@sema-agent/core 5.43.0 → 5.45.0

package/dist/core/memory-engine/tools.d.ts

@@ -66,6 +66,18 @@ export interface MemoryEngineToolsOptions {
     planes: ReadonlyArray<MemoryEnginePlane>;
     /** Clock (tests); default Date.now. Drives the natural-language age rendering only. */
     now?: () => number;
+    /**
+     * design/178 §3 (#324b) — the session's pollution READ face: the record when this session is marked
+     * polluted, `undefined` when it is clean. Read-only and side-effect-free (the mark is one-way and
+     * lives at the runner's mark seat); consulted ONLY on the empty outcomes, where a session whose
+     * writes are being withheld deserves to hear it instead of being told to search again.
+     *
+     * Absent ⇒ no pollution face is wired (engine-direct hosts, tests): the empty-outcome wording is
+     * then exactly the clean-session wording — nothing is inferred from the seat's absence.
+     */
+    sessionPollution?: () => {
+        reason: string;
+    } | undefined;
 }
 export interface MemorySearchHit {
     id: string;

package/dist/core/memory-engine/tools.js

@@ -91,6 +91,26 @@ export function skipBytes(text, startBytes) {
 export function createMemoryEngineTools(opts) {
     const { planes } = opts;
     const now = opts.now ?? Date.now;
+    const pollutionSentence = () => {
+        let reason;
+        try {
+            reason = opts.sessionPollution?.()?.reason;
+        }
+        catch {
+            return "";
+        }
+        if (reason === undefined)
+            return "";
+        return ` This session is marked polluted (${inlineUntrusted(reason, 200)}): the memory it writes is not admitted to the library at harvest, so writing this down now would not make it retrievable later either.`;
+    };
+    const noMatch = (query) => {
+        const details = { outcome: "ok", hits: [] };
+        return {
+            content: `No memory entries matched ${JSON.stringify(inlineUntrusted(query, 120))}. If the user expected you to know this, say that you checked memory and found nothing.` +
+                pollutionSentence(),
+            details,
+        };
+    };
     const getWithinScopes = async (plane, ids) => {
         const scopeSet = new Set(plane.scopes);
         return (await plane.backend.getByIds(ids)).filter((e) => scopeSet.has(e.scope) && e.frontmatter.deleted !== true);
@@ -102,7 +122,7 @@ export function createMemoryEngineTools(opts) {
         defer: true,
         offload: false,
         contentOrigin: "local",
-        contract: { contractId: "core.memory_search@1", implementationRevision: "1" },
+        contract: { contractId: "core.memory_search@1", implementationRevision: "2" },
         parameters: Type.Object({
             query: Type.String({ description: "Keywords to look for (lexical match against entry names, descriptions and bodies)." }),
             limit: Type.Optional(Type.Number({ description: `Maximum hits to return (default ${MEMORY_SEARCH_DEFAULT_LIMIT}, max ${MEMORY_SEARCH_MAX_LIMIT}).` })),
@@ -144,10 +164,8 @@ export function createMemoryEngineTools(opts) {
             }
             merged.sort(contractOrder);
             const top = merged.slice(0, limit);
-            if (top.length === 0) {
-                const details = { outcome: "ok", hits: [] };
-                return { content: `No memory entries matched ${JSON.stringify(inlineUntrusted(query, 120))}. If the user expected you to know this, say that you checked memory and found nothing.`, details };
-            }
+            if (top.length === 0)
+                return noMatch(query);
             const bodyById = new Map();
             try {
                 for (let i = 0; i < planes.length; i++) {
@@ -171,10 +189,8 @@ export function createMemoryEngineTools(opts) {
                 return refusedSearch("challenge_ledger_unavailable", "Memory search is unavailable: the challenge ledger for a mounted memory plane cannot be read (fail-closed). Report this to the operator.", "failed");
             }
             const live = top.filter((h) => bodyById.has(h.id) && terminalExclusions[h.planeIndex]?.has(h.id) !== true);
-            if (live.length === 0) {
-                const details = { outcome: "ok", hits: [] };
-                return { content: `No memory entries matched ${JSON.stringify(inlineUntrusted(query, 120))}. If the user expected you to know this, say that you checked memory and found nothing.`, details };
-            }
+            if (live.length === 0)
+                return noMatch(query);
             for (let i = 0; i < planes.length; i++) {
                 const ids = live.filter((h) => h.planeIndex === i).map((h) => h.id);
                 if (ids.length === 0)
@@ -219,7 +235,7 @@ export function createMemoryEngineTools(opts) {
         defer: true,
         offload: false,
         contentOrigin: "local",
-        contract: { contractId: "core.memory_get@1", implementationRevision: "2" },
+        contract: { contractId: "core.memory_get@1", implementationRevision: "3" },
         parameters: Type.Object({
             id: Type.Optional(Type.String({ description: "Entry id (exact lookup). Pass either id or slug, not both." })),
             slug: Type.Optional(Type.String({ description: "Entry slug (its file path without .md). Ambiguous across scopes unless scope is also passed." })),
@@ -275,7 +291,10 @@ export function createMemoryEngineTools(opts) {
                     }
                     if (matches.length === 0) {
                         const where = scope !== undefined ? ` in scope ${JSON.stringify(inlineUntrusted(scope, 80))}` : "";
-                        return refusedGet("not_found", `No memory entry with slug ${JSON.stringify(inlineUntrusted(slug, 160))}${where} is mounted in this session. Try ${MEMORY_SEARCH_TOOL_NAME}.`, "not_found", { slug: slug, ...(scope !== undefined ? { scope } : {}) });
+                        return refusedGet("not_found", `No memory entry with slug ${JSON.stringify(inlineUntrusted(slug, 160))}${where} is mounted in this session. ` +
+                            `Only entries carrying a committed entry id are served here, and a memory file written into the memory root during ` +
+                            `this session gets its id when the session-boundary harvest admits it — a file written in this session is not served here before then.` +
+                            pollutionSentence(), "not_found", { slug: slug, ...(scope !== undefined ? { scope } : {}) });
                     }
                     if (matches.length > 1) {
                         const candidates = matches.map((m) => ({ scope: m.header.scope, slug: m.header.slug, id: m.header.id }));

