@sema-agent/core 5.43.0 → 5.44.0

package/CHANGELOG.md

@@ -1,5 +1,51 @@
 # Changelog
 
+## 5.44.0 — 2026-08-19
+
+### Added
+- Memory pollution is LOUD (#324a): two EngineNotice codes — `memory.session_polluted` (once per
+  session, minted on the wx-atomic first transition; states the VERDICT: content written after the
+  mark is not admitted to the long-term library at harvest) and `memory.harvest_quarantined`
+  (at most once per harvest when a polluted session's harvest withheld ≥1 entry file;
+  `detail: {count, moved, escalated, reason?, sessionId?}` — deduplicated-path counts, `moved` =
+  files that actually left the model-visible plane, `escalated` = quarantine failures). Both ride
+  `deliverEngineNotice` (seat / absent-warn / malformed-seat fallback, unchanged). The notices
+  state facts, not promises: writeScope-null and persistence-incapable arms take the zero-adoption
+  return and are NOT described as quarantined.
+- `MemoryEngine.markSessionPolluted` now returns `SessionPollutionMarkOutcome` (was `void`) —
+  additive; the wx-atomic marker distinguishes `"created" | "existed" | "unpersisted"`.
+- Release-criteria gate hardening (5.44 rescan disposal, 8 findings): the EngineNotice MINT
+  judgment is checker-based (the `code` value inside an object literal whose non-nullable
+  contextual type carries `code`+`message` on EVERY union arm, in files the shipped build
+  compiles) — a literal type, the `err.code=` refusal dialect, a comment, an examples-only mint
+  and a bare `{code,message}` const no longer count; a public CLASS is a legal citation root
+  (instance + declared statics, minus private/write-only/language-supplied); a disclosed release
+  (CHANGELOG section present) with no criteria document reds the gate.
+- design/278 recipe pins: the coordinator fresh-spawn recipe core arms (spawn-fresh imperative,
+  verbatim user quote, literal command, execute-only, relayed-consent line) are pinned six-ways —
+  the recipe the G6 classifier exception depends on can no longer drift silently. (The #278
+  product fix itself shipped in 5.38.0; the ledger row was stale and is now closed.)
+
+### Changed
+- Grep target-spelling flip completion (#318): `jsGrepDetailed` answers — including the rescan
+  legs an rg-present host falls back to — carry the single explicit FILE target's own spelling
+  (family-aware dot-segment collapse, one family judgment for the whole anchor; `..` cannot climb
+  past a namespace root). The two engines no longer disagree on path shape for the same call.
+- Grep structured rows completion (#313 remainder): the JS legs hand served rows too; the served-row
+  contract states its one measured exception.
+- `memory_get` not-found no longer blindly suggests `memory_search`; when the missing slug was
+  written THIS session the text states the mount-snapshot fact (new writes become retrievable
+  next session) and, in a polluted session, states that the write will be withheld at harvest.
+  `memory_search` zero-hit output appends the pollution disclosure line in polluted sessions only
+  (clean sessions byte-identical). Tool contract revisions move: search 1→2, get 2→3.
+- The 5.43.0 `-H` entry erratum (recorded in that section): the flip covers count mode too, and
+  the "without a deny judge" arm is not a configuration any public route produces.
+
+### Fixed
+- `docs/release-criteria/5.43.0.json` four unexecutable/false arms repaired (deny-less arm no
+  public route can produce; the deny-note flip F5 declared and claimed by G3; the per-process
+  console latch construction made blackbox-executable; the rg-leg note wording quoted as minted).
+
 ## 5.43.0 — 2026-08-18
 
 ### Added
@@ -27,12 +73,15 @@
 - Grep's ripgrep legs always pass `-H` (#311): a single explicit file target keeps its path
   field, so a deny-guarded single-file grep keeps the rg fast path instead of abandoning rg for
   the JS scanner's explicit-file lane (an engine swap over that one file, losing rg's
-  streaming/large-file handling). Observable flip, both arms: content-mode output for a single
-  explicit file target now carries a path prefix in the TARGET's spelling as passed (the tool
-  layer hands an absolute canonical path, so the prefix is ABSOLUTE); without a deny judge the
-  line previously had no prefix, and WITH one it previously came from the JS lane with a
-  root-relative prefix — both spellings change. Multi-file and directory targets: byte-identical
-  (measured). The two engines still disagree on path shape for the same call (jsGrep emits
+  streaming/large-file handling). Observable flip: content-mode AND count-mode output for a
+  single explicit file target now carries a path prefix in the TARGET's spelling as passed (the
+  tool layer hands an absolute canonical path, so the prefix is ABSOLUTE; count mode reads
+  `<path>:<n>`); `files_with_matches` did not move. **Erratum (5.44 rescan)**: this entry
+  originally scoped the flip to content mode and described a "without a deny judge" arm — no
+  public route produces that arm (every route to the tool compiles a read-deny judge), and the
+  previous release answered the call from the JS lane with a ROOT-RELATIVE prefix in every deny
+  configuration a caller can produce; count mode flipped the same way. Multi-file and directory
+  targets: byte-identical (measured). The two engines still disagree on path shape for the same call (jsGrep emits
   root-relative) — that alignment is tracked separately (#318), not silently changed here.
 - The deny-withholding note no longer fabricates on single-file scopes (5.43 rescan): `rg --files`
   lists an explicitly named file argument regardless of glob filters, so the existence probe

package/dist/core/governance-codes.js

@@ -14,6 +14,8 @@ export const NON_GOVERNANCE_MEMORY_CODES = new Set([
     "memory.partition_split",
     "memory.tail",
     "memory.pollution_mark_failed",
+    "memory.session_polluted",
+    "memory.harvest_quarantined",
     "memory.challenge_sweep_failed",
     "memory.lineage_settle_failed",
     "memory.challenge_ledger_corrupt",

