put still unconfirmed after the chain drained), never by the
  *     entry-time flag: a put merely in flight, or one that committed under a failed response, would
  *     otherwise exempt a row that does exist — the split-brain window this claim exists to close;
- *   - POISONED lane (stale-flip ownership transfer / row reaped mid-write / heartbeat re-drive
+ *   - Contaminated lane (stale-flip ownership transfer / row reaped mid-write / heartbeat re-drive
  *     ceiling): the claim runs DIRECTLY through the store — the dead lane's chain is no longer a
  *     serialization point, the rev guard is. Re-arming that lane object in place is what is NOT
  *     done: an in-flight write from it would then see its own writerId on the re-claimed row and
- *     adopt it. It stays poisoned (its record keeps the pre-claim writerId/epoch, so its read-back
+ *     adopt it. It stays contaminated (its record keeps the pre-claim writerId/epoch, so its read-back
  *     answers "foreign" and it stops), and a row that cannot be claimed — gone, or live under
  *     another writer — REFUSES the revive rather than resuming with a durably unreachable row.
  *  A WON claim always hands the row to a FRESH lane for the claimed generation (both paths), for the

package/dist/core/task-registry-shared.d.ts

@@ -68,7 +68,7 @@ export interface UnifiedTaskOutput {
  * (`noTask`/`noTaskForStop`/`formatWorkflowRun`/`serveDurableAgentRow`/`pollTask`/`stopTask` and every
  * per-task-kind poll/stop arm). `UnifiedTaskOutput` (the `details` face) has no isError channel of its
  * own — it is a REQUIRED-field wire shape consumed by callers beyond these two tools too, so isError is
- * carried as a sibling on the WRAPPER instead (trap avoidance per the E1 sweep: never smuggle isError
+ * carried as a sibling on the WRAPPER instead (trap avoidance per the E1 sweep: never carry across isError
  * through a narrower helper contract). Optional, absent/false = success — `createTaskOutputTool`/
  * `createTaskStopTool` forward it onto the real `ToolReturn` at the tool boundary. Every internal helper
  * keeps constructing `content`/`details` exactly as before; this only adds a place to say "and this one
@@ -97,8 +97,8 @@ export interface SemaTaskHandle {
 /** P1-3(黑板 [1920]/[1921]/[1924]/[1925]) — mint a cross-channel completion correlation id ONCE per
  *  handle/record, fill-once (first writer wins): every settle/direct-terminal-flip site calls this
  *  instead of writing `completionId` directly, so no matter how many terminal-transition sites a lane
- *  has (settle / TaskStop bypass / backfill), the value is minted exactly once and every later caller
- *  (including an idempotent re-call from a bypass path that already ran) gets back the SAME id. `string`
+ *  has (settle / TaskStop circumvention / backfill), the value is minted exactly once and every later caller
+ *  (including an idempotent re-call from a circumvention path that already ran) gets back the SAME id. `string`
  *  is intentionally loose (any object with an optional `completionId` field) so the same helper serves
  *  both a `RegisteredTaskHandle` and a `WorkflowRun` (orchestration/workflow.ts — a different module,
  *  no shared base type, same fill-once shape). */
@@ -834,7 +834,7 @@ export interface RegisterBackgroundAgentInput extends TaskAccess {
      *  pre-consume window keeps the live face's checkpoint arbitration; the consume flip
      *  {@link TaskRegistry.adoptParkedResume} is the only path to running). Pass the ticket's token
      *  and a stop-arbitration closure alongside. Also licenses replacing an in-process PARKED prior
-     *  handle of the same id (the planned park→resume handoff; lane poisoned like the terminal replace). */
+     *  handle of the same id (the planned park→resume handoff; lane contaminated like the terminal replace). */
     initialStatus?: "parked";
     /** design/153 §7.2d — the parked checkpoint token this parked-born handle waits on. */
     parkedCheckpointToken?: string;

package/dist/core/tool-errors.d.ts

@@ -77,7 +77,7 @@ export declare function formatToolError(error: unknown): string;
  *                   in-presence condition) for that one code, or the errorCode's own doc for every other
  *                   member (`env.lifetime_expired`'s doc says "retrying needs a NEW environment, not a
  *                   smaller budget" — there is no `retryAfterMs` for it, by design: an expiring
- *                   environment has no return time to give). Codex adversarial review (rounds 2 and 4)
+ *                   environment has no return time to give). Codex falsification review (rounds 2 and 4)
  *                   twice suggested a distinct governance/platform class or leaving these `unknown`
  *                   instead — rejected both times: (a) explicit calling-convention direction; (b)
  *                   `WorkerErrorClass` is a small CLOSED public exported union — adding a member is an
@@ -86,7 +86,7 @@ export declare function formatToolError(error: unknown): string;
  *                   terminal codes, not foreign ones); (c) pre-existing precedent (`config.compliance_required`,
  *                   NOT part of this diff) already folds a transient/retryable governance code into `config`.
  *                   `memory.admission_required`/`_denied`/`env.lifetime_expired` are EXACT codes, not broad
- *                   `memory.`/`env.` prefixes — codex adversarial review (A-005.3 follow-up) caught an
+ *                   `memory.`/`env.` prefixes — codex falsification review (A-005.3 follow-up) caught an
  *                   earlier draft folding EVERY `memory.*`/`env.*` code here, which misclassified the
  *                   memory-engine's non-governance incident codes (`memory.secret_detected` et al.,
  *                   explicitly listed as NON-governance in `NON_GOVERNANCE_MEMORY_CODES` — a content-safety