@sema-agent/core 5.46.0 → 5.48.0

package/dist/stores/file/index.d.ts

@@ -4,6 +4,9 @@ import type { ToolResultStore } from "../../core/tool-result-store.js";
 import { type EvictPolicy } from "../../core/session-store.js";
 import type { SessionStore } from "../../core/session.js";
 import { type FileCheckpointStoreOptions } from "./checkpoint-store.js";
+import type { BackgroundAgentStore } from "../../core/background-agent-store.js";
+import type { MailboxStore } from "../../core/mailbox-store.js";
+import type { RosterStore } from "../../agents/roster-store.js";
 import type { SessionPolicyStore } from "../../core/session-policy-store.js";
 import type { FileSnapshotStore } from "../../core/file-snapshot-store.js";
 import type { WorkflowJournalStore } from "../../core/workflow-journal-store.js";
@@ -76,9 +79,8 @@ export interface FileStorageBackendOptions {
      * Reach TODAY: {@link FileStorageBackend.sessionPolicyStore} (rules read as ABSENT ⇒ an unconstrained
      * task), {@link FileStorageBackend.sessionStore}'s repo (a session listing that silently omits what it
      * could not read) and {@link FileStorageBackend.fileSnapshotStore} (a snapshot/scope read as missing,
-     * and a blob GC that aborted). The roster and CC-mailbox stores also carry the seat, but a deployment
-     * builds those itself and passes the sink directly. A store that grows the seat later is wired here in
-     * the same constructor.
+     * and a blob GC that aborted). The aggregated roster and mailbox stores receive the same sink. A
+     * store that grows the seat later is wired here in the same constructor.
      *
      * The payload is the UNION shape ({@link FileStorageCorruptReadInfo}): `path` + `reason` always,
      * with the session-policy face's `sessionId`/`principal` present only when the reading store keys by
@@ -125,6 +127,18 @@ export declare class FileStorageBackend {
      *  `RunnerDeps.usageWindowStore` so a deployment's `usageWindows` survive a restart (an in-memory
      *  ledger silently re-grants every allowance on every boot). */
     readonly usageWindowStore: UsageWindowStore;
+    /** design/151 S1a / subagent transcript persistence — the durable background-agent execution
+     *  ledger over the same data root. Wire into BOTH `RunnerDeps.backgroundAgentStore` AND (for a
+     *  deployment-composed Agent tool) `SubagentToolOptions.background.agentStore` — SAME instance
+     *  (the RB-37 pairing discipline). Aggregated here so the TOC full-persistence assembly is one
+     *  constructor, the same reason the session/checkpoint/tool-result trio are. */
+    readonly backgroundAgentStore: BackgroundAgentStore;
+    /** design/151 §7 S3c — the durable SendMessage mailbox (tier-3 parking lane), same data root.
+     *  Wire into `RunnerDeps.mailboxStore` (single-instance pairing, same as above). */
+    readonly mailboxStore: MailboxStore;
+    /** design/147 S1c — the durable name→agent roster (layer 0.5 resolution), `root/roster.json`.
+     *  Wire into `RunnerDeps.rosterStore` so name-addressing survives a restart alongside the rows. */
+    readonly rosterStore: RosterStore;
     /**
      * design/84 Seam B (TOC) — the per-scope consolidation lock for `consolidateScope`'s `acquire` injection
      * point: `consolidateScope(scope, { store: backend.memoryStore, llm, acquire: backend.consolidationLock })`.
@@ -133,6 +147,8 @@ export declare class FileStorageBackend {
      */
     readonly consolidationLock: (scope: string) => (() => void) | undefined;
     private readonly lock;
+    private readonly fileAgentRows;
+    private readonly fileMailbox;
     private readonly fileCheckpoints;
     private readonly fileMemory;
     private readonly ttl;