package/dist/core/memory-engine/engine.d.ts

@@ -1,6 +1,7 @@
+import type { EngineNotice } from "../types.js";
 import { type CommittedBinding, type EraseMemoryEntriesInput, type MemoryErasureAttestation, type TransferEvidence } from "./file-backend.js";
 import { type MemoryExportBundle, type MemoryImportReport } from "./export-bundle.js";
-import { type ChallengeAssignment, type ChallengeEvent, type ControlPlaneRebuildReceipt, type StrictControlPlaneLedger, type ChallengedHistoryRow, type LineagePendingTxn, type LineagePromotion, type MemoryPartitionIncidentSink, type RetrievedAccountRow, type SessionPollutionRecord } from "./layout.js";
+import { type ChallengeAssignment, type ChallengeEvent, type ControlPlaneRebuildReceipt, type StrictControlPlaneLedger, type ChallengedHistoryRow, type LineagePendingTxn, type LineagePromotion, type MemoryPartitionIncidentSink, type RetrievedAccountRow, type SessionPollutionMarkOutcome, type SessionPollutionRecord } from "./layout.js";
 import type { HarvestReport, MemoryAnnouncement, MemoryBackend, MemorySessionHandle, ScanFinding } from "./types.js";
 /**
  * The CC `# Memory` instruction section — VERBATIM from the live capture
@@ -255,6 +256,91 @@ export interface EntryProvenanceAccount {
         reason?: string;
     };
 }
+/**
+ * The pollution mark's loud half ({@link EngineNotice}). The engine's own `onIncident` seat carries the
+ * FAILURES of this machinery (`memory.pollution_mark_failed`, `memory.challenge_sweep_failed`); this is
+ * the other fact — the machinery worked, and its verdict silently changed what every memory write in
+ * this session will do. Before this code existed the transition had no face at all: the session went on
+ * writing memory files, the harvest quarantined every one of them, and nothing said so while a host
+ * could still act on it.
+ *
+ * SCOPE OF THE CLAIM (adversarial-review round 1, P1 — the first cut PROMISED quarantine on every mark).
+ * This notice states the VERDICT, not the mechanism's outcome: "no longer eligible", plus what a harvest
+ * does WHEN IT COLLECTS. That distinction is load-bearing, because several real paths reach a polluted
+ * harvest that quarantines nothing — a `writeScope`-null layering and a declared-unavailable session
+ * both take `harvestCore`'s zero-admission return (nothing is collected, so nothing is captured), and a
+ * mark landing after the pre-commit pollution read leaves already-committed rows to the CHALLENGE sweep
+ * rather than to containment. What a given harvest actually contained is the other code's job
+ * (`memory.harvest_quarantined`), and the message says so instead of guessing here. The baseline clause
+ * is likewise scoped to a collecting harvest: containment judges a changed file against the
+ * MATERIALIZE-time baseline, not against the mark's timestamp, so pre-mark writes are covered too.
+ *
+ * The challenge clause is likewise a POLICY statement with its failure channel named (adversarial-review
+ * round 3): the mark-side sweep is best-effort — an unreadable or unwritable lineage ledger makes
+ * `markSessionPolluted` announce `memory.challenge_sweep_failed` and return normally — so this notice
+ * must not be read as a receipt that the sweep landed.
+ *
+ * Minted by the runner's mark seat (the one call site of the mark face), so an engine-direct host keeps
+ * the incident seat and gains no new obligation.
+ *
+ * `reason` names a TOOL, and tool names come from the host/protocol roster: neutralized and bounded
+ * here — the same treatment the report warnings give it — before it rides either the message or the
+ * detail (a host renders both).
+ */
+export declare function memorySessionPollutedNotice(input: {
+    reason: string;
+    sessionId?: string;
+}): EngineNotice;
+/**
+ * The polluted harvest's loud half ({@link EngineNotice}): what the containment actually did, minted
+ * once per harvest that withheld at least one ENTRY file. `count` is the withheld set (the
+ * `polluted`-coded rejections — entry files that diverged from the materialize baseline), `moved` the
+ * subset that also LEFT the model-visible plane, and `escalated` the subset carrying a
+ * `quarantineFailures` row.
+ *
+ * `escalated` is its own input rather than `count - moved` (adversarial-review round 3): the two are
+ * NOT the same set. A file whose delete fails but whose tombstone write succeeds counts as removed —
+ * it rides `movedToQuarantine` AND an escalation row saying it was tombstoned in place — so the
+ * arithmetic would report a clean containment while a known failure sat in the report. Every
+ * not-moved file does have an escalation row, so `escalated` is the superset and the honest clause.
+ *
+ * KNOWN GAP (adversarial-review round 1, P2 — registered, not closed here): the derived index is
+ * contained by a different path (`restorePollutedIndex` captures and restores `MEMORY.md`) that mints
+ * no rejection row, so a polluted session whose ONLY memory change was an index line produces no
+ * `count` and no notice — its containment is disclosed by the harvest report's warnings alone. Closing
+ * it needs a structured containment signal on `HarvestReport`, a public type this fix does not touch.
+ * The wording therefore says "entry file(s)" rather than implying the whole containment.
+ *
+ * `reason` is optional because the mark record is read separately from the report: a record that cannot
+ * be read must not turn a true "N files were withheld" into a lie about why.
+ */
+/**
+ * The three numbers {@link memoryHarvestQuarantinedNotice} reports, read off ONE harvest report. Pure
+ * and exported so the derivation is provable on its own (the tombstone case — moved AND escalated — is
+ * not constructible through a real filesystem without root-dependent permission tricks).
+ *
+ * Every number is scoped to the WITHHELD paths: a dual-root harvest merges the read plane's report in,
+ * and that plane's ordinary write gate quarantines on its own grounds — counting its rows would credit
+ * this session's pollution with containment it never performed.
+ *
+ * FILES, NOT ROWS (adversarial-review round 4). One path can appear twice in the same report: when the
+ * pre-commit pollution recheck flips a clean harvest to containment, a file the ordinary secret/filename
+ * gate already quarantined is contained again, and both passes append. Counting rows would then publish
+ * `moved`/`escalated` greater than `count` — an impossible statement about a set of files — so every
+ * number here is a count of DISTINCT paths.
+ */
+export declare function pollutionContainmentCounts(report: HarvestReport): {
+    count: number;
+    moved: number;
+    escalated: number;
+};
+export declare function memoryHarvestQuarantinedNotice(input: {
+    count: number;
+    moved: number;
+    escalated: number;
+    reason?: string;
+    sessionId?: string;
+}): EngineNotice;
 export declare class MemoryEngine {
     private readonly backend;
     private readonly memoryDir;
@@ -301,8 +387,14 @@ export declare class MemoryEngine {
      * record, and the durable marker survives restarts (control plane — never model-writable
      * frontmatter). A failed durable write is disclosed via `onIncident` (`memory.pollution_mark_failed`)
      * while the in-memory mark keeps THIS process fail-closed.
+     *
+     * RETURNS the durable marker's {@link SessionPollutionMarkOutcome} — `"created"` ⇔ this call made
+     * the transition. That is the ONE atomic answer to "was this the clean → polluted crossing", and the
+     * runner's once-per-session disclosure is keyed on it: a pre-read cannot decide it (two concurrent
+     * markers of one session would both read clean and both announce). Callers that do not disclose
+     * ignore it exactly as before.
      */
-    markSessionPolluted(sessionId: string, reason: string): void;
+    markSessionPolluted(sessionId: string, reason: string): SessionPollutionMarkOutcome;
     /** The session's pollution record (in-process mark first, then the durable marker) — undefined =
      *  clean. Reads are side-effect-free. */
     sessionPollution(sessionId: string): SessionPollutionRecord | undefined;