package/dist/core/runner/assemble-result.d.ts

@@ -133,6 +133,11 @@ export interface ResultFlags {
      *  read-posture seats above: present iff prepare completed (the memory-less states are their own
      *  values — absence means only "prepare never ran to completion"). */
     effectiveMemoryScopes?: TaskResult["effectiveMemoryScopes"];
+    /** #327 — the leg's effective reasoning resolution, echoed on `TaskResult.effectiveReasoning`.
+     *  Pure pass-through on every terminal (same law as the read-posture seats): the SAME object the
+     *  `reasoning.resolved` trace frame carried (runtask resolves once per leg — two faces, one mint);
+     *  absent when thinking was off/unset for the leg, so the key is omitted. */
+    effectiveReasoning?: TaskResult["effectiveReasoning"];
     /** ruled 2026-08-04 — the usage-governance wait hint carried by the platform terminal the run adopted
      *  (`undefined` for every other cause: an expiring environment has no return time to give, and a store
      *  failure is not a window). Passed as data rather than read back off `threw` so the seat has a typed

package/dist/core/runner/assemble-result.js

@@ -165,5 +165,5 @@ export function assembleResult(spec, sessionId, final, stats, flags) {
     void _internalCompaction;
     if (flags.unpricedSpend)
         delete publicStats.costMicroUsd;
-    return { taskId, sessionId, status, ...(flags.model !== undefined ? { model: flags.model } : {}), result: result.trim(), salvagedOutput, blockedReason, errorMessage, errorCode, ...(retryAfterMs !== undefined ? { retryAfterMs } : {}), checkpointToken, ...(checkpointId !== undefined ? { checkpointId } : {}), checkpointGate, ...(workspaceRestoreMode !== undefined ? { workspaceRestoreMode } : {}), ...(flags.rewindNotes !== undefined && flags.rewindNotes.length > 0 ? { rewindNotes: flags.rewindNotes } : {}), ...(flags.remoteEnvFailures !== undefined && flags.remoteEnvFailures.length > 0 ? { remoteEnvFailures: flags.remoteEnvFailures } : {}), ...(flags.strandedHumanAnswers !== undefined && flags.strandedHumanAnswers.length > 0 ? { strandedHumanAnswers: flags.strandedHumanAnswers } : {}), ...(flags.effectiveReadFace !== undefined ? { effectiveReadFace: flags.effectiveReadFace } : {}), ...(flags.effectiveReadDenyPatterns !== undefined && flags.effectiveReadDenyPatterns.length > 0 ? { effectiveReadDenyPatterns: flags.effectiveReadDenyPatterns } : {}), ...(flags.effectiveMemoryScopes !== undefined ? { effectiveMemoryScopes: flags.effectiveMemoryScopes } : {}), stats: publicStats };
+    return { taskId, sessionId, status, ...(flags.model !== undefined ? { model: flags.model } : {}), result: result.trim(), salvagedOutput, blockedReason, errorMessage, errorCode, ...(retryAfterMs !== undefined ? { retryAfterMs } : {}), checkpointToken, ...(checkpointId !== undefined ? { checkpointId } : {}), checkpointGate, ...(workspaceRestoreMode !== undefined ? { workspaceRestoreMode } : {}), ...(flags.rewindNotes !== undefined && flags.rewindNotes.length > 0 ? { rewindNotes: flags.rewindNotes } : {}), ...(flags.remoteEnvFailures !== undefined && flags.remoteEnvFailures.length > 0 ? { remoteEnvFailures: flags.remoteEnvFailures } : {}), ...(flags.strandedHumanAnswers !== undefined && flags.strandedHumanAnswers.length > 0 ? { strandedHumanAnswers: flags.strandedHumanAnswers } : {}), ...(flags.effectiveReadFace !== undefined ? { effectiveReadFace: flags.effectiveReadFace } : {}), ...(flags.effectiveReadDenyPatterns !== undefined && flags.effectiveReadDenyPatterns.length > 0 ? { effectiveReadDenyPatterns: flags.effectiveReadDenyPatterns } : {}), ...(flags.effectiveMemoryScopes !== undefined ? { effectiveMemoryScopes: flags.effectiveMemoryScopes } : {}), ...(flags.effectiveReasoning !== undefined ? { effectiveReasoning: flags.effectiveReasoning } : {}), stats: publicStats };
 }