package/dist/stores/file/index.js

@@ -11,6 +11,9 @@ import { FileSessionPolicyStore } from "./session-policy-store.js";
 import { FileFileSnapshotStore } from "./file-snapshot-store.js";
 import { FileWorkflowJournalStore } from "./workflow-journal-store.js";
 import { FileUsageWindowStore } from "./usage-window-store.js";
+import { FileBackgroundAgentStore } from "./background-agent-store.js";
+import { FileMailboxStore } from "./mailbox-store.js";
+import { FileRosterStore } from "../../agents/roster-store.js";
 export { FileCheckpointStore } from "./checkpoint-store.js";
 export { FileMemoryStore } from "./memory-store.js";
 export { FileSessionRepo } from "./session-store.js";
@@ -33,8 +36,13 @@ export class FileStorageBackend {
     fileSnapshotStore;
     workflowJournalStore;
     usageWindowStore;
+    backgroundAgentStore;
+    mailboxStore;
+    rosterStore;
     consolidationLock;
     lock;
+    fileAgentRows;
+    fileMailbox;
     fileCheckpoints;
     fileMemory;
     ttl;
@@ -49,7 +57,7 @@ export class FileStorageBackend {
             const corruptRead = opts.onCorruptRead !== undefined ? { onCorruptRead: opts.onCorruptRead } : undefined;
             const repo = new FileSessionRepo(this.root, corruptRead);
             this.fileSessions = repo;
-            this.ttl = new TtlSessionStore({ repo, evict: opts.evict ?? "forget", durability: "durable" });
+            this.ttl = new TtlSessionStore({ repo, evict: opts.evict ?? "forget", durability: "durable", placements: { subagent: { durability: "durable" } } });
             this.sessionStore = this.ttl;
             this.fileCheckpoints = new FileCheckpointStore(this.root, opts.checkpoint);
             this.checkpointStore = this.fileCheckpoints;
@@ -61,6 +69,11 @@ export class FileStorageBackend {
             this.fileWorkflowJournal = new FileWorkflowJournalStore(this.root);
             this.workflowJournalStore = this.fileWorkflowJournal;
             this.usageWindowStore = new FileUsageWindowStore(this.root);
+            this.fileAgentRows = new FileBackgroundAgentStore(this.root);
+            this.backgroundAgentStore = this.fileAgentRows;
+            this.fileMailbox = new FileMailboxStore(this.root, corruptRead ?? {});
+            this.mailboxStore = this.fileMailbox;
+            this.rosterStore = new FileRosterStore(join(this.root, "roster.json"), corruptRead ?? {});
             this.consolidationLock = createFileConsolidationLock(join(this.root, "consolidation-locks"));
         }
         catch (err) {
@@ -87,6 +100,16 @@ export class FileStorageBackend {
         }
         this.fileMemory.close();
         this.fileWorkflowJournal.dispose();
+        try {
+            this.fileAgentRows.close();
+        }
+        catch {
+        }
+        try {
+            this.fileMailbox.close();
+        }
+        catch {
+        }
         this.lock.release();
     }
 }

package/dist/stores/file/session-store.d.ts

@@ -1,4 +1,5 @@
-import type { Session, SessionForkOptions, SessionMetadata, SessionRepo, SessionTreeEntry } from "../../internal/harness.js";
+import type { Session, SessionCreateOptions, SessionForkOptions, SessionMetadata, SessionPlacementRecord, SessionRepo, SessionTreeEntry } from "../../internal/harness.js";
+import type { PlacedSessionRow } from "../../core/session.js";
 export interface FileSessionRepoOptions {
     /**
      * Disclosure sink for a durable read this repo treats as ABSENT (ruled 2026-08-03). Same name and
@@ -47,11 +48,24 @@ export declare class FileSessionRepo implements SessionRepo {
      * means a stale holder can never revoke the rebuilt entry.
      */
     dispose(): Promise<void>;
-    create(options?: {
-        id?: string;
-    }): Promise<Session>;
+    create(options?: SessionCreateOptions): Promise<Session>;
     open(metadata: SessionMetadata): Promise<Session>;
     list(): Promise<SessionMetadata[]>;
+    /**
+     * Subagent transcript persistence — the PLACED partition's own enumeration (the joint reap's
+     * partition-leg input; `TtlSessionStore` re-exposes it verbatim). Age (`olderThanMs`) is judged on
+     * the session FILE's mtime — the transcript's last append — falling back to `placedAt` when the
+     * stat fails (mtime is also the CC orphan-adoption window's basis, so the two age reads agree).
+     * Rows missing either `(scope, handle)` join half return the honest `tupleIncomplete` variant
+     * (consumers fail closed on it — never age-reaped, see the SessionStore contract).
+     */
+    listPlaced(kind: "subagent", opts?: {
+        olderThanMs?: number;
+        scope?: string;
+    }): Promise<PlacedSessionRow[]>;
+    /** Cheap placement probe for one id (the TtlSessionStore's cold-cache release consults it so the
+     *  placed real-deletion obligation holds after a restart). `undefined` = missing file OR unplaced. */
+    placementOf(sessionId: string): Promise<SessionPlacementRecord | undefined>;
     delete(metadata: SessionMetadata): Promise<void>;
     fork(sourceMetadata: SessionMetadata, options?: SessionForkOptions): Promise<Session>;
     /** 2c session-sync ([275], the FILE half of [266]②): the FULL oldest-first log for export. The file backend

