@sema-agent/core 5.43.0 → 5.45.0

package/CHANGELOG.md

@@ -1,5 +1,104 @@
 # Changelog
 
+## 5.45.0 — 2026-08-19
+
+### Added
+- `RunnerDeps.memoryDelegationEvidence?: "static-face" | "attested-only"` (design/324, ruling-1
+  stopgap): the deployment's evidence standard for delegation-driven memory pollution.
+  `"attested-only"` retires ONLY the static capability-face mark (the "a child COULD reach
+  external content" over-approximation); the attestation-observed mark (`att === "external"`),
+  the chain's `incomplete` honesty, `recordExternal`, non-delegation classification and the
+  pre-call direct-class mark all stay. Key absent ≡ `"static-face"` ≡ byte-identical behavior.
+  A malformed value is refused loudly (`config.memory_delegation_evidence`, exact-spelling gate).
+  ACCEPTED COST (the deployment's to own): with `"attested-only"`, a BACKGROUND child's real
+  external contact does not mark this session — its content re-enters via TaskOutput /
+  task-notification / AgentTranscript, none of which carries an attestation.
+- `memory.delegation_static_mark_waived` EngineNotice — mandatory companion: minted at most once
+  per prepared leg when the knob actually waives a static-face mark on a pollution-armed chain
+  (`detail: {subagentType?, sessionId?}`; reason carries the waived mark's own sentence, bounded).
+- `TaskResult.effectiveReasoning?: ResolvedReasoning` (#327b): the leg's effective reasoning
+  resolution echoed on the result — same object the `reasoning.resolved` trace event carries
+  (two faces, one mint); rides the backstop/`resume.tool_unavailable` carrier like its
+  precedents. `ReasoningFormat` gains `"responses"` (dispatched by api family, single-source
+  `RESPONSES_APIS`).
+- Cross-session recall pins (#260 verdict: engine clean): the consumer contract is pinned —
+  the model's final answer text exists BEFORE the terminal harvest commits, `TaskStream.result()`
+  is the commit boundary, and a consumer that prints the answer and kills the worker without
+  awaiting `result()` strands the entry id-less on disk (the incident's exact evidence shape).
+
+### Changed
+- The reasoning resolver mirrors `thinkingLevelMap`'s null arm (5.45 rescan): a clamped tier the
+  model maps to `null` is reported tier-not-honored (`graded:false`, intent echo) — matching what
+  the wire appliers actually send (nothing) instead of claiming "honored exactly"; the r3/r4
+  mirror comment now names all three arms. `resolveEffort` reads a malformed non-array
+  `reasoningEffortLevels` as undeclared (member-level filtering: garbage/sparse/"off" entries can
+  no longer become clamp targets) — a catalog typo no longer fails the whole thinking-on leg with
+  a raw TypeError (5.44.0 regression window closed before release).
+- The #260 pins tell the bounded-teardown truth: `result()` settles after the harvest LEG settled
+  (committed, or its 15s timeout REPORTED — never silent), the discriminative arm polls 50 ticks
+  (the abandon arm sat inside the old 1-tick slack), and the incident-scale argument is stated.
+- `reasoning.resolved` now fires a LOUD DROP frame (`dropped: true`, `effective: "off"`) on
+  models whose `Model.reasoning` is falsy — a user-requested effort tier no longer evaporates
+  silently (#325). The public `resolveReasoning` reports the drop arm for such models; the
+  capable arm is byte-identical. The capability predicate is truthiness (matching every adapter),
+  and `supportsReasoningEffort === false` mirrors the ungraded intent-only arm.
+
+### Fixed
+- The two 5.44.0 pollution notices are DISPOSITIONED in the governance registry and the
+  error-surface cap vocabulary gained `inlineUntrusted`/`pollutionSentence` (both bounded by
+  contract) — landed as gate-family debts caught by the full-suite leg.
+
+### Notes
+- Commit `2f78edb7` (the delegation-evidence knob) carries the `TaskResult.effectiveReasoning`
+  declaration hunk of the parallel effort car (shared-checkout staging race; HEAD is consistent).
+  Do not cherry-pick that commit alone.
+
+## 5.44.0 — 2026-08-19
+
+### Added
+- Memory pollution is LOUD (#324a): two EngineNotice codes — `memory.session_polluted` (once per
+  session, minted on the wx-atomic first transition; states the VERDICT: content written after the
+  mark is not admitted to the long-term library at harvest) and `memory.harvest_quarantined`
+  (at most once per harvest when a polluted session's harvest withheld ≥1 entry file;
+  `detail: {count, moved, escalated, reason?, sessionId?}` — deduplicated-path counts, `moved` =
+  files that actually left the model-visible plane, `escalated` = quarantine failures). Both ride
+  `deliverEngineNotice` (seat / absent-warn / malformed-seat fallback, unchanged). The notices
+  state facts, not promises: writeScope-null and persistence-incapable arms take the zero-adoption
+  return and are NOT described as quarantined.
+- `MemoryEngine.markSessionPolluted` now returns `SessionPollutionMarkOutcome` (was `void`) —
+  additive; the wx-atomic marker distinguishes `"created" | "existed" | "unpersisted"`.
+- Release-criteria gate hardening (5.44 rescan disposal, 8 findings): the EngineNotice MINT
+  judgment is checker-based (the `code` value inside an object literal whose non-nullable
+  contextual type carries `code`+`message` on EVERY union arm, in files the shipped build
+  compiles) — a literal type, the `err.code=` refusal dialect, a comment, an examples-only mint
+  and a bare `{code,message}` const no longer count; a public CLASS is a legal citation root
+  (instance + declared statics, minus private/write-only/language-supplied); a disclosed release
+  (CHANGELOG section present) with no criteria document reds the gate.
+- design/278 recipe pins: the coordinator fresh-spawn recipe core arms (spawn-fresh imperative,
+  verbatim user quote, literal command, execute-only, relayed-consent line) are pinned six-ways —
+  the recipe the G6 classifier exception depends on can no longer drift silently. (The #278
+  product fix itself shipped in 5.38.0; the ledger row was stale and is now closed.)
+
+### Changed
+- Grep target-spelling flip completion (#318): `jsGrepDetailed` answers — including the rescan
+  legs an rg-present host falls back to — carry the single explicit FILE target's own spelling
+  (family-aware dot-segment collapse, one family judgment for the whole anchor; `..` cannot climb
+  past a namespace root). The two engines no longer disagree on path shape for the same call.
+- Grep structured rows completion (#313 remainder): the JS legs hand served rows too; the served-row
+  contract states its one measured exception.
+- `memory_get` not-found no longer blindly suggests `memory_search`; when the missing slug was
+  written THIS session the text states the mount-snapshot fact (new writes become retrievable
+  next session) and, in a polluted session, states that the write will be withheld at harvest.
+  `memory_search` zero-hit output appends the pollution disclosure line in polluted sessions only
+  (clean sessions byte-identical). Tool contract revisions move: search 1→2, get 2→3.
+- The 5.43.0 `-H` entry erratum (recorded in that section): the flip covers count mode too, and
+  the "without a deny judge" arm is not a configuration any public route produces.
+
+### Fixed
+- `docs/release-criteria/5.43.0.json` four unexecutable/false arms repaired (deny-less arm no
+  public route can produce; the deny-note flip F5 declared and claimed by G3; the per-process
+  console latch construction made blackbox-executable; the rg-leg note wording quoted as minted).
+
 ## 5.43.0 — 2026-08-18
 