package/dist/core/runner/prepare-config-doors.d.ts

@@ -144,6 +144,12 @@ export interface PrepareConfigDoorsResult {
          *  material; the in-force arm never lands here — it throws at the door). */
         discardedEnvRaw: string | undefined;
     };
+    /** owned — the NORMALIZED per-leg delegation-evidence standard (design/324): the deps seat read
+     *  ONCE, in this synchronous pre-await stretch, screened, and absent folded to the "static-face"
+     *  default. The delegation wrap consumes THIS value, never the live deps object — a deps seat
+     *  mutated (or getter-backed) after the door must not present an unscreened value to the mark
+     *  branch (the #245 5.33 read-once posture). */
+    memoryDelegationEvidence: "static-face" | "attested-only";
     /** owned — validated deployment governance windows (undefined = ungoverned). */
     usageWindows: readonly UsageWindow[] | undefined;
     /** owned, out-param cell — created EMPTY here; the brain-call wiring later installs into

package/dist/core/runner/prepare-config-doors.js

@@ -132,6 +132,22 @@ export function prepareConfigDoors(input) {
     }
     assertReadFaceValue(spec.readFace, "TaskSpec.readFace");
     assertReadFaceValue(deps.readFace, "readFace (deployment seat)");
+    const memoryDelegationEvidenceRaw = deps.memoryDelegationEvidence;
+    if (memoryDelegationEvidenceRaw !== undefined && memoryDelegationEvidenceRaw !== "static-face" && memoryDelegationEvidenceRaw !== "attested-only") {
+        const evidence = memoryDelegationEvidenceRaw;
+        const got = typeof evidence === "string"
+            ? JSON.stringify(evidence.length > 64 ? `${evidence.slice(0, 64)}…` : evidence)
+            : evidence === null
+                ? "null"
+                : Array.isArray(evidence)
+                    ? "an array"
+                    : typeof evidence;
+        const e = new Error(`RunnerDeps.memoryDelegationEvidence must be "static-face" or "attested-only" when present (got ${got}) — ` +
+            `an unevaluable evidence standard is refused loudly, never folded to either standard.`);
+        e.code = "config.memory_delegation_evidence";
+        throw e;
+    }
+    const memoryDelegationEvidence = memoryDelegationEvidenceRaw === "attested-only" ? "attested-only" : "static-face";
     if (spec.resumeAtMode !== undefined) {
         if (spec.resumeAt === undefined) {
             const e = new Error(`resumeAtMode "${spec.resumeAtMode}" requires resumeAt (there is no branch target to position against)`);
@@ -294,6 +310,7 @@ export function prepareConfigDoors(input) {
         compModel,
         fableMitigations,
         modelGate,
+        memoryDelegationEvidence,
         usageWindows,
         brainCallGuardrailRef,
         brainCallGuardrailMs,

package/dist/core/runner/prepare-memory.js

@@ -1,9 +1,10 @@
 import { sep } from "node:path";
+import { deliverEngineNotice } from "../types.js";
 import { admitMemoryScopes } from "../memory-admission.js";
 import { adoptLegacyRepoDirs, canonicalize, deriveRepoControlPlaneDir, deriveProjectControlDir, deriveProjectMemoryDir, deriveRepoMemoryDir, drainMemoryAnnouncements, enqueueMemoryAnnouncement, isContainedIn, lookupProjectIdHint, recordProjectIdHint, resolveMemoryEngineRoot } from "../memory-engine/layout.js";
 import { classifyScopePlanes, derivePersonalControlDir, derivePersonalMemoryDir, mergeHarvestReports, mergeInjections, needsDualRoots, parsedProjectPlane } from "../memory-engine/dual-root.js";
 import { normalizeMemorySpec } from "../memory.js";
-import { MEMORY_ANNOUNCEMENT_READONLY_CODA, MEMORY_PREFERENCE_DISCIPLINE, MEMORY_READONLY_NOTICE, MEMORY_RECALL_DISCIPLINE, MemoryEngine } from "../memory-engine/engine.js";
+import { MEMORY_ANNOUNCEMENT_READONLY_CODA, MEMORY_PREFERENCE_DISCIPLINE, MEMORY_READONLY_NOTICE, MEMORY_RECALL_DISCIPLINE, MemoryEngine, memoryHarvestQuarantinedNotice, memorySessionPollutedNotice, pollutionContainmentCounts, } from "../memory-engine/engine.js";
 import { createMemoryEngineTools } from "../memory-engine/tools.js";
 import { assertScopeContractPlacement, parseScopeKey, resolveProjectId } from "../memory-engine/scope-contract.js";
 import { FileMemoryEngineBackend } from "../memory-engine/file-backend.js";
@@ -298,12 +299,26 @@ export async function prepareMemory(input) {
                 }
                 return writeEngine.gateWrite(writeHandle, w.key, w.content);
             };
+            let pollutionAnnounced = false;
+            const announceHarvestContainment = (report) => {
+                const { count, moved, escalated } = pollutionContainmentCounts(report);
+                if (count === 0)
+                    return;
+                let reason;
+                try {
+                    reason = writeEngine.sessionPollution(sessionId)?.reason;
+                }
+                catch {
+                }
+                deliverEngineNotice(deps.onNotice, memoryHarvestQuarantinedNotice({ count, moved, escalated, ...(reason !== undefined ? { reason } : {}), sessionId }));
+            };
             const harvestSafe = async (phase = "terminal") => {
                 try {
                     const report = await harvestBoth();
                     if (!report.ok && report.incident) {
                         deps.onError?.(new Error(`memory harvest refused (${report.incident.kind}): ${report.incident.detail}`), { phase: "memory", sessionId });
                     }
+                    announceHarvestContainment(report);
                     try {
                         deps.onMemoryHarvestReport?.(report, { sessionId, phase });
                     }
@@ -327,7 +342,13 @@ export async function prepareMemory(input) {
                 harvest: harvestSafe,
                 pollution: {
                     polluted: () => writeEngine.sessionPollution(sessionId),
-                    markPolluted: (reason) => writeEngine.markSessionPolluted(sessionId, reason),
+                    markPolluted: (reason) => {
+                        const outcome = writeEngine.markSessionPolluted(sessionId, reason);
+                        if (outcome === "existed" || (outcome === "unpersisted" && pollutionAnnounced))
+                            return;
+                        pollutionAnnounced = true;
+                        deliverEngineNotice(deps.onNotice, memorySessionPollutedNotice({ reason, sessionId }));
+                    },
                 },
                 contentSafety: {
                     trustedTools: new Set(memorySpec.trustedTools ?? []),
@@ -341,7 +362,7 @@ export async function prepareMemory(input) {
                 writeScope: memorySpec.writeScope,
             };
             if (input.memorySearchToolsPlanned)
-                memoryTools = createMemoryEngineTools({ planes: toolPlanes });
+                memoryTools = createMemoryEngineTools({ planes: toolPlanes, sessionPollution: () => writeEngine.sessionPollution(sessionId) });
         }
         catch (err) {
             if (typeof err.code === "string" &&