package/dist/stores/file/session-store.js

@@ -1,4 +1,4 @@
-import { existsSync, readdirSync, rmSync } from "node:fs";
+import { existsSync, readdirSync, rmSync, statSync } from "node:fs";
 import { join } from "node:path";
 import { BaseSessionStorage, StoredSession, SessionError, getEntriesToFork, uuidv7, validateEntriesForImport, } from "../../internal/harness.js";
 import { canonicalStoreKey, AppendLog, atomicWriteFile, ensureDir, readJsonlRecords, sanitizePathComponent } from "./fs-atomic.js";
@@ -83,18 +83,20 @@ export class FileSessionRepo {
         const lines = readJsonlRecords(path, (info) => this.disclose(info.path, info.reason));
         let createdAt = "";
         let forkedFrom;
+        let placement;
         const entries = [];
         for (const line of lines) {
             if (line.kind === "meta") {
                 createdAt = line.createdAt;
                 forkedFrom = line.forkedFrom;
+                placement = line.placement;
             }
             else
                 entries.push(line.entry);
         }
-        return { createdAt, ...(forkedFrom !== undefined ? { forkedFrom } : {}), entries };
+        return { createdAt, ...(forkedFrom !== undefined ? { forkedFrom } : {}), ...(placement !== undefined ? { placement } : {}), entries };
     }
-    storage(id, createdAt, entries, forkedFrom) {
+    storage(id, createdAt, entries, forkedFrom, placement) {
         const canonical = canonicalStoreKey(this.pathFor(id));
         const live = sharedSessionStorages.get(canonical)?.deref();
         if (live !== undefined) {
@@ -103,7 +105,7 @@ export class FileSessionRepo {
             return live;
         }
         const log = new AppendLog(this.pathFor(id));
-        const created = new FileSessionStorage(log, { id, createdAt, ...(forkedFrom !== undefined ? { forkedFrom } : {}) }, entries, canonical);
+        const created = new FileSessionStorage(log, { id, createdAt, ...(forkedFrom !== undefined ? { forkedFrom } : {}), ...(placement !== undefined ? { placement } : {}) }, entries, canonical);
         sharedSessionStorages.set(canonical, new WeakRef(created));
         created.addHolder(this);
         this.joined.set(canonical, new WeakRef(created));
@@ -128,15 +130,16 @@ export class FileSessionRepo {
         const path = this.pathFor(id);
         if (!existsSync(path)) {
             evictSharedSessionStorage(canonicalStoreKey(path));
-            atomicWriteFile(this.tmpDir, path, `${JSON.stringify({ kind: "meta", id, createdAt })}\n`);
-            return new StoredSession(this.storage(id, createdAt, []));
+            const placement = options.placement !== undefined ? { ...options.placement, placedAt: options.placement.placedAt ?? Date.now() } : undefined;
+            atomicWriteFile(this.tmpDir, path, `${JSON.stringify({ kind: "meta", id, createdAt, ...(placement !== undefined ? { placement } : {}) })}\n`);
+            return new StoredSession(this.storage(id, createdAt, [], undefined, placement));
         }
-        const { createdAt: existingCreatedAt, forkedFrom, entries } = this.read(id);
-        return new StoredSession(this.storage(id, existingCreatedAt || createdAt, entries, forkedFrom));
+        const { createdAt: existingCreatedAt, forkedFrom, placement, entries } = this.read(id);
+        return new StoredSession(this.storage(id, existingCreatedAt || createdAt, entries, forkedFrom, placement));
     }
     async open(metadata) {
-        const { createdAt, forkedFrom, entries } = this.read(metadata.id);
-        return new StoredSession(this.storage(metadata.id, createdAt, entries, forkedFrom));
+        const { createdAt, forkedFrom, placement, entries } = this.read(metadata.id);
+        return new StoredSession(this.storage(metadata.id, createdAt, entries, forkedFrom, placement));
     }
     async list() {
         let names;
@@ -155,7 +158,9 @@ export class FileSessionRepo {
                 continue;
             const id = name.slice(0, -SUFFIX.length);
             try {
-                const { createdAt, forkedFrom } = this.read(id);
+                const { createdAt, forkedFrom, placement } = this.read(id);
+                if (placement !== undefined)
+                    continue;
                 out.push({ id, createdAt, ...(forkedFrom !== undefined ? { forkedFrom } : {}) });
             }
             catch (err) {
@@ -166,12 +171,68 @@ export class FileSessionRepo {
         }
         return out.sort((a, b) => a.createdAt.localeCompare(b.createdAt));
     }
+    async listPlaced(kind, opts) {
+        let names;
+        try {
+            names = readdirSync(this.dir);
+        }
+        catch (err) {
+            if (err.code !== "ENOENT") {
+                this.disclose(this.dir, `session directory unreadable (${err.code ?? "unknown"}) — placed listing degraded to empty`);
+            }
+            return [];
+        }
+        const now = Date.now();
+        const out = [];
+        for (const name of names) {
+            if (!name.endsWith(SUFFIX))
+                continue;
+            const id = name.slice(0, -SUFFIX.length);
+            let placement;
+            try {
+                placement = this.read(id).placement;
+            }
+            catch (err) {
+                if (!(err instanceof SessionError && err.code === "not_found")) {
+                    this.disclose(this.pathFor(id), `session log unreadable (${err instanceof Error ? err.message : String(err)}) — skipped from the placed listing`);
+                }
+                continue;
+            }
+            if (placement === undefined || placement.kind !== kind)
+                continue;
+            if (opts?.scope !== undefined && placement.scope !== opts.scope)
+                continue;
+            if (opts?.olderThanMs !== undefined) {
+                let ageAnchor = placement.placedAt;
+                try {
+                    ageAnchor = statSync(this.pathFor(id)).mtimeMs;
+                }
+                catch {
+                }
+                if (now - ageAnchor <= opts.olderThanMs)
+                    continue;
+            }
+            out.push(placement.scope !== undefined && placement.handle !== undefined
+                ? { sessionId: id, placedAt: placement.placedAt, scope: placement.scope, handle: placement.handle }
+                : { sessionId: id, placedAt: placement.placedAt, tupleIncomplete: true });
+        }
+        return out;
+    }
+    async placementOf(sessionId) {
+        try {
+            return this.read(sessionId).placement;
+        }
+        catch {
+            return undefined;
+        }
+    }
     async delete(metadata) {
         evictSharedSessionStorage(canonicalStoreKey(this.pathFor(metadata.id)));
         try {
             rmSync(this.pathFor(metadata.id), { force: true });
         }
-        catch {
+        catch (err) {
+            throw new SessionError("storage", `session ${metadata.id} could not be deleted: ${err instanceof Error ? err.message : String(err)}`, err instanceof Error ? err : undefined);
         }
     }
     async fork(sourceMetadata, options = {}) {

