@sema-agent/core 5.47.0 → 5.49.0

package/dist/core/runner/prepare-acquire-reconcile.js

@@ -35,7 +35,7 @@ export async function prepareAcquireReconcile(input) {
     let resumeAtBeforeParentId = null;
     for (let attempt = 0;; attempt++) {
         try {
-            acquired = await sessions.acquire(spec.sessionId, spec.requireExistingSession ? { requireExisting: true } : undefined);
+            acquired = await sessions.acquire(spec.sessionId, spec.requireExistingSession ? { requireExisting: true } : input.placement !== undefined ? { placement: input.placement } : undefined);
         }
         catch (err) {
             if (spec.requireExistingSession && err?.code === "not_found") {

package/dist/core/runner/prepare-hands-readface.d.ts

@@ -103,6 +103,10 @@ export interface PrepareHandsReadFaceInput {
      *  (the Read cyber/dedup/offset/empty reminders, the gh rate-limit hint) stamp the same mark the
      *  system-prompt declaration names. */
     reminderMark: string;
+    /** borrowed-mutable — design/319 (B ticket): the leg's disclosure trigger counters; the hands
+     *  band's Read/notebook/PDF trailer outlets bump keys on it at tool-execute time (the driver owns
+     *  the object and folds it into result stats). */
+    reminderDisclosureCounts: import("../reminder-disclosure.js").ReminderDisclosureCounts;
 }
 /** The phase's outputs (相 API 规则件 four-class form) — ALL settled before the return; the driver
  *  binds them as fresh consts (R-5) except the inverted-closure trio and the two shellGated bits,

package/dist/core/runner/prepare-hands-readface.js

@@ -219,6 +219,7 @@ export async function prepareHandsMount(input) {
             ...(readDenyBuiltinCfg.exclude !== undefined ? { readDenyBuiltinExclude: readDenyBuiltinCfg.exclude } : {}),
             readFace: liveReadFace,
             reminderMark: input.reminderMark,
+            reminderDisclosureCounts: input.reminderDisclosureCounts,
             includeShell: handsIncludeShell,
             readOnly: handsReadOnly,
             ...(handsCwdRef ? { cwdRef: handsCwdRef } : {}),

package/dist/core/runner/prepare-task.d.ts

@@ -147,6 +147,10 @@ export interface Prepared {
      *  fresh mint). Every engine-authored `<system-reminder>` open tag in the run carries it, and the
      *  system prompt's Harness declaration names it. Always present on a completed prepare. */
     reminderMark: string;
+    /** design/319 (B ticket) — the leg's reminder-disclosure trigger counters (mutated by the
+     *  disclosure outlets at tool-execute time; read once at result assembly into
+     *  `stats.mechanisms.reminderDisclosures` when any key is non-zero). Always present. */
+    reminderDisclosureCounts: import("../reminder-disclosure.js").ReminderDisclosureCounts;
     /** The ISOLATION-AWARE working-tree root for this task (a worktree's cwd when `isolation: "worktree"`, else
      *  `deps.rootPath ?? executionEnv.cwd`) — the same value the hands/LSP/policy/restore use. The Runner's
      *  rewind/snapshot path MUST key off THIS, not `deps.rootPath`, or a worktree-isolated turn snapshots the base
@@ -1224,6 +1228,17 @@ export interface RunInternals {
      * mirroring `insideFork`.
      */
     isDelegatedChild?: boolean;
+    /**
+     * Subagent transcript persistence — the child transcript session's PLACEMENT declaration, minted
+     * by the background delegation lane (the trusted spawner: it knows the a* handle, scope and root)
+     * and forwarded verbatim by this prepare's session acquire, so the session store CREATES the
+     * child's transcript into its declared subagent partition (see {@link SessionStore.placements}).
+     * Deliberately a TRUSTED internals seat and never a {@link TaskSpec} key: a public key would let
+     * any caller push arbitrary sessions into the partition and poison store-side retention/
+     * enumeration. Absent (sync children, forks, observers, every non-delegated run) ⇒ the acquire
+     * carries no placement — byte-identical to before.
+     */
+    sessionPlacement?: import("../session.js").SessionPlacement;
     /**
      * G1+G2 合车复审修② (1.259.0) — the DEFAULT role-base persona for a DELEGATED child, threaded by
      * `createSubagentTool`'s execute (a core caller) when neither an agent-definition `systemPrompt` nor the