package/dist/core/memory-engine/engine.js

@@ -48,6 +48,47 @@ export const DEFAULT_HARVEST_DEADLINE_MS = 5_000;
 export const DEFAULT_HARVEST_FILE_BUDGET = 2_000;
 export const MASS_DELETION_FUSE_RATIO = 0.5;
 let indexCaptureSeq = 0;
+export function memorySessionPollutedNotice(input) {
+    const reason = inlineUntrusted(input.reason, 200);
+    return {
+        code: "memory.session_polluted",
+        message: `Memory for this session is marked polluted: ${reason}. Its memory writes are no longer eligible for the ` +
+            `long-term library — a harvest withholds what it collects (quarantined for host review, judged against the ` +
+            `session's opening baseline, so changes made before this point are withheld too), and contributions this ` +
+            `session already committed are challenged (a sweep that cannot run announces memory.challenge_sweep_failed). ` +
+            `What a given harvest actually contained is announced as memory.harvest_quarantined.`,
+        detail: { reason, ...(input.sessionId !== undefined ? { sessionId: input.sessionId } : {}) },
+    };
+}
+export function pollutionContainmentCounts(report) {
+    const withheld = new Set(report.rejections.filter((r) => r.code === "polluted").map((r) => r.path));
+    const distinct = (paths) => new Set(paths.filter((p) => withheld.has(p))).size;
+    return {
+        count: withheld.size,
+        moved: distinct(report.movedToQuarantine),
+        escalated: distinct((report.quarantineFailures ?? []).map((q) => q.path)),
+    };
+}
+export function memoryHarvestQuarantinedNotice(input) {
+    const reason = input.reason !== undefined ? inlineUntrusted(input.reason, 200) : undefined;
+    return {
+        code: "memory.harvest_quarantined",
+        message: `Memory harvest committed nothing for this polluted session${reason !== undefined ? ` (${reason})` : ""}: ` +
+            `${input.count} memory entry file(s) written or changed in it were withheld, ${input.moved} of them moved into ` +
+            `the control-plane quarantine directory for host review` +
+            (input.escalated > 0
+                ? `; ${input.escalated} carr${input.escalated === 1 ? "ies" : "y"} a containment escalation (a file that did not leave the ` +
+                    `model-visible plane, or one tombstoned in place rather than deleted) — the harvest report's quarantineFailures names them.`
+                : "."),
+        detail: {
+            count: input.count,
+            moved: input.moved,
+            escalated: input.escalated,
+            ...(reason !== undefined ? { reason } : {}),
+            ...(input.sessionId !== undefined ? { sessionId: input.sessionId } : {}),
+        },
+    };
+}
 export class MemoryEngine {
     backend;
     memoryDir;
@@ -115,14 +156,14 @@ export class MemoryEngine {
     markSessionPolluted(sessionId, reason) {
         if (!this.pollutedSessions.has(sessionId))
             this.pollutedSessions.set(sessionId, { at: this.now(), reason });
-        let durable = false;
+        let outcome;
         try {
-            durable = markSessionPolluted(this.controlDir, sessionId, reason, this.now);
+            outcome = markSessionPolluted(this.controlDir, sessionId, reason, this.now);
         }
         catch {
-            durable = false;
+            outcome = "unpersisted";
         }
-        if (!durable) {
+        if (outcome === "unpersisted") {
             const sink = this.onIncident;
             if (sink !== undefined) {
                 try {
@@ -156,6 +197,7 @@ export class MemoryEngine {
                 }
             }
         }
+        return outcome;
     }
     sessionPollution(sessionId) {
         const inProcess = this.pollutedSessions.get(sessionId);

package/dist/core/memory-engine/layout.d.ts

@@ -288,11 +288,18 @@ export interface SessionPollutionRecord {
 }
 /**
  * Mark `sessionId` polluted (idempotent; the FIRST record wins — `wx` create refuses overwrite).
- * Returns true when a durable marker exists after the call (created now or already present);
- * false ⇔ the marker could not be persisted — the caller must keep its own in-memory mark and
- * disclose (the session stays polluted for this process either way).
+ *
+ * The outcome distinguishes the two ways a durable marker can exist after the call, because the
+ * `wx` create is the only ATOMIC answer to "who made this transition" available anywhere in the
+ * stack (#324a, adversarial-review round 5): a check-then-act pre-read lets two concurrent markers
+ * of one session both believe they were first, and a once-per-session disclosure keyed on that would
+ * announce twice. `"created"` ⇔ THIS call minted the marker; `"existed"` ⇔ it was already there (a
+ * repeat mark, a resumed session, or a racing peer that won the create); `"unpersisted"` ⇔ the marker
+ * could not be written at all — the caller must keep its own in-memory mark and disclose (the session
+ * stays polluted for this process either way).
  */
-export declare function markSessionPolluted(controlDir: string, sessionId: string, reason: string, now: () => number): boolean;
+export type SessionPollutionMarkOutcome = "created" | "existed" | "unpersisted";
+export declare function markSessionPolluted(controlDir: string, sessionId: string, reason: string, now: () => number): SessionPollutionMarkOutcome;
 /** Read the durable pollution record for `sessionId` (undefined = no marker).
  *  A marker that EXISTS still reads as polluted whether or not its bytes can be read or parsed
  *  (fail-closed: neither corruption nor an unreadable node may launder the state) — a synthesized

package/dist/core/memory-engine/layout.js

@@ -740,12 +740,12 @@ export function markSessionPolluted(controlDir, sessionId, reason, now) {
         ensureDirExists(dirname(path));
         const record = { at: now(), reason };
         writeFileSync(path, `${JSON.stringify(record, null, 2)}\n`, { encoding: "utf8", flag: "wx" });
-        return true;
+        return "created";
     }
     catch (err) {
         if (err instanceof Error && "code" in err && err.code === "EEXIST")
-            return true;
-        return false;
+            return "existed";
+        return "unpersisted";
     }
 }
 export function readSessionPollution(controlDir, sessionId) {

package/dist/core/memory-engine/tools.d.ts

@@ -66,6 +66,18 @@ export interface MemoryEngineToolsOptions {
     planes: ReadonlyArray<MemoryEnginePlane>;
     /** Clock (tests); default Date.now. Drives the natural-language age rendering only. */
     now?: () => number;
+    /**
+     * design/178 §3 (#324b) — the session's pollution READ face: the record when this session is marked
+     * polluted, `undefined` when it is clean. Read-only and side-effect-free (the mark is one-way and
+     * lives at the runner's mark seat); consulted ONLY on the empty outcomes, where a session whose
+     * writes are being withheld deserves to hear it instead of being told to search again.
+     *
+     * Absent ⇒ no pollution face is wired (engine-direct hosts, tests): the empty-outcome wording is
+     * then exactly the clean-session wording — nothing is inferred from the seat's absence.
+     */
+    sessionPollution?: () => {
+        reason: string;
+    } | undefined;
 }
 export interface MemorySearchHit {
     id: string;