package/dist/tools/fs/fs-pdf.d.ts

@@ -3,6 +3,17 @@ import type { DocumentContent, ImageContent, TextContent } from "../../internal/
 import type { ExecutionEnv } from "../../internal/harness-types.js";
 import { type PdfModelCapabilities } from "./pdf.js";
 import { type ReadImageDownsamplerOption } from "./fs-shared.js";
+import { type ReminderDisclosureCounts } from "../../core/reminder-disclosure.js";
+/** design/319 (B ticket) — the Read tool's disclosure state, threaded into the PDF TEXT legs (the
+ *  two `pdftotext` extraction arms — the only PDF returns with a model-facing text projection of
+ *  the document; the native document block and rendered page images have no text to scan). Shares
+ *  the Read closure's throttle windows so a PDF and its text read dedup on the same file key. */
+export interface PdfReminderDisclosure {
+    mark: string | undefined;
+    windows: Map<string, number>;
+    key: string;
+    counts?: ReminderDisclosureCounts;
+}
 export { pdfModelCapabilitiesOf, type PdfModelCapabilities } from "./pdf.js";
 /** What the Read tool's PDF pipeline returns (document block, or rendered page images, or an error string). */
 type ReadPdfReturn = string | {
@@ -33,7 +44,7 @@ type ReadPdfReturn = string | {
  * Every degraded return carries `details.fallback = { level, reason }` (telemetry on the structured frame).
  * `caps` absent ⇒ fully capable (byte-compat: native document block; the brain placeholder still guards).
  */
-export declare function readPdfFile(env: ExecutionEnv, path: string, key: string, pages: string | undefined, signal: AbortSignal | undefined, downsamplerOpt: ReadImageDownsamplerOption, cwd: string, preRead?: Uint8Array, caps?: PdfModelCapabilities, readDeny?: import("./read-deny.js").ReadDenyMatcher): Promise<ReadPdfReturn>;
+export declare function readPdfFile(env: ExecutionEnv, path: string, key: string, pages: string | undefined, signal: AbortSignal | undefined, downsamplerOpt: ReadImageDownsamplerOption, cwd: string, preRead?: Uint8Array, caps?: PdfModelCapabilities, readDeny?: import("./read-deny.js").ReadDenyMatcher, disclosure?: PdfReminderDisclosure): Promise<ReadPdfReturn>;
 /** E1: readPdfFile's own return type stays `ReadPdfReturn` (its INTERNAL string-means-error dispatch
  *  contract, shared with pdfPagesToImageBlocks) — the isError flag is applied once, here, at the tool's
  *  actual execute() boundary, not inside the helper. */