package/dist/core/runner/prepare-task.js

@@ -16,7 +16,7 @@ import { Value } from "typebox/value";
 import { uuidv7 } from "../../engine/session/uuid.js";
 import { brainToRuntime } from "../runtime.js";
 import { hasSessionFork } from "../session.js";
-import { createSubagentWorktreeHelper, forkGovernanceDenial } from "../../agents/subagent.js";
+import { createSubagentWorktreeHelper, forkGovernanceDenial, resolveDelegationEntryCaps } from "../../agents/subagent.js";
 import { createAgentTranscriptTool, AGENT_TRANSCRIPT_TOOL_NAME } from "../../agents/agent-transcript-tool.js";
 import { createSendMessageTool, SEND_MESSAGE_TOOL_NAME } from "../../agents/send-message-tool.js";
 import { SubagentRetainLedger } from "../../agents/retain-ledger.js";
@@ -88,10 +88,10 @@ import { isSelfOrchestrationActive, selfOrchestrationFailClosedReason } from "..
 import { createRunWorkflowTool, RUN_WORKFLOW_TOOL_NAME } from "../../orchestration/run-workflow-tool.js";
 import { resolveWorkflowSizeGuideline } from "../../orchestration/workflow-size-guideline.js";
 import { createLspTool, gitCheckIgnoreFilter, resolveLspPath } from "../lsp.js";
-import { resolveKey } from "../../tools/fs/safety.js";
+import { fileArgPath, resolveKey } from "../../tools/fs/safety.js";
 import { BINDING_CHECKPOINT_VERSION, mintCheckpointId, mintCheckpointToken, ORG_ADMISSION_CHECKPOINT_VERSION, F012_CHECKPOINT_VERSION, FACE_CHECKPOINT_VERSION, REAL_APPROVAL_CHECKPOINT_VERSION, RESOURCE_CHECKPOINT_VERSION, TOKEN_CHECKPOINT_VERSION, buildRiskDescriptor, debitLedger, encodeAtFidelity, remainingBudgetMicroUsd, resolveCheckpointStore, resolveDeclaredFidelity, samePlainValue, } from "../checkpoint-store.js";
 import { boundInputHashOf } from "../canonical-json.js";
-import { countElicitOptIns, deriveWiringManifest, resolveAskSeamForm, resolveDeclaredDurability, resolveElicitSeam, resolveQuestionSeam } from "../wiring-manifest.js";
+import { countElicitOptIns, deriveWiringManifest, resolveAskSeamForm, resolveDeclaredDurability, resolveElicitSeam, resolveQuestionSeam, resolveSubagentTranscriptTier } from "../wiring-manifest.js";
 import { durableParkGapFor } from "../park-selfcheck.js";
 import { GLOBAL_USAGE_KEY, usageRetryAfterMs } from "../usage-window-store.js";
 import { deliverEngineNotice } from "../types.js";
@@ -332,6 +332,33 @@ function cwdConflictsRestoreError(requestedCwd) {
     e.code = "config.cwd_conflicts_restore";
     return e;
 }
+async function adoptReminderMark(session, sessionId, seedMark, spawnMark, onError) {
+    const sessionReminderMark = await (async () => {
+        try {
+            return await session.getReminderMark();
+        }
+        catch (err) {
+            onError?.(err instanceof Error ? err : new Error(String(err)), { phase: "config", sessionId });
+            return undefined;
+        }
+    })();
+    const reminderMark = isValidReminderMark(seedMark)
+        ? seedMark
+        : isValidReminderMark(spawnMark)
+            ? spawnMark
+            : isValidReminderMark(sessionReminderMark)
+                ? sessionReminderMark
+                : mintReminderMark();
+    if (reminderMark !== sessionReminderMark) {
+        try {
+            await session.appendReminderMark(reminderMark);
+        }
+        catch (err) {
+            onError?.(err instanceof Error ? err : new Error(String(err)), { phase: "config", sessionId });
+        }
+    }
+    return { reminderMark, reminderDisclosureCounts: {} };
+}
 export async function prepareTask(spec, deps, sessions, resume, internals, runnerSelf) {
     const doors = prepareConfigDoors({ spec, deps, sessions, resume, internals });
     spec = doors.spec;
@@ -345,7 +372,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
         e.code = "resume.session_not_found";
         throw e;
     }
-    const { acquired, session, conflictRef, wakeRecovered, resumeAtBeforeParentId } = await prepareAcquireReconcile({ sessions, spec, resume, toolEffects, ...(() => { const g = durableParkGapFor(deps, spec); return g !== undefined ? { durableParkGap: g } : {}; })() });
+    const { acquired, session, conflictRef, wakeRecovered, resumeAtBeforeParentId } = await prepareAcquireReconcile({ sessions, spec, resume, toolEffects, ...(internals?.sessionPlacement !== undefined ? { placement: internals.sessionPlacement } : {}), ...(() => { const g = durableParkGapFor(deps, spec); return g !== undefined ? { durableParkGap: g } : {}; })() });
     const sessionId = acquired.sessionId;
     const hostTaskId = spec.taskId ?? sessionId;
     const delegation = effectiveDelegationFacts(internals, resume?.seed.isDelegatedChild);
@@ -353,30 +380,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
     const taskScope = internals?.registryScope ?? spec.principal ?? "default";
     internals?.peerSelfRef?.addAxis("s", sessionId);
     internals?.peerSelfRef?.addAxis("t", hostTaskId);
-    const sessionReminderMark = await (async () => {
-        try {
-            return await session.getReminderMark();
-        }
-        catch (err) {
-            deps.onError?.(err instanceof Error ? err : new Error(String(err)), { phase: "config", sessionId });
-            return undefined;
-        }
-    })();
-    const reminderMark = isValidReminderMark(resume?.seed.reminderMark)
-        ? resume.seed.reminderMark
-        : isValidReminderMark(internals?.reminderMark)
-            ? internals.reminderMark
-            : isValidReminderMark(sessionReminderMark)
-                ? sessionReminderMark
-                : mintReminderMark();
-    if (reminderMark !== sessionReminderMark) {
-        try {
-            await session.appendReminderMark(reminderMark);
-        }
-        catch (err) {
-            deps.onError?.(err instanceof Error ? err : new Error(String(err)), { phase: "config", sessionId });
-        }
-    }
+    const { reminderMark, reminderDisclosureCounts } = await adoptReminderMark(session, sessionId, resume?.seed.reminderMark, internals?.reminderMark, deps.onError);
     const offloadScope = spec.principal ?? "default";
     if (internals?.registryScope !== undefined && internals.registryScope !== offloadScope) {
         deps.onError?.(new Error(`offload/tool-result namespace note: this run mounts in registry domain "${internals.registryScope}" but its offloaded tool results live under the TRUST identity "${offloadScope}" (principal${spec.principal === undefined ? " absent → default" : ""}). Before 2.13.0 the registry domain named this namespace too; if a deployment used registryScope as its ref-tenancy boundary, that boundary is now the principal — pass one, or read refs under "${offloadScope}".`), { phase: "config", sessionId });