package/dist/core/runner/prepare-task.d.ts

@@ -1092,7 +1092,9 @@ export interface RunInternals {
      * it); `contentSafety` is the chain's FROZEN classification snapshot — the child may narrow it
      * with its own config, never widen (design/180 A-2). Trusted internals chain only, same posture as
      * {@link inheritedGate}. Absent ⇒ the child records nothing (its deliveries then read `unknown`,
-     * and every judgment falls back to the static floor — fail-closed by construction).
+     * and every judgment falls back to the static floor — fail-closed by construction; whether the
+     * floor's verdict MARKS the judging session follows that run's deployment evidence standard,
+     * {@link RunnerDeps.memoryDelegationEvidence}).
      */
     delegationProvenance?: {
         ref: {

package/dist/core/runner/prepare-task.js

@@ -333,7 +333,7 @@ function cwdConflictsRestoreError(requestedCwd) {
 export async function prepareTask(spec, deps, sessions, resume, internals, runnerSelf) {
     const doors = prepareConfigDoors({ spec, deps, sessions, resume, internals });
     spec = doors.spec;
-    const { toolFaceSnapshot, promptProfile, lockedPreflight, resolvedInteractionPosture, resolvedRole, model, thinking, compModel, fableMitigations, usageWindows, brainCallGuardrailRef, brainCallGuardrailMs } = doors;
+    const { toolFaceSnapshot, promptProfile, lockedPreflight, resolvedInteractionPosture, resolvedRole, model, thinking, compModel, fableMitigations, memoryDelegationEvidence, usageWindows, brainCallGuardrailRef, brainCallGuardrailMs } = doors;
     announceToolModelGate(deps.onNotice, model.id, doors.modelGate);
     const { toolEffects, egressTools, irreversibleTools, irreversibilityTier, axisExplicitNegatives, reversibilityProbes, ownToolNames } = prepareSafetyScan({ spec, deps });
     let shellGatedBash = false;
@@ -1855,6 +1855,8 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
         const delegationProvenanceChannel = internals?.delegationProvenance;
         if (memoryEngineSession !== undefined || delegationProvenanceChannel !== undefined) {
             const pollution = memoryEngineSession?.pollution;
+            const delegationEvidenceAttestedOnly = memoryDelegationEvidence === "attested-only";
+            let staticMarkWaiverAnnounced = false;
             const effectiveSafety = narrowContentSafety(delegationProvenanceChannel?.contentSafety, memoryEngineSession?.contentSafety);
             const trustedTools = effectiveSafety.trustedTools;
             const execIsExternalContent = effectiveSafety.execIsExternalContent;
@@ -1934,8 +1936,28 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                             }
                             else if (att !== "clean") {
                                 if (external) {
-                                    mark(`tool "${t.name}" returned the output of a delegated agent whose tool face can reach external content` +
-                                        (typeof requested === "string" ? ` (subagent_type "${requested}")` : " (no subagent_type named — classified fail-closed)"));
+                                    const staticFaceReason = `tool "${t.name}" returned the output of a delegated agent whose tool face can reach external content` +
+                                        (typeof requested === "string" ? ` (subagent_type "${requested}")` : " (no subagent_type named — classified fail-closed)");
+                                    if (!delegationEvidenceAttestedOnly) {
+                                        mark(staticFaceReason);
+                                    }
+                                    else if (pollution !== undefined && !staticMarkWaiverAnnounced) {
+                                        staticMarkWaiverAnnounced = true;
+                                        const waivedReason = inlineUntrusted(staticFaceReason, 200);
+                                        deliverEngineNotice(deps.onNotice, {
+                                            code: "memory.delegation_static_mark_waived",
+                                            message: `Delegation static-face pollution mark waived: ${waivedReason}. The deployment configured ` +
+                                                `memoryDelegationEvidence="attested-only", so a static tool-face verdict alone does not mark this ` +
+                                                `session's memory polluted; a delivered "external" attestation and a direct polluting-class ` +
+                                                `invocation still mark, and on a provenance-armed chain this delegation still records as ` +
+                                                `incomplete. At most one notice per prepared task leg.`,
+                                            detail: {
+                                                reason: waivedReason,
+                                                ...(typeof requested === "string" ? { subagentType: inlineUntrusted(requested, 120) } : {}),
+                                                sessionId,
+                                            },
+                                        });
+                                    }
                                 }
                                 recordIncomplete();
                             }