package/dist/tools/fs/fs-pdf.js

@@ -3,6 +3,20 @@ import { delimitUntrusted } from "../../core/untrusted-text.js";
 import { MCP_IMAGE_MAX_BASE64 } from "../../core/mcp.js";
 import { PDF_FALLBACK_RENDER_PAGES, PDF_INLINE_PAGE_THRESHOLD, PDF_MAX_EXTRACT_SIZE, PDF_MAX_PAGES_PER_READ, PDF_TARGET_RAW_SIZE, extractPdfPagesAsImages, extractPdfTextLayer, getPdfPageCount, parsePdfPageRange, pdfMagicMatches, } from "./pdf.js";
 import { resolveAutoDownsampler, enoentMessage, MAX_READ_BYTES } from "./fs-shared.js";
+import { discloseReminderShaped } from "../../core/reminder-disclosure.js";
+function pdfDisclosureTrailer(body, d) {
+    if (d === undefined)
+        return "";
+    const out = discloseReminderShaped({
+        segments: [body],
+        mark: d.mark,
+        outlet: "pdf",
+        defuseExactMark: false,
+        throttle: { key: d.key, windows: d.windows },
+        counts: d.counts,
+    });
+    return out.trailer !== undefined ? `\n${out.trailer}` : "";
+}
 export { pdfModelCapabilitiesOf } from "./pdf.js";
 async function pdfPagesToImageBlocks(pages, path, downsamplerOpt) {
     const downsampler = downsamplerOpt === false ? undefined : (downsamplerOpt ?? (await resolveAutoDownsampler()));
@@ -30,7 +44,7 @@ function boundPdfExtractedText(text) {
         return { body: text, truncated: false };
     return { body: text.slice(0, MAX_READ_BYTES), truncated: true };
 }
-export async function readPdfFile(env, path, key, pages, signal, downsamplerOpt, cwd, preRead, caps, readDeny) {
+export async function readPdfFile(env, path, key, pages, signal, downsamplerOpt, cwd, preRead, caps, readDeny, disclosure) {
     const cap = caps ?? { document: true, vision: true };
     const meta = await env.fileInfo(key, signal);
     if (!meta.ok) {
@@ -83,7 +97,7 @@ export async function readPdfFile(env, path, key, pages, signal, downsamplerOpt,
                         {
                             type: "text",
                             text: `[PDF: ${path} — pages ${range.first}-${last}${pageCount !== undefined ? ` of ${pageCount}` : ""} extracted as text via pdftotext (the serving model does not support native PDF input)${timeoutNote}]` +
-                                `\n${delimitUntrusted("PDF text layer", body)}${truncated ? `\n[extracted text truncated at ${MAX_READ_BYTES} bytes; narrow the pages range]` : ""}`,
+                                `\n${delimitUntrusted("PDF text layer", body)}${truncated ? `\n[extracted text truncated at ${MAX_READ_BYTES} bytes; narrow the pages range]` : ""}${pdfDisclosureTrailer(body, disclosure)}`,
                         },
                     ],
                     details: {
@@ -166,7 +180,7 @@ export async function readPdfFile(env, path, key, pages, signal, downsamplerOpt,
                     {
                         type: "text",
                         text: `[PDF: ${path} — extracted text layer via pdftotext${pageCount !== undefined ? `; ${pageCount} page${pageCount === 1 ? "" : "s"}` : ""} (the serving model does not support native PDF input)${timeoutNote}]` +
-                            `\n${delimitUntrusted("PDF text layer", body)}${truncated ? `\n[extracted text truncated at ${MAX_READ_BYTES} bytes; use the pages parameter to read specific ranges]` : ""}`,
+                            `\n${delimitUntrusted("PDF text layer", body)}${truncated ? `\n[extracted text truncated at ${MAX_READ_BYTES} bytes; use the pages parameter to read specific ranges]` : ""}${pdfDisclosureTrailer(body, disclosure)}`,
                     },
                 ],
                 details: {

package/dist/tools/fs/fs-read.d.ts

@@ -2,7 +2,8 @@ import type { AgentTool, ExecutionEnv } from "../../internal/harness-types.js";
 import { type ReadFileState } from "./safety.js";
 import { type PdfModelCapabilities } from "./pdf.js";
 import { type ReadImageDownsamplerOption, type CwdRef } from "./fs-shared.js";
+import { type ReminderDisclosureCounts } from "../../core/reminder-disclosure.js";
 export declare function createReadFileTool(env: ExecutionEnv, state: ReadFileState, rootCanonical: string, cwdRef?: CwdRef, additionalRoots?: readonly string[], imageDownsampler?: ReadImageDownsamplerOption, pdfCapabilities?: PdfModelCapabilities, bgOutputReadExemption?: (canonicalKey: string, ctx: {
     taskId?: string;
     principal?: string;
-}) => boolean, readCyberReminder?: boolean, readDeny?: import("./read-deny.js").ReadDenyMatcher, readFace?: import("./read-face.js").ReadFace, reminderMark?: string): AgentTool;
+}) => boolean, readCyberReminder?: boolean, readDeny?: import("./read-deny.js").ReadDenyMatcher, readFace?: import("./read-face.js").ReadFace, reminderMark?: string, reminderDisclosureCounts?: ReminderDisclosureCounts): AgentTool;