@@ -800,8 +804,10 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
             spec.handsReadOnly !== true &&
             !(toolFaceSnapshot.exclude?.includes("Bash") ?? false);
         let autoModeDecider;
+        const delegationEntryCapsResolved = resolveDelegationEntryCaps(deps.delegationEntryCaps);
         const enrichSpecToolCtx = (ctx) => ({
             ...ctx,
+            delegationEntryCaps: delegationEntryCapsResolved,
             reportUsage,
             model: harnessRef.current?.getModel(),
             thinkingLevel: harnessRef.current?.getThinkingLevel(),
@@ -826,6 +832,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
             getApiKeyAndHeaders: spec.getApiKeyAndHeaders,
             parentCwd: taskRootFinal,
             reminderMark,
+            reminderDisclosureCounts,
             ...(centerAdoption !== undefined ? { centerArtifactDigest: centerAdoption.artifact.artifactDigest } : {}),
             ...(centerAdoption?.sourceRevision !== undefined ? { centerSourceRevision: centerAdoption.sourceRevision } : {}),
             activeSkillScope: () => skillScope.active(),
@@ -1094,7 +1101,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
             tools.push(createOutputTool(outputRef, spec.outputSchema, compiled.strict ? compiled.modelSchema : undefined));
         }
         mcp = lockedPreflight.mcp?.length
-            ? await materializeMcpTools(lockedPreflight.mcp, spec.principal, deps.onElicit, deps.mcpImageResizer)
+            ? await materializeMcpTools(lockedPreflight.mcp, spec.principal, deps.onElicit, deps.mcpImageResizer, { reminderMark, counts: reminderDisclosureCounts })
             : { tools: [], toolAxes: [], warnings: [], serverInstructions: [], instructionsDelta: { pendingAdds: [], pendingRemovals: [] }, droppedTools: [], statuses: [], refresh: async () => [], dispose: async () => { } };
         for (const w of mcp.warnings)
             deps.onError?.(w, { phase: "mcp", sessionId });
@@ -1229,7 +1236,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
         foldProtocolAxes(a2a.toolAxes, "A2A");
         const callIssuedAtRef = {};
         const memoryWriteGateRef = {};
-        const handsReadFaceInput = { handsEnabled, executionEnv, taskRootFinal, rebaseRestoredPath, resume, session, sessionId, hostTaskId, taskScope, fullShellReachable, effectiveShellGate, toolFaceSnapshot, model, spec, deps, internals, memoryWriteGateRef, firstPartyOffload, tools, egressTools, irreversibilityTier, irreversibleTools, reversibilityProbes, reminderMark };
+        const handsReadFaceInput = { handsEnabled, executionEnv, taskRootFinal, rebaseRestoredPath, resume, session, sessionId, hostTaskId, taskScope, fullShellReachable, effectiveShellGate, toolFaceSnapshot, model, spec, deps, internals, memoryWriteGateRef, firstPartyOffload, tools, egressTools, irreversibilityTier, irreversibleTools, reversibilityProbes, reminderMark, reminderDisclosureCounts };
         const handsReadFace = handsEnabled ? await prepareHandsMount(handsReadFaceInput) : resolveHandsLessReadFace(handsReadFaceInput);
         const { readFileStateForCheckpoint, seedContextFiles, handsCwdRef, workspaceStateSettle, wsSnapshot, rebaseWsPath, backgroundTaskToolsActive, additionalRootsCanonical, additionalReadRootsCanonical, attachmentRootCanonical, readDenyMatcher } = handsReadFace;
         resolvedReadFace = handsReadFace.resolvedReadFace;
@@ -1289,6 +1296,11 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                     ...(deps.mailboxStore !== undefined ? { mailbox: deps.mailboxStore } : {}),
                     ...(reviveSpawn !== undefined ? { reviveSpawn } : {}),
                     onNotifyError: (f) => emitTrace(deps.tracer, () => ({ kind: "observer.notify_failed", version: 1, taskId: hostTaskId, site: f.site, message: f.error.message, ts: Date.now() })),
+                    onTranscriptIntegrityGap: (handle, scope) => deliverEngineNotice(deps.onNotice, {
+                        code: "delegation.transcript_integrity",
+                        message: `delegation transcript integrity: agent ${handle}'s durable row binds a transcript session the session store attests is gone — the declared transcript durability is being contradicted (check the session store wiring/retention)`,
+                        detail: { handle, ...(scope !== undefined ? { scope } : {}) },
+                    }),
                 })));
                 if (!(spec.tools ?? []).some((t) => t.name === AGENT_TRANSCRIPT_TOOL_NAME)) {
                     tools.push(firstPartyOffload(createAgentTranscriptTool({
@@ -1299,6 +1311,11 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                         scope: taskScope,
                         ...(sessionId !== undefined ? { sessionId } : {}),
                         enrichCtx: enrichSpecToolCtx,
+                        onTranscriptIntegrityGap: (handle, scope) => deliverEngineNotice(deps.onNotice, {
+                            code: "delegation.transcript_integrity",
+                            message: `delegation transcript integrity: agent ${handle}'s durable row binds a transcript session the session store attests is gone — the declared transcript durability is being contradicted (check the session store wiring/retention)`,
+                            detail: { handle, ...(scope !== undefined ? { scope } : {}) },
+                        }),
                     })));
                 }
             }
@@ -1974,8 +1991,8 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                                 const delivered = result?.isError !== true &&
                                     result?.details?.type !== "file_unchanged" &&
                                     !headText.startsWith("<system-reminder");
-                                const fp = params?.file_path;
-                                if (delivered && typeof fp === "string" && recallTaintJudge(fp)) {
+                                const fp = fileArgPath(params);
+                                if (delivered && fp !== undefined && recallTaintJudge(fp)) {
                                     mark(`the "${t.name}" tool delivered the content of an external-origin memory entry file`, "derived");
                                 }
                                 return result;
@@ -3334,6 +3351,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
             ...(checkpointStore !== undefined ? { checkpointDurability: resolveDeclaredDurability(checkpointStore, "checkpointStore") } : {}),
             sessionDurability: resolveDeclaredDurability(sessions, "sessionStore"),