package/dist/core/memory-engine/tools.js

@@ -91,6 +91,26 @@ export function skipBytes(text, startBytes) {
 export function createMemoryEngineTools(opts) {
     const { planes } = opts;
     const now = opts.now ?? Date.now;
+    const pollutionSentence = () => {
+        let reason;
+        try {
+            reason = opts.sessionPollution?.()?.reason;
+        }
+        catch {
+            return "";
+        }
+        if (reason === undefined)
+            return "";
+        return ` This session is marked polluted (${inlineUntrusted(reason, 200)}): the memory it writes is not admitted to the library at harvest, so writing this down now would not make it retrievable later either.`;
+    };
+    const noMatch = (query) => {
+        const details = { outcome: "ok", hits: [] };
+        return {
+            content: `No memory entries matched ${JSON.stringify(inlineUntrusted(query, 120))}. If the user expected you to know this, say that you checked memory and found nothing.` +
+                pollutionSentence(),
+            details,
+        };
+    };
     const getWithinScopes = async (plane, ids) => {
         const scopeSet = new Set(plane.scopes);
         return (await plane.backend.getByIds(ids)).filter((e) => scopeSet.has(e.scope) && e.frontmatter.deleted !== true);
@@ -102,7 +122,7 @@ export function createMemoryEngineTools(opts) {
         defer: true,
         offload: false,
         contentOrigin: "local",
-        contract: { contractId: "core.memory_search@1", implementationRevision: "1" },
+        contract: { contractId: "core.memory_search@1", implementationRevision: "2" },
         parameters: Type.Object({
             query: Type.String({ description: "Keywords to look for (lexical match against entry names, descriptions and bodies)." }),
             limit: Type.Optional(Type.Number({ description: `Maximum hits to return (default ${MEMORY_SEARCH_DEFAULT_LIMIT}, max ${MEMORY_SEARCH_MAX_LIMIT}).` })),
@@ -144,10 +164,8 @@ export function createMemoryEngineTools(opts) {
             }
             merged.sort(contractOrder);
             const top = merged.slice(0, limit);
-            if (top.length === 0) {
-                const details = { outcome: "ok", hits: [] };
-                return { content: `No memory entries matched ${JSON.stringify(inlineUntrusted(query, 120))}. If the user expected you to know this, say that you checked memory and found nothing.`, details };
-            }
+            if (top.length === 0)
+                return noMatch(query);
             const bodyById = new Map();
             try {
                 for (let i = 0; i < planes.length; i++) {
@@ -171,10 +189,8 @@ export function createMemoryEngineTools(opts) {
                 return refusedSearch("challenge_ledger_unavailable", "Memory search is unavailable: the challenge ledger for a mounted memory plane cannot be read (fail-closed). Report this to the operator.", "failed");
             }
             const live = top.filter((h) => bodyById.has(h.id) && terminalExclusions[h.planeIndex]?.has(h.id) !== true);
-            if (live.length === 0) {
-                const details = { outcome: "ok", hits: [] };
-                return { content: `No memory entries matched ${JSON.stringify(inlineUntrusted(query, 120))}. If the user expected you to know this, say that you checked memory and found nothing.`, details };
-            }
+            if (live.length === 0)
+                return noMatch(query);
             for (let i = 0; i < planes.length; i++) {
                 const ids = live.filter((h) => h.planeIndex === i).map((h) => h.id);
                 if (ids.length === 0)
@@ -219,7 +235,7 @@ export function createMemoryEngineTools(opts) {
         defer: true,
         offload: false,
         contentOrigin: "local",
-        contract: { contractId: "core.memory_get@1", implementationRevision: "2" },
+        contract: { contractId: "core.memory_get@1", implementationRevision: "3" },
         parameters: Type.Object({
             id: Type.Optional(Type.String({ description: "Entry id (exact lookup). Pass either id or slug, not both." })),
             slug: Type.Optional(Type.String({ description: "Entry slug (its file path without .md). Ambiguous across scopes unless scope is also passed." })),
@@ -275,7 +291,10 @@ export function createMemoryEngineTools(opts) {
                     }
                     if (matches.length === 0) {
                         const where = scope !== undefined ? ` in scope ${JSON.stringify(inlineUntrusted(scope, 80))}` : "";
-                        return refusedGet("not_found", `No memory entry with slug ${JSON.stringify(inlineUntrusted(slug, 160))}${where} is mounted in this session. Try ${MEMORY_SEARCH_TOOL_NAME}.`, "not_found", { slug: slug, ...(scope !== undefined ? { scope } : {}) });
+                        return refusedGet("not_found", `No memory entry with slug ${JSON.stringify(inlineUntrusted(slug, 160))}${where} is mounted in this session. ` +
+                            `Only entries carrying a committed entry id are served here, and a memory file written into the memory root during ` +
+                            `this session gets its id when the session-boundary harvest admits it — a file written in this session is not served here before then.` +
+                            pollutionSentence(), "not_found", { slug: slug, ...(scope !== undefined ? { scope } : {}) });
                     }
                     if (matches.length > 1) {
                         const candidates = matches.map((m) => ({ scope: m.header.scope, slug: m.header.slug, id: m.header.id }));