package/dist/tools/fs/fs-read.js

@@ -8,8 +8,16 @@ import { PDF_MAX_PAGES_PER_READ, pdfMagicMatches } from "./pdf.js";
 import { MAX_READ_BYTES, SLICED_READ_MAX_BYTES, MAX_IMAGE_READ_BYTES, MAX_IMAGE_DOWNSAMPLE_INPUT_BYTES, NO_DOWNSAMPLER_IMAGE_CAP_HINT, resolveAutoDownsampler, MAX_READ_OUTPUT_CHARS, readCyberReminderText, FILE_PATH_PARAMS, countLines, seededFileUnchangedReminder, enoentMessage, } from "./fs-shared.js";
 import { readPdfFile, pdfResultToToolReturn } from "./fs-pdf.js";
 import { openSystemReminder } from "../../core/reminder-mint.js";
-export function createReadFileTool(env, state, rootCanonical, cwdRef, additionalRoots, imageDownsampler, pdfCapabilities, bgOutputReadExemption, readCyberReminder, readDeny, readFace, reminderMark) {
+import { discloseReminderShaped } from "../../core/reminder-disclosure.js";
+export function createReadFileTool(env, state, rootCanonical, cwdRef, additionalRoots, imageDownsampler, pdfCapabilities, bgOutputReadExemption, readCyberReminder, readDeny, readFace, reminderMark, reminderDisclosureCounts) {
     const cyberReminder = readCyberReminder === false ? "" : readCyberReminderText(reminderMark);
+    const reminderDisclosureWindows = new Map();
+    const pdfReminderDisclosure = (key) => ({
+        mark: reminderMark,
+        windows: reminderDisclosureWindows,
+        key,
+        counts: reminderDisclosureCounts,
+    });
     const pathBoundLine = readFace === "open"
         ? "- `file_path` may be relative (resolved against the tracked working directory) or absolute. Reads are not confined to the workspace roots; a small sensitive-path deny list applies.\n"
         : "- `file_path` may be relative (resolved against the tracked working directory) or absolute (within the configured roots).\n";
@@ -125,7 +133,7 @@ export function createReadFileTool(env, state, rootCanonical, cwdRef, additional
                 };
             }
             if (r.key.toLowerCase().endsWith(".pdf")) {
-                return pdfResultToToolReturn(await readPdfFile(env, path, r.key, pages, ctx.signal, imageDownsampler, cwdRef?.current ?? rootCanonical, undefined, pdfCapabilities, readDeny));
+                return pdfResultToToolReturn(await readPdfFile(env, path, r.key, pages, ctx.signal, imageDownsampler, cwdRef?.current ?? rootCanonical, undefined, pdfCapabilities, readDeny, pdfReminderDisclosure(r.key)));
             }
             const binaryExt = hasBinaryExtension(r.key);
             const binaryExtRefusal = () => errorResult(`Error (Read): "${path}" appears to be a binary file (by extension); this tool reads UTF-8 text only.`);
@@ -170,7 +178,7 @@ export function createReadFileTool(env, state, rootCanonical, cwdRef, additional
                 return errorResult(`Error (Read): "${path}" is too large to read in full (${readSize} bytes > ${MAX_READ_BYTES}-byte cap); pass an explicit offset/limit to read a slice, or use grep to search it instead.`);
             }
             if (pdfMagicMatches(readBin.value)) {
-                return pdfResultToToolReturn(await readPdfFile(env, path, r.key, pages, ctx.signal, imageDownsampler, cwdRef?.current ?? rootCanonical, readBin.value, pdfCapabilities, readDeny));
+                return pdfResultToToolReturn(await readPdfFile(env, path, r.key, pages, ctx.signal, imageDownsampler, cwdRef?.current ?? rootCanonical, readBin.value, pdfCapabilities, readDeny, pdfReminderDisclosure(r.key)));
             }
             const magicFormat = binaryMagicFormat(readBin.value);
             if (magicFormat !== undefined) {
@@ -225,8 +233,20 @@ export function createReadFileTool(env, state, rootCanonical, cwdRef, additional
                     }
                     state.set(r.key, { hash, totalLines: countLines(content), truncated: false, view: { start: 1, end: total }, lastReadAt: Date.now() });
                     const bodyBlocks = rendered.blocks.length > 0 ? rendered.blocks : [{ type: "text", text: "[notebook has 0 cells]" }];
+                    const nbDisclosure = discloseReminderShaped({
+                        segments: rendered.blocks.filter((b) => b.type === "text").map((b) => b.text),
+                        mark: reminderMark,
+                        outlet: "notebook",
+                        defuseExactMark: false,
+                        throttle: { key: r.key, windows: reminderDisclosureWindows },
+                        counts: reminderDisclosureCounts,
+                    });
                     return {
-                        content: cyberReminder ? [...bodyBlocks, { type: "text", text: cyberReminder }] : bodyBlocks,
+                        content: [
+                            ...bodyBlocks,
+                            ...(cyberReminder ? [{ type: "text", text: cyberReminder }] : []),
+                            ...(nbDisclosure.trailer !== undefined ? [{ type: "text", text: nbDisclosure.trailer }] : []),
+                        ],
                         details: { type: "notebook", file: { filePath: path, cells: parsed.cells.map(stripNotebookImageData) } },
                     };
                 }
@@ -291,8 +311,16 @@ export function createReadFileTool(env, state, rootCanonical, cwdRef, additional
             if (total === 0)
                 return `${openSystemReminder(reminderMark)}Warning: the file exists but the contents are empty.</system-reminder>`;
             const header = pageMarker ?? (truncated ? `[${path}: lines ${start}-${end} of ${total}${end < total ? " — use offset to see more" : ""}]\n` : "");
+            const disclosure = discloseReminderShaped({
+                segments: [body],
+                mark: reminderMark,
+                outlet: "read",
+                defuseExactMark: false,
+                throttle: { key: r.key, windows: reminderDisclosureWindows },
+                counts: reminderDisclosureCounts,
+            });
             return {
-                content: `${nbFallbackPrefix}${header}${body}${cyberReminder}`,
+                content: `${nbFallbackPrefix}${header}${body}${cyberReminder}${disclosure.trailer !== undefined ? `\n${disclosure.trailer}` : ""}`,
                 details: {
                     type: "text",
                     file: {