             backgroundAgentStoreWired: deps.backgroundAgentStore !== undefined,
+            subagentTranscriptTier: resolveSubagentTranscriptTier(deps.backgroundAgentStore !== undefined, sessions),
             permissionRuleStoreWired: deps.permissionRuleStore !== undefined,
             permissionRuleSyncWired: deps.permissionRuleSyncWired === true,
             permissionRuleOrgGoverned: deps.permissionRuleOrg !== undefined,
@@ -4606,7 +4624,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
         const effectiveReadFaceObserved = carrierReadFace();
         const effectiveReadDenyObserved = readDenyAdditionsNormalized.length > 0 ? readDenyAdditionsNormalized.map((e) => ({ ...e })) : undefined;
         const preparedHolder = {};
-        const buildPrepared = () => ({ harness, session, sessionId, reminderMark, taskRootPath: taskRootFinal, model, thinking, compModel, mcp: mcp, ...(a2a !== undefined && a2a.tools.length > 0 ? { a2a } : {}), blockedRef, outputRef, abortController, conflictRef, blockedToolCalls, approvalSettlement, nestedStats, ...(rewindNotes.length > 0 ? { rewindNotes } : {}), ...(effectiveReadFaceObserved !== undefined ? { effectiveReadFace: effectiveReadFaceObserved } : {}), ...(effectiveReadDenyObserved !== undefined ? { effectiveReadDenyPatterns: effectiveReadDenyObserved } : {}), effectiveMemoryScopes: memoryEffectiveScopes, cwdRef: handsCwdRef, ...(worktreeSessionRef !== undefined ? { worktreeSessionRef } : {}), ...(workspaceStateSettle !== undefined ? { workspaceStateSettle } : {}), denyNarrowingPolicy, ...(basePolicyForResumeEdit !== undefined ? { basePolicyForResumeEdit } : {}), ...(permissionRuleOrgLane !== undefined ? { permissionRuleOrg: permissionRuleOrgLane } : {}), releaseSignal, settleContentAskBindings, cacheBreakDetector, cacheFingerprint, wiringManifest, promptManifest, epochDeclaredSections, activeTools, ...(deferred.size > 0 ? { deferredToolNames: deferred } : {}), toolMaterializeStatic, deferDirectCall, ...(staticFaceForRef.current !== undefined ? { staticFaceFor: staticFaceForRef.current } : {}), ownedEnv, suspendRef, suspendProgressRef, reviewRef, remoteEnvFailures, reviewRequestRef, suspendLoopRef, suspendForResource, ...(suspendForPlatformLimit !== undefined ? { suspendForPlatformLimit } : {}), ...(envLifetimeSuspendAt !== undefined ? { envLifetimeSuspendAt } : {}), ...(usageGovernance !== undefined ? { usageGovernance } : {}), callIssuedAtRef, brainCallGuardrailRef, suspendForReview, resourceLedger: priorLedger, liveSpendRef, humanReviewRef, now, tools, toolEffects, wakeRecovered, promptOverheadTokens, lastBrainContext, readTaskFile, recentlyReadFiles, normalizeAttachmentPath, isDedupStubResult, ...(onCompactionApplied ? { onCompactionApplied } : {}), compactionReuseRef, trimPressureRef, ...(memoryEngineSession ? { memoryEngineSession } : {}), ...(subagentRetain ? { subagentRetain } : {}), ...(lspDiagnostics && nudgeLspOnEdit ? { lspDiagnostics: { registry: lspDiagnostics, nudge: nudgeLspOnEdit, runIdent: lspRunIdent } } : {}), planModeRef, ...(dateChange ? { dateChange } : {}), ...(instructionSources ? { instructionSources } : {}), ...(workflowSizeGuideline ? { workflowSizeGuideline } : {}), ...(detectExternalChanges ? { detectExternalChanges } : {}), ...(toolsDeltaRef ? { toolsDeltaRef } : {}), ...(agentListing ? { agentListing } : {}), ...(skillsListing ? { skillsListing } : {}), announcedListingsRef, gitStatusRef, listBackgroundTasks, hookIdentity, ...(turnSnapshotRef.current !== undefined ? { turnSnapshot: turnSnapshotRef.current } : {}), ...(centerCompactionCandidate !== undefined ? { centerCompactionCandidate } : {}) });
+        const buildPrepared = () => ({ harness, session, sessionId, reminderMark, reminderDisclosureCounts, taskRootPath: taskRootFinal, model, thinking, compModel, mcp: mcp, ...(a2a !== undefined && a2a.tools.length > 0 ? { a2a } : {}), blockedRef, outputRef, abortController, conflictRef, blockedToolCalls, approvalSettlement, nestedStats, ...(rewindNotes.length > 0 ? { rewindNotes } : {}), ...(effectiveReadFaceObserved !== undefined ? { effectiveReadFace: effectiveReadFaceObserved } : {}), ...(effectiveReadDenyObserved !== undefined ? { effectiveReadDenyPatterns: effectiveReadDenyObserved } : {}), effectiveMemoryScopes: memoryEffectiveScopes, cwdRef: handsCwdRef, ...(worktreeSessionRef !== undefined ? { worktreeSessionRef } : {}), ...(workspaceStateSettle !== undefined ? { workspaceStateSettle } : {}), denyNarrowingPolicy, ...(basePolicyForResumeEdit !== undefined ? { basePolicyForResumeEdit } : {}), ...(permissionRuleOrgLane !== undefined ? { permissionRuleOrg: permissionRuleOrgLane } : {}), releaseSignal, settleContentAskBindings, cacheBreakDetector, cacheFingerprint, wiringManifest, promptManifest, epochDeclaredSections, activeTools, ...(deferred.size > 0 ? { deferredToolNames: deferred } : {}), toolMaterializeStatic, deferDirectCall, ...(staticFaceForRef.current !== undefined ? { staticFaceFor: staticFaceForRef.current } : {}), ownedEnv, suspendRef, suspendProgressRef, reviewRef, remoteEnvFailures, reviewRequestRef, suspendLoopRef, suspendForResource, ...(suspendForPlatformLimit !== undefined ? { suspendForPlatformLimit } : {}), ...(envLifetimeSuspendAt !== undefined ? { envLifetimeSuspendAt } : {}), ...(usageGovernance !== undefined ? { usageGovernance } : {}), callIssuedAtRef, brainCallGuardrailRef, suspendForReview, resourceLedger: priorLedger, liveSpendRef, humanReviewRef, now, tools, toolEffects, wakeRecovered, promptOverheadTokens, lastBrainContext, readTaskFile, recentlyReadFiles, normalizeAttachmentPath, isDedupStubResult, ...(onCompactionApplied ? { onCompactionApplied } : {}), compactionReuseRef, trimPressureRef, ...(memoryEngineSession ? { memoryEngineSession } : {}), ...(subagentRetain ? { subagentRetain } : {}), ...(lspDiagnostics && nudgeLspOnEdit ? { lspDiagnostics: { registry: lspDiagnostics, nudge: nudgeLspOnEdit, runIdent: lspRunIdent } } : {}), planModeRef, ...(dateChange ? { dateChange } : {}), ...(instructionSources ? { instructionSources } : {}), ...(workflowSizeGuideline ? { workflowSizeGuideline } : {}), ...(detectExternalChanges ? { detectExternalChanges } : {}), ...(toolsDeltaRef ? { toolsDeltaRef } : {}), ...(agentListing ? { agentListing } : {}), ...(skillsListing ? { skillsListing } : {}), announcedListingsRef, gitStatusRef, listBackgroundTasks, hookIdentity, ...(turnSnapshotRef.current !== undefined ? { turnSnapshot: turnSnapshotRef.current } : {}), ...(centerCompactionCandidate !== undefined ? { centerCompactionCandidate } : {}) });
         const prepared = buildPrepared();
         preparedHolder.current = prepared;
         return prepared;