 ### Added
@@ -27,12 +126,15 @@
 - Grep's ripgrep legs always pass `-H` (#311): a single explicit file target keeps its path
   field, so a deny-guarded single-file grep keeps the rg fast path instead of abandoning rg for
   the JS scanner's explicit-file lane (an engine swap over that one file, losing rg's
-  streaming/large-file handling). Observable flip, both arms: content-mode output for a single
-  explicit file target now carries a path prefix in the TARGET's spelling as passed (the tool
-  layer hands an absolute canonical path, so the prefix is ABSOLUTE); without a deny judge the
-  line previously had no prefix, and WITH one it previously came from the JS lane with a
-  root-relative prefix — both spellings change. Multi-file and directory targets: byte-identical
-  (measured). The two engines still disagree on path shape for the same call (jsGrep emits
+  streaming/large-file handling). Observable flip: content-mode AND count-mode output for a
+  single explicit file target now carries a path prefix in the TARGET's spelling as passed (the
+  tool layer hands an absolute canonical path, so the prefix is ABSOLUTE; count mode reads
+  `<path>:<n>`); `files_with_matches` did not move. **Erratum (5.44 rescan)**: this entry
+  originally scoped the flip to content mode and described a "without a deny judge" arm — no
+  public route produces that arm (every route to the tool compiles a read-deny judge), and the
+  previous release answered the call from the JS lane with a ROOT-RELATIVE prefix in every deny
+  configuration a caller can produce; count mode flipped the same way. Multi-file and directory
+  targets: byte-identical (measured). The two engines still disagree on path shape for the same call (jsGrep emits
   root-relative) — that alignment is tracked separately (#318), not silently changed here.
 - The deny-withholding note no longer fabricates on single-file scopes (5.43 rescan): `rg --files`
   lists an explicitly named file argument regardless of glob filters, so the existence probe

package/dist/agents/subagent.d.ts

@@ -297,7 +297,9 @@ export declare function completedAgentCard(child: {
      *  recorder aggregate at delivery. Present only when the parent chain armed the recorder; the
      *  parent-side judgment (the content-origin wrap) reads it off this card — `clean` retires the
      *  static face verdict for this call, `external` marks with the observed-event reason, `unknown`
-     *  (or absence) keeps the static floor. Deliberate whitelist admission (see the boundary note). */
+     *  (or absence) keeps the static floor, whose mark action follows the parent run's deployment
+     *  evidence standard (design/324, `RunnerDeps.memoryDelegationEvidence`). Deliberate whitelist
+     *  admission (see the boundary note). */
     attestation?: import("../core/memory-engine/delegation-provenance.js").DelegationAttestation;
 }): Record<string, unknown>;
 /**