package/dist/tools/fs/fs-shared.d.ts

@@ -140,8 +140,12 @@ export declare const MAX_READ_OUTPUT_CHARS = 100000;
  *  COVERAGE, stated because the switch is easy to over-read: the reminder rides the plain-text read and
  *  the notebook projection. PDF text extraction returns through its own result builder and has never
  *  carried it, so extracted PDF text reaches the model without this mitigation whatever the switch says.
- *  That gap predates the switch and is left as an open item rather than closed silently — widening the
- *  reminder to a third surface is a change to what every PDF read costs, not a wiring fix.
+ *  That gap predates the switch; its IMPERSONATION half is now closed — design/319 (B ticket) gave the
+ *  PDF text legs the same detect-and-disclose trailer as this lane (reminder-shaped bytes in extracted
+ *  PDF text are disclosed at the outlet, fs-pdf.ts), and their bodies were already fenced. The CYBER
+ *  half (this malware-alertness sentence) still does not ride PDF text and stays an open item rather
+ *  than closed silently — widening it to a third surface is a change to what every PDF read costs,
+ *  not a wiring fix.
  *
  *  design/319 (A ticket): a FUNCTION over the session mark (formerly the `READ_CYBER_REMINDER`
  *  constant) — the open tag is rendered by the mint home so it carries the run's provenance mark;

package/dist/tools/fs/index.d.ts

@@ -161,6 +161,13 @@ export interface HandsToolkitOptions {
      *  the honest form). The tag is rendered by the mint home (core/reminder-mint.ts) — the content
      *  BODY next to it is byte-untouched. */
     reminderMark?: string;
+    /** design/319 (B ticket) — the per-run trailer/defuse trigger counters (observation seat, G9②):
+     *  the Read text/notebook/PDF-text disclosure trailers bump `read.*` / `notebook.*` / `pdf.*`
+     *  keys here (appended / marked / bare_throttled). Threaded by prepare-task, which folds the
+     *  non-zero result into `TaskResult.stats.mechanisms.reminderDisclosures`; a library-direct
+     *  mount may pass its own object or omit it (counting off — and the whole disclosure pipeline
+     *  is off anyway when `reminderMark` is absent). */
+    reminderDisclosureCounts?: import("../../core/reminder-disclosure.js").ReminderDisclosureCounts;
 }
 /**
  * Build the per-task hand tool band over an injected env + fresh per-task read state (design/44 §11 A).

package/dist/tools/fs/index.js

@@ -46,7 +46,7 @@ export function createHandsToolkit(env, readFileState, rootCanonical, opts = {})
         onDeploymentClamp: () => deliverEngineNotice(opts.onNotice, deploymentReadFaceClampNotice()),
     });
     const tools = [
-        createReadFileTool(env, readFileState, rootCanonical, readOnly ? undefined : cwdRef, readFaceRoots, opts.readImageDownsampler, opts.pdfModelCapabilities, bgOutputReadExemption, opts.readCyberReminder, readDeny, readFace, opts.reminderMark),
+        createReadFileTool(env, readFileState, rootCanonical, readOnly ? undefined : cwdRef, readFaceRoots, opts.readImageDownsampler, opts.pdfModelCapabilities, bgOutputReadExemption, opts.readCyberReminder, readDeny, readFace, opts.reminderMark, opts.reminderDisclosureCounts),
     ];
     if (!readOnly) {
         tools.push(createEditFileTool(env, readFileState, rootCanonical, cwdRef, additionalRoots, opts.beforeWrite), createWriteFileTool(env, readFileState, rootCanonical, cwdRef, additionalRoots, opts.beforeWrite), createNotebookEditTool(env, readFileState, rootCanonical, cwdRef, additionalRoots, opts.beforeWrite));