package/dist/core/runner/prepare-memory.js

@@ -1,9 +1,10 @@
 import { sep } from "node:path";
+import { deliverEngineNotice } from "../types.js";
 import { admitMemoryScopes } from "../memory-admission.js";
 import { adoptLegacyRepoDirs, canonicalize, deriveRepoControlPlaneDir, deriveProjectControlDir, deriveProjectMemoryDir, deriveRepoMemoryDir, drainMemoryAnnouncements, enqueueMemoryAnnouncement, isContainedIn, lookupProjectIdHint, recordProjectIdHint, resolveMemoryEngineRoot } from "../memory-engine/layout.js";
 import { classifyScopePlanes, derivePersonalControlDir, derivePersonalMemoryDir, mergeHarvestReports, mergeInjections, needsDualRoots, parsedProjectPlane } from "../memory-engine/dual-root.js";
 import { normalizeMemorySpec } from "../memory.js";
-import { MEMORY_ANNOUNCEMENT_READONLY_CODA, MEMORY_PREFERENCE_DISCIPLINE, MEMORY_READONLY_NOTICE, MEMORY_RECALL_DISCIPLINE, MemoryEngine } from "../memory-engine/engine.js";
+import { MEMORY_ANNOUNCEMENT_READONLY_CODA, MEMORY_PREFERENCE_DISCIPLINE, MEMORY_READONLY_NOTICE, MEMORY_RECALL_DISCIPLINE, MemoryEngine, memoryHarvestQuarantinedNotice, memorySessionPollutedNotice, pollutionContainmentCounts, } from "../memory-engine/engine.js";
 import { createMemoryEngineTools } from "../memory-engine/tools.js";
 import { assertScopeContractPlacement, parseScopeKey, resolveProjectId } from "../memory-engine/scope-contract.js";
 import { FileMemoryEngineBackend } from "../memory-engine/file-backend.js";
@@ -298,12 +299,26 @@ export async function prepareMemory(input) {
                 }
                 return writeEngine.gateWrite(writeHandle, w.key, w.content);
             };
+            let pollutionAnnounced = false;
+            const announceHarvestContainment = (report) => {
+                const { count, moved, escalated } = pollutionContainmentCounts(report);
+                if (count === 0)
+                    return;
+                let reason;
+                try {
+                    reason = writeEngine.sessionPollution(sessionId)?.reason;
+                }
+                catch {
+                }
+                deliverEngineNotice(deps.onNotice, memoryHarvestQuarantinedNotice({ count, moved, escalated, ...(reason !== undefined ? { reason } : {}), sessionId }));
+            };
             const harvestSafe = async (phase = "terminal") => {
                 try {
                     const report = await harvestBoth();
                     if (!report.ok && report.incident) {
                         deps.onError?.(new Error(`memory harvest refused (${report.incident.kind}): ${report.incident.detail}`), { phase: "memory", sessionId });
                     }
+                    announceHarvestContainment(report);
                     try {
                         deps.onMemoryHarvestReport?.(report, { sessionId, phase });
                     }
@@ -327,7 +342,13 @@ export async function prepareMemory(input) {
                 harvest: harvestSafe,
                 pollution: {
                     polluted: () => writeEngine.sessionPollution(sessionId),
-                    markPolluted: (reason) => writeEngine.markSessionPolluted(sessionId, reason),
+                    markPolluted: (reason) => {
+                        const outcome = writeEngine.markSessionPolluted(sessionId, reason);
+                        if (outcome === "existed" || (outcome === "unpersisted" && pollutionAnnounced))
+                            return;
+                        pollutionAnnounced = true;
+                        deliverEngineNotice(deps.onNotice, memorySessionPollutedNotice({ reason, sessionId }));
+                    },
                 },
                 contentSafety: {
                     trustedTools: new Set(memorySpec.trustedTools ?? []),
@@ -341,7 +362,7 @@ export async function prepareMemory(input) {
                 writeScope: memorySpec.writeScope,
             };
             if (input.memorySearchToolsPlanned)
-                memoryTools = createMemoryEngineTools({ planes: toolPlanes });
+                memoryTools = createMemoryEngineTools({ planes: toolPlanes, sessionPollution: () => writeEngine.sessionPollution(sessionId) });
         }
         catch (err) {
             if (typeof err.code === "string" &&

package/dist/core/types.d.ts

@@ -4683,6 +4683,34 @@ export interface EngineNotice {
      *    `detail: { steer, taskId? }` / `{ followUp, taskId? }`. Per-run, at most once per family
      *    (the terminal sweep is a single site).
      *
+     *  - `"memory.session_polluted"` (design/178 §3, #324a) — this session's memory crossed into the
+     *    one-way POLLUTED state (a tool classified as an external content source was invoked, directly
+     *    or through a delegated child): its memory writes are no longer eligible for the long-term
+     *    library. The notice states that VERDICT plus what a harvest does when it collects — it does
+     *    not promise quarantine, because a `writeScope`-null layering and a declared-unavailable
+     *    session both reach the zero-admission harvest arm (nothing collected ⇒ nothing captured), and
+     *    a mark landing after the pre-commit pollution read leaves already-committed rows to the
+     *    challenge sweep; what a harvest actually contained is the other code below. The challenge
+     *    clause is a policy statement, not a receipt — a sweep that cannot run announces
+     *    `"memory.challenge_sweep_failed"` on the engine's incident seat. Announced ONCE PER
+     *    SESSION, at the mark seat: a repeat mark inside the process and a resumed session whose
+     *    durable marker already exists stay quiet (the state is one-way, so a second line would carry
+     *    no new fact); a pollution state that cannot be read announces rather than assuming it was
+     *    already said. `detail: { reason, sessionId? }` — `reason` names the invoked tool and is
+     *    neutralized/length-bounded (the name comes from the host/protocol roster).
+     *  - `"memory.harvest_quarantined"` (design/178 §3, #324a) — a polluted session's harvest ran its
+     *    containment: `count` ENTRY files written or changed in the session were withheld from the
+     *    library, `moved` of them were physically moved into the control-plane quarantine directory,
+     *    and `escalated` of them carry a `HarvestReport.quarantineFailures` row (a failed capture, a
+     *    failed removal, or a file tombstoned in place — which counts as moved AND escalated, so the
+     *    two numbers are read off the report's rows, never subtracted from each other). One notice PER
+     *    HARVEST that withheld at least one entry file (a checkpoint harvest and the terminal harvest
+     *    are distinct facts), never minted for a clean session; `detail: { count, moved, escalated,
+     *    reason?, sessionId? }` (`reason` absent ⇔ the pollution marker could not be re-read at report
+     *    time — the withheld count stays true either way). Registered gap: the derived index (`MEMORY.md`) is
+     *    contained on a path that mints no rejection row, so an index-ONLY containment produces no
+     *    notice and is disclosed by the harvest report's warnings alone.
+     *
      *  Deliberately NOT a notice family: brain retry/reconnect liveness (a rate limit, a 5xx, a
      *  transient network failure being retried). Those are per-attempt liveness frames with their own
      *  frequency semantics and ride the wire `status` channel ({@link BrainStatus}), whose sink the

package/dist/tools/fs/fs-search-tools.d.ts

@@ -5,9 +5,10 @@ import type { ReadFace } from "./read-face.js";
 /**
  * The Grep card's details assembly, PURE over the engine text ({mode, offset} from the request) —
  * exported so the text→structured mapping is pinnable with synthetic texts (the byte-truncation and
- * fenced-partial shapes are impractical to construct through a live tool call). Follow-up #313 will
- * replace the text parsing with structured rows from runGrep; until then this seam is the honesty
- * boundary.
+ * fenced-partial shapes are impractical to construct through a live tool call). #313 moved PATH
+ * IDENTITY off the text and onto the engines' served rows (both legs supply them now); the counts
+ * and totals below still read the engine's own honesty markers out of the text, which is what keeps
+ * this seam the honesty boundary.
  */
 export declare function grepDetailFields(text: string, mode: "files_with_matches" | "content" | "count", offset?: number, structuredRows?: readonly import("./search.js").GrepRow[]): Record<string, unknown>;
 export declare function createGrepTool(env: ExecutionEnv, rootCanonical: string, additionalRoots?: readonly string[], readDeny?: ReadDenyMatcher, readFace?: ReadFace): AgentTool;