package/dist/brain/reasoning.d.ts

@@ -34,7 +34,20 @@ export type ReasoningFormat = "openai" | "openrouter" | "deepseek" | "together"
 /** Anthropic `output_config.effort` (CC 2.1.198 / Fable-5 class, design/119): the tier is a named
  *  effort string, clamped to `compat.effortLevels` — the anthropic-side twin of the OpenAI
  *  `reasoning_effort` path (thinking FORM is `thinkingMode`; effort carries the intensity). */
- | "effort";
+ | "effort"
+/** OpenAI Responses API (`openai-responses` / `azure-openai-responses`, design/163): the tier rides
+ *  the NESTED `reasoning: { effort }` request field (open-responses.ts `resolveWireEffort`), clamped
+ *  by the same {@link resolveEffort} against `compat.reasoningEffortLevels` — NOT the completions
+ *  top-level `reasoning_effort` the `"openai"` tag names. #325 review r3: before this member the
+ *  resolver fell through to the completions default and labeled Responses resolutions `"openai"`. */
+ | "responses";
+/**
+ * The Open Responses API family — every `Api` value `createOpenResponsesBrain` serves (design/163).
+ * The SINGLE family discriminant: request-params.ts (reserved-key set selection) and
+ * {@link resolveReasoning} (format dispatch, #325 review r4) both key off THIS set, so a new
+ * Responses api value added here reaches every family-scoped behavior instead of one of two twins.
+ */
+export declare const RESPONSES_APIS: ReadonlySet<string>;
 /** How a requested intensity resolved against one endpoint's real capability. */
 export interface ReasoningResolution {
     /** The level the caller asked for. */
@@ -43,9 +56,10 @@ export interface ReasoningResolution {
     effective: ThinkingLevel;
     /**
      * True when the endpoint varies behavior by intensity (effort tiers / token budget). False = binary
-     * enable-only (qwen / zai / qwen-chat-template, or an effort endpoint that declares
-     * `supportsReasoningEffort:false`): thinking is on or off and the tier is NOT honored — read this alongside
-     * {@link effective}, which then echoes the request as intent only.
+     * enable-only (qwen / zai / qwen-chat-template, an effort endpoint that declares
+     * `supportsReasoningEffort:false`, or a tier `Model.thinkingLevelMap` maps to `null` — the wire then
+     * carries NO effort value for it): thinking is on or off and the tier is NOT honored — read this
+     * alongside {@link effective}, which then echoes the request as intent only.
      */
     graded: boolean;
     /** True when {@link effective} differs from {@link requested} (the request couldn't be honored exactly). */
@@ -62,6 +76,23 @@ export interface ResolvedReasoning extends ReasoningResolution {
     format: ReasoningFormat;
     /** A coarse endpoint label for the trace (`model.api` — e.g. `openai-completions`, `anthropic-messages`). */
     endpoint: string;
+    /**
+     * Present (true) only when the model declares NO reasoning capability (`Model.reasoning` falsy): every
+     * brain early-returns on that flag (openai.ts applyThinking / anthropic.ts / open-responses.ts
+     * resolveWireEffort), so NO thinking
+     * parameter reaches the wire at all — the requested tier is DROPPED entirely, not clamped or
+     * downgraded-to-binary. `effective:"off"` here states the ENGINE side of that fact (nothing was
+     * requested), NOT a measured gateway state: on the binary enable-only formats (qwen / zai /
+     * qwen-chat-template) parameter ABSENCE is provider-default, and a default-on gateway may still
+     * reason at its own tier — the brains deliberately send no disable key for a model declared
+     * non-reasoning, so the engine cannot claim a measured off there; `format` tells a consumer which
+     * family applies (on every other format, absence is the closest the wire has to off — see
+     * applyThinking's own contract). `format`/`endpoint` report the family that WOULD have carried the
+     * tier (the why-shape a consumer diagnoses with, not a claim about the request). Absent on every
+     * reasoning-capable resolution, so existing consumers see byte-identical objects. Loud-bad-values
+     * rule: the one arm where the request evaporates must not be the one arm with no report.
+     */
+    dropped?: true;
 }
 /**
  * Resolve a requested intensity against a model END-TO-END, dispatching on its wire format the SAME way the
@@ -74,6 +105,17 @@ export interface ResolvedReasoning extends ReasoningResolution {
  * - Binary enable-only formats (qwen / zai / qwen-chat-template) → `graded:false` (tier not honored).
  * - An effort endpoint with `supportsReasoningEffort:false` → `graded:false` (enable key only, no effort tier).
  * - Otherwise effort-based → clamp DOWN to the endpoint's `reasoningEffortLevels` (default minimal|low|medium|high).
+ * - A CLAMPED tier that `model.thinkingLevelMap` maps to `null` (declared unsupported on this model) →
+ *   `graded:false`: both effort-wire appliers key the map by the post-clamp tier and then carry NO effort
+ *   value (thinking still enables via the format's own enable key where one exists), so the tier is not
+ *   honored. Previously this resolver never read the map and reported such a request as exactly honored
+ *   (`graded:true`, `clamped:false`) while the wire dropped the value — trace/result-face drift.
+ *
+ * - A model whose `reasoning` capability flag is FALSY drops the request ENTIRELY (neither brain emits any
+ *   thinking parameter, whatever the format) → `effective:"off"`, `graded:false`, `clamped:true`,
+ *   `dropped:true` — the loud-drop arm. Previously this resolver described the capability dispatch for such
+ *   a model (a resolution the request never carried), and the runner's trace guard skipped the frame — the
+ *   one arm where the request evaporates was the one arm with no disclosure.
  *
  * `off`/falsy never enables thinking, so it resolves trivially (no clamp, graded:true) — the caller decides
  * whether to emit at all.
@@ -82,12 +124,16 @@ export declare function resolveReasoning(requested: ThinkingLevel, model: {
     api?: string;
     reasoning?: boolean;
     compat?: unknown;
+    thinkingLevelMap?: Readonly<Partial<Record<ThinkingLevel, string | null>>>;
 }): ResolvedReasoning;
 /**
  * Resolve a requested intensity for an effort-based endpoint (`reasoning_effort` / `reasoning.effort`). Picks
  * the requested tier when supported; otherwise the highest supported tier ≤ requested (clamp DOWN, never
  * silently up); if none is ≤ requested (the endpoint's set is entirely higher — unusual), the lowest supported
  * tier. Never returns a value outside `allowed`, so the brain can't emit a tier the endpoint would 422.
+ * A malformed `allowed` reads as UNDECLARED → the conservative default set (non-array, empty, or no
+ * valid member); individually invalid MEMBERS (garbage strings, sparse holes, `"off"` — not a legal
+ * member of the 6-tier compat effort sets) are dropped, so they can never become a clamp target.
  */
 export declare function resolveEffort(requested: ThinkingLevel, allowed?: readonly ThinkingLevel[]): ReasoningResolution;
 /**