package/dist/tools/task-list.d.ts

@@ -43,7 +43,11 @@ export interface TaskListItem {
  *   process ({@link createTaskListTools} keeps a per-store promise chain) — a store shared across
  *   PROCESSES additionally needs its own transactional guarantees for those sequences, which is the
  *   deployment's half (documented, not solved here; CC's file-backed team list has the same window).
- * - `allocateId` is store-owned so concurrent teammates never mint colliding ids.
+ * - `allocateId` is store-owned so concurrent teammates never mint colliding ids, and the
+ *   high-water mark is MONOTONIC ACROSS REOPENS for any backend that outlives one wrapper
+ *   instance: a restart/reconnect must never re-mint an id the backend has already handed out
+ *   (the conformance suite's durable tier pins exactly this — a counter that resets while the
+ *   rows survive makes every receipt lie and every subsequent update miss).
  * - Value semantics: `get`/`list` return detached copies; `set` stores a detached copy. Callers
  *   mutate their copy and write it back — a live-reference store would alias already-emitted events.
  * - RB-274: `list` is ordered by ID (numeric ascending), not by write order. The tool lane always

package/dist/tools/web.js

@@ -1,6 +1,7 @@
 import { Type } from "typebox";
 import { defineTool, errorResult } from "../core/tools.js";
 import { delimitUntrusted, inlineUntrusted } from "../core/untrusted-text.js";
+import { discloseReminderShaped } from "../core/reminder-disclosure.js";
 import { redactSecrets } from "../core/untrusted-egress.js";
 import { isPrivateHost } from "../core/runner/image.js";
 import { binaryMagicFormat } from "./fs/safety.js";
@@ -638,7 +639,17 @@ export function webFetchToolSpec(config = {}) {
             const partialNote = bodyCut
                 ? `\n\n[WebFetch: ${cutPhrase} — the content above is PARTIAL: ${bodyBytes?.length ?? 0} bytes were received before the cutoff and the tail is missing. Treat absent information as unfetched, not absent from the source.]`
                 : "";
-            const modelText = withNote + truncationNote + partialNote + sourceEcho;
+            let modelText = withNote + truncationNote + partialNote + sourceEcho;
+            {
+                const d = discloseReminderShaped({
+                    segments: [modelText],
+                    mark: ctx.reminderMark,
+                    outlet: "webFetch",
+                    defuseExactMark: true,
+                    ...(ctx.reminderDisclosureCounts !== undefined ? { counts: ctx.reminderDisclosureCounts } : {}),
+                });
+                modelText = d.trailer !== undefined ? `${d.segments[0]}\n\n${d.trailer}` : d.segments[0];
+            }
             const RESULT_PREVIEW_CHARS = 8_000;
             return {
                 content: modelText,
@@ -947,7 +958,15 @@ export function createWebSearchTool(config) {
             const tailReminder = shown.length > 0
                 ? "REMINDER: You MUST include the sources above in your response to the user using markdown hyperlinks."
                 : "REMINDER: this search returned ZERO usable sources — there is nothing above to cite. Do not fabricate sources, URLs or citations; tell the user the search returned no usable results (the notes above say why, when there is a why) and answer from what you already know, or try a different query.";
-            const modelText = `${fenced}${dropNote}${domainNote}${maxResultsNote}${schemeNote}${clipNote}\n\n${tailReminder}`;
+            const searchDisclosure = discloseReminderShaped({
+                segments: [fenced],
+                mark: ctx.reminderMark,
+                outlet: "webSearch",
+                defuseExactMark: true,
+                ...(ctx.reminderDisclosureCounts !== undefined ? { counts: ctx.reminderDisclosureCounts } : {}),
+            });
+            const searchDisclosureNote = searchDisclosure.trailer !== undefined ? `\n\n${searchDisclosure.trailer}` : "";
+            const modelText = `${searchDisclosure.segments[0]}${dropNote}${domainNote}${maxResultsNote}${schemeNote}${clipNote}${searchDisclosureNote}\n\n${tailReminder}`;
             return {
                 content: modelText,
                 details: {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sema-agent/core",
-  "version": "5.46.0",
+  "version": "5.48.0",
   "description": "Stateless, task-oriented AI agent core",
   "type": "module",
   "license": "BUSL-1.1",
@@ -66,7 +66,8 @@
     "gate:nuia": "node scripts/verify-nuia-baseline.mjs",
     "gate:field-liveness": "node scripts/verify-field-liveness.mjs",
     "gate:error-surface": "node scripts/verify-error-surface.mjs",
-    "gate:criteria": "node scripts/criteria-lint.mjs"
+    "gate:criteria": "node scripts/criteria-lint.mjs",
+    "gate:reminder-literal": "node scripts/verify-reminder-literal.mjs"
   },
   "dependencies": {
     "@modelcontextprotocol/sdk": "1.30.0",