package/dist/core/runner/runtask.d.ts

@@ -6,7 +6,7 @@ import { type SideQuerySpec, type SideQueryResult } from "../side-query.js";
 import type { SessionStore } from "../session.js";
 import { type RecoveredOrphan } from "../session-reconcile.js";
 import { type ApprovalSettledBy } from "../tool-policy.js";
-import type { AgentDefinition, RunnerDeps, TaskEvent, TaskResult, TaskSpec, TaskStream } from "../types.js";
+import type { AgentDefinition, ModelRef, RunnerDeps, TaskEvent, TaskResult, TaskSpec, TaskStream } from "../types.js";
 /**
  * Config re-supplied to {@link Runner.resume} (design/45). A suspended task's tools / model / policy /
  * hooks cannot be reconstructed from a checkpoint token (the session stores neither tool implementations
@@ -189,6 +189,31 @@ export declare class Runner {
     };
     /** Acquire the lock for a sessionId; returns a release fn. New (undefined) sessions need no lock. */
     private acquireSessionLock;
+    /**
+     * Hot-swap the model catalog (and optionally the tier bindings) without restarting the process or
+     * rebuilding the Runner — the deployment seat that makes "switching models" a zero-restart
+     * operation for catalogs the constructor froze (the constructor runs {@link expandTiers} once and
+     * keeps a private expanded copy, so mutating a shared table after construction never took effect;
+     * this verb is the sanctioned generation change).
+     *
+     * Semantics:
+     * - **Atomic**: the candidate catalog is tier-expanded and validated FIRST (an illegal tier
+     *   binding throws exactly like the constructor's boot error) — on any throw the current
+     *   generation stays in force, untouched.
+     * - **In-flight tasks keep their generation** (natural snapshot): a running task resolved its
+     *   `Model` object at prepare time and holds that reference; the swap changes what FUTURE
+     *   prepares (and auto-sourced agents' string refs — {@link agentCatalog} copies per read)
+     *   resolve. Same-name redirects therefore never re-route or re-price a task mid-run; the
+     *   divergence window is exactly the in-flight tasks' lifetime, by design.
+     * - `tiers` omitted ⇒ the current tier bindings are kept (and re-applied over the new models);
+     *   explicitly passed (including `undefined`) ⇒ replaced.
+     * - Success is announced via `config.models_swapped` (models/tiers counts — key material only,
+     *   never the catalog itself).
+     */
+    swapModels(next: {
+        models: Record<string, Model>;
+        tiers?: Record<string, ModelRef>;
+    }): void;
     /** [1463]① — one-shot brain-routed utility query (see {@link runSideQuery} for the full contract):
      *  preserves system/multi-turn messages/tool DEFINITIONS, routes through the deployment's brain with
      *  the same model resolution as tasks, returns real usage/model. No session, no tool execution, no