package/dist/core/runner/runtask.js

@@ -1661,6 +1661,7 @@ export class Runner {
                 errorCode: code,
                 ...(remoteEnvFailure !== undefined ? { remoteEnvFailures: remoteEnvFailure } : {}),
                 ...(taskIdRef.effectiveMemoryScopes !== undefined ? { effectiveMemoryScopes: taskIdRef.effectiveMemoryScopes } : {}),
+                ...(taskIdRef.effectiveReasoning !== undefined ? { effectiveReasoning: taskIdRef.effectiveReasoning } : {}),
                 ...(() => {
                     const hinted = err.retryAfterMs;
                     return code === "memory.admission_required" && typeof hinted === "number" && Number.isFinite(hinted) && hinted > 0
@@ -2468,23 +2469,24 @@ export class Runner {
                 ts: Date.now(),
             }));
         }
-        if (prepared.thinking && prepared.thinking !== "off" && prepared.model.reasoning === true) {
-            emitTrace(rs.telemetry.tracer, () => {
-                const r = resolveReasoning(prepared.thinking, prepared.model);
-                return {
-                    kind: "reasoning.resolved",
-                    version: 1,
-                    taskId: rs.telemetry.taskId,
-                    model: prepared.model.id,
-                    requested: r.requested,
-                    effective: r.effective,
-                    graded: r.graded,
-                    clamped: r.clamped,
-                    format: r.format,
-                    endpoint: r.endpoint,
-                    ts: Date.now(),
-                };
-            });
+        const reasoningResolution = prepared.thinking && prepared.thinking !== "off" ? resolveReasoning(prepared.thinking, prepared.model) : undefined;
+        if (taskIdRef && reasoningResolution !== undefined)
+            taskIdRef.effectiveReasoning = reasoningResolution;
+        if (reasoningResolution !== undefined) {
+            emitTrace(rs.telemetry.tracer, () => ({
+                kind: "reasoning.resolved",
+                version: 1,
+                taskId: rs.telemetry.taskId,
+                model: prepared.model.id,
+                requested: reasoningResolution.requested,
+                effective: reasoningResolution.effective,
+                graded: reasoningResolution.graded,
+                clamped: reasoningResolution.clamped,
+                format: reasoningResolution.format,
+                endpoint: reasoningResolution.endpoint,
+                ...(reasoningResolution.dropped === true ? { dropped: true } : {}),
+                ts: Date.now(),
+            }));
         }
         const effectiveTimeoutMs = spec.limits?.maxWalltimeMs;
         const walltimeMonotonicDeadline = effectiveTimeoutMs !== undefined ? rs.telemetry.taskStartMonotonic + effectiveTimeoutMs : undefined;
@@ -3458,6 +3460,7 @@ export class Runner {
                 effectiveReadFace: prepared.effectiveReadFace,
                 effectiveReadDenyPatterns: prepared.effectiveReadDenyPatterns,
                 effectiveMemoryScopes: prepared.effectiveMemoryScopes,
+                effectiveReasoning: reasoningResolution,
                 retryAfterMs: rs.limits.platformTerminal?.retryAfterMs,
                 abortedForTimeout: timeout.fired,
                 abortedForTurns: rs.limits.turnsExceeded,

package/dist/core/trace.d.ts

@@ -143,8 +143,13 @@ export type TraceEvent = {
     /**
      * How a task's requested reasoning intensity RESOLVED against the model's real capability (design/96 S6).
      * Emitted once at task start when thinking is on, so a deployment can SEE — not silently swallow (§E
-     * honesty red-line) — that a binary provider ignored the tier (`graded:false`) or that an effort endpoint
-     * clamped it down (`clamped:true`). Metadata-only (tiers + format + endpoint, never prompt content).
+     * honesty red-line) — that a binary provider ignored the tier (`graded:false`), that an effort endpoint
+     * clamped it down (`clamped:true`), or that a NON-reasoning model dropped the request entirely
+     * (`dropped:true` — the frame fires for that model too; it used to be the one arm with no report).
+     * Metadata-only (tiers + format + endpoint, never prompt content). The resolution is against the
+     * task's PRIMARY serving model at leg entry (same law as `TaskResult.model`): a mid-run
+     * degradation does not re-emit this frame — the switch is observed on its own seats
+     * (`TaskResult.degraded`).
      */
     kind: "reasoning.resolved";
     version: 1;
@@ -163,6 +168,16 @@ export type TraceEvent = {
     format: string;
     /** Coarse endpoint label (`model.api`, e.g. `openai-completions` / `anthropic-messages`). */
     endpoint: string;
+    /**
+     * Present (true) only when the model declares NO reasoning capability (`Model.reasoning` falsy): the
+     * brains send no thinking parameter at all, so the requested tier was DROPPED — not clamped.
+     * `effective:"off"` states the ENGINE side (nothing was requested), not a measured gateway state:
+     * on the binary enable-only formats (qwen/zai/qwen-chat-template) parameter absence is
+     * provider-default and a default-on gateway may still reason at its own tier — read `format` to
+     * know which family applies. `format`/`endpoint` report the family that WOULD have carried the
+     * tier. Absent on every reasoning-capable resolution (old consumers see identical frames).
+     */
+    dropped?: true;
     /** design/148 S3 (additive, §10.2): the nine-element cache identity — digests only. */
     snapshot?: {
         cacheIdentity: string;