package/dist/brain/reasoning.js

@@ -15,7 +15,18 @@ export function rankOf(level) {
 }
 export const DEFAULT_EFFORT_LEVELS = ["minimal", "low", "medium", "high"];
 const BINARY_FORMATS = new Set(["qwen", "zai", "qwen-chat-template"]);
+export const RESPONSES_APIS = new Set(["openai-responses", "azure-openai-responses", "openai-chatgpt-responses"]);
 export function resolveReasoning(requested, model) {
+    const resolved = dispatchReasoning(requested, model);
+    if (requested !== "off" && !model.reasoning) {
+        return { requested, effective: "off", graded: false, clamped: true, format: resolved.format, endpoint: resolved.endpoint, dropped: true };
+    }
+    return resolved;
+}
+function effortTierUnmapped(requested, effective, model) {
+    return requested !== "off" && model.thinkingLevelMap?.[effective] === null;
+}
+function dispatchReasoning(requested, model) {
     const endpoint = model.api ?? "unknown";
     const compat = (model.compat ?? {});
     if (model.api === "anthropic-messages") {
@@ -24,6 +35,16 @@ export function resolveReasoning(requested, model) {
         }
         return { requested, effective: requested, graded: true, clamped: false, format: "budget", endpoint };
     }
+    if (model.api !== undefined && RESPONSES_APIS.has(model.api)) {
+        if (compat.supportsReasoningEffort === false) {
+            return { requested, effective: requested, graded: false, clamped: false, format: "responses", endpoint };
+        }
+        const responsesResolved = resolveEffort(requested, compat.reasoningEffortLevels ?? DEFAULT_EFFORT_LEVELS);
+        if (effortTierUnmapped(requested, responsesResolved.effective, model)) {
+            return { requested, effective: requested, graded: false, clamped: false, format: "responses", endpoint };
+        }
+        return { ...responsesResolved, format: "responses", endpoint };
+    }
     const format = compat.thinkingFormat ?? "openai";
     if (BINARY_FORMATS.has(format)) {
         return { ...resolveBinary(requested), format, endpoint };
@@ -32,15 +53,15 @@ export function resolveReasoning(requested, model) {
     if (!supportsEffort && format !== "openrouter") {
         return { requested, effective: requested, graded: false, clamped: false, format, endpoint };
     }
-    return {
-        ...resolveEffort(requested, compat.reasoningEffortLevels ?? DEFAULT_EFFORT_LEVELS),
-        format,
-        endpoint,
-    };
+    const resolved = resolveEffort(requested, compat.reasoningEffortLevels ?? DEFAULT_EFFORT_LEVELS);
+    if (effortTierUnmapped(requested, resolved.effective, model)) {
+        return { requested, effective: requested, graded: false, clamped: false, format, endpoint };
+    }
+    return { ...resolved, format, endpoint };
 }
 export function resolveEffort(requested, allowed = DEFAULT_EFFORT_LEVELS) {
-    if (allowed.length === 0)
-        allowed = DEFAULT_EFFORT_LEVELS;
+    const declared = Array.isArray(allowed) ? allowed.filter((lvl) => isThinkingLevel(lvl) && lvl !== "off") : [];
+    allowed = declared.length > 0 ? declared : DEFAULT_EFFORT_LEVELS;
     if (requested === "off" || allowed.includes(requested)) {
         return { requested, effective: requested, graded: true, clamped: false };
     }