package/dist/core/runner/runtask.js

@@ -1533,6 +1533,21 @@ export class Runner {
             });
         };
     }
+    swapModels(next) {
+        if (next.models === null || typeof next.models !== "object" || Array.isArray(next.models)) {
+            throw new Error(`swapModels: models must be a plain Record<string, Model> (got ${next.models === null ? "null" : Array.isArray(next.models) ? "array" : typeof next.models}) — the current generation stays in force`);
+        }
+        const tiers = Object.hasOwn(next, "tiers") ? next.tiers : this.deps.tiers;
+        const expanded = tiers && Object.keys(tiers).length > 0 ? expandTiers({ ...next.models }, tiers) : { ...next.models };
+        this.deps = { ...this.deps, models: expanded, ...(tiers !== undefined ? { tiers } : {}) };
+        if (tiers === undefined)
+            delete this.deps.tiers;
+        deliverEngineNotice(this.deps.onNotice, {
+            code: "config.models_swapped",
+            message: `model catalog swapped: ${Object.keys(next.models).length} model(s), ${tiers ? Object.keys(tiers).length : 0} tier binding(s); in-flight tasks finish on their resolved models, new tasks resolve against the new catalog`,
+            detail: { models: Object.keys(next.models).length, tiers: tiers ? Object.keys(tiers).length : 0 },
+        });
+    }
     sideQuery(spec) {
         return runSideQuery(spec, { brain: this.deps.brain, models: this.deps.models, roles: this.deps.roles });
     }
@@ -2027,6 +2042,7 @@ export class Runner {
         };
         const peerSelfRef = internals?.peerSelfRef ?? createPeerSelfRef(internals?.registryScope ?? spec.principal ?? "default");
         const peerInboundChainRef = internals?.peerInboundChainRef ?? createPeerInboundChainRef();
+        const modelCatalog = this.deps.models;
         const prepared = await prepareTask(spec, this.deps, this.sessions, prepareResume, {
             ...(internals ?? {}),
             peerSelfRef,
@@ -2128,7 +2144,7 @@ export class Runner {
         rs.telemetry.pricingConfigured = this.deps.pricing?.[prepared.model.id] !== undefined || prepared.model.cost !== undefined;
         if (spec.limits?.degrade) {
             try {
-                rs.degrade.degradeToModel = resolveModel(spec.limits.degrade.to, this.deps.models);
+                rs.degrade.degradeToModel = resolveModel(spec.limits.degrade.to, modelCatalog);
             }
             catch (e) {
                 this.deps.onError?.(e, { phase: "degraded", sessionId: prepared.sessionId });
@@ -2171,7 +2187,7 @@ export class Runner {
             let m = toModel;
             if (!m) {
                 try {
-                    m = resolveModel(info.to, this.deps.models);
+                    m = resolveModel(info.to, modelCatalog);
                 }
                 catch {
                     m = undefined;
@@ -3446,7 +3462,8 @@ export class Runner {
                     gates: [...prepared.humanReviewRef.gates],
                 };
             }
-            if (rs.counters.finalVerifyInjections > 0 || rs.attach.attachmentsInjected > 0 || rs.counters.repetitionCuts > 0 || rs.counters.repetitionSpared > 0 || rs.counters.approachNoticesSent > 0) {
+            const reminderDisclosuresActive = Object.keys(prepared.reminderDisclosureCounts).length > 0;
+            if (rs.counters.finalVerifyInjections > 0 || rs.attach.attachmentsInjected > 0 || rs.counters.repetitionCuts > 0 || rs.counters.repetitionSpared > 0 || rs.counters.approachNoticesSent > 0 || reminderDisclosuresActive) {
                 stats.mechanisms = {
                     ...(rs.counters.finalVerifyInjections > 0 ? { finalVerifyInjected: true } : {}),
                     ...(rs.counters.finalVerifyInjections > 0 ? { finalVerifyInjections: rs.counters.finalVerifyInjections } : {}),
@@ -3455,6 +3472,7 @@ export class Runner {
                     ...(rs.counters.repetitionCuts > 0 ? { repetitionCuts: rs.counters.repetitionCuts } : {}),
                     ...(rs.counters.repetitionSpared > 0 ? { repetitionSpared: rs.counters.repetitionSpared } : {}),
                     ...(rs.counters.repetitionEvents.length > 0 ? { repetitionEvents: rs.counters.repetitionEvents } : {}),
+                    ...(reminderDisclosuresActive ? { reminderDisclosures: { ...prepared.reminderDisclosureCounts } } : {}),
                 };
             }
             const result = assembleResult(spec, prepared.sessionId, final, stats, {