package/dist/core/types.d.ts

@@ -846,7 +846,9 @@ export interface ToolExecuteContext {
      * content-safety snapshot — the tool then mints the child's recorder ref and threads both into
      * the child's trusted `RunInternals.delegationProvenance`. Undefined return / absent field ⇒ the
      * child spawns without a recorder (its deliveries read `unknown` and every judgment stays on the
-     * static floor — v1 behavior byte-identical). Same trust posture as
+     * static floor — whose MARK action follows the judging run's deployment evidence standard,
+     * {@link RunnerDeps.memoryDelegationEvidence}; under the `"static-face"` default this is v1
+     * behavior byte-identical). Same trust posture as
      * {@link inheritedGateForChildren}: never a model/tool argument, never a TaskSpec field.
      */
     delegationProvenanceForChildren?: () => import("./memory-engine/delegation-provenance.js").DelegationContentSafety | undefined;
@@ -2839,6 +2841,29 @@ export interface TaskResult {
      *  `TaskSpec.model` ref (which may be a role / name / `@mention`). Lets a UI echo "served by X" instead of the
      *  requested ref. A mid-run degradation is observed separately (see the degraded-model fields). */
     model?: string;
+    /**
+     * #327 — the leg's effective REASONING resolution: the result-face twin of {@link model} for the thinking
+     * knob. How the requested tier resolved against the serving model's real capability
+     * (`requested`/`effective`/`graded`/`clamped`/`format`/`endpoint`, plus `dropped:true` when a
+     * non-reasoning model dropped the request entirely — field semantics on
+     * {@link import("../brain/reasoning.js").ResolvedReasoning}). It is the SAME resolver output the
+     * `reasoning.resolved` trace frame carries, computed once per leg — the two faces cannot tell different
+     * stories; this seat serves consumers without a tracer (the trace frame is the deployment-observability
+     * face, this is the caller face).
+     *
+     * **In-presence condition** — mirrors the trace frame exactly: present on every terminal of a leg that ran
+     * with a REQUESTED thinking tier other than off/unset (the `spec > role > model.defaultThinking` chain);
+     * absent when thinking was off/unset for the leg, and on prepare failures (the resolution is minted after
+     * prepare). On a resumed task each leg re-resolves against the leg's own serving model.
+     *
+     * **Degradation law** — same as {@link model}, whose resolution this is: the seat describes the leg's
+     * PRIMARY serving model at leg entry. A mid-run degradation (reactive fallback / near-budget switch)
+     * changes the serving model WITHOUT re-minting this seat or its trace twin — read {@link degraded} to see
+     * the switch; the fallback's own reasoning capability is deliberately NOT re-reported here (re-resolving
+     * one face would desync it from the task-start `reasoning.resolved` frame). A consumer needing the
+     * fallback's reasoning posture resolves `degraded.to` itself (`resolveReasoning` is exported).
+     */
+    effectiveReasoning?: import("../brain/reasoning.js").ResolvedReasoning;
     /** Final assistant text. */
     result: string;
     /**
@@ -4683,6 +4708,50 @@ export interface EngineNotice {
      *    `detail: { steer, taskId? }` / `{ followUp, taskId? }`. Per-run, at most once per family
      *    (the terminal sweep is a single site).
      *
+     *  - `"memory.session_polluted"` (design/178 §3, #324a) — this session's memory crossed into the
+     *    one-way POLLUTED state (a tool classified as an external content source was invoked, directly
+     *    or through a delegated child): its memory writes are no longer eligible for the long-term
+     *    library. The notice states that VERDICT plus what a harvest does when it collects — it does
+     *    not promise quarantine, because a `writeScope`-null layering and a declared-unavailable
+     *    session both reach the zero-admission harvest arm (nothing collected ⇒ nothing captured), and
+     *    a mark landing after the pre-commit pollution read leaves already-committed rows to the
+     *    challenge sweep; what a harvest actually contained is the other code below. The challenge
+     *    clause is a policy statement, not a receipt — a sweep that cannot run announces
+     *    `"memory.challenge_sweep_failed"` on the engine's incident seat. Announced ONCE PER
+     *    SESSION, at the mark seat: a repeat mark inside the process and a resumed session whose
+     *    durable marker already exists stay quiet (the state is one-way, so a second line would carry
+     *    no new fact); a pollution state that cannot be read announces rather than assuming it was
+     *    already said. `detail: { reason, sessionId? }` — `reason` names the invoked tool and is
+     *    neutralized/length-bounded (the name comes from the host/protocol roster).
+     *  - `"memory.harvest_quarantined"` (design/178 §3, #324a) — a polluted session's harvest ran its
+     *    containment: `count` ENTRY files written or changed in the session were withheld from the
+     *    library, `moved` of them were physically moved into the control-plane quarantine directory,
+     *    and `escalated` of them carry a `HarvestReport.quarantineFailures` row (a failed capture, a
+     *    failed removal, or a file tombstoned in place — which counts as moved AND escalated, so the