package/dist/tools/fs/search.d.ts

@@ -190,7 +190,27 @@ export interface ReadDenyJudge {
 /** JS-fallback grep: ignore-aware walk + per-line scan, honoring output_mode / context / head_limit.
  *  design/199 件B: `deny` prunes the walk (note appended to every output shape); `denyOut` is the
  *  structured twin — a sink because this function's dozen error returns predate the facts (the sink
- *  is written the moment the walk lands, whatever the scan then returns). */
+ *  is written the moment the walk lands, whatever the scan then returns).
+ *
+ *  backlog #313 — the SERVED rows ride back next to the text. This scanner knows every result's
+ *  identity natively (the walk hands it whole paths), so a row's `path` is that walked identity,
+ *  never a cut of the rendered line — the mis-split family the text re-parse carries cannot exist
+ *  here. The rows ARE the window `text` shows: post offset, post row cap, post byte ceiling, in the
+ *  same order. The unit is the RECORD, which is the unit the cap has always counted: one record is
+ *  one rendered line EXCEPT where the file's own name carries a newline, and then the one record
+ *  spans two physical lines — the same relation {@link formatRgRecords} states for the rg leg, and
+ *  precisely the case where a row's identity beats anything the text can be split into.
+ *  Every row carries a path (this leg emits no group-separator row — the one pathless shape
+ *  ripgrep's output can carry), and a no-match run's row set is `[]`, not absent. A typed
+ *  `Error (grep): …` return carries no rows at all: a refusal is not a row set. */
+export declare function jsGrepDetailed(env: ExecutionEnv, root: string, p: GrepParams, signal?: AbortSignal, guards?: JsGrepGuards, deny?: ReadDenyJudge, denyOut?: {
+    withheld?: ReadDenyWithheld;
+}): Promise<{
+    text: string;
+    rows?: readonly GrepRow[];
+}>;
+/** Text-only wrapper of {@link jsGrepDetailed} (the shape callers that never look at the served rows
+ *  want — the same relation {@link runGrep} has to {@link runGrepDetailed}). */
 export declare function jsGrep(env: ExecutionEnv, root: string, p: GrepParams, signal?: AbortSignal, guards?: JsGrepGuards, deny?: ReadDenyJudge, denyOut?: {
     withheld?: ReadDenyWithheld;
 }): Promise<string>;
@@ -210,18 +230,34 @@ export type GrepDegradation = {
 };
 /** Structured grep result: the model-facing text plus the degradation facts, so the tool layer can
  *  ship them on the structured frame instead of leaving them prose-only. */
-/** #313 (first stage, rg legs) — one SERVED result row with its path read from ripgrep's own
- *  field ({@link parseRgRecords}), exactly the window `text` shows (post cap/offset). The tool
- *  layer prefers these over re-parsing `text` (whose `path:line:text` split mis-cuts a path that
- *  itself contains `:digits:`); absent = a leg that has no structured rows yet (the JS scanner —
- *  its rows stage is the ticket's remainder) and the text parse is the honest fallback. */
+/** #313 — one SERVED result RECORD with its path taken from the engine's own knowledge, exactly the
+ *  window `text` shows (post cap/offset): ripgrep's `--null` path field ({@link parseRgRecords}) on
+ *  the rg legs, the walked file identity ({@link jsGrepDetailed}) on the JS-scanner legs. A record is
+ *  one rendered line except where a path carries a newline (see {@link formatRgRecords}), which is
+ *  also the case the text can no longer be split into records at all. The tool layer prefers these
+ *  over re-parsing `text` (whose `path:line:text` split mis-cuts a path that
+ *  itself contains `:digits:`).
+ *
+ *  KNOWN EXCEPTION to "exactly the window `text` shows", stated because it is measurable: on the two
+ *  ripgrep PARTIAL legs (timeout / error-exit with output) the delivered text is fenced by
+ *  `delimitUntrusted`, which NEUTRALIZES fence markers inside the body, while the rows carry the
+ *  record bytes as ripgrep emitted them. A row's `text` there is therefore the un-neutralized form —
+ *  identity (`path`) is unaffected. Consume `text` for anything rendered; the rows' contract is
+ *  identity. Reconciling the two (defuse per record, or withhold rows where the text is fenced) is a
+ *  contract choice recorded for the backlog, not settled here.
+ *
+ *  `path` is absent only where the record genuinely carries none —
+ *  ripgrep's `--` group separator and the unaccountable shapes listed on {@link RgRecord} — and a
+ *  row set carrying such a row sends the tool layer back to the text parse for identity. */
 export interface GrepRow {
     path?: string;
     text: string;
 }
 export interface GrepRunResult {
     text: string;
-    /** Served rows (#313): present on the ripgrep legs, absent on the JS-scanner legs. */
+    /** Served rows (#313): present on BOTH engine legs — ripgrep's and the JS scanner's, including the
+     *  rescan legs. Absent only when the JS scanner refused the search outright (a typed
+     *  `Error (grep): …` text): a refusal has no row set, truthfully, rather than an empty one. */
     rows?: readonly GrepRow[];
     degraded?: GrepDegradation;
     /** design/199 件B — deny-list withholding facts (see {@link ReadDenyWithheld}); absent = nothing