package/dist/core/session-store.d.ts

@@ -1,5 +1,5 @@
 import { type SessionRepo } from "../internal/harness.js";
-import { type AcquiredSession, type SessionStore, type SessionStoreSummary } from "./session.js";
+import { type AcquiredSession, type PlacedSessionRow, type SessionPlacement, type SessionStore, type SessionStoreSummary } from "./session.js";
 import type { StoreDurability } from "./checkpoint-store.js";
 import { SESSION_DEFAULT_TTL_DAYS } from "../config/defaults.js";
 export { SESSION_DEFAULT_TTL_DAYS };
@@ -36,6 +36,21 @@ export interface TtlSessionStoreOptions {
      * fail-closed as process-local (under-promise, never over-promise).
      */
     durability?: StoreDurability;
+    /**
+     * Subagent transcript persistence — the store's per-placement durability declaration (see
+     * {@link SessionStore.placements}). Same declaration rule as {@link durability}: this cache layer
+     * cannot inspect whether the injected repo persists placed sessions, so the DEPLOYMENT that wired
+     * the repo states the fact (`FileStorageBackend` passes `{subagent:{durability:"durable"}}`).
+     * Declaring it also arms the cache-layer placement obligations (list exclusion, claim refusal,
+     * release-is-deletion, sweep-never-deletes) — they key on the repo-persisted tuple, which a repo
+     * that ignores `placement` never mints, so declaring over such a repo is the deployment lying to
+     * itself (declaration-制, wiring-manifest posture).
+     */
+    placements?: {
+        subagent?: {
+            durability: StoreDurability;
+        };
+    };
 }
 /**
  * TTL-cached {@link SessionStore} over a pluggable {@link SessionRepo}.
@@ -59,6 +74,18 @@ export declare class TtlSessionStore implements SessionStore {
     readonly retention: "none";
     /** design/173 §2.3 — see {@link TtlSessionStoreOptions.durability} for the declaration rules. */
     readonly durability?: StoreDurability;
+    /** Subagent transcript persistence — see {@link TtlSessionStoreOptions.placements}. */
+    readonly placements?: {
+        subagent?: {
+            durability: StoreDurability;
+        };
+    };
+    /** Placed-partition enumeration, present only when the backing repo can enumerate placements
+     *  (see {@link SessionStore.listPlaced} — absence means the partition-GC leg is unavailable). */
+    readonly listPlaced?: (kind: "subagent", opts?: {
+        olderThanMs?: number;
+        scope?: string;
+    }) => Promise<PlacedSessionRow[]>;
     private repo;
     private entries;
     /** Session-ownership rows (the multi-tenant admission capability face — see SessionStore.ownerOf).
@@ -68,6 +95,20 @@ export declare class TtlSessionStore implements SessionStore {
     private owners;
     /** In-flight acquisitions keyed by id, so concurrent acquire(sameId) share one session. */
     private pending;
+    /** Subagent transcript persistence (codex 323-r2) — placed ids whose durable deletion FAILED: the
+     *  placed fact for the retry lives HERE, not on a retained cache entry, because the repo may have
+     *  torn down the shared session authority before its removal failed (the File repo closes the
+     *  append fd pre-rmSync) — a retained entry would serve a session whose log is closed while the
+     *  file still exists (append → log_closed, transcript revival broken until restart). The entry is
+     *  dropped instead, so a re-acquire replays a FRESH authority from disk; success clears the row. */
+    private pendingPlacedDeletes;
+    /** Subagent transcript persistence (codex 323-r3) — placed deletions IN FLIGHT: acquire awaits the
+     *  settlement before resolving the id, because the repo's delete tears down the shared session
+     *  authority mid-flight — an acquire racing the await window could capture (or rebuild and then
+     *  lose) an authority the delete is about to close, and the caller would hold a session whose
+     *  first append answers log_closed while the file still exists. The gate is per-id and bounded by
+     *  the delete's own settlement (both outcomes release it). */
+    private deletingPlaced;
     /** Sessions pinned by a design/45 checkpoint — skipped by idle sweep until unpinned (B6/§5). */
     private pinned;
     private defaultTtlMs;
@@ -77,7 +118,24 @@ export declare class TtlSessionStore implements SessionStore {
     /** Get an existing session by id (resuming from the repo if needed), or create one. */
     acquire(sessionId?: string, opts?: {
         requireExisting?: boolean;
+        placement?: SessionPlacement;
     }): Promise<AcquiredSession>;
+    /**
+     * Placement obligation 6 (claim closure): an EXISTING placed session refuses the claim-form
+     * acquire — no `requireExisting` (the read/revive form, obligation 5) and no creation placement
+     * (the trusted-internals form; the creating call and its dedup/retry re-acquires stay legal, and
+     * placement immutability means the argument can never REWRITE anything — the persisted tuple wins).
+     *
+     * …and the MIRROR direction (codex 323-r1 F1 — the pre-claim SQUAT race): the child session id is
+     * published on the spawn frame BEFORE the child's prepare creates the session, so a concurrent
+     * claim-form acquire could win first creation and hand the trusted placement caller an ORDINARY
+     * session — host-listable, never really-deleted, the declared full tier falsified in silence. On
+     * a store that DECLARES the partition (an ignoring store legally drops placements), an acquire
+     * carrying a placement must therefore come back with a PERSISTED tuple whose join identity
+     * matches the declaration — a missing or foreign tuple refuses loudly, on every resolution path
+     * (cache hit, pending-promise inherit, open, idempotent re-create).
+     */
+    private assertPlacementAdmission;
     /** Resume an existing session from the repo, or create it if the backend has no such id (unless
      *  `requireExisting`, in which case a genuinely-missing id fails loud instead — design/114 Phase3). */
     private openOrCreate;