+     *    two numbers are read off the report's rows, never subtracted from each other). One notice PER
+     *    HARVEST that withheld at least one entry file (a checkpoint harvest and the terminal harvest
+     *    are distinct facts), never minted for a clean session; `detail: { count, moved, escalated,
+     *    reason?, sessionId? }` (`reason` absent ⇔ the pollution marker could not be re-read at report
+     *    time — the withheld count stays true either way). Registered gap: the derived index (`MEMORY.md`) is
+     *    contained on a path that mints no rejection row, so an index-ONLY containment produces no
+     *    notice and is disclosed by the harvest report's warnings alone.
+     *  - `"memory.delegation_static_mark_waived"` (design/324, #324 ruling ①) — the deployment set
+     *    {@link RunnerDeps.memoryDelegationEvidence} to `"attested-only"` and a delegation call whose
+     *    STATIC tool-face verdict would have marked this session's memory polluted (attestation
+     *    missing/unknown + face can reach external content) was not marked: the waiver is announced —
+     *    the explicit dual of `"memory.session_polluted"` for this arm, so the arm has a voice where a
+     *    mark used to land. MINT-side guarantee only: delivery rides the shared guarded form
+     *    ({@link deliverEngineNotice} — a wired sink that throws owns that loss, exactly as at every
+     *    de-duplicating station), and the leg latch is consumed at mint. Minted only when a pollution
+     *    face is mounted (a
+     *    recorder-only child's mark is a no-op — nothing is waived there), at most ONCE PER PREPARED
+     *    TASK LEG (a resume leg may announce again — a new leg's audit stream is a new fact;
+     *    deliberately no durable once-per-session state), never on the `"static-face"` default, and
+     *    never for a delivered `"external"` attestation (that mark still lands);
+     *    `detail: { reason, subagentType?, sessionId? }` — `reason` is the same sentence the waived
+     *    mark would have carried, neutralized/length-bounded (tool and agent-type names are
+     *    host/model-controlled inputs).
+     *
      *  Deliberately NOT a notice family: brain retry/reconnect liveness (a rate limit, a 5xx, a
      *  transient network failure being retried). Those are per-attempt liveness frames with their own
      *  frequency semantics and ride the wire `status` channel ({@link BrainStatus}), whose sink the
@@ -4830,6 +4899,36 @@ export interface RunnerDeps {
      * bypasses the gate as always — the human already adjudicated it).
      */
     writeProtectedPaths?: readonly import("./write-protect.js").WriteProtectedEntry[];
+    /**
+     * design/324 (#324 ruling ① containment) — the EVIDENCE STANDARD the delegation arm of the
+     * content-origin wrap applies when deciding whether a delegation call marks THIS session's memory
+     * polluted (design/178 §3 / design/180 half A):
+     *  - `"static-face"` (absent ≡ this; the default) — today's behavior, byte-identical: a delegation
+     *    whose delivered attestation is missing/unknown and whose static tool face can reach external
+     *    content marks the session (the capability over-approximation: possibility counts as exposure).
+     *  - `"attested-only"` — exactly that ONE static-face mark is waived, and each prepared leg
+     *    announces the first waiver (`"memory.delegation_static_mark_waived"`). Everything else is
+     *    unchanged: a delivered `"external"` attestation still marks, the chain's `incomplete`
+     *    recording still happens, a non-delegation polluting-class tool still marks, and a delegation
+     *    tool that is ITSELF classified polluting still marks pre-call.
+     * ACCEPTED COST (the deployment's to own, stated as mechanism, not as absence of risk): under
+     * `"attested-only"` a BACKGROUND child's real external contact does not mark this session — its
+     * content re-enters through the TaskOutput result, the task-notification injection, or the
+     * AgentTranscript step summaries, none of which carries an attestation — and a foreground child
+     * that ended abnormally (crash/salvage) is likewise not marked on its face alone (the chain still
+     * records `incomplete`). Already-marked sessions are never retroactively cleaned; the key only
+     * governs NEW marks.
+     * DEPLOYMENT seat ONLY (same posture as {@link readDenyBuiltinTiers}): deliberately no TaskSpec
+     * twin and not in the governed workflow whitelist — a task author or governed script gets no
+     * channel to loosen the evidence standard below its deployment. Not frozen into checkpoints: a
+     * resumed leg follows the CURRENT deployment configuration. Each run reads the deps of the Runner
+     * that PREPARES it — a multi-runner assembly should configure every runner with the same value
+     * (drift is the deployment's own configuration hazard; recorder/attestation semantics are
+     * value-independent, so the chain's evidence quality never varies with this key). Any other value
+     * refuses loudly at prepare (`config.memory_delegation_evidence`, #123 — exact spellings only,
+     * never truthiness).
+     */
+    memoryDelegationEvidence?: "static-face" | "attested-only";
     /**
      * design/199 件A — the DEPLOYMENT's read-face declaration
      * ({@link import("../tools/fs/read-face.js").ReadFace}; see {@link TaskSpec.readFace} for the