package/dist/brain/request-params.d.ts

@@ -1,15 +1,3 @@
-/**
- * Request-parameter passthrough (design/40). A deployment can set official provider params it wants but
- * core doesn't model as first-class fields (OpenAI `frequency_penalty`/`presence_penalty`/`top_p`/`seed`/
- * `logit_bias`; Anthropic `top_k`/`top_p`/`stop_sequences`; …) via `Model.extraBody`, and core merges them
- * into the brain's request body. Anchored at the **Model** level (not per-turn) so the serialized body
- * stays byte-stable across turns → the prefix cache holds (design/9/31).
- *
- * Symmetric: each brain owns its structural + tuning keys (`reserved`) and ALWAYS wins — `extraBody` can
- * only supply the long tail, never clobber `messages`/`tools`/`temperature`/etc. Stripping is the safety
- * enforcement (the brains are standalone-usable); `prepareTask` separately warns on a collision (it has
- * `onError`, the brain doesn't — council design/40).
- */
 /** OpenAI request-body keys core owns; `extraBody` cannot override these. */
 export declare const OPENAI_RESERVED: ReadonlySet<string>;
 /** Anthropic request-body keys core owns; `extraBody` cannot override these. (Note the asymmetry vs

package/dist/brain/request-params.js

@@ -1,3 +1,4 @@
+import { RESPONSES_APIS } from "./reasoning.js";
 export const OPENAI_RESERVED = new Set([
     "model",
     "messages",
@@ -38,7 +39,6 @@ export const RESPONSES_RESERVED = new Set([
     "previous_response_id",
     "conversation",
 ]);
-const RESPONSES_APIS = new Set(["openai-responses", "azure-openai-responses", "openai-chatgpt-responses"]);
 export function reservedFor(api) {
     if (RESPONSES_APIS.has(api))
         return RESPONSES_RESERVED;

package/dist/core/governance-codes.js

@@ -14,6 +14,9 @@ export const NON_GOVERNANCE_MEMORY_CODES = new Set([
     "memory.partition_split",
     "memory.tail",
     "memory.pollution_mark_failed",
+    "memory.session_polluted",
+    "memory.harvest_quarantined",
+    "memory.delegation_static_mark_waived",
     "memory.challenge_sweep_failed",
     "memory.lineage_settle_failed",
     "memory.challenge_ledger_corrupt",

package/dist/core/memory-engine/content-origin.d.ts

@@ -66,9 +66,12 @@ export interface AgentPoolTool {
  * A child that can reach a network or protocol tool returns content from outside the trust boundary
  * just as surely as calling that tool in this session would, and the parent's transcript is where it
  * lands. The judgment is STATIC — the child's face is known from its definition before the call — so
- * nothing here tracks what the child actually did (runtime provenance is the v2 ticket). That makes
- * it conservative in the safe direction: a child that COULD reach external content counts as having
- * done so.
+ * nothing here tracks what the child actually did (runtime provenance is design/180 half A). That
+ * makes it conservative in the safe direction: a child that COULD reach external content counts as
+ * having done so. Whether this verdict MARKS the judging session's memory when no attestation
+ * arrives is the deployment's evidence standard (design/324,
+ * `RunnerDeps.memoryDelegationEvidence`) — the classification itself is value-independent, and the
+ * wrap computes it on every standard (the waiver announcement keys on it).
  *
  * `pool` is the CHILD'S pool, not the parent's roster: a delegation tool carries its own tool set, and
  * the two are explicitly allowed to differ — a parent mounting nothing but the delegation tool can