package/dist/tools/fs/search.js

@@ -1,6 +1,6 @@
 import { delimitUntrusted } from "../../core/untrusted-text.js";
 import { MAX_EXEC_OUTPUT_BYTES } from "../../core/exec-output-tail.js";
-import { hasBinaryExtension, isAbsolutePathForm } from "./safety.js";
+import { hasBinaryExtension, isAbsolutePathForm, isWinFormPath } from "./safety.js";
 const WALK_MAX_FILES = 5000;
 const WALK_MAX_DEPTH = 32;
 const GREP_DEFAULT_CAP = 250;
@@ -35,6 +35,25 @@ const TYPE_GLOBS = {
     css: "*.{css,scss,less}",
 };
 const basename = (p) => p.slice(Math.max(p.lastIndexOf("/"), p.lastIndexOf("\\")) + 1);
+function collapseDotSegments(p) {
+    const win = isWinFormPath(p);
+    const lead = (win ? /^[\\/]*/ : /^\/*/).exec(p)?.[0] ?? "";
+    const sep = win ? "\\" : "/";
+    const parts = p.slice(lead.length).split(win ? /[\\/]+/ : /\/+/);
+    const floor = !win ? 0 : lead.length >= 2 ? 2 : /^[A-Za-z]:$/.test(parts[0] ?? "") ? 1 : 0;
+    const kept = [];
+    for (const part of parts) {
+        if (part === "" || part === ".")
+            continue;
+        if (part === "..") {
+            if (kept.length > floor)
+                kept.pop();
+            continue;
+        }
+        kept.push(part);
+    }
+    return kept.length === 0 ? "" : lead + kept.join(sep);
+}
 const NO_MATCHES = "No matches.";
 const GREP_LINE_CLIP = 500;
 function clipLine(line) {
@@ -759,10 +778,10 @@ function multilineSpans(content, p, captureText = false, deadline = Infinity) {
     }
     return spans;
 }
-export async function jsGrep(env, root, p, signal, guards, deny, denyOut) {
+export async function jsGrepDetailed(env, root, p, signal, guards, deny, denyOut) {
     const analysis = analyzeRedos(p.pattern, p.ignore_case === true);
     if (analysis.risk)
-        return redosRejection(analysis.risk);
+        return { text: redosRejection(analysis.risk) };
     const budgetMs = guards?.budgetMs ?? GREP_FILE_BUDGET_MS;
     const longLineLimit = guards?.longLineLimit ?? GREP_GRAY_LINE_MAX;
     const grayPattern = analysis.quantifiedGroup || analysis.unboundedCount >= 2;
@@ -776,7 +795,7 @@ export async function jsGrep(env, root, p, signal, guards, deny, denyOut) {
         test = compilePattern(p);
     }
     catch (e) {
-        return `Error (grep): invalid regex: ${e instanceof Error ? e.message : String(e)}`;
+        return { text: `Error (grep): invalid regex: ${e instanceof Error ? e.message : String(e)}` };
     }
     const ignore = await buildIgnore(env, root, signal);
     const rootPrefix = root.replace(/[\\/]+$/, "") + (root.includes("\\") ? "\\" : "/");
@@ -816,9 +835,20 @@ export async function jsGrep(env, root, p, signal, guards, deny, denyOut) {
     const cap = p.head_limit === 0 ? Infinity : Math.max(1, Math.floor(p.head_limit ?? GREP_DEFAULT_CAP));
     const mode = p.output_mode ?? "files_with_matches";
     const rel = (abs) => (abs.startsWith(rootPrefix) ? abs.slice(rootPrefix.length) : abs);
+    const startWin = isWinFormPath(start);
+    const startNorm = collapseDotSegments(start);
+    const targetSpell = p.path ? p.path.replace(startWin ? /[\\/]+$/ : /\/+$/, "") : "";
+    const isBoundary = (c) => c === "/" || (startWin && c === "\\");
     const relOut = (abs) => {
-        const r = rel(abs);
-        return p.path || r === abs ? r : `./${r}`;
+        if (!p.path) {
+            const r = rel(abs);
+            return r === abs ? r : `./${r}`;
+        }
+        if (abs === startNorm || abs === start)
+            return targetSpell;
+        if (abs.startsWith(startNorm) && isBoundary(abs[startNorm.length]))
+            return targetSpell + abs.slice(startNorm.length);
+        return rel(abs);
     };
     if (p.glob) {
         const globRes = splitGlobParam(p.glob).map((g) => globTokenToRegExp(normalizeGlobToken(g), globIsAnchored(g), true));
@@ -846,7 +876,7 @@ export async function jsGrep(env, root, p, signal, guards, deny, denyOut) {
     let outBytes = 0;
     let outputTruncated = false;
     let rowsBeforeWindow = 0;
-    const pushRow = (row) => {
+    const pushRow = (row, path) => {
         if (outputTruncated)
             return;
         if (rowsBeforeWindow < off) {
@@ -861,7 +891,7 @@ export async function jsGrep(env, root, p, signal, guards, deny, denyOut) {
             return;
         }
         outBytes += size;
-        out.push(row);
+        out.push({ path, text: row });
     };
     const fileMatches = [];
     const counts = [];
@@ -889,6 +919,7 @@ export async function jsGrep(env, root, p, signal, guards, deny, denyOut) {
         const lines = read.value.split("\n");
         if (lines.length > 1 && lines.at(-1) === "")
             lines.pop();
+        const shownPath = relOut(f);
         let fileCount = 0;
         const fileMatchStart = monotonicNow();
         if (p.multiline) {
@@ -902,8 +933,8 @@ export async function jsGrep(env, root, p, signal, guards, deny, denyOut) {
             }
             catch (e) {
                 if (e instanceof GrepBudgetExceeded)
-                    return budgetError(relOut(f), monotonicNow() - fileMatchStart);
-                return `Error (grep): invalid regex: ${e instanceof Error ? e.message : String(e)}`;
+                    return { text: budgetError(shownPath, monotonicNow() - fileMatchStart) };
+                return { text: `Error (grep): invalid regex: ${e instanceof Error ? e.message : String(e)}` };
             }
             fileCount = spans.length;
             if (mode === "content") {
@@ -911,12 +942,12 @@ export async function jsGrep(env, root, p, signal, guards, deny, denyOut) {
                     if (p.only_matching && text !== undefined) {
                         const parts = text.split("\n");
                         for (let k = 0; k < parts.length; k++) {
-                            pushRow(`${relOut(f)}:${s + k}:${clipLine(parts[k])}`);
+                            pushRow(`${shownPath}:${s + k}:${clipLine(parts[k])}`, shownPath);
                         }
                         continue;
                     }
                     for (let j = Math.max(0, s - 1 - ctxB); j <= Math.min(lines.length - 1, eL - 1 + ctxA); j++) {
-                        pushRow(`${relOut(f)}:${j + 1}:${clipLine(lines[j])}`);
+                        pushRow(`${shownPath}:${j + 1}:${clipLine(lines[j])}`, shownPath);
                     }
                 }
             }
@@ -926,7 +957,7 @@ export async function jsGrep(env, root, p, signal, guards, deny, denyOut) {
                 if (grayPattern || (i > 0 && i % GREP_LINE_CHECK_EVERY === 0)) {
                     const elapsed = monotonicNow() - fileMatchStart;
                     if (elapsed >= budgetMs)
-                        return budgetError(relOut(f), elapsed);
+                        return { text: budgetError(shownPath, elapsed) };
                 }
                 if (i > 0 && i % GREP_LINE_CHECK_EVERY === 0) {
                     await yieldEventLoop();
@@ -945,16 +976,16 @@ export async function jsGrep(env, root, p, signal, guards, deny, denyOut) {
                 if (mode === "content") {
                     if (p.only_matching) {
                         for (const part of matchedParts(lines[i], p)) {
-                            pushRow(`${relOut(f)}:${i + 1}:${clipLine(part)}`);
+                            pushRow(`${shownPath}:${i + 1}:${clipLine(part)}`, shownPath);
                         }
                     }
                     else if (ctx > 0) {