package/dist/tools/fs/fs-search-tools.d.ts

@@ -5,9 +5,10 @@ import type { ReadFace } from "./read-face.js";
 /**
  * The Grep card's details assembly, PURE over the engine text ({mode, offset} from the request) —
  * exported so the text→structured mapping is pinnable with synthetic texts (the byte-truncation and
- * fenced-partial shapes are impractical to construct through a live tool call). Follow-up #313 will
- * replace the text parsing with structured rows from runGrep; until then this seam is the honesty
- * boundary.
+ * fenced-partial shapes are impractical to construct through a live tool call). #313 moved PATH
+ * IDENTITY off the text and onto the engines' served rows (both legs supply them now); the counts
+ * and totals below still read the engine's own honesty markers out of the text, which is what keeps
+ * this seam the honesty boundary.
  */
 export declare function grepDetailFields(text: string, mode: "files_with_matches" | "content" | "count", offset?: number, structuredRows?: readonly import("./search.js").GrepRow[]): Record<string, unknown>;
 export declare function createGrepTool(env: ExecutionEnv, rootCanonical: string, additionalRoots?: readonly string[], readDeny?: ReadDenyMatcher, readFace?: ReadFace): AgentTool;

package/dist/tools/fs/search.d.ts

@@ -190,7 +190,27 @@ export interface ReadDenyJudge {
 /** JS-fallback grep: ignore-aware walk + per-line scan, honoring output_mode / context / head_limit.
  *  design/199 件B: `deny` prunes the walk (note appended to every output shape); `denyOut` is the
  *  structured twin — a sink because this function's dozen error returns predate the facts (the sink
- *  is written the moment the walk lands, whatever the scan then returns). */
+ *  is written the moment the walk lands, whatever the scan then returns).
+ *
+ *  backlog #313 — the SERVED rows ride back next to the text. This scanner knows every result's
+ *  identity natively (the walk hands it whole paths), so a row's `path` is that walked identity,
+ *  never a cut of the rendered line — the mis-split family the text re-parse carries cannot exist
+ *  here. The rows ARE the window `text` shows: post offset, post row cap, post byte ceiling, in the
+ *  same order. The unit is the RECORD, which is the unit the cap has always counted: one record is
+ *  one rendered line EXCEPT where the file's own name carries a newline, and then the one record
+ *  spans two physical lines — the same relation {@link formatRgRecords} states for the rg leg, and
+ *  precisely the case where a row's identity beats anything the text can be split into.
+ *  Every row carries a path (this leg emits no group-separator row — the one pathless shape
+ *  ripgrep's output can carry), and a no-match run's row set is `[]`, not absent. A typed
+ *  `Error (grep): …` return carries no rows at all: a refusal is not a row set. */
+export declare function jsGrepDetailed(env: ExecutionEnv, root: string, p: GrepParams, signal?: AbortSignal, guards?: JsGrepGuards, deny?: ReadDenyJudge, denyOut?: {
+    withheld?: ReadDenyWithheld;
+}): Promise<{
+    text: string;
+    rows?: readonly GrepRow[];
+}>;
+/** Text-only wrapper of {@link jsGrepDetailed} (the shape callers that never look at the served rows
+ *  want — the same relation {@link runGrep} has to {@link runGrepDetailed}). */
 export declare function jsGrep(env: ExecutionEnv, root: string, p: GrepParams, signal?: AbortSignal, guards?: JsGrepGuards, deny?: ReadDenyJudge, denyOut?: {
     withheld?: ReadDenyWithheld;
 }): Promise<string>;
@@ -210,18 +230,34 @@ export type GrepDegradation = {
 };
 /** Structured grep result: the model-facing text plus the degradation facts, so the tool layer can
  *  ship them on the structured frame instead of leaving them prose-only. */
-/** #313 (first stage, rg legs) — one SERVED result row with its path read from ripgrep's own
- *  field ({@link parseRgRecords}), exactly the window `text` shows (post cap/offset). The tool
- *  layer prefers these over re-parsing `text` (whose `path:line:text` split mis-cuts a path that
- *  itself contains `:digits:`); absent = a leg that has no structured rows yet (the JS scanner —
- *  its rows stage is the ticket's remainder) and the text parse is the honest fallback. */
+/** #313 — one SERVED result RECORD with its path taken from the engine's own knowledge, exactly the
+ *  window `text` shows (post cap/offset): ripgrep's `--null` path field ({@link parseRgRecords}) on
+ *  the rg legs, the walked file identity ({@link jsGrepDetailed}) on the JS-scanner legs. A record is
+ *  one rendered line except where a path carries a newline (see {@link formatRgRecords}), which is
+ *  also the case the text can no longer be split into records at all. The tool layer prefers these
+ *  over re-parsing `text` (whose `path:line:text` split mis-cuts a path that
+ *  itself contains `:digits:`).
+ *
+ *  KNOWN EXCEPTION to "exactly the window `text` shows", stated because it is measurable: on the two
+ *  ripgrep PARTIAL legs (timeout / error-exit with output) the delivered text is fenced by
+ *  `delimitUntrusted`, which NEUTRALIZES fence markers inside the body, while the rows carry the
+ *  record bytes as ripgrep emitted them. A row's `text` there is therefore the un-neutralized form —
+ *  identity (`path`) is unaffected. Consume `text` for anything rendered; the rows' contract is
+ *  identity. Reconciling the two (defuse per record, or withhold rows where the text is fenced) is a
+ *  contract choice recorded for the backlog, not settled here.
+ *
+ *  `path` is absent only where the record genuinely carries none —
+ *  ripgrep's `--` group separator and the unaccountable shapes listed on {@link RgRecord} — and a
+ *  row set carrying such a row sends the tool layer back to the text parse for identity. */
 export interface GrepRow {
     path?: string;
     text: string;
 }
 export interface GrepRunResult {
     text: string;
-    /** Served rows (#313): present on the ripgrep legs, absent on the JS-scanner legs. */
+    /** Served rows (#313): present on BOTH engine legs — ripgrep's and the JS scanner's, including the
+     *  rescan legs. Absent only when the JS scanner refused the search outright (a typed
+     *  `Error (grep): …` text): a refusal has no row set, truthfully, rather than an empty one. */
     rows?: readonly GrepRow[];
     degraded?: GrepDegradation;
     /** design/199 件B — deny-list withholding facts (see {@link ReadDenyWithheld}); absent = nothing