package/dist/core/memory-engine/delegation-provenance.d.ts

@@ -1,10 +1,13 @@
 /**
  * design/180 half A — delegation RUNTIME provenance: the three-value attestation and its monotonic
  * aggregate. The static tool-face judgment ({@link import("./content-origin.js").delegationCallIsExternal})
- * stays the PERMANENT FLOOR: runtime evidence may only retire the static verdict when a COMPLETE
- * clean proof is in hand; any evidence gap falls back to the floor. "We could not prove it clean"
- * and "it is clean" are different answers — replacing the floor outright would fail OPEN on every
- * evidence gap (old child vintages, crashes, un-armed sessions).
+ * stays the FLOOR of the attestation reduction: runtime evidence may only retire the static verdict
+ * when a COMPLETE clean proof is in hand; any evidence gap falls back to the floor. "We could not
+ * prove it clean" and "it is clean" are different answers — replacing the floor outright would fail
+ * OPEN on every evidence gap (old child vintages, crashes, un-armed sessions). Whether the floor's
+ * verdict MARKS the judging session's memory is a separate, deployment-governed question
+ * (design/324, `RunnerDeps.memoryDelegationEvidence`): the reduction semantics here never change
+ * with that key — only the mark action at the judging run's wrap does.
  *
  * The aggregate is two MONOTONIC bits plus versioning:
  *  - `sawExternal` — an actually-observed polluting-class invocation (own recorder, or a delivered
@@ -17,8 +20,9 @@
  * "clean" unprovable; it can never make an observed event disappear).
  */
 /** The three-value delegation attestation. Only `clean` changes behavior (the parent skips the
- *  static mark); `unknown` is byte-equivalent to absence (static floor governs); `external` marks
- *  unconditionally, with the observed-event reason. */
+ *  static mark); `unknown` is byte-equivalent to absence (the static floor governs — its mark
+ *  action subject to the judging run's deployment evidence standard, design/324); `external` marks
+ *  unconditionally on every evidence standard, with the observed-event reason. */
 export type DelegationAttestation = "clean" | "external" | "unknown";
 /** The monotonic per-run provenance aggregate (in-process this slice; the durable-checkpoint
  *  persistence leg rides the background-face slice — absence after a resume reads `incomplete`,
@@ -58,5 +62,6 @@ export declare function reduceDelegationAttestation(agg: DelegationProvenanceAgg
     completed: boolean;
 }): DelegationAttestation;
 /** Read a delivered card's attestation field (the explicit-whitelist handback seat). Anything but
- *  the three spellings — including absence — reads as undefined, i.e. the static floor governs. */
+ *  the three spellings — including absence — reads as undefined, i.e. the static floor governs
+ *  (whether that floor MARKS is the judging run's deployment evidence standard, design/324). */
 export declare function readCardAttestation(details: unknown): DelegationAttestation | undefined;