                         for (let j = Math.max(0, i - ctxB); j <= Math.min(lines.length - 1, i + ctxA); j++) {
-                            pushRow(`${relOut(f)}:${j + 1}:${clipLine(lines[j])}`);
+                            pushRow(`${shownPath}:${j + 1}:${clipLine(lines[j])}`, shownPath);
                         }
                     }
                     else {
-                        pushRow(`${relOut(f)}:${i + 1}:${clipLine(lines[i])}`);
+                        pushRow(`${shownPath}:${i + 1}:${clipLine(lines[i])}`, shownPath);
                     }
                 }
             }
@@ -968,7 +999,7 @@ export async function jsGrep(env, root, p, signal, guards, deny, denyOut) {
             if (mode === "files_with_matches")
                 fileMatches.push(f);
             else if (mode === "count" && counts.length < collectCap)
-                counts.push(`${relOut(f)}:${fileCount}`);
+                counts.push({ path: shownPath, text: `${shownPath}:${fileCount}` });
         }
     }
     if (scanAborted || skippedUnreadableFiles > 0 || skippedLongLines > 0 || multilineSkippedFiles > 0) {
@@ -988,7 +1019,7 @@ export async function jsGrep(env, root, p, signal, guards, deny, denyOut) {
         }
     }
     const caveat = honestyCaveat + denyNote;
-    const paged = (arr) => (off > 0 ? arr.slice(off, off + cap) : arr);
+    const paged = (arr) => (off > 0 ? arr.slice(off, off + cap) : [...arr]);
     const offNote = off > 0 ? `\n[offset ${off}]` : "";
     if (mode === "files_with_matches") {
         const haveMtimes = fileMatches.length > 0 && fileMatches.every((f) => walked.mtimes.has(f));
@@ -999,26 +1030,37 @@ export async function jsGrep(env, root, p, signal, guards, deny, denyOut) {
                 .map((x) => x.r)
             : fileMatches.map(relOut).sort();
         const body = sortedFileMatches.slice(off, off + cap);
-        return body.length === 0
-            ? NO_MATCHES + offNote + typeNote + caveat
-            : body.join("\n") + (totalFiles > off + cap ? `\n…[capped at ${cap} of ${totalFiles}]` : "") + offNote + typeNote + caveat;
+        const rows = body.map((r) => ({ path: r, text: r }));
+        return {
+            text: body.length === 0
+                ? NO_MATCHES + offNote + typeNote + caveat
+                : body.join("\n") + (totalFiles > off + cap ? `\n…[capped at ${cap} of ${totalFiles}]` : "") + offNote + typeNote + caveat,
+            rows,
+        };
     }
     if (mode === "count") {
         const body = paged(counts);
-        return body.length === 0
-            ? NO_MATCHES + offNote + typeNote + caveat
-            : body.join("\n") + (totalFiles > off + cap ? `\n…[capped at ${cap} of ${totalFiles}]` : "") + offNote + typeNote + caveat;
+        return {
+            text: body.length === 0
+                ? NO_MATCHES + offNote + typeNote + caveat
+                : body.map((r) => r.text).join("\n") + (totalFiles > off + cap ? `\n…[capped at ${cap} of ${totalFiles}]` : "") + offNote + typeNote + caveat,
+            rows: body,
+        };
     }
     const body = out;
     const byteNote = outputTruncated ? `\n…[output truncated at ${outputMaxBytes} bytes — narrow the pattern or set a smaller head_limit]` : "";
     if (body.length === 0)
-        return NO_MATCHES + byteNote + offNote + typeNote + caveat;
+        return { text: NO_MATCHES + byteNote + offNote + typeNote + caveat, rows: [] };
+    const bodyText = body.map((r) => r.text).join("\n");
     if (out.length < cap)
-        return body.join("\n") + byteNote + offNote + typeNote + caveat;
+        return { text: bodyText + byteNote + offNote + typeNote + caveat, rows: body };
     const marker = ctx > 0 || p.multiline || p.only_matching
         ? `\n…[capped at ${cap}; ${totalContent}+ match(es) found, more output omitted]`
         : `\n…[capped at ${cap} of ${totalContent}]`;
-    return body.join("\n") + marker + byteNote + offNote + typeNote + caveat;
+    return { text: bodyText + marker + byteNote + offNote + typeNote + caveat, rows: body };
+}
+export async function jsGrep(env, root, p, signal, guards, deny, denyOut) {
+    return (await jsGrepDetailed(env, root, p, signal, guards, deny, denyOut)).text;
 }
 const rgCache = new WeakMap();
 export function detectRipgrep(env) {
@@ -1124,23 +1166,25 @@ export function rgOutputDenyTripwire(stdout, mode, judge, opts = {}) {
 }
 async function jsGrepDenyTripFallback(env, root, p, signal, trip, deny) {
     const denyOut = {};
-    const text = await jsGrep(env, root, p, signal, undefined, deny, denyOut);
+    const { text, rows } = await jsGrepDetailed(env, root, p, signal, undefined, deny, denyOut);
     const why = trip.reason === "deny-hit" ? "its output involved sensitive-path deny-listed entries the exclusion globs cannot express" : "its output contained a record the line format cannot account for";
     return {
         text: text.startsWith("Error (grep)")
             ? text
             : `${text}\n[note: the ripgrep pass was abandoned (${why}); results are from the fallback scanner, which prunes with the authoritative deny judge]`,
+        ...(rows !== undefined ? { rows } : {}),
         degraded: { fallback: "js-scan", reason: `ripgrep output tripped the deny tripwire (${trip.reason})` },
         ...(denyOut.withheld !== undefined ? { withheld: denyOut.withheld } : {}),
     };
 }
 async function jsGrepFallback(env, root, p, signal, reason, deny) {
     const denyOut = {};
-    const text = await jsGrep(env, root, p, signal, undefined, deny, denyOut);
+    const { text, rows } = await jsGrepDetailed(env, root, p, signal, undefined, deny, denyOut);
     return {
         text: text.startsWith("Error (grep)")
             ? text
             : `${text}\n[note: ripgrep failed (${reason}); results are from a fallback scanner]`,
+        ...(rows !== undefined ? { rows } : {}),
         degraded: { fallback: "js-scan", reason: `ripgrep failed (${reason})` },
         ...(denyOut.withheld !== undefined ? { withheld: denyOut.withheld } : {}),
     };
@@ -1288,8 +1332,8 @@ export async function runGrepDetailed(env, root, p, signal, deny) {
     if (await detectRipgrep(env))
         return rgGrepDetailed(env, root, p, signal, deny);
     const denyOut = {};
-    const text = await jsGrep(env, root, p, signal, undefined, deny, denyOut);
-    return { text, ...(denyOut.withheld !== undefined ? { withheld: denyOut.withheld } : {}) };
+    const { text, rows } = await jsGrepDetailed(env, root, p, signal, undefined, deny, denyOut);
+    return { text, ...(rows !== undefined ? { rows } : {}), ...(denyOut.withheld !== undefined ? { withheld: denyOut.withheld } : {}) };
 }
 export async function runGrep(env, root, p, signal) {
     return (await runGrepDetailed(env, root, p, signal)).text;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sema-agent/core",
-  "version": "5.43.0",
+  "version": "5.44.0",
   "description": "Stateless, task-oriented AI agent core",
   "type": "module",
   "license": "BUSL-1.1",
@@ -65,7 +65,8 @@
     "gate:single-mint": "node scripts/verify-single-mint.mjs",
     "gate:nuia": "node scripts/verify-nuia-baseline.mjs",
     "gate:field-liveness": "node scripts/verify-field-liveness.mjs",
-    "gate:error-surface": "node scripts/verify-error-surface.mjs"
+    "gate:error-surface": "node scripts/verify-error-surface.mjs",
+    "gate:criteria": "node scripts/criteria-lint.mjs"
   },
   "dependencies": {
     "@modelcontextprotocol/sdk": "1.30.0",