package/dist/core/session-store.js

@@ -1,4 +1,4 @@
-import { InMemorySessionRepo, uuidv7, } from "../internal/harness.js";
+import { InMemorySessionRepo, SessionError, uuidv7, } from "../internal/harness.js";
 import { isSessionConflict } from "./session.js";
 const DAY_MS = 24 * 60 * 60 * 1000;
 import { SESSION_DEFAULT_TTL_DAYS } from "../config/defaults.js";
@@ -6,10 +6,14 @@ export { SESSION_DEFAULT_TTL_DAYS };
 export class TtlSessionStore {
     retention = "none";
     durability;
+    placements;
+    listPlaced;
     repo;
     entries = new Map();
     owners = new Map();
     pending = new Map();
+    pendingPlacedDeletes = new Set();
+    deletingPlaced = new Map();
     pinned = new Set();
     defaultTtlMs;
     evictPolicy;
@@ -21,6 +25,12 @@ export class TtlSessionStore {
             this.durability = durability;
         this.defaultTtlMs = (opts.defaultTtlDays ?? SESSION_DEFAULT_TTL_DAYS) * DAY_MS;
         this.evictPolicy = opts.evict ?? (opts.repo ? "forget" : "delete");
+        if (opts.placements !== undefined)
+            this.placements = opts.placements;
+        const repoListPlaced = this.repo.listPlaced;
+        if (typeof repoListPlaced === "function") {
+            this.listPlaced = (kind, o) => repoListPlaced.call(this.repo, kind, o);
+        }
         if (opts.sweepIntervalMs !== undefined && opts.sweepIntervalMs > 0) {
             this.sweepTimer = setInterval(() => this.sweep(), opts.sweepIntervalMs);
             this.sweepTimer.unref?.();
@@ -29,8 +39,12 @@ export class TtlSessionStore {
     async acquire(sessionId, opts) {
         this.sweep();
         if (sessionId) {
+            const inflightPlacedDelete = this.deletingPlaced.get(sessionId);
+            if (inflightPlacedDelete !== undefined)
+                await inflightPlacedDelete;
             const existing = this.entries.get(sessionId);
             if (existing) {
+                this.assertPlacementAdmission(sessionId, existing.placement, opts);
                 existing.lastActiveAt = Date.now();
                 return { session: existing.session, sessionId };
             }
@@ -39,26 +53,46 @@ export class TtlSessionStore {
             }
             const inflight = this.pending.get(sessionId);
             if (inflight) {
-                return { session: await inflight, sessionId };
+                const session = await inflight;
+                this.assertPlacementAdmission(sessionId, this.entries.get(sessionId)?.placement, opts);
+                return { session, sessionId };
             }
-            const p = this.openOrCreate(sessionId, false);
+            const p = this.openOrCreate(sessionId, false, opts?.placement);
             this.pending.set(sessionId, p);
             try {
-                return { session: await p, sessionId };
+                const session = await p;
+                this.assertPlacementAdmission(sessionId, this.entries.get(sessionId)?.placement, opts);
+                return { session, sessionId };
             }
             finally {
                 this.pending.delete(sessionId);
             }
         }
-        const session = await this.createAndStore(undefined);
+        const session = await this.createAndStore(undefined, opts?.placement);
         const meta = await session.getMetadata();
         return { session, sessionId: meta.id };
     }
-    async openOrCreate(id, requireExisting = false) {
+    assertPlacementAdmission(sessionId, placement, opts) {
+        if (placement !== undefined && opts?.requireExisting !== true && opts?.placement === undefined) {
+            throw new SessionError("placement_refused", `session ${sessionId} belongs to the ${placement.kind} placement partition — a claim-form acquire cannot attach to it (read it with requireExisting, or address the agent through its a* handle)`);
+        }
+        if (opts?.placement !== undefined && opts.requireExisting !== true && this.placements?.subagent !== undefined) {
+            const want = opts.placement;
+            if (placement === undefined) {
+                throw new SessionError("placement_refused", `session ${sessionId} exists OUTSIDE the ${want.kind} placement partition it was declared into — refusing to run a subagent transcript on it (a concurrent claim-form create won this id, or the repo dropped the tuple)`);
+            }
+            if (placement.kind !== want.kind || placement.scope !== want.scope || placement.handle !== want.handle) {
+                throw new SessionError("placement_refused", `session ${sessionId}'s persisted placement does not match the declared one (persisted ${placement.kind}/${placement.scope ?? "-"}/${placement.handle ?? "-"} vs declared ${want.kind}/${want.scope ?? "-"}/${want.handle ?? "-"}) — refusing a cross-tuple attach`);
+            }
+        }
+    }
+    async openOrCreate(id, requireExisting = false, placement) {
         try {
             const session = await this.repo.open({ id, createdAt: "" });
             const meta = await session.getMetadata();
-            this.entries.set(id, { session, lastActiveAt: Date.now(), createdAt: meta.createdAt, ...(meta.forkedFrom !== undefined ? { forkedFrom: meta.forkedFrom } : {}) });
+            if (meta.placement === undefined)
+                this.pendingPlacedDeletes.delete(id);
+            this.entries.set(id, { session, lastActiveAt: Date.now(), createdAt: meta.createdAt, ...(meta.forkedFrom !== undefined ? { forkedFrom: meta.forkedFrom } : {}), ...(meta.placement !== undefined ? { placement: meta.placement } : {}) });
             return session;
         }
         catch (err) {
@@ -68,13 +102,15 @@ export class TtlSessionStore {
             if (requireExisting && isNotFound(err)) {
                 throw err;
             }
-            return this.createAndStore(id);
+            return this.createAndStore(id, placement);
         }
     }
-    async createAndStore(id) {
-        const session = await this.repo.create(id ? { id } : {});
+    async createAndStore(id, placement) {
+        const session = await this.repo.create({ ...(id !== undefined ? { id } : {}), ...(placement !== undefined ? { placement } : {}) });
         const meta = await session.getMetadata();
-        this.entries.set(meta.id, { session, lastActiveAt: Date.now(), createdAt: meta.createdAt, ...(meta.forkedFrom !== undefined ? { forkedFrom: meta.forkedFrom } : {}) });
+        if (meta.placement === undefined)
+            this.pendingPlacedDeletes.delete(meta.id);
+        this.entries.set(meta.id, { session, lastActiveAt: Date.now(), createdAt: meta.createdAt, ...(meta.forkedFrom !== undefined ? { forkedFrom: meta.forkedFrom } : {}), ...(meta.placement !== undefined ? { placement: meta.placement } : {}) });
         return session;
     }
     touch(sessionId) {
@@ -92,6 +128,7 @@ export class TtlSessionStore {
     }
     async list() {
         return [...this.entries.entries()]
+            .filter(([, e]) => e.placement === undefined)
             .map(([sessionId, e]) => ({
             sessionId,
             lastActiveAt: e.lastActiveAt,
@@ -137,12 +174,43 @@ export class TtlSessionStore {
             return;
         }
         const e = this.entries.get(sessionId);
-        if (!e) {
+        if (e !== undefined && e.placement === undefined)
+            this.pendingPlacedDeletes.delete(sessionId);
+        let placed = e !== undefined ? e.placement !== undefined : this.pendingPlacedDeletes.has(sessionId);
+        if (!placed && e === undefined && this.placements !== undefined) {
+            const probe = this.repo.placementOf;
+            if (typeof probe === "function") {
+                try {
+                    placed = (await probe.call(this.repo, sessionId)) !== undefined;
+                }
+                catch {
+                    placed = false;
+                }
+            }
+        }
+        if (!e && !placed) {
+            return;
+        }
+        if (placed) {
+            this.pendingPlacedDeletes.add(sessionId);
+            this.entries.delete(sessionId);
+            let settleGate;
+            this.deletingPlaced.set(sessionId, new Promise((r) => (settleGate = r)));
+            try {
+                const meta = e !== undefined ? await e.session.getMetadata() : { id: sessionId, createdAt: "" };
+                await this.repo.delete(meta);
+            }
+            finally {
+                this.deletingPlaced.delete(sessionId);
+                settleGate();
+            }
+            this.pendingPlacedDeletes.delete(sessionId);
+            this.owners.delete(sessionId);
             return;
         }
         this.entries.delete(sessionId);
         if (this.evictPolicy === "delete") {
-            await this.repo.delete(await e.session.getMetadata());
+            await this.repo.delete(e !== undefined ? await e.session.getMetadata() : { id: sessionId, createdAt: "" });
             this.owners.delete(sessionId);
         }
     }
@@ -174,7 +242,7 @@ export class TtlSessionStore {
             }
             if (now - e.lastActiveAt > this.defaultTtlMs) {
                 this.entries.delete(id);
-                if (this.evictPolicy === "delete") {
+                if (this.evictPolicy === "delete" && e.placement === undefined) {
                     void this.repo.delete({ id, createdAt: "" }).then(() => {
                         this.owners.delete(id);
                     }, () => { });