package/dist/core/memory-engine/engine.d.ts

@@ -1,6 +1,7 @@
+import type { EngineNotice } from "../types.js";
 import { type CommittedBinding, type EraseMemoryEntriesInput, type MemoryErasureAttestation, type TransferEvidence } from "./file-backend.js";
 import { type MemoryExportBundle, type MemoryImportReport } from "./export-bundle.js";
-import { type ChallengeAssignment, type ChallengeEvent, type ControlPlaneRebuildReceipt, type StrictControlPlaneLedger, type ChallengedHistoryRow, type LineagePendingTxn, type LineagePromotion, type MemoryPartitionIncidentSink, type RetrievedAccountRow, type SessionPollutionRecord } from "./layout.js";
+import { type ChallengeAssignment, type ChallengeEvent, type ControlPlaneRebuildReceipt, type StrictControlPlaneLedger, type ChallengedHistoryRow, type LineagePendingTxn, type LineagePromotion, type MemoryPartitionIncidentSink, type RetrievedAccountRow, type SessionPollutionMarkOutcome, type SessionPollutionRecord } from "./layout.js";
 import type { HarvestReport, MemoryAnnouncement, MemoryBackend, MemorySessionHandle, ScanFinding } from "./types.js";
 /**
  * The CC `# Memory` instruction section — VERBATIM from the live capture
@@ -255,6 +256,91 @@ export interface EntryProvenanceAccount {
         reason?: string;
     };
 }
+/**
+ * The pollution mark's loud half ({@link EngineNotice}). The engine's own `onIncident` seat carries the
+ * FAILURES of this machinery (`memory.pollution_mark_failed`, `memory.challenge_sweep_failed`); this is
+ * the other fact — the machinery worked, and its verdict silently changed what every memory write in
+ * this session will do. Before this code existed the transition had no face at all: the session went on
+ * writing memory files, the harvest quarantined every one of them, and nothing said so while a host
+ * could still act on it.
+ *
+ * SCOPE OF THE CLAIM (adversarial-review round 1, P1 — the first cut PROMISED quarantine on every mark).
+ * This notice states the VERDICT, not the mechanism's outcome: "no longer eligible", plus what a harvest
+ * does WHEN IT COLLECTS. That distinction is load-bearing, because several real paths reach a polluted
+ * harvest that quarantines nothing — a `writeScope`-null layering and a declared-unavailable session
+ * both take `harvestCore`'s zero-admission return (nothing is collected, so nothing is captured), and a
+ * mark landing after the pre-commit pollution read leaves already-committed rows to the CHALLENGE sweep
+ * rather than to containment. What a given harvest actually contained is the other code's job
+ * (`memory.harvest_quarantined`), and the message says so instead of guessing here. The baseline clause
+ * is likewise scoped to a collecting harvest: containment judges a changed file against the
+ * MATERIALIZE-time baseline, not against the mark's timestamp, so pre-mark writes are covered too.
+ *
+ * The challenge clause is likewise a POLICY statement with its failure channel named (adversarial-review
+ * round 3): the mark-side sweep is best-effort — an unreadable or unwritable lineage ledger makes
+ * `markSessionPolluted` announce `memory.challenge_sweep_failed` and return normally — so this notice
+ * must not be read as a receipt that the sweep landed.
+ *
+ * Minted by the runner's mark seat (the one call site of the mark face), so an engine-direct host keeps
+ * the incident seat and gains no new obligation.
+ *
+ * `reason` names a TOOL, and tool names come from the host/protocol roster: neutralized and bounded
+ * here — the same treatment the report warnings give it — before it rides either the message or the
+ * detail (a host renders both).
+ */
+export declare function memorySessionPollutedNotice(input: {
+    reason: string;
+    sessionId?: string;
+}): EngineNotice;
+/**
+ * The polluted harvest's loud half ({@link EngineNotice}): what the containment actually did, minted
+ * once per harvest that withheld at least one ENTRY file. `count` is the withheld set (the
+ * `polluted`-coded rejections — entry files that diverged from the materialize baseline), `moved` the
+ * subset that also LEFT the model-visible plane, and `escalated` the subset carrying a
+ * `quarantineFailures` row.
+ *
+ * `escalated` is its own input rather than `count - moved` (adversarial-review round 3): the two are
+ * NOT the same set. A file whose delete fails but whose tombstone write succeeds counts as removed —
+ * it rides `movedToQuarantine` AND an escalation row saying it was tombstoned in place — so the
+ * arithmetic would report a clean containment while a known failure sat in the report. Every
+ * not-moved file does have an escalation row, so `escalated` is the superset and the honest clause.
+ *
+ * KNOWN GAP (adversarial-review round 1, P2 — registered, not closed here): the derived index is
+ * contained by a different path (`restorePollutedIndex` captures and restores `MEMORY.md`) that mints
+ * no rejection row, so a polluted session whose ONLY memory change was an index line produces no
+ * `count` and no notice — its containment is disclosed by the harvest report's warnings alone. Closing
+ * it needs a structured containment signal on `HarvestReport`, a public type this fix does not touch.
+ * The wording therefore says "entry file(s)" rather than implying the whole containment.
+ *
+ * `reason` is optional because the mark record is read separately from the report: a record that cannot
+ * be read must not turn a true "N files were withheld" into a lie about why.
+ */
+/**
+ * The three numbers {@link memoryHarvestQuarantinedNotice} reports, read off ONE harvest report. Pure
+ * and exported so the derivation is provable on its own (the tombstone case — moved AND escalated — is
+ * not constructible through a real filesystem without root-dependent permission tricks).
+ *
+ * Every number is scoped to the WITHHELD paths: a dual-root harvest merges the read plane's report in,
+ * and that plane's ordinary write gate quarantines on its own grounds — counting its rows would credit
+ * this session's pollution with containment it never performed.
+ *
+ * FILES, NOT ROWS (adversarial-review round 4). One path can appear twice in the same report: when the
+ * pre-commit pollution recheck flips a clean harvest to containment, a file the ordinary secret/filename
+ * gate already quarantined is contained again, and both passes append. Counting rows would then publish
+ * `moved`/`escalated` greater than `count` — an impossible statement about a set of files — so every
+ * number here is a count of DISTINCT paths.
+ */
+export declare function pollutionContainmentCounts(report: HarvestReport): {
+    count: number;
+    moved: number;
+    escalated: number;
+};
+export declare function memoryHarvestQuarantinedNotice(input: {
+    count: number;
+    moved: number;
+    escalated: number;
+    reason?: string;
+    sessionId?: string;
+}): EngineNotice;
 export declare class MemoryEngine {
     private readonly backend;
     private readonly memoryDir;
@@ -301,8 +387,14 @@ export declare class MemoryEngine {
      * record, and the durable marker survives restarts (control plane — never model-writable
      * frontmatter). A failed durable write is disclosed via `onIncident` (`memory.pollution_mark_failed`)
      * while the in-memory mark keeps THIS process fail-closed.
+     *
+     * RETURNS the durable marker's {@link SessionPollutionMarkOutcome} — `"created"` ⇔ this call made
+     * the transition. That is the ONE atomic answer to "was this the clean → polluted crossing", and the
+     * runner's once-per-session disclosure is keyed on it: a pre-read cannot decide it (two concurrent
+     * markers of one session would both read clean and both announce). Callers that do not disclose
+     * ignore it exactly as before.
      */
-    markSessionPolluted(sessionId: string, reason: string): void;
+    markSessionPolluted(sessionId: string, reason: string): SessionPollutionMarkOutcome;
     /** The session's pollution record (in-process mark first, then the durable marker) — undefined =
      *  clean. Reads are side-effect-free. */
     sessionPollution(sessionId: string): SessionPollutionRecord | undefined;

package/dist/core/memory-engine/engine.js

@@ -48,6 +48,47 @@ export const DEFAULT_HARVEST_DEADLINE_MS = 5_000;
 export const DEFAULT_HARVEST_FILE_BUDGET = 2_000;
 export const MASS_DELETION_FUSE_RATIO = 0.5;
 let indexCaptureSeq = 0;
+export function memorySessionPollutedNotice(input) {
+    const reason = inlineUntrusted(input.reason, 200);
+    return {
+        code: "memory.session_polluted",
+        message: `Memory for this session is marked polluted: ${reason}. Its memory writes are no longer eligible for the ` +
+            `long-term library — a harvest withholds what it collects (quarantined for host review, judged against the ` +
+            `session's opening baseline, so changes made before this point are withheld too), and contributions this ` +
+            `session already committed are challenged (a sweep that cannot run announces memory.challenge_sweep_failed). ` +
+            `What a given harvest actually contained is announced as memory.harvest_quarantined.`,
+        detail: { reason, ...(input.sessionId !== undefined ? { sessionId: input.sessionId } : {}) },
+    };
+}
+export function pollutionContainmentCounts(report) {
+    const withheld = new Set(report.rejections.filter((r) => r.code === "polluted").map((r) => r.path));
+    const distinct = (paths) => new Set(paths.filter((p) => withheld.has(p))).size;
+    return {
+        count: withheld.size,
+        moved: distinct(report.movedToQuarantine),
+        escalated: distinct((report.quarantineFailures ?? []).map((q) => q.path)),
+    };
+}
+export function memoryHarvestQuarantinedNotice(input) {
+    const reason = input.reason !== undefined ? inlineUntrusted(input.reason, 200) : undefined;
+    return {
+        code: "memory.harvest_quarantined",
+        message: `Memory harvest committed nothing for this polluted session${reason !== undefined ? ` (${reason})` : ""}: ` +
+            `${input.count} memory entry file(s) written or changed in it were withheld, ${input.moved} of them moved into ` +
+            `the control-plane quarantine directory for host review` +
+            (input.escalated > 0
+                ? `; ${input.escalated} carr${input.escalated === 1 ? "ies" : "y"} a containment escalation (a file that did not leave the ` +
+                    `model-visible plane, or one tombstoned in place rather than deleted) — the harvest report's quarantineFailures names them.`
+                : "."),
+        detail: {
+            count: input.count,
+            moved: input.moved,
+            escalated: input.escalated,
+            ...(reason !== undefined ? { reason } : {}),
+            ...(input.sessionId !== undefined ? { sessionId: input.sessionId } : {}),
+        },
+    };
+}
 export class MemoryEngine {
     backend;
     memoryDir;
@@ -115,14 +156,14 @@ export class MemoryEngine {
     markSessionPolluted(sessionId, reason) {
         if (!this.pollutedSessions.has(sessionId))
             this.pollutedSessions.set(sessionId, { at: this.now(), reason });
-        let durable = false;
+        let outcome;
         try {
-            durable = markSessionPolluted(this.controlDir, sessionId, reason, this.now);
+            outcome = markSessionPolluted(this.controlDir, sessionId, reason, this.now);
         }
         catch {
-            durable = false;
+            outcome = "unpersisted";
         }
-        if (!durable) {
+        if (outcome === "unpersisted") {
             const sink = this.onIncident;
             if (sink !== undefined) {
                 try {
@@ -156,6 +197,7 @@ export class MemoryEngine {
                 }
             }
         }
+        return outcome;
     }
     sessionPollution(sessionId) {
         const inProcess = this.pollutedSessions.get(sessionId);

package/dist/core/memory-engine/layout.d.ts

@@ -288,11 +288,18 @@ export interface SessionPollutionRecord {
 }
 /**
  * Mark `sessionId` polluted (idempotent; the FIRST record wins — `wx` create refuses overwrite).
- * Returns true when a durable marker exists after the call (created now or already present);
- * false ⇔ the marker could not be persisted — the caller must keep its own in-memory mark and
- * disclose (the session stays polluted for this process either way).
+ *
+ * The outcome distinguishes the two ways a durable marker can exist after the call, because the
+ * `wx` create is the only ATOMIC answer to "who made this transition" available anywhere in the
+ * stack (#324a, adversarial-review round 5): a check-then-act pre-read lets two concurrent markers
+ * of one session both believe they were first, and a once-per-session disclosure keyed on that would
+ * announce twice. `"created"` ⇔ THIS call minted the marker; `"existed"` ⇔ it was already there (a
+ * repeat mark, a resumed session, or a racing peer that won the create); `"unpersisted"` ⇔ the marker
+ * could not be written at all — the caller must keep its own in-memory mark and disclose (the session
+ * stays polluted for this process either way).
  */
-export declare function markSessionPolluted(controlDir: string, sessionId: string, reason: string, now: () => number): boolean;
+export type SessionPollutionMarkOutcome = "created" | "existed" | "unpersisted";
+export declare function markSessionPolluted(controlDir: string, sessionId: string, reason: string, now: () => number): SessionPollutionMarkOutcome;
 /** Read the durable pollution record for `sessionId` (undefined = no marker).
  *  A marker that EXISTS still reads as polluted whether or not its bytes can be read or parsed
  *  (fail-closed: neither corruption nor an unreadable node may launder the state) — a synthesized

package/dist/core/memory-engine/layout.js

@@ -740,12 +740,12 @@ export function markSessionPolluted(controlDir, sessionId, reason, now) {
         ensureDirExists(dirname(path));
         const record = { at: now(), reason };
         writeFileSync(path, `${JSON.stringify(record, null, 2)}\n`, { encoding: "utf8", flag: "wx" });
-        return true;
+        return "created";
     }
     catch (err) {
         if (err instanceof Error && "code" in err && err.code === "EEXIST")
-            return true;
-        return false;
+            return "existed";
+        return "unpersisted";
     }
 }
 export function readSessionPollution(controlDir, sessionId) {